@sixthsummit/ship-api 4.1.1 → 4.1.2-alpha-20261021214130
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +31 -0
- package/package.json +9 -8
package/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,36 @@
|
|
|
1
1
|
# @sixthsummit/ship-api
|
|
2
2
|
|
|
3
|
+
## 4.1.2-alpha-20261021214130
|
|
4
|
+
|
|
5
|
+
### Patch Changes
|
|
6
|
+
|
|
7
|
+
- c049215: Require the October 2026 Node.js security releases (22.23.4, 24.22.1, 26.12.1 or newer),
|
|
8
|
+
which fix the Brotli decoder remote code execution (CVE-2026-111497), TLS hostname
|
|
9
|
+
verification bypasses, and `dns.resolve` truncation. Bump `hono` to 4.13.13 to pick up
|
|
10
|
+
the `serveStatic` double-decode middleware bypass fix (GHSA-5r4p-p66f-jhc7).
|
|
11
|
+
|
|
12
|
+
Keep OpenTelemetry on the 2.x SDK line while the ecosystem moves to api 1.10 / SDK 3.0.
|
|
13
|
+
OpenTelemetry JS published `@opentelemetry/api` 1.10.0 alongside a new SDK major (core 3.0.0 /
|
|
14
|
+
sdk-node 0.300.0); every 2.x SDK package rejects api 1.10.0 as a peer. Three changes keep a
|
|
15
|
+
fresh consumer install resolving api 1.9.x:
|
|
16
|
+
|
|
17
|
+
- `@opentelemetry/api` is constrained to `>=1.9.1 <1.10.0` wherever it is declared.
|
|
18
|
+
- `@opentelemetry/core` is now a regular dependency of ship-api and ship-observability-otel,
|
|
19
|
+
so auto-instrumentations-node's peer on it resolves inside those packages instead of
|
|
20
|
+
bubbling to the consumer root.
|
|
21
|
+
- ship-testing and ship-auth-firebase declare the bounded `@opentelemetry/api` too. Neither
|
|
22
|
+
imports it directly, but drizzle-orm (testing) and Firestore via firebase-admin
|
|
23
|
+
(auth-firebase) request api with open ranges; without a bound in those subtrees pnpm
|
|
24
|
+
resolves 1.10.0 first and then reuses it for later peer contexts, depending on the order
|
|
25
|
+
dependencies appear in the consumer manifest.
|
|
26
|
+
|
|
27
|
+
Moving to the OpenTelemetry 3.x line is a separate upgrade.
|
|
28
|
+
- Updated dependencies [c049215]
|
|
29
|
+
- @sixthsummit/ship-hono@1.2.1-alpha-20261021214130
|
|
30
|
+
- @sixthsummit/ship-testing@1.2.1-alpha-20261021214130
|
|
31
|
+
- @sixthsummit/ship-drizzle@1.2.1-alpha-20261021214130
|
|
32
|
+
- @sixthsummit/ship-observability-otel@1.2.1-alpha-20261021214130
|
|
33
|
+
|
|
3
34
|
## 4.1.1
|
|
4
35
|
|
|
5
36
|
### Patch Changes
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@sixthsummit/ship-api",
|
|
3
|
-
"version": "4.1.
|
|
3
|
+
"version": "4.1.2-alpha-20261021214130",
|
|
4
4
|
"description": "ShipAPI Framework — TypeScript backend on Hono + Drizzle + pluggable AuthProvider + BullMQ + OpenTelemetry. Designed to be edited by AI coding agents.",
|
|
5
5
|
"main": "lib/index.js",
|
|
6
6
|
"types": "lib/index.d.ts",
|
|
@@ -95,8 +95,9 @@
|
|
|
95
95
|
"@hono/node-server": "^1.19.14",
|
|
96
96
|
"@hono/node-ws": "^1.3.0",
|
|
97
97
|
"@hono/zod-validator": "^0.7.6",
|
|
98
|
-
"@opentelemetry/api": "
|
|
98
|
+
"@opentelemetry/api": ">=1.9.1 <1.10.0",
|
|
99
99
|
"@opentelemetry/auto-instrumentations-node": "^0.80.0",
|
|
100
|
+
"@opentelemetry/core": "^2.11.0",
|
|
100
101
|
"@opentelemetry/exporter-prometheus": "^0.222.0",
|
|
101
102
|
"@opentelemetry/resources": "^2.11.0",
|
|
102
103
|
"@opentelemetry/sdk-metrics": "^2.11.0",
|
|
@@ -105,9 +106,9 @@
|
|
|
105
106
|
"@sixthsummit/ship-cli": "^1.2.0",
|
|
106
107
|
"@sixthsummit/ship-contract": "^1.3.0",
|
|
107
108
|
"@sixthsummit/ship-core": "^1.1.1",
|
|
108
|
-
"@sixthsummit/ship-drizzle": "^1.2.
|
|
109
|
-
"@sixthsummit/ship-hono": "^1.2.
|
|
110
|
-
"@sixthsummit/ship-observability-otel": "^1.2.
|
|
109
|
+
"@sixthsummit/ship-drizzle": "^1.2.1-alpha-20261021214130",
|
|
110
|
+
"@sixthsummit/ship-hono": "^1.2.1-alpha-20261021214130",
|
|
111
|
+
"@sixthsummit/ship-observability-otel": "^1.2.1-alpha-20261021214130",
|
|
111
112
|
"async": "^3.2.4",
|
|
112
113
|
"bullmq": "^5.76.3",
|
|
113
114
|
"chalk": "^5.3.0",
|
|
@@ -116,7 +117,7 @@
|
|
|
116
117
|
"drizzle-zod": "^0.8.3",
|
|
117
118
|
"file-type": "^21.3.4",
|
|
118
119
|
"firebase-admin": "^13.10.0",
|
|
119
|
-
"hono": "^4.13.
|
|
120
|
+
"hono": "^4.13.13",
|
|
120
121
|
"ioredis": "^5.10.1",
|
|
121
122
|
"jose": "^6.2.3",
|
|
122
123
|
"lru-cache": "^11.3.5",
|
|
@@ -129,7 +130,7 @@
|
|
|
129
130
|
"zod-to-json-schema": "^3.25.2"
|
|
130
131
|
},
|
|
131
132
|
"peerDependencies": {
|
|
132
|
-
"@sixthsummit/ship-testing": "^1.2.
|
|
133
|
+
"@sixthsummit/ship-testing": "^1.2.1-alpha-20261021214130",
|
|
133
134
|
"typescript": ">=5"
|
|
134
135
|
},
|
|
135
136
|
"peerDependenciesMeta": {
|
|
@@ -177,7 +178,7 @@
|
|
|
177
178
|
"@bull-board/hono": "^7.0.0",
|
|
178
179
|
"@google-cloud/storage": "^7.19.0",
|
|
179
180
|
"@opentelemetry/sdk-trace-base": "^2.11.0",
|
|
180
|
-
"@sixthsummit/ship-testing": "^1.2.
|
|
181
|
+
"@sixthsummit/ship-testing": "^1.2.1-alpha-20261021214130",
|
|
181
182
|
"@testcontainers/localstack": "^12.0.1",
|
|
182
183
|
"@testcontainers/postgresql": "^12.0.1",
|
|
183
184
|
"@types/pg": "^8.15.6",
|