v0.3.0

Added

• RedisLockStorage (src/concurrency/redis-lock-storage.ts) — a cross-instance
  distributed-lock backend using atomic SET … NX EX. RedisKeyValueClient gains
  del and setIfAbsent.

Changed

• LockStorage now exposes an atomic putIfAbsent(record, ttlMs) (plus
  get/put/delete); createLockManager acquires via it, giving real
  mutual exclusion across instances (Experimental surface — see ADR 0004 gate 3).
  Storage owns expiry. The distributed-lock cluster is promoted to Stable;
  RedisLockStorage stays Experimental for one cycle.

v0.2.0

Removed

• BREAKING: openApiFileExists and DEFAULT_OPENAPI_RELATIVE are no longer
  public exports (internal path helpers). Use resolveOpenApiPath or pass an
  absolute path. (ADR 0005 item 1)

Changed

• BREAKING: minimum runtime raised to Node 24 LTS / npm 11 (engines).
  node:sqlite is stable on 24 (no --experimental-sqlite). CI and the release
  workflow run on Node 24. (ADR 0005 item 3)
• BREAKING: Nene2AppDatabase.executor renamed to queryExecutor
  (aligns with DatabaseQueryExecutor, disambiguates from readExecutor).
  Migration: nene2.database.executor → nene2.database.queryExecutor. (ADR 0005 item 2)
• BREAKING: TokenVerifier.verify now always returns
  Promise<Readonly<Record<string, unknown>>> — the synchronous return was
  dropped. LocalBearerTokenVerifier.verify is now async (await it, or catch a
  rejection instead of a synchronous throw). bearerTokenMiddleware already
  awaited it, so no change there. (ADR 0005 item 4)

v0.1.26

Ships the FT178–187 deep-FT phase — 11 new framework helpers. npm jumps 0.1.23 → 0.1.26 (the earlier v0.1.24/v0.1.25 tags were never published).

Added

• ETag / conditional requests — computeETag, checkNotModified (304), checkPreconditions (412/428) (FT178)
• parseSortQuery — allowlist ORDER BY validation, ReDoS-immune (FT179)
• createCircuitBreaker — three-state resilience primitive (FT180)
• createLockManager — leased distributed lock, owner-verified + TTL (FT181)
• createValidationCollector — nested/indexed error paths in one 422 (FT182)
• applyMergePatch — RFC 7396 PATCH with immutable/allowed guards (FT183)
• validateTextField / countCodePoints — Unicode-safe text validation (FT184)
• checkUrlSafety — SSRF guard (private/loopback/obfuscated IPs, DNS-rebind hook) (FT185)
• assertTenantScope + ResourceNotFoundError — multi-tenant isolation, 404-not-403 (FT186)
• escapeLikePattern — LIKE wildcard-injection defence (FT187)

431 tests; type-check / lint / format / build green. Full notes in CHANGELOG [0.1.26].

v0.1.23

What's new

Tests

• tests/integration/redis-integration.test.ts — 7 integration tests against real Redis: createRedisKeyValueClientFromUrl, RedisRateLimitStorage, RedisIdempotencyStorage; skips gracefully when NENE2_NODE_TEST_REDIS_URL is unset

CI

• redis-integration job with Redis 7 service container — same structure as existing MySQL/PostgreSQL jobs

---

Full changelog: CHANGELOG.md

v0.1.22

What's new

Tests

• Unit tests for createDatabaseRuntime MySQL and PostgreSQL branches (10 tests, mocked pools — no real DB required)

CI

• npm audit --audit-level=high added to the check job (currently 0 vulnerabilities)

Docs

• docs/milestones/semver-0.2.0-breaking-inventory.md — candidate breaking-change list for a future 0.2.0 release

---

Full changelog: CHANGELOG.md

v0.1.21

Added

• Example note/tag created_at column persisted as UTC ISO-8601 via utcNowIso()
• JSON responses include created_at (FT148 / FT115 follow-up)

Closes #102

v0.1.20

Changed

• createApp() registers default domain handlers: transaction-aborted (422), version-conflict (409), forbidden (403)
• Transaction rollback via runTransaction() no longer requires manual handler wiring (FT106/FT147)

Closes #100

v0.1.19

Changed

• Example note/tag UseCases enforce row ownership via assertResourceOwner (BOLA, FT146)
• /examples/notes and /examples/tags require Bearer auth when examples are enabled
• Repositories persist owner_id; list queries scoped to JWT sub

Added

• createResourceAccessDeniedHandler wired into example module
• Cross-user access returns 403 (not 200 leak)

Closes #98

v0.1.18

Added

• Branch-focused unit tests for middleware, HTTP helpers, validation, OpenAPI path resolution, database health check, and shutdown handlers
• Coverage gate raised to 80% branches in CI

Coverage

• Branches: 80.32%
• Unit tests: 181 (+34)

Closes #96

v0.1.17

UseCase 90% coverage gate

• Note/tag update & delete not-found tests
• Per-file 90% threshold (nene2-python parity)

See CHANGELOG.md.