v1.1.0

Security Improvements:

• 🔒 Fixed critical mass assignment vulnerability - isAdmin can no longer be set during registration
• 🔐 Added JWT token expiration (7 days) with proper validation
• 🛡️ Implemented rate limiting middleware to prevent brute force attacks
• 🔒 Added secure headers middleware (XSS, clickjacking, MIME sniffing protection)
• 🛡️ Added CSRF protection for production environments
• 🔐 Fixed JWT secret validation - now throws error if missing
• 🔒 Fixed password hash leak in profile update response
• 🛡️ Improved CORS configuration with environment-based origin restrictions
• 🔍 Fixed error handler stack trace exposure logic
• ✅ Added comprehensive input validation (email format, password length)

Code Quality:

• 📦 Removed deprecated @types/mongoose dependency
• 🔄 Standardized environment variable access to process.env
• ✅ Improved TypeScript types and error handling
• 🔄 Updated to modern Hono JWT API (sign/verify instead of deprecated Jwt)
• 📝 Enhanced error messages and validation feedback

Dependencies:

• Updated to Hono v4.11.3
• Mongoose v9.1.1 (includes built-in TypeScript types)