@bymax-one/nest-core 1.6.7 → 1.6.8

package/CHANGELOG.md

@@ -11,6 +11,88 @@ heading here.
 
 ## [Unreleased]
 
+## [1.6.8] - 2026-11-13
+
+A patch release. Readiness stops amplifying probe traffic, stops serving what an indicator returned,
+and answers not ready once shutdown begins; invalid timing options now fail the boot; the README is
+corrected.
+
+**Apply to a derived backend:** `pnpm up @bymax-one/nest-core`, then:
+
+- If you call `applyHttpFloors` after `app.init()`, move the call before it: it now throws there
+  instead of applying only the timeouts.
+- By default readiness answers can be up to one second old. Set `health.readinessCacheMs: 0` to keep every
+  probe fresh; probes that overlap still share one run.
+- Readiness no longer serves the `details` an indicator returns. If a dashboard or probe reads
+  them, set `health.exposeIndicatorErrors: true` (development only) or move that data to the logger
+  or a protected endpoint.
+- Call `app.enableShutdownHooks()` if a `SIGTERM` should flip readiness to `503`; `app.close()`
+  always does.
+- `health.indicatorTimeoutMs` and `timing.slowRequestThresholdMs` must be positive integers, and the
+  timeout at most `2147483647`, or the boot fails. A zero or negative value was accepted before and
+  misbehaved silently; a fractional one was accepted too, and now has to be rounded.
+- An indicator that can cancel its query should pass on the `signal` its `check()` now receives.
+
+### Security
+
+- **Readiness no longer fans out one run per probe.** `GET /<health.path>/ready` is usually
+  reachable without credentials, and every probe ran every indicator: 200 concurrent probes made
+  200 database and cache calls at once, and a check that timed out kept running. Probes that arrive
+  while a run is in progress now share it, a finished answer is reused for
+  `health.readinessCacheMs` (default `1000`, `0` turns it off, and the window is timed on a
+  monotonic clock), and the signal passed to `check()` is aborted at the timeout. A run that throws is
+  never cached.
+- **Readiness no longer serves what an indicator returned.** An indicator's `details` were served
+  verbatim even with `health.exposeIndicatorErrors` off. Each check now carries only its `name` and
+  `status`; the timeout the aggregator itself reports is unchanged.
+
+### Added
+
+- **`health.readinessCacheMs`** and an optional `AbortSignal` argument to `IHealthIndicator.check()`.
+  Existing indicators compile unchanged.
+
+### Fixed
+
+- **`bodyDepth` no longer expands a raw body.** A `Buffer` or typed array (a body read with
+  `express.raw()` or `useBodyParser('raw')`) was walked with `Object.values`, which builds one element
+  per byte: a 40 MB body stalled the event loop for about 0.7 s and grew the process by over 1 GB,
+  with no credential needed. The walk now descends only into arrays and plain objects, so a Buffer, a typed
+  array, a `Map` or a class instance is a leaf.
+- **`applyHttpFloors` refuses an already initialised application.** After `app.init()` Nest's own
+  parsers and the routes sit ahead of anything the helper mounts, so only the timeouts took effect
+  while the call returned normally: a gzip body was no longer refused with `415` and no
+  security headers were sent. It now throws "must run before app.init()", as it already did for a listening server.
+- **Readiness answers not ready as soon as shutdown begins.** It kept returning the last healthy
+  answer while the process drained, so a load balancer kept routing to it. From
+  `beforeApplicationShutdown` it answers `503` with a `shutdown` check `down`, before it reads the
+  cache or a run in progress and without running an indicator. Liveness is unchanged.
+- **`health.indicatorTimeoutMs` and `timing.slowRequestThresholdMs` are validated.** A zero made
+  every indicator report down with a timeout, or every request slow; `NaN` flagged none. A timeout
+  above `2147483647` was clamped by Node to one millisecond and did the same. Each now fails the
+  boot, naming the option.
+
+### Documentation
+
+- **The README states two limits of `applyHttpFloors`.** Only the JSON and urlencoded parsers refuse
+  a compressed body, so a raw or text parser you add still decompresses; and
+  `strictTransportSecurity: undefined` turns helmet's HSTS default back on.
+- **The README says to raise `keepAliveTimeout` behind a load balancer.** It must exceed the
+  balancer's idle timeout, or the balancer reuses a connection Node has closed and answers an
+  intermittent `502`. On Node 24 a shorter `headersTimeout` did not close an idle keep-alive socket,
+  so the two need no particular order.
+- **The README states what `prom-client` leaves behind.** Its default collectors keep an unreferenced
+  garbage-collection observer and event-loop histogram for the life of the process, which matters only
+  to a host that creates many applications in one process.
+
+- **README rewritten for correctness and length.** The mutation threshold, the subpath and optional-peer
+  counts and the Tech Stack now match the code (`./http` and `helmet` included); the do-it-yourself
+  body-depth guide is replaced by the `bodyDepth` option it described; the OpenAPI configuration and
+  its section are merged; history and measurement narration are removed; and the Compatibility
+  section is now "What This Library Does NOT Do". No API or behaviour change.
+- **The README states the `prom-client` position.** npm marks `prom-client` 15.x deprecated in favour of
+  `@prometheus-io/client`; this library stays on `prom-client` `^15` because collectors and the
+  `MetricsRegistry` must come from one package. No API or behaviour change.
+
 ## [1.6.7] - 2026-11-12
 
 A patch release. Two floors that every backend re-implemented move into the library; both are additive
@@ -1366,4 +1448,5 @@ have regressed from. They are kept because the reasoning is worth having.
 [1.6.5]: https://github.com/bymaxone/nest-core/compare/v1.6.4...v1.6.5
 [1.6.6]: https://github.com/bymaxone/nest-core/compare/v1.6.5...v1.6.6
 [1.6.7]: https://github.com/bymaxone/nest-core/compare/v1.6.6...v1.6.7
-[Unreleased]: https://github.com/bymaxone/nest-core/compare/v1.6.7...HEAD
+[1.6.8]: https://github.com/bymaxone/nest-core/compare/v1.6.7...v1.6.8
+[Unreleased]: https://github.com/bymaxone/nest-core/compare/v1.6.8...HEAD