chore(deps): update dependency express-rate-limit to v7

[renovate]

This PR contains the following updates:

Package	Type	Update	Change	OpenSSF
express-rate-limit	dependencies	major	^5.0.0 -> ^7.0.0

---

Release Notes

express-rate-limit/express-rate-limit (express-rate-limit)

v7.5.0

Compare Source

Added

• Implemented the combined RateLimit header according to the eighth draft of the IETF RateLimit header specificiation. Enable by setting standardHeaders: 'draft-8'.
• Added a new identifier option, used as the name for the quota policy in the draft-8 headers.
• Added a new headersDraftVersion validation check to identifies cases where an unsupported version string is passed to the standardHeaders option.

---

You can view the full changelog here.

v7.4.1

Compare Source

You can view the changelog here.

v7.4.0

Compare Source

You can view the changelog here.

v7.3.1

Compare Source

Fixed

• Changed error displayed for the creationStack validation check when a store
  with localKeys set to false is used.
• Improved documentation for the creationStack check.

---

You can view the full changelog here.

v7.3.0

Compare Source

You can view the changelog here.

v7.2.0

Compare Source

Added

• Added a new creationStack validation check that looks for instances created
  in a request handler.

---

You can view the full changelog here.

v7.1.5

Compare Source

Fixed

• Enable async requestWasSuccessful methods to work as documented.

---

You can view the full changelog here.

v7.1.4

Compare Source

Fixed

• Ensure header values are strings rather than numbers, for compatibility with
  Bun.

---

You can view the full changelog here.

v7.1.3

Compare Source

Changed

• Loosened peer dependencies to explicitly allow the Express 5 beta. (See
  #​415)

---

You can view the full changelog here.

v7.1.2

Compare Source

Changed

• Re-organized documentation from readme into docs/ folder and added
  documentation website.

---

You can view the full changelog here.

v7.1.1

Compare Source

Misc

• Enabled provenance statement generation, see https://github.com/express-rate-limit/express-rate-limit#406.

---

You can view the full changelog here.

v7.1.0

Compare Source

Changed

• The getKey method is now always defined. If the store does not have the
  required get method, getKey will throw an error explaining this.

---

You can view the full changelog here.

v7.0.2

Compare Source

Added

• Added cluster-memory-store to the readme and made a couple of other minor
  clarifications.

---

You can view the full changelog here.

v7.0.1

Compare Source

Added

• Added rate-limit-postgresql to the stores list in the readme.

---

You can view the full changelog here.

v7.0.0

Compare Source

Breaking

• Changed behavior when max is set to 0:
  • Previously, max: 0 was treated as a 'disable' flag and would allow all requests through.
  • Starting with v7, all requests will be blocked when max is set to 0.
  • To replicate the old behavior, use the skip function instead.
• Renamed req.rateLimit.current to req.rateLimit.used.
  • current is now a hidden getter that will return the used value, but it will not appear when iterating over the keys or calling JSON.stringify().
• Changed the minimum required Node version from v14 to v16.
  • express-rate-limit now targets es2022 in TypeScript/ESBuild.
• Bumped TypeScript from v4 to v5 and dts-bundle-generator from v7 to v8.

Deprecated

• Removed the draft_polli_ratelimit_headers option (it was deprecated in v6).
  • Use standardHeaders: 'draft-6' instead.
• Removed the onLimitReached option (it was deprecated in v6).
  • This is an example of how to replicate it's behavior with a custom handler option.

Changed

• The MemoryStore now uses precise, per-user reset times rather than a global window that resets all users at once.
• The limit configuration option is now prefered to max.
  • It still shows the same behavior, and max is still supported. The change was made to better align with terminology used in the IETF standard drafts.

Added

• The validate config option can now be an object with keys to enable or disable specific validation checks. For more information, see this.

v6.11.2

Compare Source

Fixed

• Restored IncrementResponse TypeScript type (See
  #​397)

v6.11.1

Compare Source

Fixed

• Check for prefixed keys when validating that the stores have single counted
  keys (See
  #​395).

v6.11.0

Compare Source

Added

• Support for retrieving the current hit count and reset time for a given key
  from a store (See
  #​390).

v6.10.0

Compare Source

Added

• Support for combined RateLimit header from the
  RateLimit header fields for HTTP standardization draft
  adopted by the IETF. Enable by setting standardHeaders: 'draft-7'.
• New standardHeaders: 'draft-6' option, treated equivalent to
  standardHeaders: true from previous releases. Note that true and false
  are still supported.
• New RateLimit-Policy header added when standardHeaders is set to
  'draft-6', 'draft-7', or true.
• Warning when using deprecated draft_polli_ratelimit_headers option.
• Warning when using deprecated onLimitReached option.
• Warning when totalHits value returned from Store is invalid.

v6.9.0

Compare Source

Added

• New validaion check for double-counted requests.
• Added help link to each validation error, directing users to the appropriate
  wiki page for more info.

Changed

• Miscellaneous documenation improvements.

v6.8.1

Compare Source

Changed

• Revert 6.7.1 change that bumped typescript from 5.x to 4.x and
  dts-bundle-generator from 8.x to 7.x (See
  #​360).

v6.8.0

Compare Source

Added

• Added a set of validation checks that will log an error if failed. See
  https://github.com/express-rate-limit/express-rate-limit/wiki/Error-Codes for
  a list of potential errors. Can be disabled by setting validate: false in
  the configuration. Automatically disables after the first request. (See
  #​358).

v6.7.2

Compare Source

Changed

• Revert 6.7.1 change that bumped typescript from 5.x to 4.x and
  dts-bundle-generator from 8.x to 7.x (See
  #​360).

v6.7.1

Compare Source

Fixed

• Fixed compatibility with TypeScript's TypeScript new node16 module
  resolution strategy (See
  #​355).

Changed

• Bumped development dependencies
  • This initially include bumping typescript from 4.x to 5.x and
    dts-bundle-generator from 7.x to 8.x
• Added node 20 to list of versions the CI jobs run on.

No functional changes.

v6.7.0

Compare Source

Changed

• Updated links to point to the new express-rate-limit organization on GitHub.
• Added advertisement to readme.md for project sponsor
  Zuplo.
• Updated to typescript version 5 and bumped other dependencies.
• Dropped node 12, and added node 19 to the list of versions the CI jobs run
  on.

No functional changes.

v6.6.0

Compare Source

Added

• Added shutdown method to the Store interface and the MemoryStore. (#​322)

You can view the full changelog here.

v6.5.2

Compare Source

Fixed

• Fixed an issue with missing types in ESM monorepos. (#​321)

You can view the changelog here.

v6.5.1

Compare Source

Changed

• The message option can now be a (sync/asynx) function that returns a value (#​311)
• Updated all dependencies

v6.4.0

Compare Source

Added

• Adds Express 5 (5.0.0-beta.1) as a supported peer dependency (#​304)

Changed

• Tests are now run on Node 12, 14, 16 and 18 on CI (#​305)
• Updated all development dependencies (#​306)

v6.3.0

Compare Source

Changed

• Changes the build target to es2019 so that ESBuild outputs code that can run with Node 12.
• Changes the minimum required Node version to 12.9.0.

v6.2.1

Compare Source

Fixed

• Use the default value for an option when undefined is passed to the rate
  limiter.

v6.2.0

Compare Source

Added

• Export the MemoryStore, so it can now be imported as a named import
  (import { MemoryStore } from 'express-rate-limit').

Fixed

• Deprecate the onLimitReached option (this was supposed to be deprecated in
  v6.0.0 itself); developers should use a custom handler function that checks if
  the rate limit has been exceeded instead.

v6.1.0

Compare Source

Added

• Added a named export rateLimit in case the default import does not work.

Fixed

• Added a named export default, so Typescript CommonJS developers can default-import the library (import rateLimit from 'express-rate-limit').

v6.0.5

Compare Source

Fixed

• Use named imports for ExpressJS types so users do not need to enable the esModuleInterop flag in their Typescript compiler configuration.

v6.0.4

Compare Source

Fixed

• Upload the built package as a .tgz to GitHub releases.

Changed

• Add main and module fields to package.json. This helps tools such as ESLint that do not yet support the exports field.
• Bumped the minimum node.js version in package-lock.json to match package.json

v6.0.3

Compare Source

Changed

• Bumped minimum Node version from 12.9 to 14.5 because the transpiled output uses the nullish coalescing operator (??), which isn't supported in Node prior to 14.x.

v6.0.2

Compare Source

Fixed

• Ensure CommonJS projects can import the module.

Added

• Add additional tests that test:
  • importing the library in js-cjs, js-esm, ts-cjs, ts-esm environments.
  • usage of the library with external stores (redis, mongo, memcached, precise).

Changed

• Use esbuild to generate ESM and CJS output. This reduces the size of the built package from 138 kb to 13kb and build time to 4 ms! 🚀
• Use dts-bundle-generator to generate a single Typescript declaration file.

v6.0.1

Compare Source

Fixed

• Ensure CommonJS projects can import the module.

v6.0.0

Compare Source

Added

• express 4.x as a peer dependency.
• Better Typescript support (the library was rewritten in Typescript).
• Export the package as both ESM and CJS.
• Publish the built package (.tgz file) on GitHub releases as well as the npm registry.
• Issue and PR templates.
• A contributing guide.
• A changelog.

Changed

• Rename the draft_polli_ratelimit_headers option to standardHeaders.
• Rename the headers option to legacyHeaders.
• Retry-After header is now sent if either legacyHeaders or standardHeaders is set.
• Allow keyGenerator to be an async function/return a promise.
• Change the way custom stores are defined.
  • Add the init method for stores to set themselves up using options passed to the middleware.
  • Rename the incr method to increment.
  • Allow the increment, decrement, resetKey and resetAll methods to return a promise.
  • Old stores will automatically be promisified and used.
• The package can now only be used with NodeJS version 12.9.0 or greater.
• The onLimitReached configuration option is now deprecated. Replace it with a custom handler that checks the number of hits.

Removed

• Remove the deprecated limiter.resetIp method (use the limiter.resetKey method instead).
• Remove the deprecated options delayMs, delayAfter (the delay functionality was moved to the express-slow-down package) and global (use a key generator that returns a constant value).

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[sourcery-ai]

Reviewer's Guide by Sourcery

This pull request updates the express-rate-limit dependency from version 5 to version 7. This is a major version update, which includes breaking changes and new features.

Sequence diagram for express-rate-limit v7 request handling

sequenceDiagram
    participant Client
    participant Express
    participant RateLimiter
    participant Store

    Client->>Express: HTTP Request
    Express->>RateLimiter: middleware
    RateLimiter->>RateLimiter: Generate key
    RateLimiter->>Store: increment(key)
    Store-->>RateLimiter: {used, limit, resetTime}
    alt limit exceeded
        RateLimiter-->>Express: 429 Too Many Requests
        RateLimiter->>Client: RateLimit headers
        Express-->>Client: Error Response
    else limit not exceeded
        RateLimiter->>Client: RateLimit headers
        RateLimiter-->>Express: next()
        Express-->>Client: Normal Response
    end

Loading

Class diagram showing express-rate-limit v7 changes

classDiagram
    class RateLimiter {
        +number limit
        +boolean standardHeaders
        +boolean legacyHeaders
        +string identifier
        +Store store
        +Function keyGenerator
        +Function handler
        +Function skip
        +boolean validate
        +increment()
        +resetKey()
        +resetAll()
        +shutdown()
    }

    class Store {
        +init(options)
        +increment(key)
        +decrement(key)
        +resetKey(key)
        +resetAll()
        +shutdown()
    }

    class MemoryStore {
        +Map hits
        +init(options)
        +increment(key)
        +decrement(key)
        +resetKey(key)
        +resetAll()
        +shutdown()
    }

    RateLimiter --> Store
    Store <|-- MemoryStore

    note for RateLimiter "Changes in v7:
    - max renamed to limit
    - current renamed to used
    - max:0 now blocks all requests
    - Requires Node v16+"

    note for Store "Changes in v7:
    - incr renamed to increment
    - Added shutdown method"

Loading

File-Level Changes

Change	Details	Files
Updated the express-rate-limit dependency to v7.	Updated the dependency version in package.json. Updated the dependency version in package-lock.json.	package.json package-lock.json

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!
• Generate a plan of action for an issue: Comment @sourcery-ai plan on
  an issue to generate a plan of action for it.

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[sourcery-ai]

We have skipped reviewing this pull request. It seems to have been created by a bot (hey, renovate[bot]!). We assume it knows what it's doing!