Skip to main content

Support Policy

@nest-native/asyncapi is a community package and does not claim official NestJS or AsyncAPI status.

Supported Runtime Lines​

RuntimeSupported line
Node.js>=22 (>=22.12 with NestJS 12 — see the note below the table)
NestJS^11.0.0 || ^12.0.0
AsyncAPI spec target3.0 (2.x: best-effort conversion only)
TypeScriptCurrent project compiler line

Required peers are @nestjs/common, @nestjs/core, reflect-metadata, and rxjs. The AsyncAPI parser, the viewer, @nestjs/swagger, class-validator, and zod are optional peers — install only the ecosystems your application uses.

The Node.js floor depends on which end of the NestJS range you are on. NestJS 11 runs on any Node.js >=22. NestJS 12 is ESM-only, and a CommonJS application loads it through Node's require(esm), which is behind a flag before Node.js 22.12.0 — so the 12 end of the range needs Node.js >=22.12. engines stays >=22 because the 11 end does not need more. 12 also runs lifecycle hooks by component hierarchy level rather than registration order, which this package never depended on. Both ends of the NestJS range are tested: the default install and lockfile stay on an 11.x in the middle of it, and the nestjs-compat CI matrix installs each end on top, proves every workspace resolved exactly that, and re-runs the suite, the build, and the full sample matrix — including the @nestjs/swagger schema chain and the @nestjs/microservices migration sample — against it. The published range is ^11.0.0 || ^12.0.0; the oldest installable 11 graph we run is framework 11.0.1 with @nestjs/swagger@11.4.4, pinned exactly, because every swagger 11.x peers on @nestjs/common and @nestjs/core ^11.0.1 (this package itself uses nothing added after 11.0.0). The other leg floats on ^12.0.0. Each leg proves every workspace resolves exactly that version and that every peer range in the NestJS ecosystem holds in the final tree, which catches the peer conflicts npm merely warns about. When you document DTOs on NestJS 12, install @nestjs/swagger 12 alongside (the optional peer range is ^11.4.4 || ^12.0.0): its own peer range requires @nestjs/common and @nestjs/core 12.

Public API Tiers​

Primary application APIs:

  • AsyncApiModule.forRoot() / forRootAsync() / setup()
  • @AsyncApiChannel()
  • @AsyncApiPub() / @AsyncApiSub()
  • @AsyncApiMessage() / @AsyncApiHeaders()
  • @AsyncApiServer()
  • getAsyncApiDocument()

Binding APIs:

  • @AsyncApiChannelBindings() / @AsyncApiOperationBindings() / @AsyncApiMessageBindings()
  • AsyncApiProtocol and the typed binding interfaces

Advanced integration APIs:

  • buildAsyncApiDocument()
  • AsyncApiSchemaRegistry
  • toJson() / toYaml() serializers
  • escapeJsonPointerSegment() / buildRef() reference helpers

Prefer primary APIs in normal application code. Use advanced APIs only when an external integration or focused test needs the exact internal contract.

Dependency Policy​

The published package keeps "dependencies": {} empty. Runtime integrations belong in peerDependencies, and package-local build/test tools belong in devDependencies.

This avoids pulling a second Nest runtime, a surprise AsyncAPI parser, a heavy viewer bundle, or an unused validation stack into host applications.

Security Expectations​

Security review should cover:

  • dependency additions and lockfile churn
  • install and lifecycle scripts on every dependency change
  • docs-route authentication boundaries
  • XSS in the rendered viewer content
  • secret leakage in docs, samples, example payloads, and tests
  • URL injection in @AsyncApiServer configurations

High-risk findings should block merge until they are mitigated or explicitly accepted by maintainers. See Security.