diff --git a/README.md b/README.md index e348bd1..54b8966 100644 --- a/README.md +++ b/README.md @@ -29,7 +29,7 @@ Please create an [issue](https://github.com/FrauJulian/Discord-Audio-Stream/issu ### Installation -**Node.js `22.12.0` or newer is required.** +**Node.js `22.22.3` or newer is required.** Install the library and the required voice packages: @@ -208,88 +208,6 @@ The package exports these error classes: Configuration problems, such as a missing source or invalid URL, throw `AudioManagerConfigError`. Invalid lifecycle operations, such as calling `pause()` while nothing is playing, throw `AudioManagerStateError`. -## 📋 Migration From `0.7` - -Version `1.0` intentionally breaks the old PascalCase API. - -| Old | New | -| -------------------------------------------------------- | ------------------------------------------------------------------- | -| `new AudioManager('Native', renewMs, connection, audio)` | `new AudioManager({ ffmpeg, renewIntervalMs, connection, source })` | -| `OverrideVoiceConnectionData(...)` | `setConnection(...)` | -| `OverrideVoiceAudioDataModel(...)` | `setSource(...)` | -| `CreateConnection()` | `connect()` | -| `PlayAudio()` | `play()` | -| `CreateAndPlay()` | `start()` | -| `PauseAudio()` | `pause()` | -| `ResumeAudio()` | `resume()` | -| `StopConnection()` | `stop()` | -| `SetVolume(...)` | `setVolume(...)` | -| `Dispose()` | `dispose()` | - -Old connection data: - -```ts -{ - VoiceChannelId: voiceChannel.id, - GuildId: guild.id, - VoiceAdapter: guild.voiceAdapterCreator, -} -``` - -New connection data: - -```ts -{ - channelId: voiceChannel.id, - guildId: guild.id, - adapterCreator: guild.voiceAdapterCreator, -} -``` - -Old resource data: - -```ts -{ - ResourceType: ('Link', Resource, 'https://example.com/audio.mp3'); -} -{ - ResourceType: ('File', Resource, 'audio/intro.mp3'); -} -``` - -New source data: - -```ts -{ - type: ('url', url, 'https://example.com/audio.mp3'); -} -{ - type: ('file', path, 'audio/intro.mp3'); -} -``` - -Old ffmpeg modes: - -```ts -'Native'; -'Standalone'; -``` - -New ffmpeg modes: - -```ts -{ - ffmpeg: { - mode: 'native'; - } -} -{ - ffmpeg: { - mode: 'static'; - } -} -``` - ## 🧑‍💻 Development ```bash @@ -298,14 +216,6 @@ npm run check npm run build ``` -`npm run check` runs formatting, linting, type-aware linting, TypeScript type checking, and unit tests. - -Release version stamping is separate from normal builds: - -```bash -npm run release:version -``` - ## 📋 Contributors ~ [**FrauJulian - Julian Lechner**](https://fraujulian.xyz/) - CODEOWNER diff --git a/SECURITY.md b/SECURITY.md index 1710fcb..cc0c0f9 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -2,17 +2,54 @@ ## Supported Versions -Use this section to tell people about which versions of your project are -currently being supported with security updates. +Security fixes are provided for the latest published release line. -| Version | Supported | -| ------- | ------------------ | -| 0.1.x | :white_check_mark: | +| Version | Supported | +| ----------------------------------------- | --------- | +| Latest release | Yes | +| Older releases | No | +| Unreleased local forks or modified builds | No | + +If a vulnerability is fixed, the fix will generally be released only for the current supported version unless a backport is clearly necessary. ## Reporting a Vulnerability -Use this section to tell people how to report a vulnerability. +Do not open a public GitHub issue for security vulnerabilities. -Tell them where to go, how often they can expect to get an update on a -reported vulnerability, what to expect if the vulnerability is accepted or -declined, etc. +Report vulnerabilities privately by email to `fraujulian@lechner.top`. + +Please include: + +- A clear description of the issue and the expected security impact. +- Affected package version or commit, Node.js version, and runtime environment. +- Reproduction steps, proof of concept, or a minimal example. +- Any relevant logs, stack traces, or dependency details. +- Whether you believe the issue is already publicly known. + +## What To Expect + +- Initial acknowledgement is targeted within 7 days. +- After triage, you may be asked for more detail or validation. +- If the report is accepted, a fix will be prepared and released as soon as reasonably possible. +- Coordinated disclosure is preferred. Please wait for a fix or explicit approval before publishing details. +- If the report is out of scope or not reproducible, you will be told why. + +## Scope + +This policy covers vulnerabilities in the published `discord-audio-stream` package itself. + +Examples that may be in scope: + +- Input handling issues that could cause unsafe process execution behavior. +- Vulnerabilities caused by package logic, lifecycle management, or exposed API behavior. +- Security-relevant documentation mistakes that would realistically lead users into unsafe deployment. + +Examples that are usually out of scope: + +- Vulnerabilities in third-party dependencies that are not introduced by this package. +- Misconfiguration in a consuming bot, Discord server, host OS, or infrastructure. +- Denial of service caused solely by unsupported environments or intentionally extreme workloads. + +## Disclosure + +When a report is confirmed, the goal is to publish a fix and then disclose the issue responsibly through the repository release notes, commit history, or an advisory, depending on severity and impact.