@bymax-one/nest-queue 1.0.1 → 1.0.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (3) hide show
  1. package/CHANGELOG.md +62 -0
  2. package/README.md +14 -10
  3. package/package.json +3 -3
package/CHANGELOG.md CHANGED
@@ -7,6 +7,67 @@ versioning follows [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
7
7
 
8
8
  ---
9
9
 
10
+ ## [1.0.3] — 2026-08-01
11
+
12
+ Documentation only. `dist/` is byte-identical to `1.0.2` — verified by unpacking
13
+ the published tarball and diffing it against a fresh build — so there is no
14
+ runtime change of any kind for consumers.
15
+
16
+ ### Fixed
17
+
18
+ - **The "Example App" link in the README pointed at a path that no longer
19
+ exists.** It resolved to
20
+ `github.com/bymaxone/nest-queue/tree/main/examples/nest-queue-example`, a
21
+ directory that was renamed to `test/consumer-app` in this repository. The link
22
+ returned **404** for anyone reading the package page on npm, which is where a
23
+ README link matters most and where a broken one is least visible to us.
24
+
25
+ It now points at [`bymaxone/nest-queue-example`](https://github.com/bymaxone/nest-queue-example),
26
+ the actual reference application.
27
+
28
+ ### Changed
29
+
30
+ - **The README no longer implies that `test/consumer-app` is a demo.** The two
31
+ artifacts had been sharing one name, and only one of them is something to copy
32
+ from:
33
+
34
+ | | What it is |
35
+ | ------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
36
+ | `bymaxone/nest-queue-example` | The reference application — an API and a web console exercising every public export against a real Redis. **Start here.** |
37
+ | `test/consumer-app` (this repo) | A typecheck fixture. CI compiles it against the freshly built library on every pull request to catch an ergonomic break in the decorator API that a signature test cannot see. Not published, not a demo. |
38
+
39
+ ---
40
+
41
+ ## [1.0.2] — 2026-07-30
42
+
43
+ ### Security
44
+
45
+ - **Peer floors raised to exclude known-vulnerable NestJS versions.** The declared
46
+ ranges were `@nestjs/common ^11.0.0` and `@nestjs/core ^11.0.0`, and both
47
+ admitted versions with published advisories:
48
+
49
+ | Peer | Advisory | Vulnerable | New floor |
50
+ | ---------------- | ------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------- | ---------- |
51
+ | `@nestjs/common` | [GHSA-cj7v-w2c7-cp7c](https://github.com/advisories/GHSA-cj7v-w2c7-cp7c) — remote code execution via the `Content-Type` header | `>= 11.0.0-next.1, < 11.0.16` | `^11.0.16` |
52
+ | `@nestjs/core` | [GHSA-36xv-jgw5-4q75](https://github.com/advisories/GHSA-36xv-jgw5-4q75) — improper neutralization of special elements in downstream output | `<= 11.1.17` | `^11.1.18` |
53
+
54
+ A peer range is a statement about which versions this library supports. Leaving
55
+ the floor below a published advisory tells a consumer that a vulnerable install
56
+ is a supported one, and nothing in their tooling contradicts it.
57
+
58
+ Shipped as a **patch**, which is where a security fix belongs. Choosing a minor
59
+ would have bought nothing: `^1.0.1` — what a consumer almost always declares —
60
+ accepts `1.1.0` just as readily as `1.0.2`, so the same installs are affected
61
+ either way. Only a major would hold it back, and holding a security floor behind
62
+ a major migration is the opposite of what it is for.
63
+
64
+ No runtime behaviour changed, and the repository's own dev dependencies were
65
+ already above both floors. A consumer below them sees a peer warning telling
66
+ them to upgrade off a version with a published RCE advisory — which is the
67
+ intended outcome, not collateral damage.
68
+
69
+ ---
70
+
10
71
  ## [1.0.1] — 2026-07-30
11
72
 
12
73
  First release published by CI, and therefore the first carrying an npm provenance
@@ -146,5 +207,6 @@ v6 peer range.
146
207
 
147
208
  ---
148
209
 
210
+ [1.0.2]: https://github.com/bymaxone/nest-queue/releases/tag/v1.0.2
149
211
  [1.0.1]: https://github.com/bymaxone/nest-queue/releases/tag/v1.0.1
150
212
  [1.0.0]: https://github.com/bymaxone/nest-queue/releases/tag/v1.0.0
package/README.md CHANGED
@@ -26,7 +26,7 @@
26
26
  <a href="https://github.com/bymaxone/nest-queue/issues">Issues</a> ·
27
27
  <a href="#-quick-start">Quick Start</a> ·
28
28
  <a href="#-api-reference">API Reference</a> ·
29
- <a href="https://github.com/bymaxone/nest-queue/tree/main/examples/nest-queue-example">Example App</a>
29
+ <a href="https://github.com/bymaxone/nest-queue-example">Example App</a>
30
30
  </p>
31
31
 
32
32
  ---
@@ -114,19 +114,23 @@ Both subpaths ship ESM **and** CommonJS with declarations for each format, so a
114
114
 
115
115
  ### Peer dependency matrix
116
116
 
117
- | Subpath | Required peers |
118
- | ------------ | ----------------------------------------------------------------------------------------------- |
119
- | `.` (server) | `@nestjs/common ^11`, `@nestjs/core ^11`, `bullmq ^5.16`, `ioredis ^5`, `reflect-metadata ^0.2` |
120
- | `./shared` | None |
121
- | Optional | `bullmq-otel ^1` (OpenTelemetry) |
117
+ | Subpath | Required peers |
118
+ | ------------ | --------------------------------------------------------------------------------------------------------- |
119
+ | `.` (server) | `@nestjs/common ^11.0.16`, `@nestjs/core ^11.1.18`, `bullmq ^5.16`, `ioredis ^5`, `reflect-metadata ^0.2` |
120
+ | `./shared` | None |
121
+ | Optional | `bullmq-otel ^1` (OpenTelemetry) |
122
122
 
123
123
  ---
124
124
 
125
125
  > [!TIP]
126
- > A runnable reference application lives in
127
- > [`examples/nest-queue-example`](https://github.com/bymaxone/nest-queue/tree/main/examples/nest-queue-example) —
128
- > a NestJS app that consumes this library and exercises producers, decorated
129
- > processors, and a health endpoint against a real Redis.
126
+ > A full reference application lives in
127
+ > [`bymaxone/nest-queue-example`](https://github.com/bymaxone/nest-queue-example) —
128
+ > an API and a web console exercising every public export against a real Redis.
129
+ >
130
+ > The `test/consumer-app` directory in this repository is **not** that. It is a
131
+ > typecheck fixture: a few hundred lines of application-shaped code that CI
132
+ > compiles against the freshly built library on every pull request, to catch an
133
+ > ergonomic break in the decorator API that a signature test cannot see.
130
134
 
131
135
  ---
132
136
 
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@bymax-one/nest-queue",
3
- "version": "1.0.1",
3
+ "version": "1.0.3",
4
4
  "description": "NestJS dynamic module wrapping BullMQ — typed jobs, flows, job schedulers, deduplication, OpenTelemetry, graceful shutdown",
5
5
  "author": "Bymax One <support@bymax.one>",
6
6
  "license": "MIT",
@@ -55,8 +55,8 @@
55
55
  },
56
56
  "dependencies": {},
57
57
  "peerDependencies": {
58
- "@nestjs/common": "^11.0.0",
59
- "@nestjs/core": "^11.0.0",
58
+ "@nestjs/common": "^11.0.16",
59
+ "@nestjs/core": "^11.1.18",
60
60
  "bullmq": "^5.16.0",
61
61
  "bullmq-otel": "^1.0.0",
62
62
  "ioredis": "^5.0.0",