@bymax-one/nest-queue 1.0.1 → 1.0.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +31 -0
- package/README.md +5 -5
- package/package.json +3 -3
package/CHANGELOG.md
CHANGED
|
@@ -7,6 +7,36 @@ versioning follows [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
|
|
|
7
7
|
|
|
8
8
|
---
|
|
9
9
|
|
|
10
|
+
## [1.0.2] — 2026-07-30
|
|
11
|
+
|
|
12
|
+
### Security
|
|
13
|
+
|
|
14
|
+
- **Peer floors raised to exclude known-vulnerable NestJS versions.** The declared
|
|
15
|
+
ranges were `@nestjs/common ^11.0.0` and `@nestjs/core ^11.0.0`, and both
|
|
16
|
+
admitted versions with published advisories:
|
|
17
|
+
|
|
18
|
+
| Peer | Advisory | Vulnerable | New floor |
|
|
19
|
+
| ---------------- | ------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------- | ---------- |
|
|
20
|
+
| `@nestjs/common` | [GHSA-cj7v-w2c7-cp7c](https://github.com/advisories/GHSA-cj7v-w2c7-cp7c) — remote code execution via the `Content-Type` header | `>= 11.0.0-next.1, < 11.0.16` | `^11.0.16` |
|
|
21
|
+
| `@nestjs/core` | [GHSA-36xv-jgw5-4q75](https://github.com/advisories/GHSA-36xv-jgw5-4q75) — improper neutralization of special elements in downstream output | `<= 11.1.17` | `^11.1.18` |
|
|
22
|
+
|
|
23
|
+
A peer range is a statement about which versions this library supports. Leaving
|
|
24
|
+
the floor below a published advisory tells a consumer that a vulnerable install
|
|
25
|
+
is a supported one, and nothing in their tooling contradicts it.
|
|
26
|
+
|
|
27
|
+
Shipped as a **patch**, which is where a security fix belongs. Choosing a minor
|
|
28
|
+
would have bought nothing: `^1.0.1` — what a consumer almost always declares —
|
|
29
|
+
accepts `1.1.0` just as readily as `1.0.2`, so the same installs are affected
|
|
30
|
+
either way. Only a major would hold it back, and holding a security floor behind
|
|
31
|
+
a major migration is the opposite of what it is for.
|
|
32
|
+
|
|
33
|
+
No runtime behaviour changed, and the repository's own dev dependencies were
|
|
34
|
+
already above both floors. A consumer below them sees a peer warning telling
|
|
35
|
+
them to upgrade off a version with a published RCE advisory — which is the
|
|
36
|
+
intended outcome, not collateral damage.
|
|
37
|
+
|
|
38
|
+
---
|
|
39
|
+
|
|
10
40
|
## [1.0.1] — 2026-07-30
|
|
11
41
|
|
|
12
42
|
First release published by CI, and therefore the first carrying an npm provenance
|
|
@@ -146,5 +176,6 @@ v6 peer range.
|
|
|
146
176
|
|
|
147
177
|
---
|
|
148
178
|
|
|
179
|
+
[1.0.2]: https://github.com/bymaxone/nest-queue/releases/tag/v1.0.2
|
|
149
180
|
[1.0.1]: https://github.com/bymaxone/nest-queue/releases/tag/v1.0.1
|
|
150
181
|
[1.0.0]: https://github.com/bymaxone/nest-queue/releases/tag/v1.0.0
|
package/README.md
CHANGED
|
@@ -114,11 +114,11 @@ Both subpaths ship ESM **and** CommonJS with declarations for each format, so a
|
|
|
114
114
|
|
|
115
115
|
### Peer dependency matrix
|
|
116
116
|
|
|
117
|
-
| Subpath | Required peers
|
|
118
|
-
| ------------ |
|
|
119
|
-
| `.` (server) | `@nestjs/common ^11`, `@nestjs/core ^11`, `bullmq ^5.16`, `ioredis ^5`, `reflect-metadata ^0.2` |
|
|
120
|
-
| `./shared` | None
|
|
121
|
-
| Optional | `bullmq-otel ^1` (OpenTelemetry)
|
|
117
|
+
| Subpath | Required peers |
|
|
118
|
+
| ------------ | --------------------------------------------------------------------------------------------------------- |
|
|
119
|
+
| `.` (server) | `@nestjs/common ^11.0.16`, `@nestjs/core ^11.1.18`, `bullmq ^5.16`, `ioredis ^5`, `reflect-metadata ^0.2` |
|
|
120
|
+
| `./shared` | None |
|
|
121
|
+
| Optional | `bullmq-otel ^1` (OpenTelemetry) |
|
|
122
122
|
|
|
123
123
|
---
|
|
124
124
|
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@bymax-one/nest-queue",
|
|
3
|
-
"version": "1.0.
|
|
3
|
+
"version": "1.0.2",
|
|
4
4
|
"description": "NestJS dynamic module wrapping BullMQ — typed jobs, flows, job schedulers, deduplication, OpenTelemetry, graceful shutdown",
|
|
5
5
|
"author": "Bymax One <support@bymax.one>",
|
|
6
6
|
"license": "MIT",
|
|
@@ -55,8 +55,8 @@
|
|
|
55
55
|
},
|
|
56
56
|
"dependencies": {},
|
|
57
57
|
"peerDependencies": {
|
|
58
|
-
"@nestjs/common": "^11.0.
|
|
59
|
-
"@nestjs/core": "^11.
|
|
58
|
+
"@nestjs/common": "^11.0.16",
|
|
59
|
+
"@nestjs/core": "^11.1.18",
|
|
60
60
|
"bullmq": "^5.16.0",
|
|
61
61
|
"bullmq-otel": "^1.0.0",
|
|
62
62
|
"ioredis": "^5.0.0",
|