Skip to content

Backport fix from v2: Do not swallow calls to res.end() - #298

Open
papandreou wants to merge 2 commits into
expressjs:masterfrom
peakon:peakon/with-res-end-fix-1.8.2
Open

papandreou wants to merge 2 commits into
expressjs:masterfrom
peakon:peakon/with-res-end-fix-1.8.2

Conversation

@papandreou

Copy link
Copy Markdown

#188 was merged to v2 on Apr 16, 2025, but it seems like it might be a while until we see an actual 2.0.0 release from this repo. In the mean time, I suggest that we backport this fix so that it can be included in a 1.x release. Pretty please! 🤗

* Add tests demonstrating scenarios under which the original res.end does not get called

* Ensure stream gets closed and response gets ended when it is finished

* Only call the original res.end() a single time

* Avoid using the on-finished package

* Use finished() helper from node:stream

* Import finished() helper directly from node:stream

Co-authored-by: Sebastian Beltran <bjohansebas@gmail.com>

* Use finished() helper directly instead of nodeStream.finished()

* Adjust stream pause / resume logic instead of messing with res.end() calls directly

* Revert addition of endOnce() wrapper

* Add unit test around one more alternate sequence of events that seems reasonable to test in addition to the other ones

* Add test around avoiding 'write after end' errors

* Avoid writing into the response after it is finished

* Add a comment explaining why the compression stream gets resumed when the response finishes

* chore: use isFinished of on-finished

---------

Co-authored-by: Sebastian Beltran <bjohansebas@gmail.com>
@socket-security

socket-security Bot commented Oct 27, 2026 •

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Addednpm/​on-finished@​2.4.210010010088100

View full report

@krzysdz krzysdz left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I can't run/unblock the CI for you, but Node.js 0.8 does not support const or destructuring assignments, so these have to be changed for 1.x.

Use on-finished instead of stream.finished, avoid const/destructuring and
template literals, and call the original res.end() when the response
closes, since the destroyed stream never emits 'end'.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
@papandreou

Copy link
Copy Markdown
Author

I can't run/unblock the CI for you, but Node.js 0.8 does not support const or destructuring assignments, so these have to be changed for 1.x.

Ah, good shout. Tried to fix that now 🙏

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants