chore(deps): bump nest-native libs to latest (lockout/authlock 0.4.0, messaging 0.5.0)#68
Open
rodrigobnogueira wants to merge 1 commit into
Open
chore(deps): bump nest-native libs to latest (lockout/authlock 0.4.0, messaging 0.5.0)#68rodrigobnogueira wants to merge 1 commit into
rodrigobnogueira wants to merge 1 commit into
Conversation
… messaging 0.5.0) Move the three pins that had fallen behind their latest published versions: - @authlock/core ^0.3.0 -> ^0.4.0 - @nest-native/lockout ^0.3.1 -> ^0.4.0 - @nest-native/messaging ^0.3.1 -> ^0.5.0 All three are additive, backward-compatible releases: lockout/authlock 0.4.0 add per-dimension identity `normalize`, `resetAll()`, and audit-logging docs; messaging 0.4.0/0.5.0 add the opt-in OutboxWaker / WakeSocket / Postgres LISTEN-NOTIFY wake tiers (the poller is unchanged when no waker is passed). No app code changes — every surface the app consumes is unchanged. The remaining libraries were already at their latest. Full gate green: typecheck, client-smoke typecheck, lint, complexity, tests (exit 0), build, and security:audit (6 moderate advisories remain, all in dev/build tooling only — esbuild via drizzle-kit, qs via typed-rest-client — outside the production surface and below the high gate).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the three nest-native pins that had fallen behind their latest published versions. The other six libraries were already current.
@authlock/core^0.3.0^0.4.0@nest-native/lockout^0.3.1^0.4.0@nest-native/messaging^0.3.1^0.5.0Why these are safe
All three are additive, backward-compatible releases, and every surface this app consumes is unchanged — so there are no app code changes, only the pins + regenerated lockfile.
normalize,resetAll()/ storeclearAll(), and an audit-logging recipe. The app's existingLockoutModule.forRootAsyncconfig (SqliteLockoutStore,['email']/['ip']parameters,logger) is untouched.OutboxWaker,WakeSocketServer/Client, PostgresLISTEN/NOTIFY). The worker loop is an unchanged pure poller when no waker is passed, which is how this app runs it.Verification
Full CI gate green locally (
node --import tsxsuite, SQLite / in-process profile):typecheck,client-smoke:typechecklint,complexity:checktest/test:cov(exit 0)buildsecurity:audit(--audit-level=high) — passes. The 6 remaining moderate advisories are all in dev/build tooling (esbuildviadrizzle-kit,qsviatyped-rest-client), outside the published production surface; Dependabot's territory, not a release blocker.Live-Kafka e2e (
test:full) not run in this environment; the bump does not touch the Kafka transport surface.Possible follow-up (not in this PR)
The app locks by
['email'], soAlice@x.com/alice@x.com/alice@x.comcurrently split into three separate counters — the exact case-normalization bypass lockout 0.4.0'snormalizecloses. Adoptingnormalize: { email: (v) => v.trim().toLowerCase() }would be a natural showcase of the new version, but belongs in its own scoped PR.