Skip to content

fix(deps): update dependency rate-limiter-flexible to v11 - #16572

Open
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/rate-limiter-flexible-11.x
Open

fix(deps): update dependency rate-limiter-flexible to v11#16572
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/rate-limiter-flexible-11.x

Conversation

@renovate

@renovate renovate Bot commented Jul 1, 2026

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Change Age Confidence
rate-limiter-flexible 5.0.5 → 11.2.0 age confidence

Release Notes

animir/node-rate-limiter-flexible (rate-limiter-flexible)

v11.2.0: Expiring Queue items

Compare Source

What's Changed

New Contributors

Full Changelog: animir/node-rate-limiter-flexible@v11.1.1...v11.2.0

🌠

v11.1.1: Dynamic execEvenlyMinDelayMs

Compare Source

What's Changed

  • fix execEvenlyMinDelayMs not reflecting points/duration mutation by @​quad in #​364 Thanks!

New Contributors

Full Changelog: animir/node-rate-limiter-flexible@v11.1.0...v11.1.1

🚉

v11.1.0: Dump and restore for Memory limiter

Compare Source

What's Changed

This is a best-effort persistence mechanism for graceful restarts (SIGTERM/SIGINT), blue/green deploys, or writing a snapshot to disk on shutdown.

Use this when losing up to 1% of request counts won’t affect security or finances, such as in overload or DoS protection.

New Contributors

Full Changelog: animir/node-rate-limiter-flexible@v11.0.2...v11.1.0

🔶

v11.0.2: Drizzle-orm v1 support

Compare Source

What's Changed

Full Changelog: animir/node-rate-limiter-flexible@v11.0.1...v11.0.2

😉

v11.0.1: Fix msBeforeNext delayed response

Compare Source

What's Changed

Full Changelog: animir/node-rate-limiter-flexible@v11.0.0...v11.0.1

👀

v11.0.0: Wrappers don't require points and duration options

Compare Source

What's Changed

  • #​356 fix do not require points and duration options in wrappers by @​animir in #​357
  • RateLimiterCompatibleAbstract lightweight base class for custom wrappers
    Added a minimal abstract class that defines the core interface (consume, get, set, delete, penalty, reward, block, getKey) without requiring the full RateLimiterAbstract implementation. This makes it easy to build custom wrappers that work seamlessly with RateLimiterUnion, RLWrapperTimeouts, and insurance limiters.
  • Fixed RateLimiterStoreAbstract.set() incorrectly calling _block instead of _set
  • Fixed key parsing when keyPrefix is empty

[BREAKING CHANGES]
RLWrapperBlackAndWhite now extends RateLimiterCompatibleAbstract, and all union/wrapper/insurance classes accept both abstract types via a new isRateLimiterCompatible helper.

⏲️

Full Changelog: animir/node-rate-limiter-flexible@v10.0.1...v11.0.0

v10.0.1: AI docs fix

Compare Source

Full Changelog: animir/node-rate-limiter-flexible@v10.0.0...v10.0.1

v10.0.0: Require points and duration opts

Compare Source

What's Changed

[BREAKING CHANGES]

  • Require points and duration options by @​animir in #​354

    No default values are set for points and duration options starting from v10. Negative points will not be replaced by default points value 4.
    Validation rules apply.

    Error is thrown during limiter creation if points or duration is invalid:

    1. points must be number.

      Any limiter accepts negative points as valid option starting from v10. If you migrate from older version, be careful: If in your code points option is set to negative value and that works for your project now then you should review the logic in your project. After update to version 10, negative points value will not be replaced by 4 by default as it was prior to version 10.

      When your limiter has negative or zero points consume method call is always rejected since there is always not enough points to consume. You can set points to negative and play with reward and consume calls, that could be useful sometimes.

    2. duration must be non-negative number >= 0. Error is thrown during limiter creation if duration option has invalid value.

    Requiring points and duration seems logical for security package. We don't want our apps working not as we expect even if there is no security threat. This update removes uncertaincy about negative duration and zero points.

[OTHER UPDATES]

  • Faster memory limiter and block mechanism by @​animir in #​355

    Internal memory storage implementation refactored for Map with timestamps instead of Date objects.

    Memory limiter is faster on 10-15% now on high traffic with diverse keys. Tests show performance improvement from 2569948 ops/sec to 2885688 ops/sec on my laptop.

Full Changelog: animir/node-rate-limiter-flexible@v9.1.1...v10.0.0

🐚

v9.1.1: Sequelize v7 support

Compare Source

What's Changed

🔔

v9.1.0: Non atomic Redis limiter

Compare Source

What's Changed

💬

v9.0.1: Fixes: Queue and DynamoDB

Compare Source

What's Changed

  • RateLimiterQueue: maxQueueSize default param when opts is set to {} by @​sevauni in #​340
  • RateLimiterDynamo: return null for expired keys in get() method by @​anasdevv in #​341

New Contributors

Full Changelog: animir/node-rate-limiter-flexible@v9.0.0...v9.0.1

📶

v9.0.0: Mongoose 9 support

Compare Source

What's Changed

BREAKING CHANGES

  • Dropped support for MongoDB Native Driver version prior 4.0.0
  • Dropped support for Mongoose package version prior to 5.2.0

😋

v8.3.0: Timeouts wrapper fixed

Compare Source

RLWrapperTimeouts can be imported from defaults:

import { RLWrapperTimeouts } from "rate-limiter-flexible";

Use it with or without insuranceLimiter to handle long requests to a storage.
Read more in docs.

Thank you @​florian-schunk

💧

v8.2.1: Fix Insurance Strategy

Compare Source

This patch reverts v8.2.0 changes. Timeouts Wrapper changed how Insurance Strategy treats rejected promises from working stores.

If you're on the version 8.2.0, please update to v8.2.1.
The impact of 8.2.0 changes is that when main limiter rejected consume or any other method call because there were not enough points on store, insurance limiter consume method was mistakenly called. This logic is incorrect as Insurance Strategy should handle only store errors.

v8.2.0: Timeouts wrapper

Compare Source

Added a new RLWrapperTimeouts.
It can be used with or without insuranceLimiter to handle long requests to a storage.

Thanks to @​florian-schunk .

✌️

v8.1.0: fix node-redis v4+ client is ready checks

Compare Source

  • Improved node-redis package client is ready checks. All versions and cluster mode is supported now.

Thanks to @​Neumann-Nils

☺️

v8.0.1: Fix TS definitions

Compare Source

  • v8.0.0 [BREAKING CHANGES] RateLimiterQueueError import was changed in TypeScript projects.
    It should be imported from defaults now.

    import { RateLimiterQueueError } from "rate-limiter-flexible"

    TS definition for RateLimiterQueueError was moved to types.d.ts.

  • v8.0.1: index.d.ts file was moved outside of lib directory and renamed to types.d.ts.

Thanks @​wildfluss and @​PaulAnnekov for help.

💿

v8.0.0

Compare Source

v7.4.0: Drizzle ORM support

Compare Source

  • In version 7.2.0 RateLimiterDrizzle limiter was added. Read about it on wiki
    Thanks @​Nayanchandrakar !

  • In version 7.3.0 disableIndexesCreation option added to RateLimiterMongo.

  • In version 7.3.1 conditional require of drizzle-orm was replaced with dynamic import to avoid issues with linters and tree-shakers.

  • In version 7.3.2 drizzle-orm lazy import is hidden behind function call and string concatenation to avoid unnecessary tree-shaking and statistical analysis in different bundlers.

  • In version 7.4.0 RateLimiterDrizzleNonAtomic was added. It doesn't guarantee precise events count under race conditions, but much faster than atomic limiter.

💫

v7.3.2

Compare Source

v7.3.1

Compare Source

v7.3.0

Compare Source

v7.2.0

Compare Source

v7.1.1: Check points before upserting with Redis

Compare Source

  • RateLimiterRedis limiter checks if points value is an integer and throws a clear error otherwise. This helps to avoid mysterious errors provided by Lua script when consuming a floating-point number of points, e.g. 2.1.
    Thank you @​roggervalf

🌞

v7.1.0: Etcd support

Compare Source

This is the first time we add atomic and non-atomic limiters for the same storage. Atomic increments are necessary to count sensitive things like incorrect password or PIN tries while non-atomic increments may be better (because they are faster) when exact count doesn't matter, e.g. to protect a service against DDoS attack.

Thank you @​Tobias4872
🍇

v7.0.0

Compare Source

What's Changed

  • feat: add RateLimiterValkeyGlide to support Valkey Glide @​avifenesh in #​302 Thank you!
  • X-RateLimit-Reset header example was fixed. It should be Math.ceil((Date.now() + rateLimiterRes.msBeforeNext) / 1000). Thanks to @​Fdavidtr.
  • [BREAKING CHANGE] Node.js 18 support removed.

New Contributors

Full Changelog: animir/node-rate-limiter-flexible@v6.2.1...v7.0.0

🐆

v6.2.1: SQLite: fix Knex connection issue

Compare Source

  • RateLimiterSQLite: This fixes an issue where an unused Knex connection remained open, causing pool connection problems. Additionally, this adds functions to run tests against Knex.
    Thanks to @​muco-rolle
    📌

v6.2.0: Multiple SQLite clients support

Compare Source

  • RateLimiterSQLite supports sqlite3, better-sqlite3 and knex clients now.
    Set storeType option to one of sqlite3, better-sqlite3 or knex, defaults to sqlite3 if not set.
    Thank you @​muco-rolle
    🎁

v6.1.0: SQLite support

Compare Source

Just a day after Valkey limiter release we are releasing SQLite support. One new database and one old (but still good) added to the list of the big family. Congrats!

v6.0.0: Valkey support [zap]

Compare Source

  • RateLimiterValkey added. Thanks to @​gurgunday rate-limiter-flexible supports Valkey now! ⚡
    It can be used with iovalkey package.

  • [breaking] Node.js support for version 16 was dropped.

Configuration

📅 Schedule: (in timezone America/Los_Angeles)

  • Branch creation
    • "on the first day of the month"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Never, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@vercel

vercel Bot commented Jul 1, 2026 •
edited
Loading

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
governance Ready Ready Preview, Comment Jul 1, 2026 10:55pm
2 Skipped Deployments
Project Deployment Actions Updated (UTC)
unlock-airdrops Ignored Ignored Preview Jul 1, 2026 10:55pm
unlock-storybook Ignored Ignored Preview Jul 1, 2026 10:55pm

Request Review

@cla-bot cla-bot Bot added the cla-signed label Jul 1, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

cla-signed

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants