fast-gateway 6.0.0

v6.0.0 — Reliability, restana 7 and Node.js 24

on Node.js NPM

fast-gateway 6 is a reliability release. We put the gateway through several rounds of adversarial review, looking for requests that slip past routes, hooks that crash the process and WebSockets that hang. We fixed everything we could reproduce, and the test suite went from 57 to 131 tests with 100% coverage.

It also moves to restana 7 and Node.js 24, so it's a major version: please read the upgrade notes below before updating.

⬆️ Upgrading from 5.x

Most gateways only need the first two checks.

1. Use Node.js 24 or newer. restana 7 requires it.
2. Check the case of your paths. Routes now match case-sensitively, so GET /Users/42 no longer reaches a route with prefix: '/users'. To keep the old behavior:

   gateway({
     restana: { caseSensitive: false },
     routes: [/* ... */]
   })

3. Check prefixRewrite values that contain $. They're now used literally, so $& and other replacement patterns are no longer expanded.
4. Check clients that send . or .. path segments. These requests now get a 400, including encoded forms such as %2e%2e and /..;/.
5. Check tests that assert error bodies. restana's default error handler now uses the standard status text, e.g. {"code":404,"message":"Not Found"} instead of "Internal Server Error".

The full list of behavior changes is in the v6.x breaking changes.

🔒 Safer by default

• Path traversal is blocked. Before, /public/../admin could get past the /public route's middlewares and reach a different service.
• The hostnames hook no longer leaks memory. Requests to random subdomains under a wildcard pattern used to fill an unbounded cache.
• Your route config is no longer modified. The routes and hooks you pass to gateway() stay unchanged, so you can share them between routes and gateways.

🐛 Fewer crashes and hangs

• An onError hook that sends its own response no longer crashes the process with ERR_HTTP_HEADERS_SENT.
• A rejected async proxyHandler reaches onError instead of leaving the request hanging.
• A Lambda response without a statusCode, or with an object body, no longer crashes the gateway. isBase64Encoded is honored as well.
• Large chunked downloads over Connection: close (Python's urllib, for example) are streamed instead of failing with 502. Memory stays capped at 1MB.

🔌 Better WebSockets

• Close codes and reasons reach the other side, in both directions.
• Messages sent while an async onOpen hook runs are queued and delivered, not dropped.
• Unreachable upstreams, clients that disconnect, and upgrade requests that aren't WebSocket no longer leave connections open forever.

🧭 More predictable routing and proxying

• prefix: '/' works as a catch-all route, and a prefix ending in / matches nested paths.
• A route's timeout: 0 disables the global timeout, as documented.
• Repeated query parameters (?a=1&a=2) are forwarded as sent.
• The http-legacy proxy type is accepted at startup, and /services.json shows RegExp prefixes.

📦 Dependencies

• restana 7 (migration guide), plus the latest versions of everything else.
• npm audit reports no vulnerabilities in production dependencies.

What's Changed

• v6.0.0: fix functional bugs found by adversarial review, upgrade to restana 7 by @jkyberneees in #105

Full Changelog: v5.0.1...v6.0.0