medplum / medplum / 21734871738

92%

main: 92%

push

github

perf(server): switch from bcryptjs to native bcrypt for improved performance (#8377)

Replace the pure JavaScript bcryptjs package with the native bcrypt package
to prevent event loop blocking during password hashing operations.

bcryptjs performs bcrypt operations synchronously on the main thread using
setImmediate/nextTick, which blocks the event loop for ~100-300ms per hash
(depending on cost factor). Under sustained authentication load, this causes
cascading delays as requests queue behind blocked operations.

Native bcrypt offloads hash computation to the libuv thread pool via N-API,
keeping the event loop responsive during password verification.

This addresses the performance degradation reported in #8338.

Changes:
- Replace bcryptjs@3.0.3 with bcrypt@6.0.0 in server package
- Update imports in auth/utils.ts, auth/changepassword.ts, oauth/utils.ts

The APIs are identical - this is a drop-in replacement with no code changes
required beyond the import statements.

Note: bcrypt v6.0.0 includes prebuilt binaries for common platforms
(Windows/Linux/macOS, x64/arm64), minimizing native compilation requirements.

Signed-off-by: Wihan <wihanvh@gmail.com>
Co-authored-by: Wihan <wihanvh@gmail.com>

16971 of 19238 branches covered (88.22%)

Branch coverage included in aggregate %.

31001 of 32730 relevant lines covered (94.72%)

13846.33 hits per line