fix: Bump compression from 1.7.3 to 1.8.2 - #32

Closes #26

Changes

compression:

• 1.7.4: Marks text/less as compressible (via compressible 2.0.16 and mime-db >= 1.38.0; compressible already treated it as compressible through its text/* fallback); fixes the res.writeHead patch missing its return value (via on-headers 1.0.2); perf: prevents an unnecessary buffer copy when a Buffer chunk is written
• 1.7.5: Replaces accepts with negotiator ~0.6.4, which adds an encoding preference option (Replace accepts with negotiator expressjs/compression#197); also removes the override that switched from deflate to gzip whenever the client accepted gzip, and passes gzip as the preferred encoding instead, which only breaks ties between equal q-values; bytes 3.1.2 (adds petabyte pb support, fixes thousandsSeparator formatting the fractional part, fixes the return value for unparsable strings); compressible ~2.0.18 (marks font/ttf as compressible, drops the compressible: false flag from multipart/mixed, which stays not compressible, mime-db >= 1.43.0); safe-buffer 5.2.1
• 1.8.0: Uses res.headersSent when available instead of res._header (Use headersSent instead of _header expressjs/compression#129); calls res.writeHead() instead of the private res._implicitHeader() (Bugfix/use write head instead of implicit header expressjs/compression#170); adds Brotli support on Node.js versions that have it, with a new brotli option and a default quality of 4, and prefers br over gzip when the client accepts both with equal quality (feat: support for brotli expressjs/compression#194); adds the enforceEncoding option for requests without an Accept-Encoding header, default identity (feat: add default option expressjs/compression#191); refactors chunkLength(), toBuffer() and the encoding negotiation logic (Refactor chunkLength function for improved readability and consistency expressjs/compression#203, Refactor toBuffer function to simplify buffer check logic expressjs/compression#201, refactor: simplify encoding negotiation logic expressjs/compression#213)
• 1.8.1: on-headers ~1.1.0, which fixes CVE-2025-7339 (GHSA-76c9-3jph-rj3q, low, response headers could be modified unintentionally when an array is passed to res.writeHead())
• 1.8.2: Fixes CVE-2026-87776 (GHSA-vc2v-76pw-4v95, high, denial of service through a native zlib memory leak when the client closes the connection before a compressed response finishes) by destroying the compression stream when the response closes, using the new dependency destroy 1.2.0; matches the Cache-Control: no-transform directive case-insensitively (fix: match Cache-Control no-transform directive case-insensitively expressjs/compression#286)
• Docs, CI, test and repository-maintenance entries are not listed. 1.8.2 also stops publishing HISTORY.md in the npm package (doc(package): remove history.md and add readme.md to published files expressjs/compression#270).

Dependencies of compression that change (each is used only by compression; the other copies in the tree stay as they are):

• negotiator 0.6.1 → 0.6.4 (new nested copy; accepts keeps 0.6.1): 0.6.2 fixes the sorting of charsets, encodings and languages with extra parameters; 0.6.3 reverts the lazy-loading of modules from the main entry point; 0.6.4 adds the preferred encodings argument (Added an option preferred encodings array jshttp/negotiator#59) and replaces the deprecated String.prototype.substr()
• on-headers 1.0.1 → 1.1.0: 1.0.2 fixes the res.writeHead patch missing its return value; 1.1.0 fixes CVE-2025-7339 (see 1.8.1)
• compressible 2.0.14 → 2.0.18, with a new nested mime-db 1.54.0 (the top-level mime-db 1.35.0 stays for mime-types): 2.0.15 to 2.0.17 raise the mime-db range; 2.0.16 marks text/less as compressible, which compressible already did through its text/* fallback; 2.0.18 marks font/ttf as compressible and drops the compressible: false flag from multipart/mixed, which stays not compressible; mime-db 1.35.0 → 1.54.0 adds media types and their compressible flags
• bytes 3.0.0 → 3.1.2 (new nested copy; body-parser and raw-body keep 3.0.0): 3.1.0 adds petabyte support; 3.1.1 fixes thousandsSeparator formatting the fractional part; 3.1.2 fixes the return value for unparsable strings
• safe-buffer 5.1.2 → 5.2.1 (nested copy): 5.2.0 makes the SafeBuffer prototype inherit from Buffer; 5.2.1 has no functional changes
• destroy 1.2.0 (new dependency, nested; send keeps 1.0.4): 1.1.0 adds zlib stream support and a Node.js leak workaround; 1.1.1 works around a zlib close bug in Node.js < 4.5.5; 1.2.0 adds the suppress argument
• accepts is no longer used by compression; it stays in the tree for express, express-graphql and serve-index.

compression is a transitive production dependency of webpack-dev-server 3.1.5 in the todo subproject (compression@^1.5.2). webpack-dev-server 3.1.5 loads the module at startup, but mounts the middleware, as compress() without options, only when its compress option is truthy. The todo server.js creates WebpackDevServer with only contentBase, publicPath and stats, so the middleware is not mounted in this app, and the upgrade does not change how the app handles requests. If compress were enabled, the default options would behave differently in these ways:

• Clients that accept br and gzip with equal quality, as current browsers do, would receive Brotli-compressed responses (Content-Encoding: br, quality 4) instead of gzip on Node.js versions with Brotli support.
• The 1.7.3 override that switched from deflate to gzip whenever the client accepted gzip no longer exists, and the preferred encodings (br, gzip) only break ties between equal q-values. A client that gives deflate a higher q-value than gzip would get deflate instead of gzip, and a client that lists identity before gzip at equal q-values would get gzip instead of an uncompressed response. Both are edge cases.
• A Cache-Control header with no-transform in any letter case would disable compression.
• The compressible content types would follow mime-db 1.54.0 instead of 1.35.0; for example, font/ttf would now be compressed. text/less was already compressed through the text/* fallback, and multipart/mixed stays uncompressed.
• A compressed response that the client aborts would free its zlib stream instead of leaking it.

The default threshold stays 1 KiB, the default filter logic is unchanged, Vary: Accept-Encoding is still set, and requests without Accept-Encoding still get an uncompressed response, because enforceEncoding defaults to identity.

The strictest engines.node among the new package versions is >= 0.8, and the todo subproject declares no engines. The legacy root .travis.yml (Node.js 6, 8 and 10, running npm install, npm run update-schema and npm run build in ./todo) is inactive, as no Travis check reports on this PR; Node.js 6 would also satisfy these ranges.

Risk

Medium. compression moves across a minor version with changed encoding negotiation: the override that switched from deflate to gzip is gone since 1.7.5, Brotli is preferred over gzip since 1.8.0, and negotiator moves from 0.6.1 to 0.6.4 with the new preferred encodings argument. on-headers 1.1.0 changes how res.writeHead() applies array headers, compressible and mime-db change the set of compressible types, and the new destroy dependency handles the stream on response close. None of this affects the todo app, because webpack-dev-server does not mount the middleware without the compress option.

Breaking Changes

None

Code Changes Required

None — the upgrade is a drop-in replacement. compression is a transitive dependency in the todo subproject. In todo/package-lock.json and todo/yarn.lock, only the entries of compression and its own dependencies change: compression, compressible, on-headers and the nested safe-buffer are updated, and nested bytes, destroy, negotiator and mime-db entries are added. In yarn.lock, the new safe-buffer@5.2.1 range resolves to the existing safe-buffer 5.2.1 entry, and the safe-buffer@5.1.2 and mime-db@>= 1.34.0 < 2 ranges are removed from the headers of the existing safe-buffer 5.1.2 and mime-db 1.35.0 entries, which other packages still use. The lock-file changes are identical to the bot PR's, because npm 10 rewrites yarn.lock and unrelated package-lock.json fields in this subproject; npm resolves the same entries.

Summary by CodeRabbit

• Chores
  • Updated internal project maintenance records.
  • No user-visible feature, interface, or behavior changes are described in this release. The update is limited to behind-the-scenes project metadata, with no reported changes to how the app is used. Existing functionality remains as before, based on the available change summary.