@nanokajs/core 1.13.1 → 2.0.1

package/CHANGELOG.md

@@ -5,6 +5,22 @@ All notable changes to `@nanokajs/core` will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/)
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [2.0.1] — 2026-10-02
+
+### Security
+
+- Update Hono to 4.13.12 and Vitest to 4.1.11. Pin vulnerable development-tool dependencies (esbuild, Undici, PostCSS, nanoid, fflate, and Miniflare’s Sharp) to patched releases; update the site’s Sharp to 0.35.5. Public APIs and peer dependency ranges are unchanged.
+
+### Changed
+
+- Add missing auth/scaffolder checks and site typechecking to PR CI; synchronize maintenance and development documentation. The scaffolder now recommends patched Hono releases.
+
+## [2.0.0] — 2026-07-18
+
+### Changed
+
+- **BREAKING**: `engines.node` を `>= 20` から `>= 22` に引き上げ（`@nanokajs/core` / `@nanokajs/auth` / `create-nanoka-app` の全パッケージ）。開発ツールチェーン（wrangler 4 / vite 8）が既に Node 22+ を要求しており、宣言を実態に合わせた。ランタイム（Cloudflare Workers）への影響はなし。Node 20 環境でのローカル開発は非サポートとなる。
+
 ## [1.13.1] — 2026-07-15
 
 ### Changed

package/README.md

@@ -17,7 +17,7 @@ Targets **Cloudflare Workers + D1 (SQLite)** as first-class. Hono-compatible rou
 
 ## Status
 
-**Stable (1.12.1).** Core API-boundary surface — field policies, `inputSchema` / `outputSchema`, validator presets, `t.json(zodSchema)`, field accessor API, Zod 3 / 4 support, OpenAPI component seed, `t.timestamp().defaultNow()`, mutation/findOne SQL expression and `in` operator in `where` — is stable under SemVer.
+**Stable (2.0.0).** Core API-boundary surface — field policies, `inputSchema` / `outputSchema`, validator presets, `t.json(zodSchema)`, field accessor API, Zod 3 / 4 support, OpenAPI component seed, `t.timestamp().defaultNow()`, mutation/findOne SQL expression and `in` operator in `where` — is stable under SemVer.
 
 ## Stable API surface (1.0)
 
@@ -45,7 +45,7 @@ pnpm add @nanokajs/core drizzle-orm zod
 pnpm add -D typescript drizzle-kit @cloudflare/workers-types
 ```
 
-> **Node.js 22 or later is required for the development toolchain.** `wrangler` 4 declares `engines.node >= 22` (and `vite` 8 requires `>= 22.12`), so local dev / test tooling needs Node 22+. The `@nanokajs/core` library itself still declares `engines.node >= 20` — it runs on Cloudflare Workers, and the runtime surface is unchanged.
+> **Node.js 22.12 or later is required for this repository’s development/test toolchain.** `wrangler` 4 declares `engines.node >= 22` (and `vite` 8 requires `>= 22.12`), so use Node 22.12+ on the Node 22 line. As of v2.0.0, `@nanokajs/core` also declares `engines.node >= 22`, raising the declared minimum for local development (the library still runs on Cloudflare Workers; the runtime surface is unchanged).
 
 Then add a `types` entry to `tsconfig.json` so `D1Database`, `Request`, `ExecutionContext`, and `crypto` resolve as ambient globals (no per-file imports needed):
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nanokajs/core",
-  "version": "1.13.1",
+  "version": "2.0.1",
   "type": "module",
   "description": "Thin wrapper over Hono + Drizzle + Zod for Cloudflare Workers + D1. 80% automatic, 20% explicit.",
   "author": "Eiichiro Iriguchi <eiichiro_iriguchi@a-1ro.dev>",
@@ -23,7 +23,7 @@
     "validation"
   ],
   "engines": {
-    "node": ">=20"
+    "node": ">=22"
   },
   "sideEffects": false,
   "exports": {
@@ -83,11 +83,11 @@
     "@libsql/client": "^0.17.4",
     "@types/node": "^25.9.1",
     "drizzle-orm": "^0.45.2",
-    "hono": "^4.12.22",
+    "hono": "^4.13.12",
     "tsup": "^8.5.1",
     "typescript": "^5.9.3",
     "vite": "^8.1.4",
-    "vitest": "^4.1.10",
+    "vitest": "^4.1.11",
     "wrangler": "^4.111.0",
     "zod": "^3.25.76"
   }