Release notes & design decisions
What changed, why it changed, and how it maps to the code in this repository.
Hardening the security boundaries: 19 findings, one root cause
A security review turned up 19 findings — spoofable client IPs, a CSRF default that deletes its own cookie, cookies signed to the wrong name. Almost all of them came from the same mistake. Here's what we fixed and what we left alone on purpose.
Faster, safer body parsing: closing NextRush's POST gap
NextRush led Hello World but slipped on POST JSON. A body-parser audit found a real limit-enforcement bug and a handful of per-request costs. Here is what we fixed, what it bought, and — honestly — what is still structural.
NextRush 3.1 — a unified class runtime, 35 packages, one core
Where NextRush stands today: core packages at 3.1.0, a consolidated class-based runtime, and a modular package tree you install piece by piece.
Why we consolidated into @nextrush/class
The former decorators/controllers/di split created a three-package tax for one feature. Here's why NextRush merged them into a single class runtime.