docs: correct readme, security policy and changelog claims

[derodero24]

Summary

Problem

• README.md, SECURITY.md and the 1.1.0 CHANGELOG entry no longer match what comprs does today (docs: README, SECURITY.md and CONTRIBUTING.md contradict current behaviour #556, part A).
• README comparison:
  • The intro said the ecosystem has "no streaming support".
  • The comparison table said pako, fflate and node:zlib have no dictionary support, and that node:zlib does not run in Deno and Bun.
• README streaming:
  • It promised bounded-memory streaming. The LZ4 decompression and brotli-dictionary compression streams don't provide it (perf(streams): LZ4 decompression and brotli dictionary compression streams buffer the entire input #565).
  • It did not say that the stream helpers run synchronously on the calling thread (perf(streams): stream transforms compress and decompress synchronously on the main thread #554).
  • It did not say that the *Async functions copy their input on the calling thread (perf(core): *Async functions copy their input on the main thread #548).
• README benchmarks:
  • "Brotli 10–155x faster than node:zlib" compared quality 6 with quality 11 (perf(brotli): the pure-Rust encoder is up to 7x slower than node:zlib at the same quality #563).
  • The lz4 "random/incompressible" takeaway rested on data that repeats every 256 bytes.
  • The tables did not say when, or with which comprs version, they were measured.
• SECURITY.md listed only 0.x as supported.
• The 1.1.0 changelog entry claims zstd multi-threaded compression (zstdmt), which nothing turns on (chore(zstd): the zstdmt feature is compiled in but never enabled #561).

Fix

• README claims:
  • Dropped "no streaming support" from the intro.
  • Comparison table: node:zlib Deno/Bun is ✅‡, with a footnote that Deno 2 and Bun implement node:zlib. The Dictionary row says what each library supports: zstd, brotli / deflate / deflate / deflate; zstd (Node.js 22.19+, 24.6+). The footnotes render on separate lines.
  • The "bounded memory" bullet names the two streams that buffer their whole input. A new Notes entry, "Streams that buffer their input", lists them, including the auto-detecting createDecompressStream() / createDecompressTransform() when the input is LZ4. It limits the bounded-memory statement to @derodero24/comprs/streams and @derodero24/comprs/node and links perf(streams): LZ4 decompression and brotli dictionary compression streams buffer the entire input #565.
  • "Choosing an API mode" has a new paragraph. The Web Streams and Node.js Transforms process each chunk synchronously on the calling thread, while node:zlib streams use the libuv thread pool. For large inputs where event-loop latency matters, use the *Async one-shot functions or a worker thread.
  • The Async section has a new paragraph. The input (data, dictionary or training samples) is copied on the calling thread and no reference to it is kept, so changing or transferring the input once the call has returned is safe. The copy blocks the event loop for about 0.6 ms per MB. For very large inputs, use a worker thread.
  • The LZ4 rows now read createLz4DecompressStream(maxOutputSize?) and createLz4DecompressTransform(maxOutputSize?).
  • The Quick Start streaming snippet is self-contained (fetch plus a response.body null check) and has no unused import.
  • Deno section: without --allow-ffi, the import fails with a misleading Cannot find native binding error. Deno also needs "nodeModulesDir": "auto" in deno.json or a local node_modules.
• README benchmarks:
  • Removed the brotli table, the bench-brotli.svg chart (the file is deleted; nothing else references it), the "10–155x" takeaway and its Note, and the lz4 "random/incompressible" claim.
  • The section now says the tables and charts were measured in March 2026, before comprs 1.0, on an Apple M2 with Node.js 22, with each library at its default level. It also says a script is regenerating them (docs: README, SECURITY.md and CONTRIBUTING.md contradict current behaviour #556).
  • Added: "comprs uses a pure-Rust brotli encoder: at equal quality, it is slower than node:zlib's C encoder, especially for small inputs. Prefer zstd when speed matters."
• SECURITY.md has one row per package and version line:
  • comprs: 2.x ✅, < 2.0 ❌.
  • comprs-middleware: 1.x ✅, < 1.0 ❌.
  • comprs-wasm32-wasi: ❌, no longer published.
  • Fixes ship in the latest 2.x release of comprs and the latest 1.x release of comprs-middleware. The "Once version 1.0" sentence is gone.
• CHANGELOG.md 1.1.0: the zstdmt claim now carries an in-place "(corrected: …)" note. libzstd is built with multi-threading support, but nothing turns on its worker threads, so zstd compression runs on one thread (chore(zstd): the zstdmt feature is compiled in but never enabled #561). A changeset cannot amend a released entry.
• CONTRIBUTING.md is not changed here: build: declare and enforce the minimum supported Rust version #612 already replaced the outdated pnpm requirement.

References

• node:zlib dictionaries: deflate/inflate use dictionary in Options, and zstd uses dictionary in ZstdOptions. The zstd option was added in Node.js v22.19.0 / v24.6.0 (zlib: add dictionary support to zstdCompress and zstdDecompress nodejs/node#59240) and is missing from the v22.15–v22.18 and v24.5 docs. That is why the table says 22.19+/24.6+, not 22.15.
• Thread pool: "All zlib APIs, except those that are explicitly synchronous, use the Node.js internal threadpool".
• Benchmark dates: the tables come from docs: add benchmark comparison results to README #224 (2026-03-25) and the charts from docs: comprehensive README update with missing APIs and SVG benchmark #118 and docs: add benchmark comparison SVG charts #248 (March 2026). v1.0.0 was released on 2026-04-04.
• Note for perf: investigate async task input data copy overhead #339: napi ≥ 3 implements Send for Buffer.
  • In napi 3.13.0, the version Cargo.lock pins, unsafe impl Send for Buffer {} is at src/bindgen_runtime/js_values/buffer.rs:496. The typed-array impl at arraybuffer.rs:476 covers Uint8Array.
  • So Send is no longer why the async functions copy their input. They copy it so the result stays correct even if the caller mutates, transfers or detaches the input while the operation runs (see perf(core): *Async functions copy their input on the main thread #548).

Tests

• Docs only, no changeset.
• pnpm run check and commitlint pass.
• The Quick Start snippet type-checks under tsc --strict with lib dom. The old snippet failed with an undeclared response and an unused import.
• Every changed anchor and link was checked.

Follow-ups

• Part B of docs: README, SECURITY.md and CONTRIBUTING.md contradict current behaviour #556: regenerate the benchmark tables and charts from a checked-in script, with equal levels and compression ratios.

Refs #556, #548, #554, #563, #565, #561 (tracking: #535)

Related issue

Refs #556
Refs #548
Refs #554
Refs #563
Refs #565
Part of #535

Breaking changes / Deprecations

N/A

Checklist

• Lint passes (pnpm run check)
• TypeScript type-check passes (pnpm run typecheck) — N/A, docs only (the Quick Start snippet was type-checked separately with tsc --strict)
• JS tests pass (pnpm test) — N/A, docs only
• Rust tests pass (cargo test) — N/A, docs only
• Clippy passes (cargo clippy) — N/A, docs only
• Build succeeds (pnpm run build) — N/A, docs only
• Changeset included (if crates/ changed) — N/A, docs only, crates/ unchanged
• Benchmarks run for performance-sensitive changes — N/A, no code change

🤖 Generated with Claude Code

https://claude.ai/code/session_01DRi2Qu5rPjQSDBcR8xmkSS

---

Generated by Claude Code

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 33 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: de12ff56-1a31-42de-95f5-dbd6098129d6

📥 Commits

Reviewing files that changed from the base of the PR and between a1a2d6b and d5ac099.

⛔ Files ignored due to path filters (1)

• .github/assets/bench-brotli.svg is excluded by !**/*.svg

📒 Files selected for processing (3)

• CHANGELOG.md
• README.md
• SECURITY.md

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}