@bymax-one/nest-cache 1.0.1 → 1.0.3

package/CHANGELOG.md

@@ -6,6 +6,52 @@ project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
 
+## [1.0.3] - 2026-08-01
+
+### Security
+
+- **Peer floors raised to exclude known-vulnerable NestJS versions.** The declared
+  ranges were `@nestjs/common ^11.0.0` and `@nestjs/core ^11.0.0`, and both
+  admitted versions carrying published advisories:
+
+  | Peer             | Advisory                                                                                                                                    | Vulnerable                    | New floor  |
+  | ---------------- | ------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------- | ---------- |
+  | `@nestjs/common` | [GHSA-cj7v-w2c7-cp7c](https://github.com/advisories/GHSA-cj7v-w2c7-cp7c) — remote code execution via the `Content-Type` header              | `>= 11.0.0-next.1, < 11.0.16` | `^11.0.16` |
+  | `@nestjs/core`   | [GHSA-36xv-jgw5-4q75](https://github.com/advisories/GHSA-36xv-jgw5-4q75) — improper neutralization of special elements in downstream output | `<= 11.1.17`                  | `^11.1.18` |
+
+  A peer range is a statement about which versions this library supports. Leaving
+  the floor below a published advisory told a consumer that a vulnerable install
+  was a supported one, and nothing in their tooling contradicted it — the install
+  resolved cleanly and silently.
+
+  Shipped as a patch, which is where a security fix belongs. A minor would have
+  bought nothing: `^1.0.2` accepts `1.1.0` just as readily as `1.0.3`, so the same
+  installs are affected either way. No runtime behaviour changed.
+
+## [1.0.2] - 2026-07-29
+
+### Fixed
+
+- **The `./shared` subpath now resolves under `moduleResolution: node`.** A
+  `typesVersions` map points the subpath at its `.d.cts` declarations, which is
+  the only mechanism that resolution algorithm understands — it predates
+  `exports` and ignores it entirely. Without this, a consumer whose tsconfig
+  sets `module: commonjs` without an explicit `moduleResolution` (the default
+  the Nest CLI scaffolds, which falls back to `node`) got
+  `error TS2307: Cannot find module '@bymax-one/nest-cache/shared'` while the
+  root entrypoint resolved fine. Runtime was never affected: Node reads
+  `exports`, so `require('@bymax-one/nest-cache/shared')` always worked.
+
+  This supersedes the note under 1.0.1 claiming the subpath was "not fixable
+  without a directory shim" — that was wrong, `typesVersions` fixes it with no
+  extra files in the tarball.
+
+### Changed
+
+- `check:exports` now runs the **strict** `attw` profile. The `--profile node16`
+  escape hatch existed only to ignore the failing `node10` row, which no longer
+  fails, so every entrypoint is now verified in every resolution mode.
+
 ## [1.0.1] - 2026-07-29
 
 ### Fixed
@@ -63,3 +109,8 @@ project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 - E2E suite: `@nestjs/testing` with `ioredis-mock` + Testcontainers (standalone, sentinel, cluster, connection resilience)
 - Published with npm OIDC provenance — no long-lived tokens
 - Zero direct runtime dependencies (`dependencies: {}`) — `ioredis` and NestJS via peer deps
+
+[1.0.3]: https://github.com/bymaxone/nest-cache/releases/tag/v1.0.3
+[1.0.2]: https://github.com/bymaxone/nest-cache/releases/tag/v1.0.2
+[1.0.1]: https://github.com/bymaxone/nest-cache/releases/tag/v1.0.1
+[1.0.0]: https://github.com/bymaxone/nest-cache/releases/tag/v1.0.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bymax-one/nest-cache",
-  "version": "1.0.1",
+  "version": "1.0.3",
   "description": "Typed Redis cache for NestJS based on ioredis 5, with namespace strategy, Pub/Sub and Lua script management.",
   "author": "Bymax One <support@bymax.one>",
   "license": "MIT",
@@ -46,6 +46,13 @@
   "main": "./dist/server/index.cjs",
   "module": "./dist/server/index.mjs",
   "types": "./dist/server/index.d.cts",
+  "typesVersions": {
+    "*": {
+      "shared": [
+        "./dist/shared/index.d.cts"
+      ]
+    }
+  },
   "lint-staged": {
     "*.{ts,tsx,js,mjs,cjs}": [
       "eslint --fix",
@@ -57,8 +64,8 @@
   },
   "dependencies": {},
   "peerDependencies": {
-    "@nestjs/common": "^11.0.0",
-    "@nestjs/core": "^11.0.0",
+    "@nestjs/common": "^11.0.16",
+    "@nestjs/core": "^11.1.18",
     "ioredis": "^5.0.0",
     "reflect-metadata": "^0.2.0"
   },
@@ -118,22 +125,23 @@
   },
   "scripts": {
     "build": "pnpm clean && tsup",
+    "check:exports": "attw --pack .",
+    "check:published": "node scripts/check-published-surface.mjs",
+    "clean": "rm -rf dist coverage",
     "lint": "eslint src scripts",
     "lint:fix": "eslint src scripts --fix",
+    "mutation": "stryker run",
+    "mutation:dry-run": "stryker run --dryRunOnly",
+    "mutation:incremental": "stryker run --incremental",
+    "release": "pnpm publish --provenance",
+    "size": "node scripts/check-size.mjs",
     "test": "jest",
-    "test:cov": "jest --coverage",
-    "test:watch": "jest --watch",
-    "test:e2e": "jest --config jest.e2e.config.ts --runInBand",
     "test:all": "pnpm test && pnpm test:e2e",
+    "test:cov": "jest --coverage",
     "test:cov:all": "jest --config jest.coverage.config.ts --coverage",
-    "mutation": "stryker run",
-    "mutation:incremental": "stryker run --incremental",
-    "mutation:dry-run": "stryker run --dryRunOnly",
-    "typecheck": "tsc --noEmit && tsc --noEmit -p tsconfig.server.json",
+    "test:e2e": "jest --config jest.e2e.config.ts --runInBand",
     "test:types": "tsc --noEmit -p tsconfig.typetest.json",
-    "size": "node scripts/check-size.mjs",
-    "check:exports": "attw --pack . --profile node16",
-    "clean": "rm -rf dist coverage",
-    "release": "pnpm publish --provenance"
+    "test:watch": "jest --watch",
+    "typecheck": "tsc --noEmit && tsc --noEmit -p tsconfig.server.json"
   }
 }