Elysia 2.0 codename Kiana
This is an entire rewrite of Elysia with a better foundation structure
This release aims to provide much better performance, memory usage and easier contributions
You can track the progress the progress here
Expect 2 months until stable release
From @elysiajs → @elysia on npm
$ bun install @elysia/eden
Elysia plugins are now under @elysia instead of @elysiajs
We will continue to publish patches under @elysiajs until Elysia 2 arrive
Make sure to migrate to @elysia when possible
t.String({ format: 'url' }) is vulnerable to redos on long URL
It only has an impact on a specific pattern with a long URL string (> 4096 characters)
Valid URL, and most value isn't affected by redos
As a workaround, it's recommended to
1. Limit the URL string to a reasonable limit (< 384)
2. If a long URL string is necessary, it's recommended to update Elysia to at least 1.4.26
We will disclose a vulnerability in the upcoming week
Unsigned Cookie Transition
Migrate from unsigned to signed cookie can be frustrating
By adding `null` in an array of cookie secrets, new cookie will be signed while the old one will continue to be supported
We can have multiple secrets too!
Available on Elysia 1.4.24+
How we made Elysia fast
Wrote a thing about we made Elysia fast
and likely as one of the fastest JavaScript frameworks
Explaning about JIT "Compiler" and "Sucrose"
ElysiaJS will never involve with cryptocurrency
This isn’t the first time and it won’t be the last but my answer will always be the same
My passion is not for a quick cash grab
My dignity is not something for sell
My soul is not something you can buy
In December, I discovered a very simple yet critical vulnerability in @elysiaJS (CVE pending).
The bug has been fixed for almost a month now, so I'm sharing the details:
ElysiaJS Cookie Signature Validation Bypass
https://t.co/Sg8jUodudO
I think Elysia make a lot of sense for meta-framework API routes
API routes are usually lacking in documentation area because of rapid development so it's somewhat hard to track when something changes
Elysia fix that because it's self-documenting by offering:
1. Eden Treaty: End-to-end type safety w/ RPC-like client similar to tRPC
2. OpenAPI: Tight integration with OpenAPI and runtime schema with Standard JSON Schema eg. TypeBox, Zod, etc.
3. OpenAPI Type Gen: Automatic documenting all possible type based on HTTP status using return type infers directly from TypeScript type
Because it's Single Source of Truth from runtime to type to OpenAPI documentation to Frontend via RPC-like client without generator means nothing is out of sync and directly infers from code
This means if something changes, it would show exactly where it could cause error and if your code works and the documentation would update instantly without effort
It's a REST API, so everyone already knows it and you can just use something like OpenAPI generator for other languages as necessary to works with
And it's using Web Standard API so it works with most meta framework like Nextjs, Nuxt, Tanstack Start, Astro and so on
Elysia is "If your code works, it's self documented"
We add a "think harder" to Elysia chan
Now you should be able to ask her more complex questions if needed
We are also experimenting with a new model for Elysia chan so let us know your experience
Also, please stop flirting with Elysia chan 🥺