strapi-cms-audit-log 1.2.0 → 1.2.1

package/CHANGELOG.md

@@ -5,6 +5,19 @@ All notable changes to this project are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and
 the project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.2.1] — 2026-11-06
+
+### Fixed
+- Building the list page's filter options no longer takes extra pooled
+  database connections. `readStoredOptions` ran its six `DISTINCT` queries on
+  raw `strapi.db.connection`, which from inside an open transaction takes a
+  second connection per query and can exhaust a small pool. The queries now run
+  in turn on a single transaction connection.
+
+### Changed
+- Removed the upper bound on the supported Node.js version; `engines.node` is
+  now `>=18.0.0`.
+
 ## [1.2.0] — 2026-09-11
 
 Remediates every finding of the 10 September OWASP ASVS Level 2 (V7) assessment.

package/README.md

@@ -126,7 +126,7 @@ sidebar entry are all created on boot.
 | | |
 |---|---|
 | Strapi | `^5.0.0` (developed and tested against 5.52) |
-| Node | `>=18 <=22` |
+| Node | `>=18` |
 | Database | Any Strapi v5 supports — PostgreSQL, MySQL/MariaDB, SQLite |
 
 There is one manual step after installing: **grant the permission**. See

package/dist/server/index.js

@@ -949,8 +949,13 @@ const auditService = ({ strapi }) => {
     sources: [...options.sources].sort(),
     outcomes: [...options.outcomes].sort()
   });
-  const readStoredOptions = async () => {
-    const knex = strapi.db.connection;
+  const readStoredOptions = () => (
+    // Never raw `strapi.db.connection`: from inside an open transaction it takes
+    // a second pooled connection, and `Promise.all` below would take six. On the
+    // transaction's one connection the six queries simply run in turn.
+    strapi.db.transaction(({ trx }) => readStoredOptionsWith(trx))
+  );
+  const readStoredOptionsWith = async (knex) => {
     const metadata = strapi.db.metadata.get(AUDIT_LOG_UID);
     const table = metadata.tableName;
     const column = (attribute) => {

package/dist/server/index.mjs

@@ -947,8 +947,13 @@ const auditService = ({ strapi }) => {
     sources: [...options.sources].sort(),
     outcomes: [...options.outcomes].sort()
   });
-  const readStoredOptions = async () => {
-    const knex = strapi.db.connection;
+  const readStoredOptions = () => (
+    // Never raw `strapi.db.connection`: from inside an open transaction it takes
+    // a second pooled connection, and `Promise.all` below would take six. On the
+    // transaction's one connection the six queries simply run in turn.
+    strapi.db.transaction(({ trx }) => readStoredOptionsWith(trx))
+  );
+  const readStoredOptionsWith = async (knex) => {
     const metadata = strapi.db.metadata.get(AUDIT_LOG_UID);
     const table = metadata.tableName;
     const column = (attribute) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "strapi-cms-audit-log",
-  "version": "1.2.0",
+  "version": "1.2.1",
   "description": "Tamper-evident audit logging for Strapi v5. Content create/update/delete/publish/unpublish with field-level diffs and a per-widget before/after view, plus logins, failed logins, logouts, denied requests and admin user/role/permission/media changes — all from Community Edition events. Hash-chained, undeletable, correlation ids on every request, RBAC-protected admin UI, redaction, self-audited retention and structured-log forwarding. Built to pass an OWASP ASVS L2 (V7) review.",
   "keywords": [
     "strapi",
@@ -100,7 +100,7 @@
     "description": "Automatic audit logging with field-level diffs and an RBAC-protected admin UI."
   },
   "engines": {
-    "node": ">=18.0.0 <=22.x.x"
+    "node": ">=18.0.0"
   },
   "publishConfig": {
     "access": "public"