chore(release): 0.12.0 — trusted-proxy client IP - #27
Merged
Conversation
A minor bump rather than a patch: the client IP now comes from the peer address unless the app declares how many proxies wrote the forwarding header, so an Express app behind an unconfigured proxy, or a Next.js app behind two, resolves a different address than it did in 0.11.1. Also carries the eslint config the repo never had, and two client-side corrections that fell out of it -- most notably a benchmark loop that could be optimised away, which drove mathOps toward zero and tripped the "JS execution unusually fast" automation signal on ordinary browsers.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Rolls
[Unreleased]to[0.12.0]and bumps all five workspaces plus the@webdecoy/nodedependency ranges in the three adapters.Minor, not patch. The client IP now comes from the peer address unless the app declares how many proxies wrote the forwarding header (#24). An Express app behind an unconfigured proxy, or a Next.js app behind two, resolves a different address than it did in 0.11.1 — which changes what rate limits key on and what address lands on a detection. That is a behaviour change, and the changelog leads with what to set.
Contents:
trustProxyon every adapter and on the captcha endpoints;resolveClientIp()/normalizeIp()/ipInCidr()exported._measureJSExecution()had a loop whose result was discarded and could legally be optimised away, drivingmathOpstoward zero and tripping the "JS execution unusually fast" automation signal on an ordinary browser.Publishing is on the
v0.12.0tag, pushed after this merges.Verified:
npm run build,npm run lint,npm test(306),npm run check:edgeall pass.