chore(deps): bump raw-body from 3.0.2 to 4.0.0

[dependabot]

Bumps raw-body from 3.0.2 to 4.0.0.

Release notes

Sourced from raw-body's releases.

v4.0.0

⚠️ Breaking changes

• Remove support for Node <22 - by @​bjohansebas in #156

  Node.js versions prior to 22 are no longer supported. This allows the package to migrate to ESM and rely on require(esm), which does not work correctly on earlier versions.

• Migrate to TypeScript and publish as ESM-only - by @​bjohansebas in #157

  CommonJS consumers can keep loading the package through require(esm).

• Use native TextDecoder instead of iconv-lite - by @​bjohansebas in #143

  Supported encodings are now those of the WHATWG Encoding Standard; encodings outside the standard (e.g. UTF-32) now throw a 415 error. utf-16 no longer detects a big-endian BOM and always decodes as little-endian; use utf-16be for big-endian content.

• Remove streams1 support - by @​bjohansebas in #144 and #161

  Node streams that emit string chunks now error with a 500 stream.encoding.set through the callback (previously they were decoded silently, or crashed the process when no encoding was set), matching the web stream path. Streams are expected to implement the readable stream interface (unpipe, pause).

• Validate the limit option - by @​bjohansebas in #162

  A limit that does not parse to a byte count (e.g. 'banana', NaN) now throws a TypeError instead of silently reading with no limit at all. limit: null remains the explicit way to disable the limit.

🚀 Improvements

• Support reading WHATWG ReadableStream (web streams) through the new getRawBodyWeb export - by @​bjohansebas in #148, #160 and #175

  fetch Request/Response bodies, Blob.stream(), TransformStream readables, and Readable.toWeb() bridges can be read with getRawBodyWeb, which takes the same options as getRawBody; getRawBody itself keeps accepting only node streams. Streams already locked, read, or cancelled error with a 500 stream.not.readable; client aborts are mapped to the same 400 request.aborted error as node streams, with the original error in cause; string chunks are accepted without an encoding (UTF-8 Buffer), but error with a 500 stream.encoding.set when combined with one, since the stream is already decoded; non-byte chunks (e.g. ArrayBuffer) error with a TypeError. On error the reader lock is released, but the stream is not cancelled; disposing it is up to the caller.

• Add a custom decoder option - by @​bjohansebas in #145

  A function compatible with iconv-lite's getDecoder can be plugged in to decode encodings outside the WHATWG Encoding Standard.

• Use native stream.unpipe() and remove the unpipe dependency - by @​Phillip9587 in #93

• Remove the check for a global Promise when no callback is provided - by @​bjohansebas in #146

• Add a benchmark suite - by @​bjohansebas in #163

  npm run bench compares the node and web stream paths with realistic request bodies.

• Fail as soon as a stream exceeds its declared length - by @​bjohansebas in #172

  A body that sends more bytes than its declared length now errors with a 400 request.size.invalid as soon as the excess arrives, rather than buffering the rest first. This bounds memory to length even when no limit is set. When both are set, a length overrun is reported before the limit's 413.

🐞 Bug fixes

• Fix a length that does not parse to a number failing every request - by @​bjohansebas in #172

... (truncated)

Changelog

Sourced from raw-body's changelog.

4.0.0

⚠️ Breaking changes

• Remove support for Node <22 - by @​bjohansebas in #156

  Node.js versions prior to 22 are no longer supported. This allows the package to migrate to ESM and rely on require(esm), which does not work correctly on earlier versions.

• Migrate to TypeScript and publish as ESM-only - by @​bjohansebas in #157

  CommonJS consumers can keep loading the package through require(esm).

• Use native TextDecoder instead of iconv-lite - by @​bjohansebas in #143

  Supported encodings are now those of the WHATWG Encoding Standard; encodings outside the standard (e.g. UTF-32) now throw a 415 error. utf-16 no longer detects a big-endian BOM and always decodes as little-endian; use utf-16be for big-endian content.

• Remove streams1 support - by @​bjohansebas in #144 and #161

  Node streams that emit string chunks now error with a 500 stream.encoding.set through the callback (previously they were decoded silently, or crashed the process when no encoding was set), matching the web stream path. Streams are expected to implement the readable stream interface (unpipe, pause).

• Validate the limit option - by @​bjohansebas in #162

  A limit that does not parse to a byte count (e.g. 'banana', NaN) now throws a TypeError instead of silently reading with no limit at all. limit: null remains the explicit way to disable the limit.

🚀 Improvements

• Support reading WHATWG ReadableStream (web streams) through the new getRawBodyWeb export - by @​bjohansebas in #148, #160 and #175

  fetch Request/Response bodies, Blob.stream(), TransformStream readables, and Readable.toWeb() bridges can be read with getRawBodyWeb, which takes the same options as getRawBody; getRawBody itself keeps accepting only node streams. Streams already locked, read, or cancelled error with a 500 stream.not.readable; client aborts are mapped to the same 400 request.aborted error as node streams, with the original error in cause; string chunks are accepted without an encoding (UTF-8 Buffer), but error with a 500 stream.encoding.set when combined with one, since the stream is already decoded; non-byte chunks (e.g. ArrayBuffer) error with a TypeError. On error the reader lock is released, but the stream is not cancelled; disposing it is up to the caller.

• Add a custom decoder option - by @​bjohansebas in #145

  A function compatible with iconv-lite's getDecoder can be plugged in to decode encodings outside the WHATWG Encoding Standard.

• Use native stream.unpipe() and remove the unpipe dependency - by @​Phillip9587 in #93

• Remove the check for a global Promise when no callback is provided - by @​bjohansebas in #146

• Add a benchmark suite - by @​bjohansebas in #163

  npm run bench compares the node and web stream paths with realistic request bodies.

• Fail as soon as a stream exceeds its declared length - by @​bjohansebas in #172

  A body that sends more bytes than its declared length now errors with a 400 request.size.invalid as soon as the excess arrives, rather than buffering the rest first. This bounds memory to length even when no limit is set. When both are set, a length overrun is reported before the limit's 413.

🐞 Bug fixes

• Fix a length that does not parse to a number failing every request - by @​bjohansebas in #172

... (truncated)

Commits

• c3949f8 chore: release 4.0.0 (#174)
• a1ab71c feat!: split node and web streams into separate functions (#175)
• d765d5c perf: avoid static AsyncResource.bind (#173)
• 2cd546a fix: improve length handling (#172)
• a3e031a fix(webstreams): update buffer handling to support Uint8Array in finish (#171)
• 7eb641e fix: optimize buffer handling for single chunk bodies in finish function (#170)
• 3c1f3d6 perf: improve buffer for known lenght #169)
• d34faba fix: improve handling of aborts in Readable.toWeb request streams (#168)
• fbe1bff fix: update RawBodyError type to use RawBodyErrorType for better error handli...
• b9d71f7 fix: remove redundant export of getRawBody as 'module.exports' (#166)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for raw-body since your current version.