@bymax-one/nest-queue 1.0.9 → 1.0.10

package/CHANGELOG.md

@@ -7,6 +7,44 @@ versioning follows [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ---
 
+## [1.0.10] — 2026-08-06
+
+**Documentation and tooling only.** `dist/` is byte-identical to `1.0.9`; no source file
+changed.
+
+### Fixed
+
+- The quality bullet claimed "no suppression comments" while the source carries five
+  `// Stryker disable` comments. The claim was about type suppressions and read as false to
+  anyone who grepped for it; it now says what is true — no `@ts-ignore` and no
+  `eslint-disable`.
+
+### Security
+
+- **The OSV scan was passing because it had nothing to read.** The workflow ran
+  `osv-scanner` with no `actions/checkout` step, so it walked an empty workspace and
+  reported "No package sources found" and "No lockfiles found" before exiting 0. A green
+  check meant the scanner found no files, which is indistinguishable from finding no
+  vulnerabilities. With the checkout in place it scans the lockfile, which is how the next
+  item was found.
+- **`js-yaml` is patched to the fixed release** (GHSA-5p4m-2wfm-xmqj, CVSS 7.5). The
+  override floors here already scoped it per major but admitted `3.15.0` and `4.3.0`, both
+  covered by the advisory; they are raised to `^3.15.1` and `^4.3.1`. It reaches this repo
+  only through `jest` -> `babel-plugin-istanbul` -> `@istanbuljs/load-nyc-config`, and
+  `dependencies` is empty, so nothing here ships it and no consumer was exposed. `dist/` is
+  unaffected.
+
+### Added
+
+- `check:mutants` gate (`scripts/check-mutation-directives.mjs`) — validates every
+  `// Stryker` comment against the grammar Stryker's own parser accepts, rejecting a reason
+  written after `--` instead of a colon (silently dropped, and the report then shows
+  `Ignored using a comment`), a reason wrapped onto a second comment line (the report keeps
+  only the first fragment), and a mutator name Stryker does not know, which matches nothing
+  and so silences nothing. Wired into CI and `prepublishOnly`.
+- `docs/mutation_testing_plan.md` carries the suppression policy now shared, word for word,
+  across the `@bymax-one/nest-*` libraries.
+
 ## [1.0.9] — 2026-08-06
 
 **Published-artifact change, not a behavioural one.** `dist/` differs from `1.0.8` — this
@@ -405,6 +443,7 @@ v6 peer range.
 
 ---
 
+[1.0.10]: https://github.com/bymaxone/nest-queue/compare/v1.0.9...v1.0.10
 [1.0.9]: https://github.com/bymaxone/nest-queue/compare/v1.0.8...v1.0.9
 [1.0.8]: https://github.com/bymaxone/nest-queue/compare/v1.0.7...v1.0.8
 [1.0.7]: https://github.com/bymaxone/nest-queue/compare/v1.0.6...v1.0.7

package/README.md

@@ -87,7 +87,7 @@ peer dependencies, so you control exact versions and the supply-chain surface st
 - ✅ **Stable error catalog** — namespaced codes exported from both subpaths, so a frontend maps a `code` without importing the server
 - ✅ **Dual-format output** — ESM + CJS with declarations for each format, verified against the packed tarball on every PR
 - ✅ **Opt-in observability** — OpenTelemetry passthrough via `bullmq-otel`, plus a `MetricsService` with a configurable TTL cache
-- ✅ **Typed end to end** — TypeScript `strict` with `exactOptionalPropertyTypes` and `noUncheckedIndexedAccess`; zero `any`, no suppression comments
+- ✅ **Typed end to end** — TypeScript `strict` with `exactOptionalPropertyTypes` and `noUncheckedIndexedAccess`; zero `any`, no `@ts-ignore` and no `eslint-disable`
 
 ---
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bymax-one/nest-queue",
-  "version": "1.0.9",
+  "version": "1.0.10",
   "description": "NestJS dynamic module wrapping BullMQ — typed jobs, flows, job schedulers, deduplication, OpenTelemetry, graceful shutdown",
   "author": "Bymax One <support@bymax.one>",
   "license": "MIT",
@@ -56,6 +56,7 @@
   "scripts": {
     "build": "pnpm clean && tsup",
     "check:exports": "attw --pack .",
+    "check:mutants": "node scripts/check-mutation-directives.mjs",
     "check:published": "node scripts/check-published-surface.mjs",
     "clean": "rm -rf dist coverage",
     "lint": "eslint src scripts test",
@@ -64,7 +65,7 @@
     "mutation:dry-run": "stryker run --dryRunOnly",
     "mutation:incremental": "stryker run --incremental",
     "prepare": "husky",
-    "prepublishOnly": "pnpm clean && pnpm typecheck && pnpm test:types && pnpm lint && pnpm test:cov:all && pnpm build && pnpm check:published",
+    "prepublishOnly": "pnpm clean && pnpm typecheck && pnpm test:types && pnpm lint && pnpm check:mutants && pnpm test:cov:all && pnpm build && pnpm check:published",
     "release": "npm publish --provenance --access public",
     "size": "node scripts/check-size.mjs",
     "smoke": "node scripts/dogfood-smoke-test.mjs",