@bymax-one/nest-logger 1.0.4 → 1.0.5

package/CHANGELOG.md

@@ -11,6 +11,71 @@ heading here.
 
 ## [Unreleased]
 
+## [1.0.5] - 2026-07-30
+
+### Security
+
+- **Peer floors raised to exclude known-vulnerable NestJS versions.** `@nestjs/common ^11.0.0`
+  admitted 11.0.0–11.0.15, carrying [GHSA-cj7v-w2c7-cp7c](https://github.com/advisories/GHSA-cj7v-w2c7-cp7c)
+  (remote code execution via the `Content-Type` header, patched in 11.0.16), and
+  `@nestjs/core ^11.0.0` admitted everything up to 11.1.17, carrying
+  [GHSA-36xv-jgw5-4q75](https://github.com/advisories/GHSA-36xv-jgw5-4q75) (patched in 11.1.18).
+
+  A peer range states which versions this library supports. A floor below a published
+  advisory told a consumer a vulnerable install was supported, and nothing in their
+  tooling contradicted it — the install resolved cleanly and silently. Floors are now
+  `^11.0.16` and `^11.1.18`.
+
+  Shipped as a patch, which is where a security fix belongs; a minor would reach the
+  same installs anyway, since `^1.0.4` accepts `1.1.0` as readily as `1.0.5`. No
+  runtime behaviour changed.
+
+### Fixed
+
+- **The custom-destination examples did not compile against `ILogDestination`.**
+  The published interface takes a serialized line:
+
+  ```ts
+  write(payload: string): void | Promise<void>   // newline-terminated JSON, UTF-8
+  ```
+
+  All three examples in the README — `LokiDestination`, `PrismaLogDestination`,
+  `RollingFileDestination` — and the API reference table declared
+  `write(entry: LogEntry): void`, so anyone following the README to build a
+  destination got:
+
+  ```
+  TS2416: Property 'write' in type 'LokiDestination' is not assignable to the
+          same property in base type 'ILogDestination'.
+  ```
+
+  `ILogDestination` is this library's extension point, so the documentation was
+  teaching the wrong shape for the one thing consumers are meant to implement.
+  `RollingFileDestination` compounded it by re-serializing a payload that already
+  **is** newline-terminated JSON — anyone casting past the type error would have
+  written double-encoded lines to disk.
+
+  Each example now does what its own job requires rather than all three doing the
+  same thing: Loki buffers the line verbatim, Prisma parses because it stores
+  individual columns, rolling-file writes it through untouched.
+
+- **The request-id middleware typed `req` as the global DOM `Request`**, whose
+  `headers` is a `Headers` instance and cannot be indexed (`TS7052`). `1.0.4`
+  introduced `LoggableRequest` and `LoggableResponse` for exactly this and exports
+  them; the README never adopted them. It does now, and narrows the
+  `string | string[]` a repeated header produces.
+
+### Added
+
+- **`pnpm check:published`** — verifies that the README's links resolve, that its
+  TypeScript snippets and the type tests compile against the built package, and
+  that every `v*.*.*` tag has a `## [x.y.z]` CHANGELOG section. It resolves the
+  package through its `exports` map into `dist/`, which `test:types` cannot do:
+  that one maps the package to `./src` through tsconfig `paths` and so never
+  compiles what the README claims. Both defects above were found by it.
+
+  Runs in CI, in `release.yml`, and inside `prepublishOnly`.
+
 ## [1.0.4] - 2026-07-29
 
 ### Fixed
@@ -187,7 +252,8 @@ published `dist/` is identical — no runtime behaviour changes for consumers.
 - Professional CI suite: `ci.yml`, `bench.yml`, `codeql.yml`, `scorecard.yml`,
   `release.yml`, Dependabot, and issue templates
 
-[Unreleased]: https://github.com/bymaxone/nest-logger/compare/v1.0.4...HEAD
+[Unreleased]: https://github.com/bymaxone/nest-logger/compare/v1.0.5...HEAD
+[1.0.5]: https://github.com/bymaxone/nest-logger/compare/v1.0.4...v1.0.5
 [1.0.4]: https://github.com/bymaxone/nest-logger/compare/v1.0.3...v1.0.4
 [1.0.3]: https://github.com/bymaxone/nest-logger/compare/v1.0.2...v1.0.3
 [1.0.2]: https://github.com/bymaxone/nest-logger/compare/v1.0.1...v1.0.2

package/README.md

@@ -337,15 +337,21 @@ Once active, every log entry automatically carries `traceId`, `spanId`, and `tra
 ```typescript
 // request-id.middleware.ts
 import { Injectable, NestMiddleware } from '@nestjs/common'
-import { LogContextService } from '@bymax-one/nest-logger'
+import {
+  LogContextService,
+  type LoggableRequest,
+  type LoggableResponse
+} from '@bymax-one/nest-logger'
 import { randomUUID } from 'node:crypto'
 
 @Injectable()
 export class RequestIdMiddleware implements NestMiddleware {
   constructor(private readonly logContext: LogContextService) {}
 
-  use(req: Request, res: Response, next: () => void) {
-    const requestId = req.headers['x-request-id'] ?? `r_${randomUUID()}`
+  use(req: LoggableRequest, res: LoggableResponse, next: () => void) {
+    // A header can arrive repeated, so its type is `string | string[]`.
+    const raw = req.headers['x-request-id']
+    const requestId = (Array.isArray(raw) ? raw[0] : raw) ?? `r_${randomUUID()}`
     this.logContext.run({ requestId }, next)
   }
 }
@@ -439,7 +445,8 @@ export class LokiDestination implements ILogDestination {
   private readonly url: string
   private readonly headers: Record<string, string>
   private readonly labels: Record<string, string>
-  private buffer: LogEntry[] = []
+  // Serialized lines, not objects — `write` receives the payload already encoded.
+  private buffer: string[] = []
   private flushTimer?: NodeJS.Timeout
 
   constructor(opts: {
@@ -466,8 +473,10 @@ export class LokiDestination implements ILogDestination {
     await this.flush()
   }
 
-  write(entry: LogEntry): void {
-    this.buffer.push(entry)
+  // `payload` already IS the serialized entry, newline-terminated. Buffer it as
+  // it arrives; parse only where a field is genuinely needed, as `flush` does.
+  write(payload: string): void {
+    this.buffer.push(payload)
     if (this.buffer.length >= 100) void this.flush()
   }
 
@@ -478,7 +487,10 @@ export class LokiDestination implements ILogDestination {
       streams: [
         {
           stream: this.labels,
-          values: batch.map((e) => [String(BigInt(e.time) * 1_000_000n), JSON.stringify(e)])
+          values: batch.map((line) => [
+            String(BigInt((JSON.parse(line) as LogEntry).time) * 1_000_000n),
+            line.trimEnd()
+          ])
         }
       ]
     })
@@ -520,7 +532,10 @@ export class PrismaLogDestination implements ILogDestination {
 
   constructor(private readonly prisma: PrismaClient) {}
 
-  write(entry: LogEntry): void {
+  write(payload: string): void {
+    // This destination stores individual columns, so it is one of the few that
+    // has to parse. A sink that forwards the line verbatim should not.
+    const entry = JSON.parse(payload) as LogEntry
     void this.prisma.applicationLog.create({
       data: {
         level: entry.level,
@@ -557,8 +572,9 @@ export class RollingFileDestination implements ILogDestination {
     await new Promise<void>((resolve) => this.stream?.end(resolve))
   }
 
-  write(entry: LogEntry): void {
-    this.stream?.write(JSON.stringify(entry) + '\n')
+  write(payload: string): void {
+    // Already newline-terminated JSON — re-serializing would double-encode it.
+    this.stream?.write(payload)
   }
 }
 ```
@@ -806,7 +822,8 @@ type LogEntry = {
 interface ILogDestination {
   readonly name: string
   readonly minLevel?: LogLevel
-  write(entry: LogEntry): void
+  /** `payload` is a newline-terminated JSON entry, UTF-8 encoded — not an object. */
+  write(payload: string): void | Promise<void>
   onInit?(): Promise<void>
   onShutdown?(): Promise<void>
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bymax-one/nest-logger",
-  "version": "1.0.4",
+  "version": "1.0.5",
   "description": "Structured JSON logging for NestJS based on Pino 10, with optional OpenTelemetry correlation.",
   "author": "Bymax One <support@bymax.one>",
   "license": "MIT",
@@ -64,8 +64,8 @@
   },
   "dependencies": {},
   "peerDependencies": {
-    "@nestjs/common": "^11.0.0",
-    "@nestjs/core": "^11.0.0",
+    "@nestjs/common": "^11.0.16",
+    "@nestjs/core": "^11.1.18",
     "@opentelemetry/api": "^1.9.0",
     "pino": "^10.0.0",
     "pino-pretty": "^13.0.0",
@@ -142,23 +142,24 @@
     "registry": "https://registry.npmjs.org/"
   },
   "scripts": {
+    "bench": "node --expose-gc --import tsx bench/throughput.bench.ts",
     "build": "pnpm clean && tsup",
+    "check:exports": "attw --pack .",
+    "check:published": "node scripts/check-published-surface.mjs",
+    "clean": "rm -rf dist coverage",
     "lint": "eslint src",
     "lint:fix": "eslint src --fix",
-    "test": "jest",
-    "test:cov": "jest --coverage",
-    "test:watch": "jest --watch",
-    "test:e2e": "jest --config jest.e2e.config.ts",
-    "test:all": "pnpm test && pnpm test:e2e",
-    "test:cov:all": "jest --config jest.coverage.config.ts --coverage",
     "mutation": "stryker run",
-    "mutation:incremental": "stryker run --incremental",
     "mutation:dry-run": "stryker run --dryRunOnly",
-    "bench": "node --expose-gc --import tsx bench/throughput.bench.ts",
-    "typecheck": "tsc --noEmit && tsc --noEmit -p tsconfig.server.json",
+    "mutation:incremental": "stryker run --incremental",
+    "release": "pnpm publish --provenance",
     "size": "node scripts/check-size.mjs",
-    "check:exports": "attw --pack .",
-    "clean": "rm -rf dist coverage",
-    "release": "pnpm publish --provenance"
+    "test": "jest",
+    "test:all": "pnpm test && pnpm test:e2e",
+    "test:cov": "jest --coverage",
+    "test:cov:all": "jest --config jest.coverage.config.ts --coverage",
+    "test:e2e": "jest --config jest.e2e.config.ts",
+    "test:watch": "jest --watch",
+    "typecheck": "tsc --noEmit && tsc --noEmit -p tsconfig.server.json"
   }
 }