[dependabot]

Bumps @morojs/engine from 1.1.13 to 1.1.15.

Release notes

Sourced from @​morojs/engine's releases.

v1.1.15

@​morojs/engine 1.1.15

A WebSocket and TLS release. One capability flag and four exports are added; nothing on the wire changes for an existing caller.

WebSocket upgrades performed by the engine

setWsAutoUpgrade(serverId, on), reported as capabilities.wsAutoUpgrade. With it on, a request that carries a valid WebSocket handshake is answered by the engine itself: the 101 goes out, onWsOpen fires, frames pipelined in the handshake's segment reach onWsMessage, and onRequest is never called for it. Until now every upgrade went out to JS as a request first, and an adapter that wanted the peer's address, the headers and the query on the socket had to fetch all three through native calls before calling upgradeToWebSocket(), because the request id died with the upgrade. The handshake now stays on the connection for the socket's lifetime and is read on demand: wsGetHeaders(wsId) (the flat list getHeaders() gives a request), wsGetQuery(wsId) and wsGetRemoteAddress(wsId), each undefined once the socket is gone; they are still valid inside onWsClose. An invalid handshake is surfaced to onRequest like any other request. Static routes keep precedence over the upgrade, as they did over onRequest. The flag belongs to one native server and is set again after close() + serve(), like static routes.

WebSocket frames built in the cork buffer

Inside a read's batch (1.1.14 corks the connection for the whole read), a frame sent on a plaintext connection is now encoded straight into the cork buffer, the way a corked HTTP reply is built, instead of into the scratch buffer and copied from there. TLS connections keep the scratch path, since the frame must be encrypted before it reaches the cork buffer.

TLS record buffers kept between records

SSL_MODE_RELEASE_BUFFERS is no longer set. With it OpenSSL freed its read and write buffers after every record and allocated them again for the next, a malloc/free pair per reply on a busy connection, in return for about 34 KB less memory per idle TLS connection. A server terminating TLS in-process is measured on the busy connections.

Tests

• test/ws-conformance.test.mjs: with setWsAutoUpgrade on, a valid handshake gets its 101 and onWsOpen while onRequest never runs, the accessors return the handshake's headers (every Cookie line kept, names lowercased), query and peer address, frames pipelined with the handshake arrive in order, an invalid handshake and a plain request still reach onRequest, and the accessors answer undefined once the socket closed.

... (truncated)

Changelog

Sourced from @​morojs/engine's changelog.

Changelog

One file per release in https://github.com/Moro-JS/engine/blob/main/changelog; the GitHub Release for a tag carries the same text. Newest first.

• 1.1.16 — wsSend() borrows its payload (the backpressure shed is deferred); ASCII text frames as one-byte strings; TLS record buffers released again.
• 1.1.15 — WebSocket upgrades performed by the engine (setWsAutoUpgrade, handshake accessors); frames built in the cork buffer; TLS record buffers kept between records.
• 1.1.14 — WebSocket replies corked per read (one write for a pipelined batch); one ciphertext buffer per loop on the TLS write path.
• 1.1.13 — epoll transport: the service order is selectable (grouped, arrival, or measured auto); the default is unchanged.
• 1.1.12 — epoll transport serves each loop turn's sockets grouped by peer CPU.
• 1.1.11 — epoll transport on one epoll_wait per loop turn; engine-answered routes parsed and routed per request.
• 1.1.10 — engine-answered routes parsed in place and framed from a prepared head; epoll transport the Linux default; request-registry fix.
• 1.1.9 — parameter routes (setParamRoute, clearParamRoutes).
• 1.1.8 — TLS release, one new native function.
• 1.1.7 — correctness release with one transport improvement.
• 1.1.6 — the JS boundary: prepared templates, static routes, V8 fast API calls, worker-thread teardown, PGO builds.
• 1.1.5 — hot-path and memory-headroom audit.
• 1.1.4 — correctness hardening from the code-quality audit.
• 1.1.3 — security hardening, third-party audit closed.
• 1.1.1 — hot-path performance patch.
• 1.1.0 — pipelined response corking, zero-allocation hot path.

Commits

• e1b6c3a chore: release v1.1.15
• 5009cbf v1.1.15
• db15d89 ci: update macOS runner from 14 to 15 in CI and release workflows
• 371d780 chore: release v1.1.14
• 005158b 1.1.14
• See full diff in compare view