v4.0.7

Changes

• fix(deps): ⬆️ update dependency dotenv to ^18.0.9

Release details

• npm: https://www.npmjs.com/package/@haskou/ddd-kernel/v/4.0.7
• Pull request: #102
• Source branch: renovate/non-major-runtime-dependencies
• Version bump: patch

Pull request notes

This PR contains the following updates:

Package	Change	Age	Confidence
dotenv	^18.0.8 → ^18.0.9

---

Release Notes

motdotla/dotenv (dotenv)

v18.0.9

Compare Source

Changed

• Permit DOTENV_PATH being empty string with the CLI (#​1076)

---

Configuration

📅 Schedule: (in timezone Europe/Madrid)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

v4.0.6

Changes

• fix(deps): ⬆️ update dependency node-dependency-injection to v4.3.2

Release details

• npm: https://www.npmjs.com/package/@haskou/ddd-kernel/v/4.0.6
• Pull request: #101
• Source branch: renovate/non-major-runtime-dependencies
• Version bump: patch

Pull request notes

This PR contains the following updates:

Package	Change	Age	Confidence
node-dependency-injection	4.3.1 → 4.3.2

---

Release Notes

zazoomauro/node-dependency-injection (node-dependency-injection)

v4.3.2

Compare Source

What's Changed

• build(deps-dev): bump handlebars from 4.7.9 to 4.7.10 by @​dependabot[bot] in #​281

Full Changelog: zazoomauro/node-dependency-injection@v4.3.1...v4.3.2

---

Configuration

📅 Schedule: (in timezone Europe/Madrid)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

v4.0.5

Changes

• fix(deps): ⬆️ update non-major runtime dependencies

Release details

• npm: https://www.npmjs.com/package/@haskou/ddd-kernel/v/4.0.5
• Pull request: #97
• Source branch: renovate/non-major-runtime-dependencies
• Version bump: patch

Pull request notes

This PR contains the following updates:

Package	Change	Age	Confidence
dotenv	^18.0.7 → ^18.0.8
node-dependency-injection	4.3.0 → 4.3.1

---

Release Notes

motdotla/dotenv (dotenv)

v18.0.8

Compare Source

Changed

• Fast parser should strip appended extra quotes (#​1073)
• Type detail improvement (#​1074)

zazoomauro/node-dependency-injection (node-dependency-injection)

v4.3.1

Compare Source

What's Changed

• build(deps-dev): bump brace-expansion from 1.1.18 to 1.1.21 by @​dependabot[bot] in #​280

Full Changelog: zazoomauro/node-dependency-injection@v4.3.0...v4.3.1

---

Configuration

📅 Schedule: (in timezone Europe/Madrid)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

v4.0.4

Changes

• fix(deps): ⬆️ update dependency @haskou/value-objects to ^8.4.3

Release details

• npm: https://www.npmjs.com/package/@haskou/ddd-kernel/v/4.0.4
• Pull request: #96
• Source branch: renovate/non-major-runtime-dependencies
• Version bump: patch

Pull request notes

This PR contains the following updates:

Package	Change	Age	Confidence
@haskou/value-objects (source)	^8.3.4 → ^8.4.3

---

Release Notes

haskou/value-objects (@​haskou/value-objects)

v8.4.3

Compare Source

Changes

• fix(exports): 🐛 Export ComparableItem and SerializedValue

Release details

• npm: https://www.npmjs.com/package/@haskou/value-objects/v/8.4.3
• Pull request: #​101
• Source branch: fix/export-comparable-item-serialized-value
• Version bump: patch

Pull request notes

What

ComparableItem (constraint of UniqueObjectArray<T>) and SerializedValue (constraint of PrimitiveOf<T>) appear in the public signatures but were not exported, so consumers could not name them.

• ComparableItem moves to src/interfaces/ComparableItem.ts.
• SerializedValue moves to src/types/SerializedValue.ts.
• Both are re-exported through the existing interfaces and types barrels, so they are available from the package root.
• UniqueObjectArray.ts and PrimitiveOf.ts now import them instead of declaring them.

Notes

• Neither type was exported in any earlier release I checked (8.3.4, 8.4.2). This adds exports, it does not restore removed ones.
• Pure type-level change, no runtime behaviour change.

Verification

yarn test (717 tests) and yarn build pass. Coverage stays at 100%. dist/index.d.cts declares both with export, and a throwaway consumer importing them from dist compiled under --strict.

v8.4.2

Compare Source

Changes

• fix(positive-integer): 🐛 Extend PositiveNumber instead of Integer

Release details

• npm: https://www.npmjs.com/package/@haskou/value-objects/v/8.4.2
• Pull request: #​100
• Source branch: fix/positive-integer-extends-positive-number
• Version bump: patch

Pull request notes

What

PositiveInteger now extends PositiveNumber instead of Integer. PositiveNumber validates the sign and PositiveInteger adds the integer check (InvalidIntegerError).

Behaviour changes

• new PositiveInteger(1) instanceof Integer is now false. Code typing a parameter as Integer and passing a PositiveInteger will stop compiling. FileSize is the only consumer in this repo and is unaffected.
• The sign is validated first, so new PositiveInteger(-0.5) throws InvalidPositiveNumberError (it used to throw InvalidIntegerError).
• The % 1 === 0 check now exists in both Integer and PositiveInteger.

Docs and tests

docs/reference/positive-integer.md updated (signature and notes). Spec now asserts inheritance from PositiveNumber, no inheritance from Integer, and the new error for -0.5.

Verification

yarn test (717 tests) and yarn build pass. Coverage stays at 100%.

v8.4.1

Compare Source

Changes

• fix(file-size): 🐛 Type FileSize add and subtract as FileSize

Release details

• npm: https://www.npmjs.com/package/@haskou/value-objects/v/8.4.1
• Pull request: #​99
• Source branch: fix/file-size-arithmetic-types
• Version bump: patch

Pull request notes

What

FileSize.add and FileSize.subtract were typed as NumberValueObject (inherited), although at runtime they return a FileSize. They are now declared as add(other: FileSize): FileSize and subtract(other: FileSize): FileSize.

Notes

• Adding or subtracting two FileSize is a closed operation, so the return type is exact. NumberValueObject is unchanged: its arithmetic can fail on subclass invariants, so this would be a wrong promise there.
• Implemented with clone(), so subclasses of FileSize keep their own type at runtime.
• Breaking at type level: size.add(100) with a plain number no longer compiles. Pass new FileSize(100).
• Docs for FileSize updated with the new signatures and the negative-result error.

Verification

yarn test, yarn build pass. Coverage stays at 100%. The arithmetic test calls FileSize.to() on the results, so it only compiles if both return FileSize.

v8.4.0

Compare Source

Changes

• feat(file-size): ✨ Add FileSize, FileSizeUnit and PositiveInteger value objects

Release details

• npm: https://www.npmjs.com/package/@haskou/value-objects/v/8.4.0
• Pull request: #​98
• Source branch: feat/file-size
• Version bump: minor

Pull request notes

What

• PositiveInteger (extends Integer, accepts 0).
• FileSizeUnit (extends Enum): SI (kB..PB, base 1000) and IEC (KiB..PiB, base 1024) units, with a single typed bytes-per-unit table and FileSizeUnit.SI / FileSizeUnit.IEC sets.
• FileSize (extends PositiveInteger, stored in bytes): fromBytes, from(value, unit), parse, toBytes, to(unit), toHumanReadable(units), plus inherited arithmetic.

Behaviour worth reviewing

• toHumanReadable returns { value, unit }: no formatting or rounding in the domain.
• from and parse round to the nearest byte. multiply/divide do not round and throw InvalidIntegerError on non-integer results. subtract below zero throws InvalidPositiveNumberError.
• Static factories use the this: new (...) => T pattern from #​94, so subclasses get their own type (covered in SubclassFactories.spec.ts).
• parse units are exact and case-sensitive (KB is invalid).

Docs

Reference pages for the three classes, plus sidebar, reference index, docs home and README entries. The README table was re-aligned by prettier.

Verification

yarn test, yarn build and yarn docs:build pass. Coverage is 100% (statements, branches, functions, lines).

---

Configuration

📅 Schedule: (in timezone Europe/Madrid)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

v4.0.3

Changes

• fix(deps): ⬆️ update non-major runtime dependencies

Release details

• npm: https://www.npmjs.com/package/@haskou/ddd-kernel/v/4.0.3
• Pull request: #92
• Source branch: renovate/non-major-runtime-dependencies
• Version bump: patch

Pull request notes

This PR contains the following updates:

Package	Change	Age	Confidence
dotenv	^18.0.6 → ^18.0.7
express (source)	5.2.1 → 5.3.0

---

Release Notes

motdotla/dotenv (dotenv)

v18.0.7

Compare Source

Changed

• Treat undefined settings like quiet: true as null rather than falsey (#​1070)
• CLI should honor DOTENV_QUIET setting in .env file (#​1071)

expressjs/express (express)

v5.3.0

Compare Source

=====

🐞 Bug fixes

• Fixed HTTP header conflict between Content-Length and Transfer-Encoding in res.send - by @​YuryShkoda in #​4893

  Fixed the behavior of res.send() to prevent conflicts between Content-Length and Transfer-Encoding HTTP headers in responses. The Content-Length header in res.send() is now only added when a Transfer-Encoding header is not present, complying with the HTTP specification that states both headers should not coexist in the same response. ETag generation is unaffected by the presence of a Transfer-Encoding header - by @​cuishuang in #​7459

• Upgrade qs to ^6.16.0, which fixes CVE-2026-2391 (GHSA-w7fw-mjwx-w883), CVE-2026-82417 (GHSA-4mjr-xmp4-gh2g) and CVE-2026-82562 (GHSA-x5fp-wj9c-mxmx): arrayLimit bypasses in comma parsing and a denial of service via an attacker-controlled isBuffer - by @​davetashner in #​7057 and #​7478, and @​cyphercodes in #​7305

• Upgrade proxy-addr to ^2.0.8, which fixes CVE-2026-90711 - by @​lazerg in #​7474

🚀 Improvements

• Allow conditional revalidation for QUERY requests. req.fresh previously only validated freshness for GET and HEAD requests, so QUERY responses never returned 304 despite a matching validator. Since QUERY is a safe, idempotent, and cacheable method that supports conditional requests, it is now included in the freshness check - by @​Cherry in #​7366

  // QUERY /reports with If-None-Match: "12345"
  app.query('/reports', (req, res) => {
    res.set('ETag', '"12345"');
    res.send(results); // now responds 304 Not Modified
  });

• Improve HTML structure in res.redirect() responses when HTML format is accepted by adding <!DOCTYPE html>, <title>, and <body> tags for better browser compatibility - by @​Bernice55231 in #​5167

• When calling app.render with options set to null, the locals object is handled correctly, preventing unexpected errors and making the method behave the same as when options is omitted or an empty object is passed - by AkaHarshit in #​6903

  app.render('index', null, callback); // now works as expected

• Upgrade content-type to ^2.0.0, bringing a faster parser (~1.5x quicker Content-Type parsing/formatting in res.send()) along with a behavior change: res.send() now keeps any existing parameters when adding the charset and no longer throws on a Content-Type that fails to parse. type-is is upgraded to ^2.1.0 as part of the same change - by @​blakeembrey in #​7234

  res.set('Content-Type', 'text/plain; foo=bar').send('hey');
  // -> Content-Type: text/plain; foo=bar; charset=utf-8

• The default error handler now logs the full error object instead of only its stack trace, so nested details such as Error.cause and library-specific properties (e.g. Sequelize's parent/original) are no longer swallowed - by @​Nitin-Mohapatra in #​6464

• Upgrade content-disposition to ^2.0.1, which changes the Content-Disposition header emitted by res.download(), res.attachment(), and res.sendFile(): file names that are valid HTTP tokens are no longer wrapped in quotes. This is equivalent per RFC 6266, but applications asserting on the exact header bytes should update their expectations - by @​blakeembrey in #​7233

  res.attachment('user.html');
  // before -> Content-Disposition: attachment; filename="user.html"
  // after  -> Content-Disposition: attachment; filename=user.html

• Upgrade body-parser to ^2.3.0, which fixes CVE-2026-12590 (GHSA-v422-hmwv-36x6): an invalid limit option value caused request body size enforcement to be silently disabled (fail-open), allowing a denial of service via arbitrarily large payloads. Invalid limit values now throw at parser initialization instead of being ignored - by @​Mayvis in #​7390

⚡ Performance

• Avoid duplicate Content-Type header processing in res.send() when sending string responses without an explicit Content-Type header - by @​bjohansebas in #​6991

---

Configuration

📅 Schedule: (in timezone Europe/Madrid)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

v4.0.2

Changes

• fix(deps): ⬆️ update non-major runtime dependencies

Release details

• npm: https://www.npmjs.com/package/@haskou/ddd-kernel/v/4.0.2
• Pull request: #91
• Source branch: renovate/non-major-runtime-dependencies
• Version bump: patch

Pull request notes

This PR contains the following updates:

Package	Change	Age	Confidence
@haskou/value-objects (source)	^8.3.3 → ^8.3.4
dotenv	^18.0.5 → ^18.0.6

---

Release Notes

haskou/value-objects (@​haskou/value-objects)

v8.3.4

Compare Source

Changes

• fix(factories): 🐛 Return subclass from static factories (#​94)

Release details

• npm: https://www.npmjs.com/package/@haskou/value-objects/v/8.3.4
• Pull request: #​95
• Source branch: fix/subclass-static-factories
• Version bump: patch

Pull request notes

Closes #​94

UUID.generate, ShortId.generate, Timestamp.now/new/fromSeconds and Duration.from* now instantiate through the receiver (new this(...)) with a typed this, so subclasses get subclass instances and types, and isEqual works against them.

Note: calling the factories detached (const f = UUID.generate; f(), .map(Duration.fromDays)) no longer works.

Adds regression tests in tests/value-objects/SubclassFactories.spec.ts.

motdotla/dotenv (dotenv)

v18.0.6

Compare Source

Changed

• Use smarter parseBoolean not Boolean() to fix override (#​1069)

---

Configuration

📅 Schedule: (in timezone Europe/Madrid)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

v4.0.1

Changes

• fix(deps): ⬆️ update dependency @haskou/flow to v3.0.2

Release details

• npm: https://www.npmjs.com/package/@haskou/ddd-kernel/v/4.0.1
• Pull request: #90
• Source branch: renovate/non-major-runtime-dependencies
• Version bump: patch

Pull request notes

This PR contains the following updates:

Package	Change	Age	Confidence
@haskou/flow	3.0.1 → 3.0.2

---

Release Notes

haskou/flow (@​haskou/flow)

v3.0.2

Compare Source

Changes

• fix: 🐛 Remove unnecessary Node engines requirement

Release details

• npm: https://www.npmjs.com/package/@haskou/flow/v/3.0.2
• Pull request: #​57
• Source branch: fix/remove-engines-requirement
• Version bump: patch

---

Configuration

📅 Schedule: (in timezone Europe/Madrid)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

v4.0.0

Changes

• refactor!: ♻️ Remove legacy idempotency stores and deprecated Express hook options

Release details

• npm: https://www.npmjs.com/package/@haskou/ddd-kernel/v/4.0.0
• Pull request: #89
• Source branch: break/remove-remaining-legacy
• Version bump: major

Pull request notes

Removes remaining backward-compat code (no production/legacy consumers exist).

Breaking changes:

• IdempotencyStore now requires atomic claim/commit/release; has/mark dropped from the contract and the handleLegacyKey path removed from IdempotencyConsumerMiddleware (and InMemoryIdempotencyStore.mark).
• Removed deprecated staticHooks/swaggerHooks from ExpressKernelServerOptions; use hooks with phase: 'beforeErrors'.

Also: docs/README compat wording removed, 'legacy' test names renamed, internal alias-tracking variable renamed (_getLegacyServiceId is the node-dependency-injection private API name and is still required).

Validated: lint, typecheck, test:coverage (100%), docs:build.

v3.0.1

Changes

• fix(di): 🐛 Drop autowire legacy base64 aliases from the container (#87)

Release details

• npm: https://www.npmjs.com/package/@haskou/ddd-kernel/v/3.0.1
• Pull request: #88
• Source branch: fix/drop-autowire-legacy-aliases
• Version bump: patch

Pull request notes

Closes #87

Removes the base64 aliases that node-dependency-injection adds next to each readable id (they encode absolute paths and ended up in services.yaml). Local: lint, typecheck, test:coverage 100%.

v3.0.0

Changes

• refactor(di)!: ♻️ Use native readable service ids and drop legacy base64 ids (#85)

Release details

• npm: https://www.npmjs.com/package/@haskou/ddd-kernel/v/3.0.0
• Pull request: #86
• Source branch: break/native-service-ids
• Version bump: major

Pull request notes

Closes #85

• Removes Autowire.makeIdLegacy() and every base64 service-id decode in DependencyInjection.
• Parent, alias and reference matching uses readable NDI ids (id basename).
• Tests now use readable ids; the base64 kernel test is replaced by a readable-id assertion; docs describe the id format.

Breaking: generated services.yaml ids change from base64 to readable paths (major release).

Checks run locally: lint, typecheck, test, test:coverage (100%), docs:build, npm pack --dry-run.