chore: release 3.3.4

Author: rockyshi1993

CHANGELOG.md

@@ -1,18 +1,19 @@
 # CHANGELOG
 
-> Summary index — the 3.3.3 versioned details are in [changelogs/v3.3.3.md](./changelogs/v3.3.3.md). A versioned note does not establish npm publication; check the registry and immutable tag before deployment.
-> **Last updated**: 2026-10-23
+> Summary index — the 3.3.4 versioned details are in [changelogs/v3.3.4.md](./changelogs/v3.3.4.md). A versioned note does not establish npm publication; check the registry and immutable tag before deployment.
+> **Last updated**: 2026-10-26
 
 ---
 
 ## Unreleased
 
-The schema-dsl 3.0.5 dependency upgrade is assigned to **3.3.3** ([versioned notes](./changelogs/v3.3.3.md)); the audited 3.3.2 repairs are in its [versioned notes](./changelogs/v3.3.2.md) and the [next-change staging log](https://github.com/devcodex-labs/monSQLize/blob/main/changelogs/unreleased.md). Untagged checkouts remain release candidates.
+The weekly-scan cache-key, health-check and lockfile security fixes are assigned to **3.3.4** ([versioned notes](./changelogs/v3.3.4.md)); the schema-dsl 3.0.5 upgrade is in [3.3.3](./changelogs/v3.3.3.md); the audited 3.3.2 repairs are in its [versioned notes](./changelogs/v3.3.2.md) and the [next-change staging log](https://github.com/devcodex-labs/monSQLize/blob/main/changelogs/unreleased.md). Untagged checkouts remain release candidates.
 
 ## Version Overview
 
 | Version | Date | Summary | Details |
 |---------|------|---------|---------|
+| [v3.3.4](./changelogs/v3.3.4.md) | 2026-10-26 | Patch: cached-read keys under autoConvertObjectId, hung health-check pings, lockfile security patches | [View](./changelogs/v3.3.4.md) |
 | [v3.3.3](./changelogs/v3.3.3.md) | 2026-10-23 | Patch: pin schema-dsl 3.0.5 (dependency bug fixes only) | [View](./changelogs/v3.3.3.md) |
 | [v3.3.2](./changelogs/v3.3.2.md) | 2026-10-22 | Patch: BSON/cache identity, Model invalidation, pagination, transaction/sync lifecycle and upgrade safeguards; availability requires registry/tag verification | [View](./changelogs/v3.3.2.md) |
 | [v3.3.1](./changelogs/v3.3.1.md) | 2026-09-23 | Patch: audited Model, count, transaction, cache, sync, pool, Data Task and SSH corrections | [View](./changelogs/v3.3.1.md) |

README.md

@@ -14,7 +14,7 @@ Upgrade and security: [Migration Guide](./MIGRATION.md) · [Private Vulnerabilit
 
 The npm `latest` dist-tag and GitHub Pages are the stable channel; `main` may contain the next release. Pages deployment accepts only a versioned Git tag whose package version is already present on npm, so unpublished APIs are not promoted as stable documentation. The Google site ownership verification file is copied separately from the workflow commit, with its source commit and content hash recorded in the deployment summary.
 
-This source tree targets **3.3.3**, a dependency-only patch pinning `schema-dsl@3.0.5` (see the [3.3.3 notes](./changelogs/v3.3.3.md)). The 3.3.2 cache, Model, pagination and sync fixes, including cold-cache upgrades and checkpoint rollback limits, are described in the [3.3.2 notes](./changelogs/v3.3.2.md) and [migration guide](./MIGRATION.md). Read the upgrade guide in [English](https://github.com/devcodex-labs/monSQLize/blob/main/docs/en/upgrade-3.3.2.md) or [简体中文](https://github.com/devcodex-labs/monSQLize/blob/main/docs/zh/upgrade-3.3.2.md). Untagged checkouts remain release candidates; verify the immutable tag and requested registry version before deployment. Candidate preparation does not publish npm or update stable Pages.
+This source tree targets **3.3.4**, a patch fixing cached-read keys under `autoConvertObjectId`, hung health-check pings and lockfile security advisories (see the [3.3.4 notes](./changelogs/v3.3.4.md)); 3.3.3 pinned `schema-dsl@3.0.5`. The 3.3.2 cache, Model, pagination and sync fixes, including cold-cache upgrades and checkpoint rollback limits, are described in the [3.3.2 notes](./changelogs/v3.3.2.md) and [migration guide](./MIGRATION.md). Read the upgrade guide in [English](https://github.com/devcodex-labs/monSQLize/blob/main/docs/en/upgrade-3.3.2.md) or [简体中文](https://github.com/devcodex-labs/monSQLize/blob/main/docs/zh/upgrade-3.3.2.md). Untagged checkouts remain release candidates; verify the immutable tag and requested registry version before deployment. Candidate preparation does not publish npm or update stable Pages.
 
 This development source is pinned to verified registry `schema-dsl@3.0.5`. The v3 package remains subject to the full release gate before an immutable tag and npm publication.
 

changelogs/unreleased.md

@@ -1,12 +1,8 @@
 # Unreleased
 
-## Changes after v3.3.3
+## Changes after v3.3.4
 
-The schema-dsl 3.0.5 upgrade is assigned to the [3.3.3 versioned notes](./v3.3.3.md). Publication is established by the npm registry and immutable tag, not this file.
-
-- Key cached `find`, `findOne`, `count` and `distinct` reads by the exact filter sent to MongoDB. With `autoConvertObjectId`, a filter whose `toBSON()` yields a 24-hex string `_id` no longer shares a cache entry with the equivalent `ObjectId` query; plain string filters still convert and share keys as before. Uncached results, invalidation descriptors and public signatures are unchanged.
-- Let a health check whose ping hangs past `timeout` keep counting failures: later checks wait on the same pending ping instead of skipping, so the pool reaches `down` after `retries` timeouts. Still only one ping per pool is in flight, and a late ping result cannot overwrite newer status.
-- Refresh lockfile-only security patches: `fast-uri` 3.1.9 (production, via schema-dsl/ajv; clears 4 GHSA advisories that failed `test:audit`), dev-only `follow-redirects` 1.16.2 and overridden `brace-expansion` 1.1.21/5.0.12. No direct dependency version changes.
+No changes have been staged after 3.3.4. The weekly-scan fixes are assigned to the [3.3.4 versioned notes](./v3.3.4.md). Publication is established by the npm registry and immutable tag, not this file.
 
 ## Archived preparation notes for the 3.3.2 candidate
 

changelogs/v3.3.4.md

@@ -0,0 +1,21 @@
+# monSQLize v3.3.4
+
+> Release date: 2026-10-26
+> Publication authority: the immutable tag and npm registry. An untagged checkout is a release candidate; the date above does not establish registry availability.
+
+## Highlights
+
+Bug-fix and security patch. Public entry points, signatures, Node.js `>=18`, build formats and package budgets remain unchanged from 3.3.3.
+
+## Fixed
+
+- Key cached `find`, `findOne`, `count` and `distinct` reads by the exact filter sent to MongoDB. With `autoConvertObjectId`, a filter whose `toBSON()` yields a 24-hex string `_id` no longer shares a cache entry with the equivalent `ObjectId` query; plain string filters still convert and share keys as before. Uncached results, invalidation descriptors and public signatures are unchanged.
+- Let a health check whose ping hangs past `timeout` keep counting failures: later checks wait on the same pending ping instead of skipping, so the pool reaches `down` after `retries` timeouts. Still only one ping per pool is in flight, and a late ping result cannot overwrite newer status.
+
+## Security
+
+- Refresh lockfile-only security patches: `fast-uri` 3.1.9 (production, via schema-dsl/ajv; clears 4 GHSA advisories that failed `test:audit`), dev-only `follow-redirects` 1.16.2 and overridden `brace-expansion` 1.1.21/5.0.12. No direct dependency version changes.
+
+## Upgrade and rollback
+
+No migration is required. Cached reads whose filter uses `toBSON()` with `autoConvertObjectId` get a new key and are read once from MongoDB after upgrade; all other cache keys are unchanged. Rollback to 3.3.3 restores the previous behavior and lockfile.

package-lock.json

@@ -1,6 +1,6 @@
 {
     "name": "monsqlize",
-    "version": "3.3.3",
+    "version": "3.3.4",
     "description": "TypeScript production data runtime layer for MongoDB today, with cache, transactions, pools, models, sync, and observability",
     "type": "commonjs",
     "main": "./dist/cjs/index.cjs",
@@ -22,6 +22,7 @@
     },
     "files": [
         "changelogs/v3.3.3.md",
+        "changelogs/v3.3.4.md",
         "changelogs/v3.3.2.md",
         "changelogs/v3.3.1.md",
         "changelogs/v3.3.0.md",

package.json

@@ -1,6 +1,6 @@
 {
-  "generatedAt": "2026-10-23",
-  "packageVersion": "3.3.3",
+  "generatedAt": "2026-10-26",
+  "packageVersion": "3.3.4",
   "support": {
     "node": {
       "declared": ">=18.0.0",