Benchmarks and Performance

Relevant source files

The following files were used as context for generating this wiki page:

• benchmarks/bench-compare.js
• benchmarks/bench-parse.js
• benchmarks/bench-satisfies.js
• benchmarks/bench-diff.js
• benchmarks/bench-subset.js
• benchmarks/bench-parse-options.js
• test/integration/whitespace.js
• semver.js

Introduction

The node-semver project includes a dedicated benchmarking suite designed to measure the performance and efficiency of core Semantic Versioning operations. These benchmarks utilize the benchmark library to provide high-resolution timing and statistical analysis for functions such as parsing, comparison, and range satisfaction. The primary goal of these benchmarks is to ensure that the library remains performant across various versions and configuration options while preventing performance regressions during development.

In addition to timing benchmarks, the project places a critical emphasis on "Regex DoS" (ReDoS) protection. Performance testing includes integration tests that validate the library's ability to handle extremely large inputs—specifically those containing excessive whitespace or leading zeros—without succumbing to catastrophic backtracking in regular expressions. Sources: benchmarks/bench-parse.js, test/integration/whitespace.js, semver.js:35-55

Benchmark Architecture

The benchmarking system is structured as a series of standalone scripts, each focusing on a specific functional area of the library. Each script initializes a Benchmark.Suite, adds various test cases, and executes them synchronously.

Performance Data Flow

The following diagram illustrates how a benchmark suite processes test cases and reports results.

The benchmark runner iterates through defined test cases, executing the logic (e.g., parse(test)) repeatedly to generate statistical significance. Sources: benchmarks/bench-parse.js:10-27, benchmarks/bench-compare.js:13-52

Core Benchmark Categories

1. Parsing and Configuration

Benchmarks in this category measure the speed of the parse function and the internal parseOptions utility. Testing covers standard version strings, invalid strings, and various combinations of configuration objects (e.g., includePrerelease, loose, rtl).

Benchmark	Focus Area	Sample Input
bench-parse.js	Version string validation and object creation	'1.2.3-pre', 'xyz'
bench-parse-options.js	Internal configuration object normalization	{ loose: true, rtl: false }

Sources: benchmarks/bench-parse.js:8-20, benchmarks/bench-parse-options.js:7-29

2. Comparison and Logic

These benchmarks evaluate the performance of version ordering and range matching. Comparison benchmarks often involve creating new SemVer class instances and calling the .compare() method against a reference version.

3. Range Satisfaction and Subsets

Range benchmarks measure the complexity of determining if a version satisfies a complex range or if one range is a subset of another.

• Satisfies: Tests inputs like satisfies('1.0.6', '1.0.3||^2.0.0'). Sources: benchmarks/bench-satisfies.js:11-30
• Subset: Tests range hierarchy, such as subset('^1.2.3', '*'). Sources: benchmarks/bench-subset.js:8-15

Regex Performance and Security

A critical performance consideration in node-semver is the mitigation of Regular Expression Denial of Service (ReDoS). The library implements "Safe Regex" patterns to prevent performance collapse when encountering malicious or oversized inputs.

Safe Re Implementation

The library replaces standard greedy tokens (*, +) with bounded quantifiers based on a MAX_LENGTH constant (defaulting to 256).

var MAX_LENGTH = 256
var safeRegexReplacements = [
  ['\\s', 1],
  ['\\d', MAX_LENGTH],
  [LETTERDASHNUMBER, MAX_SAFE_BUILD_LENGTH],
]

function makeSafeRe (value) {
  for (var i = 0; i < safeRegexReplacements.length; i++) {
    var token = safeRegexReplacements[i][0]
    var max = safeRegexReplacements[i][1]
    value = value
      .split(token + '*').join(token + '{0,' + max + '}')
      .split(token + '+').join(token + '{1,' + max + '}')
  }
  return value
}

Sources: semver.js:35-65

Large Input Validation

Integration tests verify that the library can process inputs with 500,000 characters of whitespace or zeros. These tests are governed by a global timeout; if the regex logic is inefficient (susceptible to backtracking), the tests fail the timeout threshold.

Test Case	Input Type	Expected Behavior
Range Whitespace	1.2.3 [500k spaces] <1.3.0	Success (Fast processing)
Range Zeros	1.2.3 [500k zeros] <1.3.0	Throws/Null (Safety check)
Large Version	[500k spaces]1.2.3[500k spaces]	Throws (Length limit)

Sources: test/integration/whitespace.js:11-50

Conclusion

The "Benchmarks and Performance" system in node-semver provides a robust framework for validating both execution speed and algorithmic safety. By combining standard micro-benchmarks via the benchmark library with specific ReDoS stress tests, the project ensures that version parsing and comparison remain reliable even under adversarial conditions or high-load environments.