[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
amqplib (source)	^2.2.0 → ^2.3.1

---

Release Notes

amqp-node/amqplib (amqplib)

v2.3.1

Compare Source

• Throw a clear RangeError from publish when an encoded headers or arguments table exceeds the 64 KiB encoding buffer. Previously the outcome depended on where the boundary fell: a string or Buffer value crossing the end of the buffer was silently truncated, producing a frame whose table length prefix did not match its contents, which RabbitMQ rejected by closing the connection with a 541 INTERNAL_ERROR after publish had returned; at other positions a bare offset is out of range error escaped from publish instead (fixes #​867)

v2.3.0

Compare Source

• Reject a connection.tune whose frameMax is below the protocol minimum of 4096 (the spec allows 0 or at least frame-min-size). Previously such a value was accepted, and the first publish whose encoded frames total 2048 bytes or more entered a loop in sendContent that never advanced, exhausting memory. sendContent now also throws if frameMax leaves no room for a body frame (GHSA-37f9-7m79-6866, reported by Rizwan Bedekar (@​r-bedekar); fix based in part on their patch and tests)
• Add a maxFrameSize connection option, also settable as a URL query parameter, bounding the payload size of frames accepted from the server. The default is 64 MiB, or the negotiated frameMax if that is larger, so raising frameMax needs no second option; 0 disables the limit. Incoming frame sizes were previously unchecked, so a frame header declaring up to 4 GiB made the client buffer, and repeatedly re-copy, that much data before looking at it. An oversized frame is now refused from its header alone and closes the connection with Frame size N exceeds maxFrameSize M. The limit is deliberately separate from the negotiated frameMax, since some brokers send larger frames without splitting them (see #​784). Upgrade note: a broker that delivers an unsplit frame larger than the limit will now have that connection closed; pass maxFrameSize: 0, or a higher value, to restore the previous behaviour (GHSA-37f9-7m79-6866)

v2.2.1

Compare Source

• Return the server acknowledgement from promise-based channel.cancel, matching the callback API (thanks @​edsonsims).
• Type cancel replies as Replies.Cancel ({ consumerTag }) in both the promise and callback API declarations, which previously claimed Replies.Empty.
• Fix callback-based waitForConfirms never calling back when invoked after the confirm channel closed with unconfirmed messages; it now yields a channel closed error, matching the promise API (thanks @​youdie006).
• waitForConfirms (both APIs) now always fails with channel closed after the channel closes with unconfirmed messages. Previously it reported success if every outstanding message had its own callback, or on any call after the first.
• The callback API's waitForConfirms callback is now required in the TypeScript declarations, matching the docs. Calling it without one threw at runtime.
• Replace .npmignore with a files allowlist in package.json so the published package no longer includes tests, tooling config, dotfiles or the defs generator. Install size drops from 577 kB to 358 kB (fixes #​859, thanks @​rubiesonthesky)

---

Configuration

📅 Schedule: (in timezone Europe/Madrid)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!