@bymax-one/nest-config 1.2.0 → 1.2.1

package/CHANGELOG.md

@@ -11,6 +11,39 @@ as the GitHub Release body, so each released version needs a matching
 
 ## [Unreleased]
 
+## [1.2.1] - 2026-10-30
+
+### Security
+
+- **The `zod` peer range now starts at `4.6.6`, the first release without
+  GHSA-mrhx-c7xc-m3w5** (high: memory exhaustion while validating oversized constrained
+  collections). The range `^4.0.0` declared installs below it as supported, and the
+  advisory applies to them in an application that validates untrusted collection input
+  through its own schemas. **Apply to a derived backend:** raise `zod` to `4.6.6` or later
+  (`pnpm up zod`); an install below it is outside the declared peer range.
+
+### Documentation
+
+- **Support policy: only the latest minor receives security fixes, and the Discussions
+  link is gone.** `SECURITY.md` supports the latest minor alone; earlier versions get no fix and no
+  backport, and the guidance is to upgrade. The issue-template chooser no longer links to
+  Discussions; the security contact by e-mail remains.
+
+- **`strict` names the two prefixed-variable sources a search will not find.** Both came
+  from an adopter enabling it in a real deployment. A container's own `environment:` block
+  assigns a variable whose host-side name is a different one, so a search over
+  interpolations misses it — and it fails on the default path, because Compose assigns an
+  unset interpolation the empty string rather than absent, and validation skips only
+  `undefined`. Kubernetes service links appear in no file at all: at the default
+  `enableServiceLinks`, a Service named `redis` supplies `REDIS_PORT`,
+  `REDIS_SERVICE_HOST`, `REDIS_SERVICE_PORT` and the `REDIS_PORT_6379_TCP*` family into a
+  closed `redis` namespace — a crash loop in production that never appears in CI.
+
+  The cost of an open namespace is also stated in its sharpest form rather than its
+  general one: the typo it cannot catch may be in that namespace's own declared variable,
+  so `OTEL_ENABLE` is waived, the leaf falls back to its default, and the feature stays
+  off with nothing reported.
+
 ## [1.2.0] - 2026-09-04
 
 ### Added
@@ -49,8 +82,9 @@ as the GitHub Release body, so each released version needs a matching
   (GHSA-5jgf-p345-68v8, GHSA-jqff-g426-hqxp — host confusion; GHSA-f65p-4m7j-42xc,
   GHSA-fph4-wmhf-6fwf — server-side request forgery; CVSS 7.5 each) and `qs`
   (GHSA-4mjr-xmp4-gh2g, GHSA-x5fp-wj9c-mxmx, CVSS 6.3 each). All three are reached through
-  the mutation-testing and commit-tooling chains, none is a runtime dependency, and this
-  package ships `dist` alone — so no consumer resolved a vulnerable version through it.
+  the mutation-testing and commit-tooling chains, none is a runtime dependency, and the
+  package ships only `dist` as runtime code — so no consumer resolved a vulnerable version
+  through it.
 
   Recorded here rather than omitted as internal because a consumer reading an advisory feed
   needs to know whether a library in their tree pulled one in, and "it did not" is an answer
@@ -375,4 +409,5 @@ have regressed from. They are kept because the reasoning is worth having.
 [1.1.2]: https://github.com/bymaxone/nest-config/compare/v1.1.1...v1.1.2
 [1.1.3]: https://github.com/bymaxone/nest-config/compare/v1.1.2...v1.1.3
 [1.2.0]: https://github.com/bymaxone/nest-config/compare/v1.1.3...v1.2.0
-[Unreleased]: https://github.com/bymaxone/nest-config/compare/v1.2.0...HEAD
+[1.2.1]: https://github.com/bymaxone/nest-config/compare/v1.2.0...v1.2.1
+[Unreleased]: https://github.com/bymaxone/nest-config/compare/v1.2.1...HEAD

package/README.md

@@ -125,7 +125,7 @@ pnpm add @bymax-one/nest-config @nestjs/common @nestjs/core reflect-metadata zod
 | `@nestjs/common`   | `^11.0.16` |
 | `@nestjs/core`     | `^11.1.18` |
 | `reflect-metadata` | `^0.2.0`   |
-| `zod`              | `^4.0.0`   |
+| `zod`              | `^4.6.6`   |
 
 ## 🚀 Quick Start
 
@@ -343,11 +343,60 @@ What the waiver does and does not do:
   and `otelExporter` (closed), `OTEL_EXPORTER_TYPO` belongs to `otelExporter`
   and is still reported.
 
+#### Where prefixed variables come from that a sweep will miss
+
+Before enabling `strict`, know that reading your own repository does not enumerate
+what reaches `process.env`. Two sources defeat a migration sweep in different ways
+— one because the search you would naturally run is the wrong one, the other
+because there is nothing to search — and both were found by adopters rather than
+by reading manifests.
+
+**A container's own `environment:` block.** Compose assigns variables to the
+container with no `${...}` on the host side to give them away:
+
+```yaml
+services:
+  app:
+    environment:
+      REDIS_PASSWORD: ${STACK_REDIS_PASSWORD:-}
+```
+
+`REDIS_PASSWORD` lands in the application's environment. A repository-wide search
+for the prefix does find this line — but the search a migration actually reaches
+for is over interpolations, `${REDIS_`, and that one finds nothing, because the
+interpolated name is the _other_ one. The variable the container receives and the
+variable the host supplies are different names on the same line.
+
+This one fails on the default path rather than only when someone opts in, and the
+reason is worth stating: **Compose assigns an unset interpolation the empty string,
+not absent.** Validation skips a variable whose value is `undefined` — an absent
+variable is the schema's business, not strict mode's — and `''` is not `undefined`.
+So the boot fails even when nobody set a password. That is deliberate: a validator
+that ignored empty strings would also ignore a real misconfiguration that sets one.
+
+**Kubernetes service links, which appear in no file at all.** With
+`enableServiceLinks` at its default, a pod receives Docker-link-compatible
+variables for every Service in its namespace. A Service named `redis` supplies
+`REDIS_PORT`, `REDIS_SERVICE_HOST`, `REDIS_SERVICE_PORT` and the
+`REDIS_PORT_6379_TCP*` family — all inside a closed `redis` namespace, none
+declared, none written down anywhere you can search. Under `strict` that is a crash
+loop in production over variables the application never reads, and it will not have
+appeared in CI.
+
+Set `enableServiceLinks: false` on the pod spec, or open the namespace. Managed
+add-ons injecting names like `REDIS_PUBLIC_URL` or `DATABASE_URL_UNPOOLED` are the
+same family.
+
 **The cost, stated plainly:** an open namespace cannot tell a foreign variable
-from a misspelled local one. Under an open `otel`, a typo of `OTEL_ENABLED`
-passes silently and the leaf falls back to its default. No design removes this —
-the two cases are indistinguishable by name — so open the namespaces whose
-prefix genuinely belongs to someone else, and leave the rest closed.
+from a misspelled local one. No design removes this — the two cases are
+indistinguishable by name — so open the namespaces whose prefix genuinely belongs
+to someone else, and leave the rest closed.
+
+The sharpest form of that cost is worth seeing before you accept it. The typo can
+be in the open namespace's **own** declared variable: write `OTEL_ENABLE` instead
+of `OTEL_ENABLED` and it is waived like any other unclaimed name, the leaf falls
+back to its default, and the feature you meant to switch on stays off with nothing
+reported. A closed namespace would have named that variable and refused to boot.
 
 > Filtering the foreign names out of `source` instead is **not** equivalent, and
 > is worse in a way that is easy to miss: removing `OTEL_*` from the source also

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bymax-one/nest-config",
-  "version": "1.2.0",
+  "version": "1.2.1",
   "description": "Typed and validated environment configuration entry point for NestJS 11 applications, built on Zod v4.",
   "author": "Bymax One <support@bymax.one>",
   "license": "MIT",
@@ -91,7 +91,7 @@
     "@nestjs/common": "^11.0.16",
     "@nestjs/core": "^11.1.18",
     "reflect-metadata": "^0.2.0",
-    "zod": "^4.0.0"
+    "zod": "^4.6.6"
   },
   "devDependencies": {
     "@arethetypeswrong/cli": "^0.18.2",
@@ -126,7 +126,7 @@
     "ts-node": "^10.9.2",
     "tsup": "^8.5.1",
     "typescript": "^5.9.3",
-    "zod": "^4.0.0"
+    "zod": "^4.6.7"
   },
   "keywords": [
     "nestjs",