You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
This library is old, stable, and reliable, but recent releases include some security-related fixes. I know that httpuv-based applications are not usually exposed directly to the internet without a better-behaving proxy in front of them, but I think it's still worth updating on safety grounds. There is also one serious out-of-tree security fix in Node (as of December) that is not yet part of http_parser itself.
More generally: http_parser was declared officially unmaintained in October. Node has moved to llhttp, which apparently has a nearly identical API and is significantly faster. httpuv should consider moving to that project instead.
The text was updated successfully, but these errors were encountered:
Hi that is a good point, u should not use unmaintained projects in productive projects. Are there already efforts to replace the http_parser with llhttp?
This library is old, stable, and reliable, but recent releases include some security-related fixes. I know that
httpuv
-based applications are not usually exposed directly to the internet without a better-behaving proxy in front of them, but I think it's still worth updating on safety grounds. There is also one serious out-of-tree security fix in Node (as of December) that is not yet part ofhttp_parser
itself.More generally:
http_parser
was declared officially unmaintained in October. Node has moved to llhttp, which apparently has a nearly identical API and is significantly faster.httpuv
should consider moving to that project instead.The text was updated successfully, but these errors were encountered: