chore(deps): bump the npm-dependencies group across 1 directory with 35 updates

[dependabot]

Bumps the npm-dependencies group with 35 updates in the / directory:

Package	From	To
@fastify/helmet	13.1.0	13.1.1
@fastify/static	10.1.2	10.1.5
@nestjs/cache-manager	3.1.3	12.0.0
@nestjs/common	11.1.28	12.1.2
@nestjs/config	4.0.4	12.0.1
@nestjs/core	11.1.28	12.1.2
@nestjs/platform-fastify	11.1.28	12.1.2
@nestjs/swagger	11.4.6	12.0.2
@nestjs/throttler	6.5.0	6.7.1
@prisma/adapter-pg	7.9.0	7.10.0
@prisma/client	7.9.0	7.10.0
@scalar/nestjs-api-reference	1.2.11	1.2.25
dotenv	17.4.2	18.0.5
fastify	5.12.1	5.12.5
ioredis	5.11.1	6.0.0
nestjs-i18n	10.8.4	10.8.5
nestjs-pino	4.6.1	5.2.1
nestjs-zod	5.4.0	5.5.0
pg	8.22.0	8.23.1
@types/pg	8.20.0	8.23.1
prisma	7.9.0	7.9.1
zod	4.4.3	4.6.5
@biomejs/biome	2.5.2	2.5.15
@commitlint/cli	21.2.0	21.2.3
@commitlint/config-conventional	21.2.0	21.2.3
@nestjs/cli	11.0.23	12.0.8
@nestjs/schematics	11.1.0	12.0.6
@nestjs/testing	11.1.28	12.1.2
@types/node	26.1.0	26.6.4
@types/pg	8.20.0	8.23.1
jest	30.4.2	30.5.2
lint-staged	17.0.8	17.6.0
supertest	7.2.2	7.3.0
@types/supertest	7.2.0	7.2.1
ts-jest	29.4.11	29.4.14
typescript	6.0.3	7.0.2

Updates @fastify/helmet from 13.1.0 to 13.1.1

Release notes

Sourced from @​fastify/helmet's releases.

v13.1.1

What's Changed

• test: fix CSP header order assertions for helmet@8.3.x by @​Tony133 in fastify/fastify-helmet#318
• ci: pin actions to commit-hash by @​Fdawgs in fastify/fastify-helmet#316
• chore: bump c8 from 11.0.0 to 12.0.0 by @​dependabot[bot] in fastify/fastify-helmet#317
• chore: bump fastify/workflows/.github/workflows/lock-threads.yml from 6.0.0 to 7.0.0 by @​dependabot[bot] in fastify/fastify-helmet#320
• chore: bump fastify/workflows/.github/workflows/plugins-ci.yml from 6.0.0 to 7.0.0 by @​dependabot[bot] in fastify/fastify-helmet#321
• chore(.npmrc): add min-release-age by @​Fdawgs in fastify/fastify-helmet#319

Full Changelog: fastify/fastify-helmet@v13.1.0...v13.1.1

Commits

• 8854d49 Bumped v13.1.1
• c4bbcb2 chore(.npmrc): add min-release-age (#319)
• 8406fa8 chore: bump fastify/workflows/.github/workflows/plugins-ci.yml (#321)
• d8da457 chore: bump fastify/workflows/.github/workflows/lock-threads.yml (#320)
• 655cd3a chore: bump c8 from 11.0.0 to 12.0.0 (#317)
• 928d9b5 ci: pin actions to commit-hash
• 7c9cda3 test: fix CSP header order assertions for helmet@8.3.x
• See full diff in compare view

Maintainer changes

This version was pushed to npm by tony133, a new releaser for @​fastify/helmet since your current version.

Updates @fastify/static from 10.1.2 to 10.1.5

Release notes

Sourced from @​fastify/static's releases.

v10.1.5

What's Changed

• fix: use registered root for relative downloads by @​lprnmns in fastify/fastify-static#610

New Contributors

• @​lprnmns made their first contribution in fastify/fastify-static#610

Full Changelog: fastify/fastify-static@v10.1.4...v10.1.5

v10.1.4

This is a security release for GHSA-r799-r9gc-m956 (CVE-2026-90982).

It fixes a route guard and allowedPath bypass on case-insensitive filesystems. Users should upgrade to @fastify/static 10.1.4.

Full Changelog: fastify/fastify-static@v10.1.3...v10.1.4

v10.1.3

What's Changed

• chore: bump c8 from 11.0.0 to 12.0.0 by @​dependabot[bot] in fastify/fastify-static#602
• chore(.npmrc): add min-release-age by @​Fdawgs in fastify/fastify-static#603
• chore: bump fastify/workflows/.github/workflows/lock-threads.yml from 6.0.0 to 7.0.0 by @​dependabot[bot] in fastify/fastify-static#605

Full Changelog: fastify/fastify-static@v10.1.2...v10.1.3

Commits

• 2f0953a Bumped v10.1.5
• 275d87e fix: use registered root for relative downloads (#610)
• a39a464 Bumped v10.1.4
• ac46015 Ignore .pi
• 6288466 test: consume compressed response bodies
• 04134a4 test: cover rootless path validation on Windows
• d9a8c0a test: make case-folding fallback portable
• dbe65e8 Merge commit from fork
• 48b821f chore: bump content-disposition in the dependencies group (#607)
• ee3f89d chore: bump fastify/workflows/.github/workflows/plugins-ci.yml (#604)
• Additional commits viewable in compare view

Updates @nestjs/cache-manager from 3.1.3 to 12.0.0

Release notes

Sourced from @​nestjs/cache-manager's releases.

Release 12.0.0

What's Changed

@nestjs/cache-manager is now a native ES module, and the major version is aligned with the Nest 12 release line (there is no 4.x — 3.1.3 goes straight to 12.0.0).

ESM migration

The package is published as pure ESM ("type": "module", compiled with NodeNext) behind a proper exports map. The legacy root index.js / index.d.ts / index.ts shims are gone, and deep imports into build internals are no longer resolvable — import from the package root:

import { CacheModule, CacheInterceptor, CacheKey, CacheTTL } from '@nestjs/cache-manager';

require(esm) — CommonJS still works

You do not need to convert your app to ESM. Thanks to Node's require(esm) support, CommonJS consumers can keep using require('@nestjs/cache-manager') unchanged — the exports map points both import and require at the same ESM build, and Node loads it natively.

This is why the supported Node range is now enforced via engines:

"engines": {
  "node": "^20.19.0 || ^22.12.0 || >=24.0.0"
}

Those are the Node versions where require(esm) is available unflagged. On older Node versions, requiring this package from CommonJS will fail with ERR_REQUIRE_ESM.

Upgrading

npm i @nestjs/cache-manager@12

Checklist:

• Ensure you're on Node ^20.19.0, ^22.12.0, or >=24.0.0.
• Replace any deep imports (e.g. @nestjs/cache-manager/dist/...) with root imports.
• No changes needed to CacheModule.register() / registerAsync(), interceptors, or decorators.

Commits

• 661bc00 chore(): release v12.0.0
• 085ae1a chore: upgrade to v12
• 3a07e0b chore(deps): update dependency oxlint to v1.80.0 (#1152)
• 5f1ad64 chore(deps): update nest monorepo to v11.2.3 (#1151)
• f34fe5a chore(deps): update dependency vite to v8.2.2 (#1150)
• 288ea83 Merge pull request #1149 from miso-kyoungminkim/cachettl-ms-comment
• 9c08ea6 chore(deps): update dependency oxlint to v1.79.0 (#1148)
• f2b60ee docs(cache-ttl): clarify that ttl is in milliseconds
• f12d697 chore(deps): update dependency vitest to v4.1.11 (#1147)
• d0030ab Merge pull request #1067 from nestjs/chore/esm-migration
• Additional commits viewable in compare view

Updates @nestjs/common from 11.1.28 to 12.1.2

Release notes

Sourced from @​nestjs/common's releases.

v12.1.1 (2026-09-28)

Bug fixes

• common, core, microservices, testing
  • #17893 fix(common): logger bugs in json output, level changes, fatal and buffered logs (@​kamilmysliwiec)
• microservices
  • #17891 fix(microservices): let the mqtt client retry after a failed connect (@​hktitof)
  • #17888 fix(microservices): keep tcp event listeners across reconnects (@​KAPUIST)
  • #17887 fix(microservices): ignore events from a replaced tcp client socket (@​KAPUIST)
  • #17878 fix(microservices): keep a newer nats connection when a stale one fails (@​hktitof)
  • #17869 fix(microservices): keep a newer kafka connection when a stale one fails (@​kamilmysliwiec)
  • #17865 fix(microservices): let the rmq client retry after a failed connect (@​hktitof)
  • #17866 fix(microservices): reply on the request channel when redis wildcards are enabled (@​fadiroot)
  • #17861 fix(microservices): recover the nats client after it gives up reconnecting (@​xia-chao)
• common
  • #17884 fix(common): preserve string enum values matching numeric member names (@​KAPUIST)
• core
  • #17871 fix(core): detect circular dependencies across more than two providers (@​erezcor)
• platform-fastify
  • #17867 fix(fastify): treat a JSON content type with parameters as JSON in reply() (@​fadiroot)
• core, testing
  • #17860 fix(core): honor class and factory overrides of value providers (@​lehafari)

Enhancements

• common
  • #17876 fix(common): reject non-numeric items in ParseArrayPipe with items Number (@​SulimanAbdulrazzaq)
• microservices
  • #17863 feat(microservices): export deserializers from the package root (@​lazerg)

Committers: 13

• Abdellatif Anaflous (@​hktitof)
• Alejandro (@​lehafari)
• Daniel Pinto (@​Cayan)
• Dharmik Sondagar (@​DharmikSondagar)
• Kamil Mysliwiec (@​kamilmysliwiec)
• Lazizbek Ergashev (@​lazerg)
• Luke Son (@​KAPUIST)
• Micael Levi L. Cavalcante (@​micalevisk)
• Roman Khegay (@​thekhegay)
• Suliman Abdulrazzaq (@​SulimanAbdulrazzaq)
• Xia Chao (@​xia-chao)
• @​erezcor
• fadi romdhan (@​fadiroot)

v12.1.0 (2026-09-23)

Bug fixes

• core
  • #17838 fix(core): inherit optional ctor params when the ctor is not redeclared (@​kamilmysliwiec)
  • #17819 fix(core): name the module when metadata entries are invalid (@​thekhegay)

... (truncated)

Commits

• 8ab60aa chore(release): publish v12.1.2 release
• ab3fb3d chore(release): publish v12.1.2 release
• 50fb722 docs(core): fix resolve() @​returns tags to match their Promise signatures (#1...
• 4ea29cc feat(common): export UUIDVersion and support 'all' and numeric versions in Pa...
• a054312 fix(common): keep StreamableFile from mutating the caller options (#17925)
• 41a3a54 feat(common): support uuid v1, v2, v6 and v8 in ParseUUIDPipe (#17904)
• 9feedff chore(release): publish v12.1.1 release
• daf6883 fix(common): logger bugs in json output, level changes, fatal and buffered lo...
• 34c9965 fix(common): preserve string enum values matching numeric member names (#17884)
• 1fbe1c5 fix(common): reject non-numeric items in ParseArrayPipe with items Number (#1...
• Additional commits viewable in compare view

Updates @nestjs/config from 4.0.4 to 12.0.1

Release notes

Sourced from @​nestjs/config's releases.

Release 12.0.1

What's Changed

• fix(config): prevent prefix corruption and escape propertyPath in updateInterpolatedEnv by @​Asadshah7950 in nestjs/config#2427
• fix(deps): update dependency dotenv to v18.0.3 by @​renovate[bot] in nestjs/config#2444

New Contributors

• @​Asadshah7950 made their first contribution in nestjs/config#2427

Full Changelog: nestjs/config@12.0.0...12.0.1

12.0.0

What's Changed

@nestjs/config is now a native ES module, environment validation is built on Standard Schema instead of Joi-specific code, and the major version is aligned with the Nest 12 release line (there is no 5.x — 4.0.4 goes straight to 12.0.0).

ESM migration

The package is published as pure ESM ("type": "module", compiled with NodeNext) behind a proper exports map. The legacy root index.js / index.d.ts shims are gone, and deep imports into build internals are no longer resolvable — import from the package root.

// ✅
import { ConfigModule, ConfigService } from '@nestjs/config';
// ❌ no longer resolvable
import { ConfigService } from '@​nestjs/config/dist/config.service';

require(esm) — CommonJS still works

You do not need to convert your app to ESM. Thanks to Node's require(esm) support (Node 20.19+ / 22.12+), a CommonJS app can keep using require('@nestjs/config') unchanged.

Validation is now Standard Schema based

validationSchema accepts any schema implementing the Standard Schema spec — Zod (v3, v4, v4-mini), Valibot, ArkType, Joi 18+, and anything else that adopts it. There is no longer any Joi-specific code path in the module, and Joi is no longer implied as the validation library.

ConfigModule.forRoot({
  validationSchema: z.object({
    PORT: z.coerce.number().default(3000),
    DATABASE_NAME: z.string(),
  }),
});

Joi keeps working — it implements Standard Schema as of v18 — and the historical abortEarly: false / allowUnknown: true defaults are still applied automatically for Joi schemas, so existing Joi setups behave as before.

Breaking: validationOptions shape

Options are now the Standard Schema Options object, and library-specific settings move under libraryOptions:

... (truncated)

Commits

• 2785b5f chore(): release v12.0.1
• 0c0a0d6 fix(deps): update dependency dotenv to v18.0.3 (#2444)
• 130ee69 fix(deps): update dependency es-toolkit to v1.52.0 (#2411)
• ab84892 chore(deps): update node.js to v24.21.0 (#2420)
• d71b4a8 fix(config): prevent prefix corruption and escape propertyPath in updateInter...
• 498b207 fix(deps): update dependency dotenv to v18 (#2437)
• c32556f chore(deps): update dependency oxlint to v1.85.0 (#2443)
• 58af4ad chore(deps): update nest monorepo to v12.0.4 (#2442)
• 56fdf53 chore(deps): update commitlint monorepo to v21.2.3 (#2441)
• 73353eb chore(deps): update dependency @​types/node to v24.13.6 (#2440)
• Additional commits viewable in compare view

Updates @nestjs/core from 11.1.28 to 12.1.2

Release notes

Sourced from @​nestjs/core's releases.

v12.1.1 (2026-09-28)

Bug fixes

• common, core, microservices, testing
  • #17893 fix(common): logger bugs in json output, level changes, fatal and buffered logs (@​kamilmysliwiec)
• microservices
  • #17891 fix(microservices): let the mqtt client retry after a failed connect (@​hktitof)
  • #17888 fix(microservices): keep tcp event listeners across reconnects (@​KAPUIST)
  • #17887 fix(microservices): ignore events from a replaced tcp client socket (@​KAPUIST)
  • #17878 fix(microservices): keep a newer nats connection when a stale one fails (@​hktitof)
  • #17869 fix(microservices): keep a newer kafka connection when a stale one fails (@​kamilmysliwiec)
  • #17865 fix(microservices): let the rmq client retry after a failed connect (@​hktitof)
  • #17866 fix(microservices): reply on the request channel when redis wildcards are enabled (@​fadiroot)
  • #17861 fix(microservices): recover the nats client after it gives up reconnecting (@​xia-chao)
• common
  • #17884 fix(common): preserve string enum values matching numeric member names (@​KAPUIST)
• core
  • #17871 fix(core): detect circular dependencies across more than two providers (@​erezcor)
• platform-fastify
  • #17867 fix(fastify): treat a JSON content type with parameters as JSON in reply() (@​fadiroot)
• core, testing
  • #17860 fix(core): honor class and factory overrides of value providers (@​lehafari)

Enhancements

• common
  • #17876 fix(common): reject non-numeric items in ParseArrayPipe with items Number (@​SulimanAbdulrazzaq)
• microservices
  • #17863 feat(microservices): export deserializers from the package root (@​lazerg)

Committers: 13

• Abdellatif Anaflous (@​hktitof)
• Alejandro (@​lehafari)
• Daniel Pinto (@​Cayan)
• Dharmik Sondagar (@​DharmikSondagar)
• Kamil Mysliwiec (@​kamilmysliwiec)
• Lazizbek Ergashev (@​lazerg)
• Luke Son (@​KAPUIST)
• Micael Levi L. Cavalcante (@​micalevisk)
• Roman Khegay (@​thekhegay)
• Suliman Abdulrazzaq (@​SulimanAbdulrazzaq)
• Xia Chao (@​xia-chao)
• @​erezcor
• fadi romdhan (@​fadiroot)

v12.1.0 (2026-09-23)

Bug fixes

• core
  • #17838 fix(core): inherit optional ctor params when the ctor is not redeclared (@​kamilmysliwiec)
  • #17819 fix(core): name the module when metadata entries are invalid (@​thekhegay)

... (truncated)

Commits

• 8ab60aa chore(release): publish v12.1.2 release
• ab3fb3d chore(release): publish v12.1.2 release
• 50fb722 docs(core): fix resolve() @​returns tags to match their Promise signatures (#1...
• dee19bb fix(core): resolve durable global filters with the strategy's context id (#17...
• 9feedff chore(release): publish v12.1.1 release
• daf6883 fix(common): logger bugs in json output, level changes, fatal and buffered lo...
• b1014b6 fix(core): detect circular dependencies across more than two providers (#17871)
• b5f3273 fix(core): honor class and factory overrides of value providers (#17860)
• 5100837 fix(core): recommend {*path} in the legacy wildcard warning (#17859)
• 6739656 chore(release): publish v12.1.0 release
• Additional commits viewable in compare view

Updates @nestjs/platform-fastify from 11.1.28 to 12.1.2

Release notes

Sourced from @​nestjs/platform-fastify's releases.

v12.1.1 (2026-09-28)

Bug fixes

• common, core, microservices, testing
  • #17893 fix(common): logger bugs in json output, level changes, fatal and buffered logs (@​kamilmysliwiec)
• microservices
  • #17891 fix(microservices): let the mqtt client retry after a failed connect (@​hktitof)
  • #17888 fix(microservices): keep tcp event listeners across reconnects (@​KAPUIST)
  • #17887 fix(microservices): ignore events from a replaced tcp client socket (@​KAPUIST)
  • #17878 fix(microservices): keep a newer nats connection when a stale one fails (@​hktitof)
  • #17869 fix(microservices): keep a newer kafka connection when a stale one fails (@​kamilmysliwiec)
  • #17865 fix(microservices): let the rmq client retry after a failed connect (@​hktitof)
  • #17866 fix(microservices): reply on the request channel when redis wildcards are enabled (@​fadiroot)
  • #17861 fix(microservices): recover the nats client after it gives up reconnecting (@​xia-chao)
• common
  • #17884 fix(common): preserve string enum values matching numeric member names (@​KAPUIST)
• core
  • #17871 fix(core): detect circular dependencies across more than two providers (@​erezcor)
• platform-fastify
  • #17867 fix(fastify): treat a JSON content type with parameters as JSON in reply() (@​fadiroot)
• core, testing
  • #17860 fix(core): honor class and factory overrides of value providers (@​lehafari)

Enhancements

• common
  • #17876 fix(common): reject non-numeric items in ParseArrayPipe with items Number (@​SulimanAbdulrazzaq)
• microservices
  • #17863 feat(microservices): export deserializers from the package root (@​lazerg)

Committers: 13

• Abdellatif Anaflous (@​hktitof)
• Alejandro (@​lehafari)
• Daniel Pinto (@​Cayan)
• Dharmik Sondagar (@​DharmikSondagar)
• Kamil Mysliwiec (@​kamilmysliwiec)
• Lazizbek Ergashev (@​lazerg)
• Luke Son (@​KAPUIST)
• Micael Levi L. Cavalcante (@​micalevisk)
• Roman Khegay (@​thekhegay)
• Suliman Abdulrazzaq (@​SulimanAbdulrazzaq)
• Xia Chao (@​xia-chao)
• @​erezcor
• fadi romdhan (@​fadiroot)

v12.1.0 (2026-09-23)

Bug fixes

• core
  • #17838 fix(core): inherit optional ctor params when the ctor is not redeclared (@​kamilmysliwiec)
  • #17819 fix(core): name the module when metadata entries are invalid (@​thekhegay)

... (truncated)

Commits

• 8ab60aa chore(release): publish v12.1.2 release
• ab3fb3d chore(release): publish v12.1.2 release
• 1685a43 fix(express,fastify): keep +json content types on error replies (#17916)
• 697ff89 fix(express,fastify): read media type version from any accept param
• 9feedff chore(release): publish v12.1.1 release
• 3e903a0 fix(fastify): treat a JSON content type with parameters as JSON in reply() (#...
• 233a88e fix(fastify): register static assets and view engine before listen (#17854)
• 6739656 chore(release): publish v12.1.0 release
• ea0d2cc fix(fastify): honor Nest forceCloseConnections in initHttpServer (#17824)
• d232dda feat(fastify): add file upload interceptors backed by @​fastify/multipart (#17...
• Additional commits viewable in compare view

Updates @nestjs/swagger from 11.4.6 to 12.0.2

Release notes

Sourced from @​nestjs/swagger's releases.

12.0.2

What's Changed

• fix(plugin): treat single literal types as enums by @​y-hsgw in nestjs/swagger#4097
• fix(deps): update dependency es-toolkit to v1.52.0 by @​renovate[bot] in nestjs/swagger#4081
• fix(swagger): merge standard schema query params with @​ApiQuery by @​TadejPolajnar in nestjs/swagger#4090
• fix(plugin): keep the source package specifier for workspace imports by @​mhalikosen in nestjs/swagger#4086
• fix: resolve @​fastify/static through a bundler-visible dynamic import by @​kamilmysliwiec in nestjs/swagger#4115
• fix(standard-schema): promote schema description to parameter object by @​tjsousa in nestjs/swagger#4140
• fix: declare typescript as an optional peer dependency by @​lazerg in nestjs/swagger#4134
• fix(deps): update dependency swagger-ui-dist to v5.33.0 by @​renovate[bot] in nestjs/swagger#4128
• fix(deps): update dependency @​microsoft/tsdoc to v0.17.0 by @​renovate[bot] in nestjs/swagger#4124
• feat: support the HTTP QUERY method (RFC 10008) by @​gentritabazi in nestjs/swagger#4007
• fix(swagger-ui): preserve $ characters when building swagger-ui-init.js by @​csulit in nestjs/swagger#4119

New Contributors

• @​mhalikosen made their first contribution in nestjs/swagger#4087
• @​TadejPolajnar made their first contribution in nestjs/swagger#4090
• @​tjsousa made their first contribution in nestjs/swagger#4140
• @​lazerg made their first contribution in nestjs/swagger#4134
• @​gentritabazi made their first contribution in nestjs/swagger#4007
• @​csulit made their first contribution in nestjs/swagger#4119

Full Changelog: nestjs/swagger@12.0.1...12.0.2

Release 12.0.1

12.0.1 (2026-08-28)

Bug fixes

• #4082 fix: esm hoist static imports (@​kamilmysliwiec)

Dependencies

• #4077 chore(deps): update dependency swagger-ui-dist to v5.32.14 (@​renovate[bot])

Committers: 1

• Kamil Mysliwiec (@​kamilmysliwiec)

Release 12.0.0

What's Changed

@nestjs/swagger is now a native ES module, requires Nest 12, and changes how nullable schemas are spelled in the generated document.

ESM migration

The package is published as pure ESM ("type": "module", compiled with NodeNext) behind a proper exports map. The legacy root index.ts / plugin.js / plugin.ts shims are gone, and deep imports into build internals are no longer resolvable — import from the package root (@nestjs/swagger) or from @nestjs/swagger/plugin.

require(esm) — CommonJS still works

You do not need to convert your app to ESM. Thanks to Node's require(esm) support, a CommonJS app can keep doing const { SwaggerModule } = require('@nestjs/swagger'). The CLI plugin entry (@nestjs/swagger/plugin) also keeps a require condition so nest-cli.json setups load it unchanged.

This is why the package now declares "engines": { "node": "^20.19.0 || >=22.12.0" } — those are the Node versions where require(esm) is available without a flag.

... (truncated)

Commits

• 8f00eb9 chore(): release v12.0.2
• bfb2315 fix(swagger-ui): preserve $ characters when building swagger-ui-init.js (#4119)
• 2bea96a feat: support the HTTP QUERY method (RFC 10008) (#4007)
• 752e5c7 chore(deps): update dependency supertest to v7.3.0 (#4142)
• 4faed70 fix(deps): update dependency @​microsoft/tsdoc to v0.17.0 (#4124)
• d0e7976 fix(deps): update dependency swagger-ui-dist to v5.33.0 (#4128)
• abce2be fix: declare typescript as an optional peer dependency (#4134)
• 234c20c fix(standard-schema): promote schema description to parameter object (#4140)
• 9652868 chore(deps): update dependency oxlint to v1.85.0 (#4141)
• 92ee181 chore(deps): update nest monorepo to v12.0.4 (#4138)
• Additional commits viewable in compare view

Updates @nestjs/throttler from 6.5.0 to 6.7.1

Release notes

Sourced from @​nestjs/throttler's releases.

v6.7.1

Patch Changes

• e8368b3: Set rate limit headers through res.setHeader() when the response has no res.header() method, so the guard no longer throws res.header is not a function on custom HTTP adapters. The logic lives in a new protected setResponseHeader() method that subclasses can override.
• a482ef9: Coerce numeric strings for limit, ttl and blockDuration to numbers, as returned for example by ConfigService.get<number>() for environment variables. Previously Date.now() + '60000' concatenated instead of adding, which silently corrupted every expiry and X-RateLimit-Reset. A value that is not numeric now fails with an error naming the option and the throttler.
• a9a28b9: Respect an explicit 0 for limit, ttl and blockDuration in @Throttle() and the module options instead of falling back to the default. blockDuration: 0 now means "no extra block": the in-memory storage rejects requests while the window is full and lets them through again as soon as the oldest hit expires, without recording the rejected ones.
• bf81677: Import shared interfaces from the public Nest package entry point for Nest 12 compatibility.
• caaabc9: Stop the in-memory storage from retaining request contexts. It used to schedule one setTimeout per counted hit, and each timer kept the request's AsyncLocalStorage stores (for example an ORM's per-request entity manager) in memory until the TTL expired. It now records when each hit expires and prunes expired hits on access. The idle-record sweep is also no longer tied to the context of the first request. With blockDuration: 0, Retry-After now reports when the oldest hit expires rather than when the window ends.
• 7703c10: Log a warning when no throttler is configured. The guard limits nothing in that case and previously said nothing at boot, so ThrottlerModule.forRoot() and ThrottlerModule.forRoot([]) looked like a working setup.

v6.7.0

Minor Changes

• 7004a97: Normalize IPv6 source addresses in the default tracker, and evict expired records from the in-memory storage.

  The built-in getTracker returned req.ip verbatim, so a client holding an IPv6 allocation could send every request from a different address within its own subnet and never share a counter, defeating the rate limit. Addresses are now masked to a /64 before being used as the tracker; the prefix length is configurable via the new ipv6SubnetPrefix module option. IPv4 addresses, IPv4-mapped addresses, the loopback, and custom getTracker implementations are unaffected.

  ThrottlerStorageService also never removed records, so a stream of requests from distinct trackers grew the internal map for the lifetime of the process. Idle records are now swept out once their window has fully elapsed. Limiting behaviour is unchanged: a record is only dropped after every pending hit has expired and any block has lapsed.

  Note that the tracker string for IPv6 clients changes shape (2001:db8:0:1::/64), so storage keys rotate once on upgrade.

v6.6.0

Minor Changes

• c342bad: Declare the supported Node versions in engines, matching the range the CI matrix tests
• c625e98: Update to allow for support for Nest version 12

Changelog

Sourced from @​nestjs/throttler's changelog.

6.7.1

Patch Changes

• e8368b3: Set rate limit headers through res.setHeader() when the response has no res.header() method, so the guard no longer throws res.header is not a function on custom HTTP adapters. The logic lives in a new protected setResponseHeader() method that subclasses can override.
• a482ef9: Coerce numeric strings for limit, ttl and blockDuration to numbers, as returned for example by ConfigService.get<number>() for environment variables. Previously Date.now() + '60000' concatenated instead of adding, which silently corrupted every expiry and X-RateLimit-Reset. A value that is not numeric now fails with an error naming the option and the throttler.
• a9a28b9: Respect an explicit 0 for limit, ttl and blockDuration in @Throttle() and the module options instead of falling back to the default. blockDuration: 0 now means "no extra block": the in-memory storage rejects requests while the window is full and lets them through again as soon as the oldest hit expires, without recording the rejected ones.
• bf81677: Import shared interfaces from the public Nest package entry point for Nest 12 compatibility.
• caaabc9: Stop the in-memory storage from retaining request contexts. It used to schedule one setTimeout per counted hit, and each timer kept the request's AsyncLocalStorage stores (for example an ORM's per-request entity manager) in memory until the TTL expired. It now records when each hit expires and prunes expired hits on access. The idle-record sweep is also no longer tied to the context of the first request. With blockDuration: 0, Retry-After now reports when the oldest hit expires rather than when the window ends.
• 7703c10: Log a warning when no throttler is configured. The guard limits nothing in that case and previously said nothing at boot, so ThrottlerModule.forRoot() and ThrottlerModule.forRoot([]) looked like a working setup.

6.7.0

Minor Changes

• 7004a97: Normalize IPv6 source addresses in the default tracker, and evict expired records from the in-memory storage.

  The built-in getTracker returned req.ip verbatim, so a client holding an IPv6 allocation could send every request from a different address within its own subnet and never share a counter, defeating the rate limit. Addresses are now masked to a /64 before being used as the tracker; the prefix length is configurable via the new ipv6SubnetPrefix module option. IPv4 addresses, IPv4-mapped addresses, the loopback, and custom getTracker implementations are unaffected.

  ThrottlerStorageService also never removed records, so a stream of requests from distinct trackers grew the internal map for the lifetime of the process. Idle records are now swept out once their window has fully elapsed. Limiting behaviour is unchanged: a record is only dropped after every pending hit has expired and any block has lapsed.

  Note that the tracker string for IPv6 clients changes shape (2001:db8:0:1::/64), so storage keys rotate once on upgrade.

6.6.0

Minor Changes

• c342bad: Declare the supported Node versions in engines, matching the range the CI matrix tests
• c625e98: Update to allow for support for Nest version 12

6.4.0

6.5.1

Patch Changes

• 603cb82: handles edge case where multiple clients making frequent requests interfere wit...

  Description has been truncated