Skip to content

chore(deps): bump @bymax-one/nest-auth to ^1.0.11#4

Merged
msalvatti merged 4 commits into
mainfrom
chore/bump-nest-auth-1.0.11
May 30, 2026
Merged

chore(deps): bump @bymax-one/nest-auth to ^1.0.11#4
msalvatti merged 4 commits into
mainfrom
chore/bump-nest-auth-1.0.11

Conversation

@msalvatti

@msalvatti msalvatti commented May 30, 2026

Copy link
Copy Markdown
Member

Bumps @bymax-one/nest-auth from ^1.0.10 to ^1.0.11 across the root, apps/api, and apps/web, plus the regenerated pnpm-lock.yaml. Also includes staged .vscode editor settings.

About 1.0.11

The library's 1.0.11 release is a dev-only security patch internal to the library's own repo — it forces tmp >=0.2.6 via a pnpm.overrides entry in the library, clearing an advisory in its dev toolchain. That override is not present in the published bundle and does not propagate to consumers, so this example app needs no tmp override and its lockfile/overrides are unchanged (this repo's pnpm.overrides still contains only @hono/node-server). There are no API changes from 1.0.10, so no application code changes were required.

Verification

typecheck, lint, format:check, and the full test suite (API 540 tests, web 701 tests) all green locally.

Dev-only security patch (forces tmp >=0.2.6 via overrides); no API
changes from 1.0.10. Updates root, apps/api, apps/web and the lockfile.
Includes staged .vscode editor settings.

Verified: typecheck, lint, format:check and full test suite
(API 540 tests, web 701 tests) all green.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Copilot AI review requested due to automatic review settings May 30, 2026 18:53
@socket-security

socket-security Bot commented May 30, 2026

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Added@​bymax-one/​nest-auth@​1.0.117910010095100

View full report

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR bumps @bymax-one/nest-auth from ^1.0.10 to ^1.0.11 across the monorepo and updates the lockfile accordingly, plus adds shared VS Code workspace settings/extensions to standardize formatting and linting behavior for contributors.

Changes:

  • Bump @bymax-one/nest-auth to ^1.0.11 in the root, apps/api, and apps/web.
  • Update pnpm-lock.yaml to reflect the new resolved version.
  • Add .vscode workspace settings and extension recommendations for Prettier/ESLint/Tailwind/EditorConfig.

Reviewed changes

Copilot reviewed 5 out of 6 changed files in this pull request and generated 1 comment.

Show a summary per file
File Description
pnpm-lock.yaml Updates lock resolution to @bymax-one/nest-auth@1.0.11.
package.json Bumps root devDependency for @bymax-one/nest-auth to ^1.0.11.
apps/api/package.json Bumps API app dependency for @bymax-one/nest-auth to ^1.0.11.
apps/web/package.json Bumps Web app dependency for @bymax-one/nest-auth to ^1.0.11.
.vscode/settings.json Adds workspace editor/formatter/linting/search settings.
.vscode/extensions.json Recommends common workspace extensions (ESLint, Prettier, Tailwind, EditorConfig).
Files not reviewed (1)
  • pnpm-lock.yaml: Language not supported

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread package.json
@msalvatti

msalvatti commented May 30, 2026

Copy link
Copy Markdown
Member Author
{
  "consecutiveFailures": {
    "Mutation — apps/api::prisma-config-DATABASE_URL": 1,
    "Mutation — apps/api::users.service.ts:179-StringLiteral-survived": 1
  },
  "flakyReruns": {},
  "processedCommentIds": [3329162383, 4583900291, 3329191232],
  "paused": false,
  "localGate": "pnpm test",
  "headSha": "2b34613",
  "terminated": true,
  "terminatedReason": "All checks green, mergeable CLEAN, no open bot threads. Ready to merge (babysit did not merge).",
  "fixes": [
    { "commit": "0677f1a", "summary": "DATABASE_URL placeholder for prisma generate in mutation.yml + mutation-nightly.yml." },
    { "commit": "fa01c94", "summary": "Hardened findById not-found test to assert verbatim 404 message — kills surviving StringLiteral mutant." },
    { "commit": "2b34613", "summary": "Copilot review: assert against a single rejected promise. Mutation apps/api back to 100%." }
  ]
}

msalvatti and others added 2 commits May 30, 2026 16:04
… workflows

The "Generate Prisma client" step in mutation.yml and mutation-nightly.yml
did not set DATABASE_URL. Prisma 7 resolves env('DATABASE_URL') in
prisma.config.ts at CLI load time, so `prisma generate` throws
PrismaConfigEnvError before mutation testing can even start. ci.yml already
passes a placeholder on the same step; these two workflows were missing it.

Surfaced on PR #4 — the first run of mutation.yml (triggered by pnpm-lock.yaml
/ package.json paths). Pre-existing latent bug, not a regression.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…case

The not-found test only asserted the error type (NotFoundException), not the
message, so an empty-message variant of the 404 went uncaught — surfacing as a
surviving StringLiteral mutant (score 99.87 < break threshold 100) the first
time mutation.yml ran on a PR. The incremental cache from main had masked it;
the nightly cold run would have caught it.

Adds an assertion that the 404 names the requested id verbatim, matching the
existing convention in the updateStatus tests. Targeted Stryker run on
users.service.ts is back to 100.00% (0 survivors).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Copilot AI review requested due to automatic review settings May 30, 2026 19:22

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 8 out of 9 changed files in this pull request and generated 1 comment.

Files not reviewed (1)
  • pnpm-lock.yaml: Language not supported

Comment thread apps/api/src/users/users.service.spec.ts Outdated
Asserts the type and the verbatim 404 message against one rejected promise
instead of calling service.findById twice, so the lookup runs exactly once.
Still kills the StringLiteral mutant — targeted Stryker run stays at 100.00%.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
@msalvatti msalvatti merged commit df1e4c9 into main May 30, 2026
13 checks passed
@msalvatti msalvatti deleted the chore/bump-nest-auth-1.0.11 branch May 30, 2026 19:41
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants