[dependabot]

Bumps the production-dependencies group with 23 updates in the /api directory:

Package	From	To
@nestjs/cache-manager	2.3.0	12.0.1
@nestjs/common	10.4.22	12.2.0
@nestjs/core	10.4.22	12.2.0
@nestjs/jwt	10.2.0	12.0.3
@nestjs/platform-express	10.4.22	12.2.0
@nestjs/platform-socket.io	10.4.22	12.2.0
@nestjs/schedule	4.1.2	12.0.2
@nestjs/swagger	7.4.2	12.0.3
@nestjs/terminus	10.3.0	12.1.0
@nestjs/throttler	6.5.0	6.7.1
@nestjs/websockets	10.4.22	12.2.0
@opentelemetry/api	1.9.1	1.10.0
@opentelemetry/auto-instrumentations-node	0.54.0	0.82.0
@opentelemetry/exporter-trace-otlp-http	0.57.2	0.300.0
@opentelemetry/sdk-node	0.57.2	0.300.0
cache-manager	5.7.6	7.2.9
compression	1.8.1	1.8.2
helmet	8.1.0	8.3.0
nodemailer	6.10.1	10.2.1
pg	8.21.0	8.23.1
reflect-metadata	0.1.14	0.2.2
sanitize-html	2.17.5	2.18.1
socket.io	4.8.3	4.8.4

Updates @nestjs/cache-manager from 2.3.0 to 12.0.1

Release notes

Sourced from @​nestjs/cache-manager's releases.

Release 12.0.1

What's Changed

• fix: apply module namespace and ttl to keyv instance stores by @​Asadshah7950 in nestjs/cache-manager#1188

New Contributors

• @​Asadshah7950 made their first contribution in nestjs/cache-manager#1188

Full Changelog: nestjs/cache-manager@12.0.0...12.0.1

Release 12.0.0

What's Changed

@nestjs/cache-manager is now a native ES module, and the major version is aligned with the Nest 12 release line (there is no 4.x — 3.1.3 goes straight to 12.0.0).

ESM migration

The package is published as pure ESM ("type": "module", compiled with NodeNext) behind a proper exports map. The legacy root index.js / index.d.ts / index.ts shims are gone, and deep imports into build internals are no longer resolvable — import from the package root:

import { CacheModule, CacheInterceptor, CacheKey, CacheTTL } from '@nestjs/cache-manager';

require(esm) — CommonJS still works

You do not need to convert your app to ESM. Thanks to Node's require(esm) support, CommonJS consumers can keep using require('@nestjs/cache-manager') unchanged — the exports map points both import and require at the same ESM build, and Node loads it natively.

This is why the supported Node range is now enforced via engines:

"engines": {
  "node": "^20.19.0 || ^22.12.0 || >=24.0.0"
}

Those are the Node versions where require(esm) is available unflagged. On older Node versions, requiring this package from CommonJS will fail with ERR_REQUIRE_ESM.

Upgrading

npm i @nestjs/cache-manager@12

Checklist:

• Ensure you're on Node ^20.19.0, ^22.12.0, or >=24.0.0.
• Replace any deep imports (e.g. @nestjs/cache-manager/dist/...) with root imports.
• No changes needed to CacheModule.register() / registerAsync(), interceptors, or decorators.

Release 3.1.3

What's Changed

... (truncated)

Commits

• ba7b70a chore(): release v12.0.1
• 867c15e chore(deps): update dependency @​types/node to v24.19.1 (#1186)
• 0cb657c Merge pull request #1185 from nestjs/renovate/vite-8.x
• 947038e chore(deps): update dependency vite to v8.3.3
• 0deb091 Merge pull request #1183 from nestjs/renovate/oxlint-monorepo
• 2ef8516 chore(deps): update dependency oxlint to v1.87.0
• 872fd03 Merge pull request #1182 from nestjs/renovate/nest-monorepo
• 4b42dba Merge pull request #1184 from nestjs/renovate/vitest-monorepo
• 0bcad8a Merge pull request #1189 from nestjs/renovate/supertest-7.x
• 8c43fc8 Merge pull request #1190 from nestjs/renovate/release-it-21.x
• Additional commits viewable in compare view

Updates @nestjs/common from 10.4.22 to 12.2.0

Release notes

Sourced from @​nestjs/common's releases.

v12.2.0 (2026-10-19)

Notable changes

New options

• @Sse({ maxPendingDataLength }) sets how many characters of event data may wait for a client that is not reading its events (4M by default; 0 or Infinity lifts the limit) – 2f05ad954e
• IoAdapter and WsAdapter take maxConcurrentMessages, the number of a client's messages handled at once (1000 by default; Infinity lifts it) – 0bd0810ed7
• ValidationPipe takes maxErrorMessagesLength (1,000,000 characters by default); messages past it are replaced by a "Further validation errors were omitted" entry – 086c1c514f
• Kafka: parser.maxMessageSize (16 MiB after decompression by default); larger messages are logged and skipped – 9bdf844fca
• TCP server: drainTimeout (30 s by default, 0 disables) disconnects a peer that leaves its responses unread – 583d6077ad
• MQTT server: reconnectOnConnackError is now enabled by default, so a refused connection attempt is retried; set it to false for the previous behaviour – a63cea600a
• HttpServer.getRouteMatchingOptions(), an optional adapter hook that tells core how the router matches paths (see "Middleware exclusions" below) – 08d8677c8d

New defaults and behaviour changes

• @nestjs/platform-express, @nestjs/platform-fastify: fieldNestingDepth and fieldArrayIndexLimit (#18074) now default to 32 and 1000; set them to Infinity to lift the limits – 94fcc93770
• ValidationPipe validates with validationError.target: false unless the options set it, so an exceptionFactory that reads error.target gets undefined; set validationError.target to true for the old errors – 8c5a59bf63
• ValidationPipe answers an array or a primitive sent for a validated class with a 400 – 197371c1f3
• FileTypeValidator matches a string fileType up to the end of a name (e.g. font/woff no longer accepts font/woff2; use a RegExp for that) – 770c6f1a19
• @SerializeOptions({}) on a handler no longer turns off the class schema – d27cb7017f
• BaseExceptionFilter answers http-errors errors created with expose: false (the default from 500) with the standard reason phrase instead of their message – 9ed572f853
• A StreamableFile error still gets a 400, but the body no longer carries the error message – 2f28d91afb
• Files uploaded with a request that a pipe rejected are removed from storage – acb98de89e
• @nestjs/platform-fastify: a route with fileSize: undefined (or null) falls back to the plugin's limit; set it to Infinity to keep uploads unlimited – dd549e1a74
• @nestjs/platform-express: object error bodies are sent as application/json on routes with a non-JSON Content-Type – 7dc6e349d5
• ConsoleLogger in JSON mode cuts a record short past about a million characters – ad4915eaa3
• A global enhancer that the injector failed to instantiate now fails the application at startup – ae78524ced
• A request- or transient-scoped APP_FILTER now logs a startup warning, as it only applies to exceptions thrown from controllers – df5275c5e1
• Microservices: a pattern key longer than 256 characters matches no handler – accd27e66c
• Kafka: a message may carry up to 10,000 header values (e419ff540b); headers given as a string or array are not sent (312777743f); reply headers are decoded as text (ee94f6aaae)
• gRPC: request streams are paused while their replies wait to be written – 37e5cf7706
• Deprecation: on TCP, Redis, NATS, MQTT and RabbitMQ, an @EventPattern() handler that replies to ClientProxy#send() now logs a deprecation warning. The reply is unchanged; in the next major version event handlers will not reply to send(), as on Kafka already – ba3668d36b

Middleware exclusions

• MiddlewareConsumer.exclude() now compiles excluded routes with the router's case and trailing-slash matching (08d8677c8d). Update @nestjs/core together with @nestjs/platform-express / @nestjs/platform-fastify: with an adapter that does not implement getRouteMatchingOptions(), excluded routes are matched exactly (f5aa875e40), so on a lenient router other spellings of an excluded path run the middleware.
• With header, media type or custom versioning, exclude({ path, method, version }) and enableCsrfProtection({ exclude }) apply only to requests that ask for one of the excluded versions – 1a7a31fa46
• @nestjs/platform-fastify: the request hook used by enableCsrfProtection() and useSecurityHeaders() now runs before Nest and app.use() middleware with NestFactory.create() too, including middleware registered before either call, as it already did with Test.createNestApplication() – 8351806290

Bug fixes

• platform-fastify
  • 614d1ac7ea fix(fastify): send the status of an exception whose body is an error (@​kamilmysliwiec)
  • 8b420f788f fix(fastify): apply middleware to plugins registered before init (@​kamilmysliwiec)
  • #18175 fix(fastify): keep raw-response cookies in the header helpers (@​johnnyhuirilef)
  • c215fd9b4f fix(fastify): match middleware paths like a case-insensitive router (@​kamilmysliwiec)
  • 43d4420205 fix(fastify): pass version extractor errors to the error handler (@​kamilmysliwiec)
  • 1435ed22f4 fix(fastify): pass middleware rejections to the error handler (@​kamilmysliwiec)
  • 84c947faf9 fix(fastify): stop reading a streamable file for a head request (@​kamilmysliwiec)
  • dd549e1a74 fix(fastify): let undefined upload limits fall back to the defaults (@​kamilmysliwiec)
  • 4735f8d050 fix(fastify): free memory storage chunks once a file is buffered (@​kamilmysliwiec)
  • 3e3e6eea6f fix(fastify): remove uploads cut off after their last chunk (@​kamilmysliwiec)
  • c04a9182b9 fix(fastify): set the security headers on router error responses (@​kamilmysliwiec)

... (truncated)

Commits

• af37111 chore(release): publish v12.2.0 release
• 770c6f1 fix(common): match a file type string up to the end of a name
• 8c5a59b fix(common): stop exposing the validated object on validation errors
• 086c1c5 fix(common): limit the length of validation error messages by default
• e77ceba fix(common): stop copying nested validation errors for each level
• 197371c fix(common): reject arrays and primitives for validated classes
• b34a359 fix(common): validate parsed array items one at a time
• 1a7a31f fix(core,common): exclude a version only for requests that ask for it
• 2f05ad9 fix(core): make the sse pending data limit configurable
• 2f28d91 fix(common): keep StreamableFile error messages out of responses
• Additional commits viewable in compare view

Updates @nestjs/core from 10.4.22 to 12.2.0

Release notes

Sourced from @​nestjs/core's releases.

v12.2.0 (2026-10-19)

Notable changes

New options

• @Sse({ maxPendingDataLength }) sets how many characters of event data may wait for a client that is not reading its events (4M by default; 0 or Infinity lifts the limit) – 2f05ad954e
• IoAdapter and WsAdapter take maxConcurrentMessages, the number of a client's messages handled at once (1000 by default; Infinity lifts it) – 0bd0810ed7
• ValidationPipe takes maxErrorMessagesLength (1,000,000 characters by default); messages past it are replaced by a "Further validation errors were omitted" entry – 086c1c514f
• Kafka: parser.maxMessageSize (16 MiB after decompression by default); larger messages are logged and skipped – 9bdf844fca
• TCP server: drainTimeout (30 s by default, 0 disables) disconnects a peer that leaves its responses unread – 583d6077ad
• MQTT server: reconnectOnConnackError is now enabled by default, so a refused connection attempt is retried; set it to false for the previous behaviour – a63cea600a
• HttpServer.getRouteMatchingOptions(), an optional adapter hook that tells core how the router matches paths (see "Middleware exclusions" below) – 08d8677c8d

New defaults and behaviour changes

• @nestjs/platform-express, @nestjs/platform-fastify: fieldNestingDepth and fieldArrayIndexLimit (#18074) now default to 32 and 1000; set them to Infinity to lift the limits – 94fcc93770
• ValidationPipe validates with validationError.target: false unless the options set it, so an exceptionFactory that reads error.target gets undefined; set validationError.target to true for the old errors – 8c5a59bf63
• ValidationPipe answers an array or a primitive sent for a validated class with a 400 – 197371c1f3
• FileTypeValidator matches a string fileType up to the end of a name (e.g. font/woff no longer accepts font/woff2; use a RegExp for that) – 770c6f1a19
• @SerializeOptions({}) on a handler no longer turns off the class schema – d27cb7017f
• BaseExceptionFilter answers http-errors errors created with expose: false (the default from 500) with the standard reason phrase instead of their message – 9ed572f853
• A StreamableFile error still gets a 400, but the body no longer carries the error message – 2f28d91afb
• Files uploaded with a request that a pipe rejected are removed from storage – acb98de89e
• @nestjs/platform-fastify: a route with fileSize: undefined (or null) falls back to the plugin's limit; set it to Infinity to keep uploads unlimited – dd549e1a74
• @nestjs/platform-express: object error bodies are sent as application/json on routes with a non-JSON Content-Type – 7dc6e349d5
• ConsoleLogger in JSON mode cuts a record short past about a million characters – ad4915eaa3
• A global enhancer that the injector failed to instantiate now fails the application at startup – ae78524ced
• A request- or transient-scoped APP_FILTER now logs a startup warning, as it only applies to exceptions thrown from controllers – df5275c5e1
• Microservices: a pattern key longer than 256 characters matches no handler – accd27e66c
• Kafka: a message may carry up to 10,000 header values (e419ff540b); headers given as a string or array are not sent (312777743f); reply headers are decoded as text (ee94f6aaae)
• gRPC: request streams are paused while their replies wait to be written – 37e5cf7706
• Deprecation: on TCP, Redis, NATS, MQTT and RabbitMQ, an @EventPattern() handler that replies to ClientProxy#send() now logs a deprecation warning. The reply is unchanged; in the next major version event handlers will not reply to send(), as on Kafka already – ba3668d36b

Middleware exclusions

• MiddlewareConsumer.exclude() now compiles excluded routes with the router's case and trailing-slash matching (08d8677c8d). Update @nestjs/core together with @nestjs/platform-express / @nestjs/platform-fastify: with an adapter that does not implement getRouteMatchingOptions(), excluded routes are matched exactly (f5aa875e40), so on a lenient router other spellings of an excluded path run the middleware.
• With header, media type or custom versioning, exclude({ path, method, version }) and enableCsrfProtection({ exclude }) apply only to requests that ask for one of the excluded versions – 1a7a31fa46
• @nestjs/platform-fastify: the request hook used by enableCsrfProtection() and useSecurityHeaders() now runs before Nest and app.use() middleware with NestFactory.create() too, including middleware registered before either call, as it already did with Test.createNestApplication() – 8351806290

Bug fixes

• platform-fastify
  • 614d1ac7ea fix(fastify): send the status of an exception whose body is an error (@​kamilmysliwiec)
  • 8b420f788f fix(fastify): apply middleware to plugins registered before init (@​kamilmysliwiec)
  • #18175 fix(fastify): keep raw-response cookies in the header helpers (@​johnnyhuirilef)
  • c215fd9b4f fix(fastify): match middleware paths like a case-insensitive router (@​kamilmysliwiec)
  • 43d4420205 fix(fastify): pass version extractor errors to the error handler (@​kamilmysliwiec)
  • 1435ed22f4 fix(fastify): pass middleware rejections to the error handler (@​kamilmysliwiec)
  • 84c947faf9 fix(fastify): stop reading a streamable file for a head request (@​kamilmysliwiec)
  • dd549e1a74 fix(fastify): let undefined upload limits fall back to the defaults (@​kamilmysliwiec)
  • 4735f8d050 fix(fastify): free memory storage chunks once a file is buffered (@​kamilmysliwiec)
  • 3e3e6eea6f fix(fastify): remove uploads cut off after their last chunk (@​kamilmysliwiec)
  • c04a9182b9 fix(fastify): set the security headers on router error responses (@​kamilmysliwiec)

... (truncated)

Commits

• af37111 chore(release): publish v12.2.0 release
• 85d0a0b fix(core): run interceptor, pipe and filter classes without a name
• 8a53d08 fix(core): detect cycles in request-scoped forward references (#18186)
• 92136a6 fix(core): give a module that extends another module its own id (#18180)
• bafce3b fix(core): answer http requests an rpc exception filter leaves
• 8f9fbfd fix(core): settle async param decorator values before pipes run
• 9b77f56 fix(core,microservices): let only the hybrid application bind gateways
• fec478e fix(core): subscribe to guard observables from other copies of rxjs
• 034ef09 fix(core): run guards bound as classes without a name
• a190887 fix(core,websockets): run transient enhancers bound to static gateways
• Additional commits viewable in compare view

Updates @nestjs/jwt from 10.2.0 to 12.0.3

Release notes

Sourced from @​nestjs/jwt's releases.

Release 12.0.3

What's Changed

• fix(jwt): reject async sign when the secret provider rejects by @​thekhegay in nestjs/jwt#2294
• fix(jwt): suppress async provider rejection on string payload error by @​thekhegay in nestjs/jwt#2295

New Contributors

• @​thekhegay made their first contribution in nestjs/jwt#2294

Full Changelog: nestjs/jwt@12.0.2...12.0.3

Release 12.0.2

What's Changed

• fix(jwt): add type overloads for decode with complete option and nullable return by @​Asadshah7950 in nestjs/jwt#2269

New Contributors

• @​Asadshah7950 made their first contribution in nestjs/jwt#2269

Full Changelog: nestjs/jwt@12.0.1...12.0.2

Release 12.0.1

• fix: jsonwebtoken esm imports (05d0075)

Release 12.0.0

What's Changed

@nestjs/jwt is now a native ES module, and the major version is aligned with the Nest 12 release line

ESM migration

The package is published as pure ESM ("type": "module", compiled with NodeNext) behind a proper exports map. The legacy root index.js / index.d.ts / index.ts shims are gone, and deep imports into build internals are no longer resolvable — import from the package root.

// ✅
import { JwtModule, JwtService } from '@nestjs/jwt';
// ❌ no longer resolvable
import { JwtService } from '@​nestjs/jwt/dist/jwt.service';

require(esm) — CommonJS still works

You do not need to convert your app to ESM. Thanks to Node's require(esm) support (Node 20.19+, 22.12+, and all of 24.x), a CommonJS Nest application can keep requiring the package exactly as before:

const { JwtModule, JwtService } = require('@nestjs/jwt');

TypeScript users compiling to CommonJS are unaffected as long as their runtime is on a supported Node version. On older Node releases, require() of this package will throw ERR_REQUIRE_ESM — upgrade Node, or switch the consuming code to import.

jsonwebtoken re-exports

... (truncated)

Commits

• 1b8f652 chore(): release v12.0.3
• 99ac1f9 fix(jwt): suppress async provider rejection on string payload error (#2295)
• 96bfd75 chore(deps): update nest monorepo to v12.1.2 (#2289)
• b74a723 chore(deps): update dependency @​types/node to v24.19.2 (#2290)
• 41ac94b chore(deps): update dependency oxlint to v1.87.0 (#2291)
• 19b1466 chore(deps): update dependency release-it to v21.1.1 (#2292)
• d399c15 chore(deps): update dependency prettier to v3.9.10 (#2293)
• 61c5e94 ci(): upgrade circleci config to version 2.1 (#2296)
• 1801d4d Merge pull request #2294 from thekhegay/fix/sign-async-secret-provider-reject
• d995c2f fix(jwt): reject async sign when the secret provider rejects
• Additional commits viewable in compare view

Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.

Updates @nestjs/platform-express from 10.4.22 to 12.2.0

Release notes

Sourced from @​nestjs/platform-express's releases.

v12.2.0 (2026-10-19)

Notable changes

New options

• @Sse({ maxPendingDataLength }) sets how many characters of event data may wait for a client that is not reading its events (4M by default; 0 or Infinity lifts the limit) – 2f05ad954e
• IoAdapter and WsAdapter take maxConcurrentMessages, the number of a client's messages handled at once (1000 by default; Infinity lifts it) – 0bd0810ed7
• ValidationPipe takes maxErrorMessagesLength (1,000,000 characters by default); messages past it are replaced by a "Further validation errors were omitted" entry – 086c1c514f
• Kafka: parser.maxMessageSize (16 MiB after decompression by default); larger messages are logged and skipped – 9bdf844fca
• TCP server: drainTimeout (30 s by default, 0 disables) disconnects a peer that leaves its responses unread – 583d6077ad
• MQTT server: reconnectOnConnackError is now enabled by default, so a refused connection attempt is retried; set it to false for the previous behaviour – a63cea600a
• HttpServer.getRouteMatchingOptions(), an optional adapter hook that tells core how the router matches paths (see "Middleware exclusions" below) – 08d8677c8d

New defaults and behaviour changes

• @nestjs/platform-express, @nestjs/platform-fastify: fieldNestingDepth and fieldArrayIndexLimit (#18074) now default to 32 and 1000; set them to Infinity to lift the limits – 94fcc93770
• ValidationPipe validates with validationError.target: false unless the options set it, so an exceptionFactory that reads error.target gets undefined; set validationError.target to true for the old errors – 8c5a59bf63
• ValidationPipe answers an array or a primitive sent for a validated class with a 400 – 197371c1f3
• FileTypeValidator matches a string fileType up to the end of a name (e.g. font/woff no longer accepts font/woff2; use a RegExp for that) – 770c6f1a19
• @SerializeOptions({}) on a handler no longer turns off the class schema – d27cb7017f
• BaseExceptionFilter answers http-errors errors created with expose: false (the default from 500) with the standard reason phrase instead of their message – 9ed572f853
• A StreamableFile error still gets a 400, but the body no longer carries the error message – 2f28d91afb
• Files uploaded with a request that a pipe rejected are removed from storage – acb98de89e
• @nestjs/platform-fastify: a route with fileSize: undefined (or null) falls back to the plugin's limit; set it to Infinity to keep uploads unlimited – dd549e1a74
• @nestjs/platform-express: object error bodies are sent as application/json on routes with a non-JSON Content-Type – 7dc6e349d5
• ConsoleLogger in JSON mode cuts a record short past about a million characters – ad4915eaa3
• A global enhancer that the injector failed to instantiate now fails the application at startup – ae78524ced
• A request- or transient-scoped APP_FILTER now logs a startup warning, as it only applies to exceptions thrown from controllers – df5275c5e1
• Microservices: a pattern key longer than 256 characters matches no handler – accd27e66c
• Kafka: a message may carry up to 10,000 header values (e419ff540b); headers given as a string or array are not sent (312777743f); reply headers are decoded as text (ee94f6aaae)
• gRPC: request streams are paused while their replies wait to be written – 37e5cf7706
• Deprecation: on TCP, Redis, NATS, MQTT and RabbitMQ, an @EventPattern() handler that replies to ClientProxy#send() now logs a deprecation warning. The reply is unchanged; in the next major version event handlers will not reply to send(), as on Kafka already – ba3668d36b

Middleware exclusions

• MiddlewareConsumer.exclude() now compiles excluded routes with the router's case and trailing-slash matching (08d8677c8d). Update @nestjs/core together with @nestjs/platform-express / @nestjs/platform-fastify: with an adapter that does not implement getRouteMatchingOptions(), excluded routes are matched exactly (f5aa875e40), so on a lenient router other spellings of an excluded path run the middleware.
• With header, media type or custom versioning, exclude({ path, method, version }) and enableCsrfProtection({ exclude }) apply only to requests that ask for one of the excluded versions – 1a7a31fa46
• @nestjs/platform-fastify: the request hook used by enableCsrfProtection() and useSecurityHeaders() now runs before Nest and app.use() middleware with NestFactory.create() too, including middleware registered before either call, as it already did with Test.createNestApplication() – 8351806290

Bug fixes

• platform-fastify
  • 614d1ac7ea fix(fastify): send the status of an exception whose body is an error (@​kamilmysliwiec)
  • 8b420f788f fix(fastify): apply middleware to plugins registered before init (@​kamilmysliwiec)
  • #18175 fix(fastify): keep raw-response cookies in the header helpers (@​johnnyhuirilef)
  • c215fd9b4f fix(fastify): match middleware paths like a case-insensitive router (@​kamilmysliwiec)
  • 43d4420205 fix(fastify): pass version extractor errors to the error handler (@​kamilmysliwiec)
  • 1435ed22f4 fix(fastify): pass middleware rejections to the error handler (@​kamilmysliwiec)
  • 84c947faf9 fix(fastify): stop reading a streamable file for a head request (@​kamilmysliwiec)
  • dd549e1a74 fix(fastify): let undefined upload limits fall back to the defaults (@​kamilmysliwiec)
  • 4735f8d050 fix(fastify): free memory storage chunks once a file is buffered (@​kamilmysliwiec)
  • 3e3e6eea6f fix(fastify): remove uploads cut off after their last chunk (@​kamilmysliwiec)
  • c04a9182b9 fix(fastify): set the security headers on router error responses (@​kamilmysliwiec)

... (truncated)

Commits

• af37111 chore(release): publish v12.2.0 release
• c8923bd fix(express,fastify): parse quoted media type version parameters (#18178)
• fb8c2ca fix(core): mount wildcard middleware on every path when "/" is excluded
• b75244f fix(express): run wildcard middleware on "/api/" for a named wildcard
• 8b8e839 fix(express): stop reading a streamable file for a head request
• acb98de fix(core,express,fastify): remove uploads of requests a pipe rejected
• 1933cc9 fix(express,fastify): handle a StreamableFile that cannot be streamed
• 7dc6e34 fix(express): send object error bodies with a json content type
• e075cda fix(express,fastify): let a route's dest replace the module's storage
• 84a16fe fix(deps): update dependency express to v5.3.0 (#18150)
• Additional commits viewable in compare view

Updates @nestjs/platform-socket.io from 10.4.22 to 12.2.0

Release notes

Sourced from @​nestjs/platform-socket.io's releases.

v12.2.0 (2026-10-19)

Notable changes

New options

• @Sse({ maxPendingDataLength }) sets how many characters of event data may wait for a client that is not reading its events (4M by default; 0 or Infinity lifts the limit) – 2f05ad954e
• IoAdapter and WsAdapter take maxConcurrentMessages, the number of a client's messages handled at once (1000 by default; Infinity lifts it) – 0bd0810ed7
• ValidationPipe takes maxErrorMessagesLength (1,000,000 characters by default); messages past it are replaced by a "Further validation errors were omitted" entry – 086c1c514f
• Kafka: parser.maxMessageSize (16 MiB after decompression by default); larger messages are logged and skipped – 9bdf844fca
• TCP server: drainTimeout (30 s by default, 0 disables) disconnects a peer that leaves its responses unread – 583d6077ad
• MQTT server: reconnectOnConnackError is now enabled by default, so a refused connection attempt is retried; set it to false for the previous behaviour – a63cea600a
• HttpServer.getRouteMatchingOptions(), an optional adapter hook that tells core how the router matches paths (see "Middleware exclusions" below) – 08d8677c8d

New defaults and behaviour changes

• @nestjs/platform-express, @nestjs/platform-fastify: fieldNestingDepth and fieldArrayIndexLimit (#18074) now default to 32 and 1000; set them to Infinity to lift the limits – 94fcc93770
• ValidationPipe validates with validationError.target: false unless the options set it, so an exceptionFactory that reads error.target gets undefined; set validationError.target to true for the old errors – 8c5a59bf63
• ValidationPipe answers an array or a primitive sent for a validated class with a 400 – 197371c1f3
• FileTypeValidator matches a string fileType up to the end of a name (e.g. font/woff no longer accepts font/woff2; use a RegExp for that) – 770c6f1a19
• @SerializeOptions({}) on a handler no longer turns off the class schema – d27cb7017f
• BaseExceptionFilter answers http-errors errors created with expose: false (the default from 500) with the standard reason phrase instead of their message – 9ed572f853
• A StreamableFile error still gets a 400, but the body no longer carries the error message – 2f28d91afb
• Files uploaded with a request that a pipe rejected are removed from storage – acb98de89e
• @nestjs/platform-fastify: a route with fileSize: undefined (or null) falls back to the plugin's limit; set it to Infinity to keep uploads unlimited – dd549e1a74
• @nestjs/platform-express: object error bodies are sent as application/json on routes with a non-JSON Content-Type – 7dc6e349d5
• ConsoleLogger in JSON mode cuts a record short past about a million characters – ad4915eaa3
• A global enhancer that the injector failed to instantiate now fails the application at startup – ae78524ced
• A request- or transient-scoped APP_FILTER now logs a startup warning, as it only applies to exceptions thrown from controllers – df5275c5e1
• Microservices: a pattern key longer than 256 characters matches no handler – accd27e66c
• Kafka: a message may carry up to 10,000 header values (e419ff540b); headers given as a string or array are not sent (312777743f); reply headers are decoded as text (ee94f6aaae)
• gRPC: request streams are paused while their replies wait to be written – 37e5cf7706
• Deprecation: on TCP, Redis, NATS, MQTT and RabbitMQ, an @EventPattern() handler that replies to ClientProxy#send() now logs a deprecation warning. The reply is unchanged; in the next major version event handlers will not reply to send(), as on Kafka already – ba3668d36b

Middleware exclusions

• MiddlewareConsumer.exclude() now compiles excluded routes with the router's case and trailing-slash matching (08d8677c8d). Update @nestjs/core together with @nestjs/platform-express / @nestjs/platform-fastify: with an adapter that does not implement getRouteMatchingOptions(), excluded routes are matched exactly (f5aa875e40), so on a lenient router other spellings of an excluded path run the middleware.
• With header, media type or custom versioning, exclude({ path, method, version }) and enableCsrfProtection({ exclude }) apply only to requests that ask for one of the excluded versions – 1a7a31fa46
• @nestjs/platform-fastify: the request hook used by enableCsrfProtection() and useSecurityHeaders() now runs before Nest and app.use() middleware with NestFactory.create() too, including middleware registered before either call, as it already did with Test.createNestApplication() – 8351806290

Bug fixes

• platform-fastify
  • 614d1ac7ea fix(fastify): send the status of an exception whose body is an error (@​kamilmysliwiec)
  • 8b420f788f fix(fastify): apply middleware to plugins registered before init (@​kamilmysliwiec)
  • #18175 fix(fastify): keep raw-response cookies in the header helpers (@​johnnyhuirilef)

[dependabot]

Labels

The following labels could not be found: area:api, ci, dependencies. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.