flyingsquirrel0419/layercache

v3.1.1 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 1mo Caching

✓ No known CVEs patched

This release patches 1 known CVE

Topics

cache-manager cache memory-cache multi-layer-cache nodejs redis

+2 more

stampede-prevention typescript

Affected surfaces

deps

Summary

AI summary

Security audit findings resolved by updating development dependencies to non‑vulnerable versions.

Type	Severity	Summary	CVE
Security	High	Added esbuild override to prevent resolution of vulnerable 0.27.x transitive dependency line. Added esbuild override to prevent resolution of vulnerable 0.27.x transitive dependency line. Source: llm_adapter@2026-06-14 Confidence: high	—
Dependency	Low	Updated development dependencies tmp, tsx, and esbuild to non‑vulnerable versions. Updated development dependencies tmp, tsx, and esbuild to non‑vulnerable versions. Source: llm_adapter@2026-06-14 Confidence: high	—
Bugfix	Medium	Fixed FetchRateLimiter queue item typing under strict TypeScript checks. Fixed FetchRateLimiter queue item typing under strict TypeScript checks. Source: llm_adapter@2026-06-14 Confidence: high	—
Bugfix	Medium	Restored `lint` and `lint:fix` scripts to direct `biome` invocations. Restored `lint` and `lint:fix` scripts to direct `biome` invocations. Source: llm_adapter@2026-06-14 Confidence: high	—

Full changelog

Fixed the FetchRateLimiter queue item typing under strict TypeScript checks by aligning queued task and resolver storage with the bucket queue's unknown value boundary.
Restored the lint and lint:fix scripts to direct biome invocations, since npm scripts already resolve local binaries from node_modules/.bin.
Added rate limiter regression coverage for rejected queued tasks continuing to drain and for corrupted pending-queue defensive cleanup, raising the suite to 601 passing tests and overall statement coverage to 97.13%.

Resolved development dependency audit findings by updating the lockfile to use [email protected], [email protected], and [email protected].
Added an esbuild override so transitive dev tooling no longer resolves the vulnerable 0.27.x line.

Updated lockfile to use [email protected], [email protected], and [email protected]; added esbuild override to prevent resolution of vulnerable 0.27.x line.

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track flyingsquirrel0419/layercache

Get notified when new releases ship.

About flyingsquirrel0419/layercache

v4.0.0 Write coordination applies finite default limits and can reject saturated work with CacheWriteSaturationError.
v4.0.0 Automatically derived structured `wrap()` keys now use the `j2:` schema; old `j:` entries become cold misses and expire naturally.
v4.0.0 Read-through fetchers now cache null as a regular value by default; `getOrThrow()` returns stored nulls while throwing only for undefined.
v4.0.0 Public CacheStack reads now return undefined for misses and negative-cache entries instead of null.