@bymax-one/nest-cache 1.0.2 → 1.0.4

package/CHANGELOG.md

@@ -6,6 +6,46 @@ project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
 
+## [1.0.4] - 2026-08-04
+
+### Security
+
+- The Redis credentials are no longer disclosed when a service that holds the resolved
+  options is serialized. The three connection shapes — `connection`, `sentinel` and
+  `cluster` — move from plain fields on the resolved options to non-enumerable accessors,
+  and `ConnectionManager` keeps its client and the driver options built from them, as does
+  `PubSubService` with its subscriber, in ECMAScript private fields. A `url` carries the
+  password inline, the discrete forms carry it as a field, and an ioredis instance carries
+  `options.password` as a plain field, so `JSON.stringify`, object spread and
+  `util.inspect` on any holder emitted it in plaintext — which is what a structured logger
+  does when it renders a provider it was handed, and what an error reporter does when it
+  captures the scope of a throw.
+
+Reading on purpose is unchanged: `options.connection` resolves as before, and no public
+type or export moved.
+
+## [1.0.3] - 2026-08-01
+
+### Security
+
+- **Peer floors raised to exclude known-vulnerable NestJS versions.** The declared
+  ranges were `@nestjs/common ^11.0.0` and `@nestjs/core ^11.0.0`, and both
+  admitted versions carrying published advisories:
+
+  | Peer             | Advisory                                                                                                                                    | Vulnerable                    | New floor  |
+  | ---------------- | ------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------- | ---------- |
+  | `@nestjs/common` | [GHSA-cj7v-w2c7-cp7c](https://github.com/advisories/GHSA-cj7v-w2c7-cp7c) — remote code execution via the `Content-Type` header              | `>= 11.0.0-next.1, < 11.0.16` | `^11.0.16` |
+  | `@nestjs/core`   | [GHSA-36xv-jgw5-4q75](https://github.com/advisories/GHSA-36xv-jgw5-4q75) — improper neutralization of special elements in downstream output | `<= 11.1.17`                  | `^11.1.18` |
+
+  A peer range is a statement about which versions this library supports. Leaving
+  the floor below a published advisory told a consumer that a vulnerable install
+  was a supported one, and nothing in their tooling contradicted it — the install
+  resolved cleanly and silently.
+
+  Shipped as a patch, which is where a security fix belongs. A minor would have
+  bought nothing: `^1.0.2` accepts `1.1.0` just as readily as `1.0.3`, so the same
+  installs are affected either way. No runtime behaviour changed.
+
 ## [1.0.2] - 2026-07-29
 
 ### Fixed
@@ -87,3 +127,9 @@ project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 - E2E suite: `@nestjs/testing` with `ioredis-mock` + Testcontainers (standalone, sentinel, cluster, connection resilience)
 - Published with npm OIDC provenance — no long-lived tokens
 - Zero direct runtime dependencies (`dependencies: {}`) — `ioredis` and NestJS via peer deps
+
+[1.0.4]: https://github.com/bymaxone/nest-cache/compare/v1.0.3...v1.0.4
+[1.0.3]: https://github.com/bymaxone/nest-cache/releases/tag/v1.0.3
+[1.0.2]: https://github.com/bymaxone/nest-cache/releases/tag/v1.0.2
+[1.0.1]: https://github.com/bymaxone/nest-cache/releases/tag/v1.0.1
+[1.0.0]: https://github.com/bymaxone/nest-cache/releases/tag/v1.0.0

package/dist/server/index.cjs

@@ -4,6 +4,9 @@ var common = require('@nestjs/common');
 var ioredis = require('ioredis');
 
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __typeError = (msg) => {
+  throw TypeError(msg);
+};
 var __decorateClass = (decorators, target, key, kind) => {
   var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc(target, key) : target;
   for (var i = decorators.length - 1, decorator; i >= 0; i--)
@@ -12,6 +15,10 @@ var __decorateClass = (decorators, target, key, kind) => {
   return result;
 };
 var __decorateParam = (index, decorator) => (target, key) => decorator(target, key, index);
+var __accessCheck = (obj, member, msg) => member.has(obj) || __typeError("Cannot " + msg);
+var __privateGet = (obj, member, getter) => (__accessCheck(obj, member, "read from private field"), getter ? getter.call(obj) : member.get(obj));
+var __privateAdd = (obj, member, value) => member.has(obj) ? __typeError("Cannot add the same private member more than once") : member instanceof WeakSet ? member.add(obj) : member.set(obj, value);
+var __privateSet = (obj, member, value, setter) => (__accessCheck(obj, member, "write to private field"), member.set(obj, value), value);
 
 // src/server/bymax-cache.constants.ts
 var BYMAX_CACHE_OPTIONS = /* @__PURE__ */ Symbol("BYMAX_CACHE_OPTIONS");
@@ -215,8 +222,17 @@ function applyDefaults(options) {
     isGlobal: options.isGlobal ?? true,
     scripts: options.scripts
   };
+  for (const key of ["connection", "sentinel", "cluster"]) {
+    const value = Object.getOwnPropertyDescriptor(resolved, key)?.value;
+    Object.defineProperty(resolved, key, {
+      get: () => value,
+      enumerable: false,
+      configurable: false
+    });
+  }
   return Object.freeze(resolved);
 }
+var _client, _redisOptionsResolved;
 exports.ConnectionManager = class ConnectionManager {
   /**
    * @param options - Resolved module options (frozen).
@@ -226,19 +242,29 @@ exports.ConnectionManager = class ConnectionManager {
   constructor(options, events) {
     this.options = options;
     this.events = events;
-    this.client = null;
+    /**
+     * The live Redis client.
+     *
+     * An ECMAScript private field rather than a TypeScript `private` one, which is
+     * erased at runtime: an ioredis instance carries `options.password` as a plain
+     * field, so leaving it enumerable puts the credentials one `JSON.stringify`
+     * away from any service that holds this manager.
+     */
+    __privateAdd(this, _client, null);
+    /** The driver options built from the connection config; they carry the password. */
+    __privateAdd(this, _redisOptionsResolved);
     /** Default backoff: grow 50 ms per attempt, capped at 2 s. */
     this.defaultRetryStrategy = (times) => Math.min(times * DEFAULT_RETRY_BASE_MS, DEFAULT_RETRY_MAX_MS);
     /** Default reconnect policy: reconnect only on a `READONLY` replica failover. */
     this.defaultReconnectOnError = (err) => err.message.includes("READONLY");
-    this.redisOptionsResolved = this.buildRedisOptions(options);
+    __privateSet(this, _redisOptionsResolved, this.buildRedisOptions(options));
   }
   /** Opens the main client and waits for readiness unless `lazyConnect`. */
   async onModuleInit() {
-    this.client = this.createClient();
-    this.registerListeners(this.client, "main");
+    __privateSet(this, _client, this.createClient());
+    this.registerListeners(__privateGet(this, _client), "main");
     if (!this.options.connection?.lazyConnect) {
-      await this.waitUntilReady(this.client);
+      await this.waitUntilReady(__privateGet(this, _client));
     }
   }
   /**
@@ -248,11 +274,11 @@ exports.ConnectionManager = class ConnectionManager {
    * @returns The shared main client.
    */
   getClient() {
-    if (!this.client) {
-      this.client = this.createClient();
-      this.registerListeners(this.client, "main");
+    if (!__privateGet(this, _client)) {
+      __privateSet(this, _client, this.createClient());
+      this.registerListeners(__privateGet(this, _client), "main");
     }
-    return this.client;
+    return __privateGet(this, _client);
   }
   /**
    * Creates a brand-new dedicated connection for subscriber mode (a subscriber
@@ -278,7 +304,7 @@ exports.ConnectionManager = class ConnectionManager {
   }
   /** Quits the main client gracefully, forcing `disconnect()` on timeout. */
   async onModuleDestroy() {
-    const client = this.client;
+    const client = __privateGet(this, _client);
     if (!client) {
       return;
     }
@@ -306,7 +332,7 @@ exports.ConnectionManager = class ConnectionManager {
       client.disconnect();
     } finally {
       clearTimeout(timer);
-      this.client = null;
+      __privateSet(this, _client, null);
     }
   }
   // ─── Private ──────────────────────────────────────────────────────────────
@@ -324,7 +350,7 @@ exports.ConnectionManager = class ConnectionManager {
         throw new CacheException(CACHE_ERROR_CODES.SENTINEL_MISCONFIGURED, { mode: "sentinel" });
       }
       return new ioredis.Redis({
-        ...this.redisOptionsResolved,
+        ...__privateGet(this, _redisOptionsResolved),
         ...overrides,
         sentinels: sentinel.sentinels,
         name: sentinel.name,
@@ -347,7 +373,7 @@ exports.ConnectionManager = class ConnectionManager {
       }
       return new ioredis.Cluster(cluster.nodes, cluster.options ?? {});
     }
-    return new ioredis.Redis({ ...this.redisOptionsResolved, ...overrides });
+    return new ioredis.Redis({ ...__privateGet(this, _redisOptionsResolved), ...overrides });
   }
   /** Merges connection options with defaults; URL fields take precedence. */
   buildRedisOptions(opts) {
@@ -413,6 +439,8 @@ exports.ConnectionManager = class ConnectionManager {
     });
   }
 };
+_client = new WeakMap();
+_redisOptionsResolved = new WeakMap();
 exports.ConnectionManager = __decorateClass([
   common.Injectable(),
   __decorateParam(0, common.Inject(BYMAX_CACHE_OPTIONS)),
@@ -1259,6 +1287,7 @@ exports.CacheService = __decorateClass([
   __decorateParam(4, common.Optional()),
   __decorateParam(4, common.Inject(exports.ScriptManagerService))
 ], exports.CacheService);
+var _subscriber;
 exports.PubSubService = class PubSubService {
   /**
    * @param options - Resolved module options. Supplies the serializer.
@@ -1276,7 +1305,13 @@ exports.PubSubService = class PubSubService {
     this.keyBuilder = keyBuilder;
     this.events = events;
     /** Lazily-created dedicated subscriber connection (null until first subscribe). */
-    this.subscriber = null;
+    /**
+     * The dedicated subscriber connection.
+     *
+     * Private for the same reason as the manager's client: an ioredis instance
+     * carries `options.password` as a plain field.
+     */
+    __privateAdd(this, _subscriber, null);
     /** Live-listener ref-count per namespaced channel; UNSUBSCRIBE fires on the last. */
     this.channelRefs = /* @__PURE__ */ new Map();
     /** Live-listener ref-count per namespaced pattern; PUNSUBSCRIBE fires on the last. */
@@ -1379,11 +1414,11 @@ exports.PubSubService = class PubSubService {
   }
   /** Closes the subscriber connection gracefully, forcing disconnect on failure. */
   async onModuleDestroy() {
-    if (!this.subscriber) {
+    if (!__privateGet(this, _subscriber)) {
       return;
     }
-    const subscriber = this.subscriber;
-    this.subscriber = null;
+    const subscriber = __privateGet(this, _subscriber);
+    __privateSet(this, _subscriber, null);
     try {
       await subscriber.quit();
     } catch {
@@ -1401,10 +1436,10 @@ exports.PubSubService = class PubSubService {
    * experimental passthrough per the spec).
    */
   ensureSubscriber() {
-    if (!this.subscriber) {
-      this.subscriber = this.connection.createSubscriberClient();
+    if (!__privateGet(this, _subscriber)) {
+      __privateSet(this, _subscriber, this.connection.createSubscriberClient());
     }
-    return this.subscriber;
+    return __privateGet(this, _subscriber);
   }
   /**
    * Subscribes the target (channel or pattern) only when it gains its FIRST
@@ -1483,6 +1518,7 @@ exports.PubSubService = class PubSubService {
     }
   }
 };
+_subscriber = new WeakMap();
 exports.PubSubService = __decorateClass([
   common.Injectable(),
   __decorateParam(0, common.Inject(BYMAX_CACHE_OPTIONS)),

package/dist/server/index.d.cts

@@ -356,10 +356,9 @@ type ResolvedOptions = Required<Pick<BymaxCacheModuleOptions, 'mode' | 'namespac
 /** The two client flavors this manager can produce. */
 type AnyRedis = Redis | Cluster;
 declare class ConnectionManager implements OnModuleInit, OnModuleDestroy {
+    #private;
     private readonly options;
     private readonly events?;
-    private client;
-    private readonly redisOptionsResolved;
     /** Default backoff: grow 50 ms per attempt, capped at 2 s. */
     private readonly defaultRetryStrategy;
     /** Default reconnect policy: reconnect only on a `READONLY` replica failover. */
@@ -991,11 +990,10 @@ type IPubSubPatternHandler<T> = (message: T, channel: string, pattern: string) =
 /** Detaches a subscription's listener and unsubscribes its channel/pattern. */
 type Unsubscribe = () => Promise<void>;
 declare class PubSubService implements OnModuleDestroy {
+    #private;
     private readonly connection;
     private readonly keyBuilder;
     private readonly events?;
-    /** Lazily-created dedicated subscriber connection (null until first subscribe). */
-    private subscriber;
     /** Live-listener ref-count per namespaced channel; UNSUBSCRIBE fires on the last. */
     private readonly channelRefs;
     /** Live-listener ref-count per namespaced pattern; PUNSUBSCRIBE fires on the last. */

package/dist/server/index.d.ts

@@ -356,10 +356,9 @@ type ResolvedOptions = Required<Pick<BymaxCacheModuleOptions, 'mode' | 'namespac
 /** The two client flavors this manager can produce. */
 type AnyRedis = Redis | Cluster;
 declare class ConnectionManager implements OnModuleInit, OnModuleDestroy {
+    #private;
     private readonly options;
     private readonly events?;
-    private client;
-    private readonly redisOptionsResolved;
     /** Default backoff: grow 50 ms per attempt, capped at 2 s. */
     private readonly defaultRetryStrategy;
     /** Default reconnect policy: reconnect only on a `READONLY` replica failover. */
@@ -991,11 +990,10 @@ type IPubSubPatternHandler<T> = (message: T, channel: string, pattern: string) =
 /** Detaches a subscription's listener and unsubscribes its channel/pattern. */
 type Unsubscribe = () => Promise<void>;
 declare class PubSubService implements OnModuleDestroy {
+    #private;
     private readonly connection;
     private readonly keyBuilder;
     private readonly events?;
-    /** Lazily-created dedicated subscriber connection (null until first subscribe). */
-    private subscriber;
     /** Live-listener ref-count per namespaced channel; UNSUBSCRIBE fires on the last. */
     private readonly channelRefs;
     /** Live-listener ref-count per namespaced pattern; PUNSUBSCRIBE fires on the last. */

package/dist/server/index.mjs

@@ -2,6 +2,9 @@ import { ConfigurableModuleBuilder, HttpStatus, Injectable, Inject, Optional, Mo
 import { Redis, Cluster } from 'ioredis';
 
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __typeError = (msg) => {
+  throw TypeError(msg);
+};
 var __decorateClass = (decorators, target, key, kind) => {
   var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc(target, key) : target;
   for (var i = decorators.length - 1, decorator; i >= 0; i--)
@@ -10,6 +13,10 @@ var __decorateClass = (decorators, target, key, kind) => {
   return result;
 };
 var __decorateParam = (index, decorator) => (target, key) => decorator(target, key, index);
+var __accessCheck = (obj, member, msg) => member.has(obj) || __typeError("Cannot " + msg);
+var __privateGet = (obj, member, getter) => (__accessCheck(obj, member, "read from private field"), getter ? getter.call(obj) : member.get(obj));
+var __privateAdd = (obj, member, value) => member.has(obj) ? __typeError("Cannot add the same private member more than once") : member instanceof WeakSet ? member.add(obj) : member.set(obj, value);
+var __privateSet = (obj, member, value, setter) => (__accessCheck(obj, member, "write to private field"), member.set(obj, value), value);
 
 // src/server/bymax-cache.constants.ts
 var BYMAX_CACHE_OPTIONS = /* @__PURE__ */ Symbol("BYMAX_CACHE_OPTIONS");
@@ -213,8 +220,17 @@ function applyDefaults(options) {
     isGlobal: options.isGlobal ?? true,
     scripts: options.scripts
   };
+  for (const key of ["connection", "sentinel", "cluster"]) {
+    const value = Object.getOwnPropertyDescriptor(resolved, key)?.value;
+    Object.defineProperty(resolved, key, {
+      get: () => value,
+      enumerable: false,
+      configurable: false
+    });
+  }
   return Object.freeze(resolved);
 }
+var _client, _redisOptionsResolved;
 var ConnectionManager = class {
   /**
    * @param options - Resolved module options (frozen).
@@ -224,19 +240,29 @@ var ConnectionManager = class {
   constructor(options, events) {
     this.options = options;
     this.events = events;
-    this.client = null;
+    /**
+     * The live Redis client.
+     *
+     * An ECMAScript private field rather than a TypeScript `private` one, which is
+     * erased at runtime: an ioredis instance carries `options.password` as a plain
+     * field, so leaving it enumerable puts the credentials one `JSON.stringify`
+     * away from any service that holds this manager.
+     */
+    __privateAdd(this, _client, null);
+    /** The driver options built from the connection config; they carry the password. */
+    __privateAdd(this, _redisOptionsResolved);
     /** Default backoff: grow 50 ms per attempt, capped at 2 s. */
     this.defaultRetryStrategy = (times) => Math.min(times * DEFAULT_RETRY_BASE_MS, DEFAULT_RETRY_MAX_MS);
     /** Default reconnect policy: reconnect only on a `READONLY` replica failover. */
     this.defaultReconnectOnError = (err) => err.message.includes("READONLY");
-    this.redisOptionsResolved = this.buildRedisOptions(options);
+    __privateSet(this, _redisOptionsResolved, this.buildRedisOptions(options));
   }
   /** Opens the main client and waits for readiness unless `lazyConnect`. */
   async onModuleInit() {
-    this.client = this.createClient();
-    this.registerListeners(this.client, "main");
+    __privateSet(this, _client, this.createClient());
+    this.registerListeners(__privateGet(this, _client), "main");
     if (!this.options.connection?.lazyConnect) {
-      await this.waitUntilReady(this.client);
+      await this.waitUntilReady(__privateGet(this, _client));
     }
   }
   /**
@@ -246,11 +272,11 @@ var ConnectionManager = class {
    * @returns The shared main client.
    */
   getClient() {
-    if (!this.client) {
-      this.client = this.createClient();
-      this.registerListeners(this.client, "main");
+    if (!__privateGet(this, _client)) {
+      __privateSet(this, _client, this.createClient());
+      this.registerListeners(__privateGet(this, _client), "main");
     }
-    return this.client;
+    return __privateGet(this, _client);
   }
   /**
    * Creates a brand-new dedicated connection for subscriber mode (a subscriber
@@ -276,7 +302,7 @@ var ConnectionManager = class {
   }
   /** Quits the main client gracefully, forcing `disconnect()` on timeout. */
   async onModuleDestroy() {
-    const client = this.client;
+    const client = __privateGet(this, _client);
     if (!client) {
       return;
     }
@@ -304,7 +330,7 @@ var ConnectionManager = class {
       client.disconnect();
     } finally {
       clearTimeout(timer);
-      this.client = null;
+      __privateSet(this, _client, null);
     }
   }
   // ─── Private ──────────────────────────────────────────────────────────────
@@ -322,7 +348,7 @@ var ConnectionManager = class {
         throw new CacheException(CACHE_ERROR_CODES.SENTINEL_MISCONFIGURED, { mode: "sentinel" });
       }
       return new Redis({
-        ...this.redisOptionsResolved,
+        ...__privateGet(this, _redisOptionsResolved),
         ...overrides,
         sentinels: sentinel.sentinels,
         name: sentinel.name,
@@ -345,7 +371,7 @@ var ConnectionManager = class {
       }
       return new Cluster(cluster.nodes, cluster.options ?? {});
     }
-    return new Redis({ ...this.redisOptionsResolved, ...overrides });
+    return new Redis({ ...__privateGet(this, _redisOptionsResolved), ...overrides });
   }
   /** Merges connection options with defaults; URL fields take precedence. */
   buildRedisOptions(opts) {
@@ -411,6 +437,8 @@ var ConnectionManager = class {
     });
   }
 };
+_client = new WeakMap();
+_redisOptionsResolved = new WeakMap();
 ConnectionManager = __decorateClass([
   Injectable(),
   __decorateParam(0, Inject(BYMAX_CACHE_OPTIONS)),
@@ -1257,6 +1285,7 @@ CacheService = __decorateClass([
   __decorateParam(4, Optional()),
   __decorateParam(4, Inject(ScriptManagerService))
 ], CacheService);
+var _subscriber;
 var PubSubService = class {
   /**
    * @param options - Resolved module options. Supplies the serializer.
@@ -1274,7 +1303,13 @@ var PubSubService = class {
     this.keyBuilder = keyBuilder;
     this.events = events;
     /** Lazily-created dedicated subscriber connection (null until first subscribe). */
-    this.subscriber = null;
+    /**
+     * The dedicated subscriber connection.
+     *
+     * Private for the same reason as the manager's client: an ioredis instance
+     * carries `options.password` as a plain field.
+     */
+    __privateAdd(this, _subscriber, null);
     /** Live-listener ref-count per namespaced channel; UNSUBSCRIBE fires on the last. */
     this.channelRefs = /* @__PURE__ */ new Map();
     /** Live-listener ref-count per namespaced pattern; PUNSUBSCRIBE fires on the last. */
@@ -1377,11 +1412,11 @@ var PubSubService = class {
   }
   /** Closes the subscriber connection gracefully, forcing disconnect on failure. */
   async onModuleDestroy() {
-    if (!this.subscriber) {
+    if (!__privateGet(this, _subscriber)) {
       return;
     }
-    const subscriber = this.subscriber;
-    this.subscriber = null;
+    const subscriber = __privateGet(this, _subscriber);
+    __privateSet(this, _subscriber, null);
     try {
       await subscriber.quit();
     } catch {
@@ -1399,10 +1434,10 @@ var PubSubService = class {
    * experimental passthrough per the spec).
    */
   ensureSubscriber() {
-    if (!this.subscriber) {
-      this.subscriber = this.connection.createSubscriberClient();
+    if (!__privateGet(this, _subscriber)) {
+      __privateSet(this, _subscriber, this.connection.createSubscriberClient());
     }
-    return this.subscriber;
+    return __privateGet(this, _subscriber);
   }
   /**
    * Subscribes the target (channel or pattern) only when it gains its FIRST
@@ -1481,6 +1516,7 @@ var PubSubService = class {
     }
   }
 };
+_subscriber = new WeakMap();
 PubSubService = __decorateClass([
   Injectable(),
   __decorateParam(0, Inject(BYMAX_CACHE_OPTIONS)),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bymax-one/nest-cache",
-  "version": "1.0.2",
+  "version": "1.0.4",
   "description": "Typed Redis cache for NestJS based on ioredis 5, with namespace strategy, Pub/Sub and Lua script management.",
   "author": "Bymax One <support@bymax.one>",
   "license": "MIT",
@@ -53,6 +53,29 @@
       ]
     }
   },
+  "scripts": {
+    "build": "pnpm clean && tsup",
+    "check:exports": "attw --pack .",
+    "check:published": "node scripts/check-published-surface.mjs",
+    "clean": "rm -rf dist coverage",
+    "lint": "eslint src scripts",
+    "lint:fix": "eslint src scripts --fix",
+    "mutation": "stryker run",
+    "mutation:dry-run": "stryker run --dryRunOnly",
+    "mutation:incremental": "stryker run --incremental",
+    "prepare": "husky",
+    "prepublishOnly": "pnpm clean && pnpm typecheck && pnpm test:types && pnpm lint && pnpm test:cov:all && pnpm build && pnpm check:published",
+    "release": "npm publish --provenance --access public",
+    "size": "node scripts/check-size.mjs",
+    "test": "jest",
+    "test:all": "pnpm test && pnpm test:e2e",
+    "test:cov": "jest --coverage",
+    "test:cov:all": "jest --config jest.coverage.config.ts --coverage",
+    "test:e2e": "jest --config jest.e2e.config.ts --runInBand",
+    "test:types": "tsc --noEmit -p tsconfig.typetest.json",
+    "test:watch": "jest --watch",
+    "typecheck": "tsc --noEmit && tsc --noEmit -p tsconfig.server.json"
+  },
   "lint-staged": {
     "*.{ts,tsx,js,mjs,cjs}": [
       "eslint --fix",
@@ -64,8 +87,8 @@
   },
   "dependencies": {},
   "peerDependencies": {
-    "@nestjs/common": "^11.0.0",
-    "@nestjs/core": "^11.0.0",
+    "@nestjs/common": "^11.0.16",
+    "@nestjs/core": "^11.1.18",
     "ioredis": "^5.0.0",
     "reflect-metadata": "^0.2.0"
   },
@@ -116,6 +139,7 @@
     "pubsub",
     "lua"
   ],
+  "packageManager": "pnpm@10.8.1",
   "engines": {
     "node": ">=24.0.0"
   },
@@ -123,24 +147,18 @@
     "access": "public",
     "registry": "https://registry.npmjs.org/"
   },
-  "scripts": {
-    "build": "pnpm clean && tsup",
-    "lint": "eslint src scripts",
-    "lint:fix": "eslint src scripts --fix",
-    "test": "jest",
-    "test:cov": "jest --coverage",
-    "test:watch": "jest --watch",
-    "test:e2e": "jest --config jest.e2e.config.ts --runInBand",
-    "test:all": "pnpm test && pnpm test:e2e",
-    "test:cov:all": "jest --config jest.coverage.config.ts --coverage",
-    "mutation": "stryker run",
-    "mutation:incremental": "stryker run --incremental",
-    "mutation:dry-run": "stryker run --dryRunOnly",
-    "typecheck": "tsc --noEmit && tsc --noEmit -p tsconfig.server.json",
-    "test:types": "tsc --noEmit -p tsconfig.typetest.json",
-    "size": "node scripts/check-size.mjs",
-    "check:exports": "attw --pack .",
-    "clean": "rm -rf dist coverage",
-    "release": "pnpm publish --provenance"
+  "pnpm": {
+    "overrides": {
+      "brace-expansion@1": "^1.1.18",
+      "brace-expansion@2": "^2.1.4",
+      "brace-expansion@5": "^5.0.9",
+      "esbuild": "^0.28.1",
+      "fast-uri": "^3.1.5",
+      "js-yaml@3": "^3.15.0",
+      "js-yaml@4": "^4.3.0",
+      "protobufjs": "^7.6.5",
+      "qs": "^6.15.2",
+      "undici": "^7.28.0"
+    }
   }
-}
+}