@bymax-one/nest-cache 1.0.2 → 1.0.3

package/CHANGELOG.md

@@ -6,6 +6,28 @@ project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
 
+## [1.0.3] - 2026-08-01
+
+### Security
+
+- **Peer floors raised to exclude known-vulnerable NestJS versions.** The declared
+  ranges were `@nestjs/common ^11.0.0` and `@nestjs/core ^11.0.0`, and both
+  admitted versions carrying published advisories:
+
+  | Peer             | Advisory                                                                                                                                    | Vulnerable                    | New floor  |
+  | ---------------- | ------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------- | ---------- |
+  | `@nestjs/common` | [GHSA-cj7v-w2c7-cp7c](https://github.com/advisories/GHSA-cj7v-w2c7-cp7c) — remote code execution via the `Content-Type` header              | `>= 11.0.0-next.1, < 11.0.16` | `^11.0.16` |
+  | `@nestjs/core`   | [GHSA-36xv-jgw5-4q75](https://github.com/advisories/GHSA-36xv-jgw5-4q75) — improper neutralization of special elements in downstream output | `<= 11.1.17`                  | `^11.1.18` |
+
+  A peer range is a statement about which versions this library supports. Leaving
+  the floor below a published advisory told a consumer that a vulnerable install
+  was a supported one, and nothing in their tooling contradicted it — the install
+  resolved cleanly and silently.
+
+  Shipped as a patch, which is where a security fix belongs. A minor would have
+  bought nothing: `^1.0.2` accepts `1.1.0` just as readily as `1.0.3`, so the same
+  installs are affected either way. No runtime behaviour changed.
+
 ## [1.0.2] - 2026-07-29
 
 ### Fixed
@@ -87,3 +109,8 @@ project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 - E2E suite: `@nestjs/testing` with `ioredis-mock` + Testcontainers (standalone, sentinel, cluster, connection resilience)
 - Published with npm OIDC provenance — no long-lived tokens
 - Zero direct runtime dependencies (`dependencies: {}`) — `ioredis` and NestJS via peer deps
+
+[1.0.3]: https://github.com/bymaxone/nest-cache/releases/tag/v1.0.3
+[1.0.2]: https://github.com/bymaxone/nest-cache/releases/tag/v1.0.2
+[1.0.1]: https://github.com/bymaxone/nest-cache/releases/tag/v1.0.1
+[1.0.0]: https://github.com/bymaxone/nest-cache/releases/tag/v1.0.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bymax-one/nest-cache",
-  "version": "1.0.2",
+  "version": "1.0.3",
   "description": "Typed Redis cache for NestJS based on ioredis 5, with namespace strategy, Pub/Sub and Lua script management.",
   "author": "Bymax One <support@bymax.one>",
   "license": "MIT",
@@ -64,8 +64,8 @@
   },
   "dependencies": {},
   "peerDependencies": {
-    "@nestjs/common": "^11.0.0",
-    "@nestjs/core": "^11.0.0",
+    "@nestjs/common": "^11.0.16",
+    "@nestjs/core": "^11.1.18",
     "ioredis": "^5.0.0",
     "reflect-metadata": "^0.2.0"
   },
@@ -125,22 +125,23 @@
   },
   "scripts": {
     "build": "pnpm clean && tsup",
+    "check:exports": "attw --pack .",
+    "check:published": "node scripts/check-published-surface.mjs",
+    "clean": "rm -rf dist coverage",
     "lint": "eslint src scripts",
     "lint:fix": "eslint src scripts --fix",
+    "mutation": "stryker run",
+    "mutation:dry-run": "stryker run --dryRunOnly",
+    "mutation:incremental": "stryker run --incremental",
+    "release": "pnpm publish --provenance",
+    "size": "node scripts/check-size.mjs",
     "test": "jest",
-    "test:cov": "jest --coverage",
-    "test:watch": "jest --watch",
-    "test:e2e": "jest --config jest.e2e.config.ts --runInBand",
     "test:all": "pnpm test && pnpm test:e2e",
+    "test:cov": "jest --coverage",
     "test:cov:all": "jest --config jest.coverage.config.ts --coverage",
-    "mutation": "stryker run",
-    "mutation:incremental": "stryker run --incremental",
-    "mutation:dry-run": "stryker run --dryRunOnly",
-    "typecheck": "tsc --noEmit && tsc --noEmit -p tsconfig.server.json",
+    "test:e2e": "jest --config jest.e2e.config.ts --runInBand",
     "test:types": "tsc --noEmit -p tsconfig.typetest.json",
-    "size": "node scripts/check-size.mjs",
-    "check:exports": "attw --pack .",
-    "clean": "rm -rf dist coverage",
-    "release": "pnpm publish --provenance"
+    "test:watch": "jest --watch",
+    "typecheck": "tsc --noEmit && tsc --noEmit -p tsconfig.server.json"
   }
 }