v1.2.3

Changed

• JsonSerializer.deserialize throws DESERIALIZATION_FAILED with details of a fixed error text and the
  length of the stored value. details.preview and the parser's own message, which quoted the start of the
  input, are gone. The error code is unchanged; a consumer that read details.preview must stop.
• Apply to a consumer. Do not read details.preview or details.error to debug a decoding
  failure. Log the error on the server by its code, cache.deserialization_failed; the call site already
  knows the prefix and id it asked for. Use details.length when you need a size signal. A backend that
  sent details to its clients needs no other change: the response no longer carries any part of the
  stored value.
• Apart from that, nothing you execute changes.

Documentation

• README.md, docs/technical_specification.md and the contributor documents state that
  KeyBuilder validates prefix and id only for emptiness. A separator inside either
  collides (build('a', 'b:c') and build('a:b', 'c') both give app:a:b:c), and a glob
  metacharacter in prefix widens keys() and scan() within the namespace. Behaviour is
  unchanged. Keys are unambiguous only for a single-character separator that appears in neither field; encoding each field with encodeURIComponent provides that for a separator it escapes and never emits, such as the default ':'.
• Contributor and security documents match the current tooling: pnpm 11, the admin
  read-only check in the verification chain, mutation testing after merge and weekly, and
  how dependency advisories are handled.

Security

• A non-JSON stored value no longer appears in the exception body. CacheException extends
  HttpException, so a default Nest filter sends details to the HTTP client. A cached value that was
  not JSON (written by another writer, or by another serializer) leaked up to 100 characters of itself
  through details.preview, and the start of it through details.error. It could carry PII or a token.
  Only a malformed entry triggers it; a valid JSON value never does.
• Dependency advisories in development-only transitive dependencies are fixed by raising the
  overrides floors in pnpm-workspace.yaml. None of them ships: the package
  publishes with "dependencies": {}, so no consumer was exposed to these advisories.
• GHSA-gcqx-w48m-w2h4 (deepmerge, reached only through jest-config) has no patched
  release. It is suppressed in osv-scanner.toml until 2027-01-27 and nowhere else.

Internal

• Development dependencies updated within their ranges; GitHub Actions bumped.