tsdevstack
Medium

v0.3.2

Released: June 1, 2026

Security: axios 1.16.1 + OpenTelemetry SDK 2.x

A follow-up security release. Two dependency upgrades close advisories in code tsdevstack ships through templates, generated clients, and @tsdevstack/nest-common. Both are drop-in. Your application code does not change.

axios → 1.16.1

Further axios advisories landed against the 1.15.x line that v0.3.1 shipped. They cover prototype-pollution gadgets (credential injection, response tampering, request hijacking), SSRF via NO_PROXY bypass, CRLF injection in multipart request bodies, and a denial of service through unbounded recursion in toFormData. The 1.15.x range is affected; 1.16.1 is the minimum patched version.

The bump applies everywhere tsdevstack declares axios:

  • the frontend app and nextjs-auth-frontend-template
  • the *-service-client packages and the handlebars template that generates them (npx tsdevstack generate-client)
  • @tsdevstack/cli

OpenTelemetry → SDK 2.x (nest-common)

The Prometheus exporter that @tsdevstack/nest-common uses for the /metrics endpoint carried a high-severity advisory: a malformed HTTP request could crash the exporter process. The fix required moving the observability stack off the 0.57 experimental line and onto the current release train (stable packages to 2.x, experimental exporters to 0.218).

This is an internal upgrade. The TelemetryModule and MetricsModule public surface, the /metrics Prometheus output, and OTLP trace export are all unchanged. Metrics and traces were verified end to end on the new SDK before release.

Action

If your project depends on tsdevstack-shipped templates, generated clients, or @tsdevstack/nest-common:

npm install

Caret ranges resolve to the patched versions automatically. Regenerate clients with npx tsdevstack generate-client <service> if you want the new peer-deps shape on disk; existing builds still resolve correctly against the bumped ranges.