All Versions
33
Latest Version
Avg Release Cycle
5 days
Latest Release
32 days ago

Changelog History
Page 1

  • v1.20.0 Changes

    May 15, 2026

    ➕ Added

    • 👷 Star prompt printed to stderr on first import (skipped in CI and non-TTY environments), with a ~/.pompelmi/.starred marker so it shows only once.
    • 🖨 scripts/postinstall.js — prints a GitHub star nudge to stdout after npm install in interactive terminals.

    🔄 Changed

    • 📦 package.json — added postinstall script pointing to scripts/postinstall.js; bumped version to 1.20.0.

  • v1.19.0 Changes

    May 12, 2026

    Title:

    v1.19.0 — Scan Cache, Policies, Multi-Engine, Directory Streaming

    Body:

    ## What's New### SHA256 Scan CacheSkip rescanning files that have already been verified.
Cache results in memory or on disk with configurable TTL and LRU eviction.```jsconst{createCache}=require('pompelmi')constcache=createCache({ ttl:3600000, maxSize:1000})constresult=awaitcache.scan(filePath, options)// Second call with same file content: instant, no clamd roundtripcache.stats()// { hits: 42, misses: 8, size: 50, hitRate: 0.84 }

    File-based persistence across restarts:

    constcache=createCache({storage:'file',filePath:'./.pompelmi-cache.json',ttl:86400000})

    Scan Policies

    🔒 Define all upload security rules in one place — size, MIME type,
    extension, and virus scanning — and apply them with a single call.

    const{createPolicy}=require('pompelmi')constpolicy=createPolicy({scan:{host:'localhost',port:3310},maxSize:10\*1024\*1024,allowedMimeTypes:['image/jpeg','image/png','application/pdf'],allowedExtensions:['.jpg','.jpeg','.png','.pdf'],rejectEncrypted:true,onScannerUnavailable:'reject'})constresult=awaitpolicy.check(buffer,{filename:'upload.pdf',mimeType:'application/pdf',size:buffer.length})// { allowed: true, reason: null, verdict: Verdict.Clean }// Express middlewareapp.post('/upload',upload.single('file'),policy.middleware(),handler)

    Multi-Engine Scanning

    Combine ClamAV with VirusTotal for higher confidence results.

    const{createMultiEngine}=require('pompelmi')constscanner=createMultiEngine({engines:[{type:'clamav',host:'localhost',port:3310},{type:'virustotal',apiKey:process.env.VIRUSTOTAL\_API\_KEY}],consensus:'any'})constresult=awaitscanner.scanBuffer(buffer)// {// verdict: Verdict.Malicious,// engines: [// { name: 'clamav', verdict: Verdict.Malicious, virus: 'Win.Malware.Agent' },// { name: 'virustotal', verdict: Verdict.Clean, detections: 0 }//]// }

    Consensus modes: any (strict) · all (lenient) · majority

    Directory Streaming with Progress Events

    Scan large directories with real-time progress via async iteration:

    forawait(consteventofscanDirectory.stream('/uploads',options)){if(event.type==='progress'){console.log(`${event.scanned}/${event.total} — ${event.file}`)}if(event.type==='result'){console.log(event.file,event.verdict)}if(event.type==='complete'){console.log('Done:',event.summary)}}

    🔄 Changes

    • src/ScanCache.js — SHA256 cache with TTL, LRU, memory and file storage
    • 🔒 src/Policy.js — unified upload security policy
    • src/MultiEngine.js — multi-engine scanning with consensus modes
    • src/DirectoryScanner.js — streaming async iterator with progress events
    • src/index.js — exports createCache, createPolicy, createMultiEngine
    • types/index.d.ts — full type declarations for all new exports
    • 📄 docs/cache.html — cache API reference
    • 📄 docs/policy.html — policy API reference
    • 📄 docs/multi-engine.html — multi-engine guide
    • ⚡️ docs/*.html — navbar updated

    Full Changelog

    v1.18.0...v1.19.0

  • v1.18.0 Changes

    May 08, 2026

    What's New

    🐳 Official Docker Image

    🐳 pompelmi/scanner is now available on Docker Hub.
    A self-contained image with ClamAV, clamd, and an HTTP scan API
    🔧 built in — no configuration required.

    docker pull pompelmi/scanner
docker run -p 8080:8080 pompelmi/scanner

# Scan a file via HTTPcurl -F"file=@./document.pdf"http://localhost:8080/scan# {"verdict":"clean","file":"document.pdf","viruses":[]}# Health checkcurl http://localhost:8080/health# {"status":"ok","clamd":"running"}

    🔒 Security Scorecard

    🔒 Grade your upload security configuration from A to F:

    const{generateScorecard}=require('pompelmi')constscorecard=awaitgenerateScorecard({scanEnabled:true,mimeTypeAllowlist:['image/jpeg','image/png','application/pdf'],fileSizeLimit:10\*1024\*1024,diskWriteBeforeScan:false,scanErrorBehavior:'reject',clamdUnavailableBehavior:'reject'})console.log(scorecard.grade)// 'A'console.log(scorecard.score)// 95console.log(scorecard.findings)// array of passed/failed checks

    From the CLI:

    npx pompelmi scorecard --config ./pompelmi.config.js

    VS Code Extension

    📦 A VS Code extension scaffold is now available at packages/vscode/.
    Right-click any file in the IDE and select "Scan with pompelmi".
    🚀 Marketplace publishing coming in a future release.

    Quarantine Mode

    🚚 Automatically move infected files to a quarantine directory:

    watch('/uploads',{host:'localhost',port:3310,quarantine:'/quarantine'},{onMalicious:'quarantine'})

npx pompelmi watch ./uploads --quarantine ./quarantine

    Each quarantined file gets a sidecar JSON with original path,
    virus name, timestamp, and SHA256 hash.

    🔄 Changes

    • 🐳 docker/ — Dockerfile, entrypoint.sh, HTTP scan API server
    • 🐳 .github/workflows/docker.yml — automated Docker Hub publishing
    • 🔒 src/Scorecard.js — A-F grading for upload security config
    • 👍 src/Watcher.js — quarantine mode support
    • 📦 packages/vscode/ — VS Code extension scaffold
    • bin/pompelmi.js — scorecard command and --quarantine flag
    • 🐳 docs/docker-image.html — Docker Hub image guide
    • 📄 docs/scorecard.html — scorecard API and CLI reference
    • 📄 docs/vscode.html — VS Code extension guide
    • ⚡️ docs/*.html — navbar updated across all pages
    • 🐳 README.md — Docker Hub badge, new features

    Full Changelog

    v1.17.0...v1.18.0

  • v1.17.0 Changes

    May 08, 2026

    What's New

    👍 Native ESM Support

    👍 pompelmi now supports both CommonJS and ES Modules natively.
    ↪ No more createRequire workarounds.

    // ESM (new)import{scan,scanBuffer,Verdict}from'pompelmi'// CommonJS (unchanged)const{scan,scanBuffer,Verdict}=require('pompelmi')

    👍 Deno Support

    pompelmi now works natively in Deno:

    import{scan,Verdict}from'npm:pompelmi'constresult=awaitscan('./file.pdf',{host:'localhost',port:3310})

    📦 Cloudflare Workers Package

    @pompelmi/cloudflare is now available on npm.
    Scan file uploads at the edge via a remote clamd instance.

    npm install @pompelmi/cloudflare

import{scanBuffer}from'@pompelmi/cloudflare'exportdefault{asyncfetch(request,env){constformData=awaitrequest.formData()constfile=formData.get('file')constbuffer=awaitfile.arrayBuffer()constresult=awaitscanBuffer(buffer,{host:env.CLAMAV\_HOST,port:parseInt(env.CLAMAV\_PORT)})if(result!=='clean'){returnnewResponse('File rejected',{status:422})}returnnewResponse('OK')}}

    Landing Page Improvements

    pompelmi.app now shows:

    • 👷 Runtime compatibility logos: Node.js • Bun • Deno • Cloudflare Workers
    • Framework logos grid: Express • Fastify • NestJS • Next.js • Hono • Remix • SvelteKit
    • Live GitHub stars and npm downloads badges

    GitHub Sponsors

    A Sponsor button is now visible on the GitHub repo via .github/FUNDING.yml.

    ⚙ Runtime Support

    Runtime Status
    Node.js ✅
    Bun ✅
    Deno ✅
    👷 Cloudflare Workers

    Framework Integrations

    📦 | Package | Framework | | --- | --- | 📦 | @pompelmi/nestjs | NestJS | 📦 | @pompelmi/fastify | Fastify | 📦 | @pompelmi/nextjs | Next.js | 📦 | @pompelmi/hono | Hono | 📦 | @pompelmi/remix | Remix | 📦 | @pompelmi/sveltekit | SvelteKit | 📦 | @pompelmi/cloudflare | Cloudflare Workers | 📦 | @pompelmi/testing | Jest / Vitest / Node |

    🔄 Changes

    • src/index.mjs — native ESM entry point
    • 📦 package.json — dual CJS/ESM exports field
    • 🔧 deno.json — Deno configuration
    • 📦 packages/cloudflare/ — Cloudflare Workers package
    • .github/FUNDING.yml — GitHub Sponsors button
    • 📄 docs/deno.html — Deno usage guide
    • 👷 docs/cloudflare.html — Cloudflare Workers guide
    • ⚡️ docs/*.html — navbar updated
    • index.html — landing page runtime and framework logos

    Full Changelog

    v1.16.0...v1.17.0

  • v1.16.0 Changes

    May 07, 2026

    What's New

    🔌 Remix Plugin

    @pompelmi/remix is now available on npm.

    npm install @pompelmi/remix pompelmi

import{withPompelmi}from'@pompelmi/remix'exportconstaction=withPompelmi(async({request})=\>{constformData=awaitrequest.formData()returnjson({ok:true})},{host:'localhost',port:3310})

    🔌 SvelteKit Plugin

    @pompelmi/sveltekit is now available on npm.

    npm install @pompelmi/sveltekit pompelmi

import{withPompelmi}from'@pompelmi/sveltekit'exportconstPOST=withPompelmi(async({request})=\>{returnnewResponse(JSON.stringify({ok:true}))},{host:'localhost',port:3310})

    Scan Statistics

    ✅ Track scan activity in-memory with createStats():

    const{createStats}=require('pompelmi')conststats=createStats()constresult=awaitstats.track(()=\>scan(filePath,options))stats.get()// {// totalScanned: 1247,// totalClean: 1245,// totalInfected: 2,// totalErrors: 0,// avgScanTimeMs: 45,// lastScanAt: '2026-05-07T...',// uptime: 3600000// }app.get('/pompelmi/stats',(req,res)=\>res.json(stats.get()))

    Navbar Fix

    📄 All docs/ HTML pages now have a consistent navbar linking to every
    📚 page in the documentation site. Previously several pages were missing
    🔗 links to newer sections.

    Framework Integrations

    📦 | Package | Framework | | --- | --- | 📦 | @pompelmi/nestjs | NestJS | 📦 | @pompelmi/fastify | Fastify | 📦 | @pompelmi/nextjs | Next.js | 📦 | @pompelmi/hono | Hono | 📦 | @pompelmi/remix | Remix | 📦 | @pompelmi/sveltekit | SvelteKit | 📦 | @pompelmi/testing | Jest / Vitest / Node |

    🔄 Changes

    • 📦 packages/remix/ — Remix action wrapper
    • 📦 packages/sveltekit/ — SvelteKit server handler and hook
    • src/Stats.js — in-memory scan statistics tracker
    • 📄 docs/remix.html, docs/sveltekit.html, docs/stats.html — new docs pages
    • 📄 docs/*.html — canonical navbar across all pages
    • ⚡️ README.md — updated framework integrations table
    • ⚡️ .github/workflows/ci.yml — updated to Node.js 24 actions

    Full Changelog

    v1.15.0...v1.16.0

  • v1.15.0 Changes

    May 06, 2026

    What's New

    🔌 Hono Plugin

    @pompelmi/hono is now available on npm. Works on Node.js, Bun,
    👷 and Cloudflare Workers.

    npm install @pompelmi/hono pompelmi

import{pompelmiMiddleware}from'@pompelmi/hono'import{Hono}from'hono'constapp=newHono()app.use('/upload/\*',pompelmiMiddleware({host:'localhost',port:3310,field:'file',onInfected:(c)=\>c.json({error:'Malware detected'},422)}))

    👍 Bun Support

    👍 pompelmi now officially supports the Bun runtime. The core library
    detects Bun at runtime and uses native Bun APIs where available for
    👷 faster file reads. Bun is now included in the CI test matrix.

    bun install pompelmi
bun run your-app.js

    Interactive Demo

    💻 A browser-based demo is now available at
    pompelmi.app/demo — try the pompelmi
    👀 terminal UI and see all three verdicts without installing anything.

    ✅ Testing Utilities

    ✅ @pompelmi/testing provides mock utilities for unit testing
    applications that use pompelmi.

    npm install --save-dev @pompelmi/testing

const{mockClean,mockInfected,mockScanError}=require('@pompelmi/testing')// In your testsit('rejects infected files',async()=\>{constscanner=mockInfected('Win.Malware.Test')constresult=awaitscanner.scanBuffer(buffer)expect(result).toBe(Verdict.Malicious)})

    ✅ Works with Jest, Vitest, and the Node.js built-in test runner.

    Comparison Page

    Side-by-side comparison of pompelmi against other Node.js ClamAV
    📄 integrations at docs/comparison.html.

    Framework Integrations

    📦 | Package | Framework | | --- | --- | 📦 | @pompelmi/nestjs | NestJS | 📦 | @pompelmi/fastify | Fastify | 📦 | @pompelmi/nextjs | Next.js | 📦 | @pompelmi/hono | Hono | 📦 | @pompelmi/testing | Jest / Vitest / Node |

    🔄 Changes

    • 📦 packages/hono/ — Hono middleware plugin
    • 📦 packages/testing/ — mock utilities for unit testing
    • src/ClamdScanner.js, BufferScanner.js, StreamScanner.js — Bun runtime detection
    • ✅ .github/workflows/ci.yml — Bun added to test matrix
    • 💻 docs/demo.html — interactive browser demo
    • 📄 docs/comparison.html — comparison with alternatives
    • ⚡️ docs/*.html — navbar updated across all pages
    • ⚡️ README.md — Bun support, demo link, updated integrations table

    Full Changelog

    v1.14.0...v1.15.0

  • v1.14.0 Changes

    May 06, 2026

    What's New

    🔒 HTML Security Dashboard

    Generate a beautiful, self-contained scan report in one command:

    npx pompelmi scan ./uploads --report
npx pompelmi scan ./uploads --report --output report.html

    Or from code:

    const{scanDirectory,generateDashboard}=require('pompelmi')constresults=awaitscanDirectory('./uploads')consthtml=awaitgenerateDashboard(results)fs.writeFileSync('report.html',html)

    🔋 Features:

    • Summary stats: scanned, infected, clean, errors, time
    • Color-coded status banner (green / red)
    • Full file table with verdict badges
    • Infected files highlighted with virus names
    • 👍 Dark mode support
    • 🖨 Print-friendly CSS
    • Zero external dependencies — single self-contained HTML file

    SVG Share Card

    Generate a shareable scan result card for README badges or social media:

    npx pompelmi scan ./uploads --share-card# saves pompelmi-scan-card.svg

const{generateShareCard}=require('pompelmi')constsvg=awaitgenerateShareCard(results)

    📦 Next.js Package

    @pompelmi/nextjs is now available on npm:

    npm install @pompelmi/nextjs pompelmi

// App Router (Next.js 13+)import{withPompelmi}from'@pompelmi/nextjs'exportconstPOST=withPompelmi(async(req)=\>{returnResponse.json({ok:true})},{host:'localhost',port:3310})// Pages RouterexportdefaultwithPompelmiHandler(handler,options)

    GitHub App

    🔧 Configuration for a one-click pompelmi GitHub App for organizations —
    no workflow file needed, scans changed files on every PR with inline
    annotations on the diff.

    👀 See docs/github-app.html for setup instructions.

    Framework Integrations

    📦 | Package | Framework | | --- | --- | 📦 | @pompelmi/nestjs | NestJS | 📦 | @pompelmi/fastify | Fastify | 📦 | @pompelmi/nextjs | Next.js |

    🔄 Changes

    • src/Dashboard.js — HTML report generator
    • src/ShareCard.js — SVG share card generator
    • bin/pompelmi.js — --report and --share-card flags added
    • 📦 packages/nextjs/ — Next.js App Router and Pages Router support
    • 🔧 .github/app.yml — GitHub App configuration
    • 📚 docs/dashboard.html — dashboard documentation
    • 📚 docs/github-app.html — GitHub App documentation
    • ⚡️ docs/*.html — navbar updated with new pages
    • ⚡️ README.md — Features list updated

    Full Changelog

    v1.13.0...v1.14.0

  • v1.13.0 Changes

    May 05, 2026

    ➕ Added

    • @pompelmi/nestjs — NestJS module with PompelmiModule.forRoot() / .forRootAsync(), injectable PompelmiService (scan / scanBuffer / isMalware), PompelmiGuard (blocks malicious uploads via CanActivate), and PompelmiInterceptor (throws BadRequestException on infection). Full TypeScript declarations included.
    • @pompelmi/fastify — Fastify plugin that decorates the instance with fastify.pompelmi (scan / scanBuffer / scanStream / preHandler). The preHandler() helper returns a route-level hook that scans uploaded files before the route handler runs. Supports custom onMalicious callbacks and full TypeScript declarations.
    • Framework Integrations section in README.md — table of official packages with usage snippets for NestJS and Fastify.

  • v1.12.0 Changes

    May 05, 2026

    What's New

    Standalone CLI

    Scan files directly from the terminal — no code required:

    # Scan a filenpx pompelmi scan ./uploads/file.pdf# Scan a directory recursivelynpx pompelmi scan ./uploads --recursive# Output as JSON for scriptingnpx pompelmi scan ./uploads --json# Watch a folder in real timenpx pompelmi watch ./uploads

    🔋 Features:

    • Renders the pompelmi grapefruit logo in the terminal via terminal-image
    • Live progress bar for directory scans
    • 💻 Box-drawing UI with color-coded results (green/red/yellow)
    • --json mode for shell script integration
    • 🚚 --delete flag to auto-remove infected files
    • 👷 --quiet mode for CI pipelines
    • Works with TCP, UNIX socket, and local clamscan

    Exit codes: 0 clean · 1 infected · 2 scan error · 3 clamd unreachable

    Install globally:

    npm install -g pompelmi
pompelmi scan ./uploads

    Or use without installing:

    npx pompelmi scan ./uploads

    📚 CLI Documentation

    🆕 New dedicated page: docs/cli.html

    • Full commands and options reference
    • JSON output format
    • Exit codes table
    • 8 real-world examples
    • Shell script integration

    ⚡️ Navbar updated across all docs

    📄 All docs/ pages now have a consistent navbar including the new CLI link.

    🔄 Changes

    • bin/pompelmi.js — full CLI implementation
    • 📦 package.json — bin field added, terminal-image dependency
    • 📚 docs/cli.html — new CLI documentation page
    • ⚡️ docs/*.html — navbar updated across all pages
    • 📄 README.md — Quick Start section, CLI in Features and docs table
    • CHANGELOG.md — v1.12.0 entry

    Full Changelog

    v1.11.0...v1.12.0

  • v1.11.0 Changes

    May 04, 2026

    ➕ Added

    • Webhook notifications — notify(webhookUrl, scanResult, options) sends a POST request when a virus is detected. Payload includes file, verdict, viruses, timestamp, and hostname. Supports HMAC-SHA256 request signing via X-Pompelmi-Signature header when a secret is provided. Ships with onlyOnMalicious: true default so noise-free by default. Uses Node.js built-in https/http — zero extra dependencies.
    • EventEmitter scanner — createScanner(options) returns an EventEmitter-based scanner with scan(filePath) and scanDirectory(dirPath) methods. Emits 'clean', 'malicious', 'scanError', and 'error' events per file — ideal for streaming pipelines and upload processing loops.
    • 🚀 Automated GitHub Release notes — release workflow now extracts the matching changelog section from CHANGELOG.md and uses it as the release body, with a one-line summary in the release title (vX.Y.Z — <summary>). No more static template.
    • .mailmap — maps any historical claude/Claude authorship entries to the project author so they are excluded from GitHub's contributor list.

    🔄 Changed

    • src/index.js — exports notify and createScanner alongside existing API.
    • 🛰 types/index.d.ts — full TypeScript declarations for notify, NotifyOptions, WebhookPayload, ScanResultInput, createScanner, and ScanEmitter (including typed event overloads).