[dependabot]

Bumps the nestjs group with 3 updates: @nestjs/common, @nestjs/core and @nestjs/platform-express.

Updates @nestjs/common from 12.1.3 to 12.2.0

Release notes

Sourced from @​nestjs/common's releases.

v12.2.0 (2026-10-19)

Notable changes

New options

• @Sse({ maxPendingDataLength }) sets how many characters of event data may wait for a client that is not reading its events (4M by default; 0 or Infinity lifts the limit) – 2f05ad954e
• IoAdapter and WsAdapter take maxConcurrentMessages, the number of a client's messages handled at once (1000 by default; Infinity lifts it) – 0bd0810ed7
• ValidationPipe takes maxErrorMessagesLength (1,000,000 characters by default); messages past it are replaced by a "Further validation errors were omitted" entry – 086c1c514f
• Kafka: parser.maxMessageSize (16 MiB after decompression by default); larger messages are logged and skipped – 9bdf844fca
• TCP server: drainTimeout (30 s by default, 0 disables) disconnects a peer that leaves its responses unread – 583d6077ad
• MQTT server: reconnectOnConnackError is now enabled by default, so a refused connection attempt is retried; set it to false for the previous behaviour – a63cea600a
• HttpServer.getRouteMatchingOptions(), an optional adapter hook that tells core how the router matches paths (see "Middleware exclusions" below) – 08d8677c8d

New defaults and behaviour changes

• @nestjs/platform-express, @nestjs/platform-fastify: fieldNestingDepth and fieldArrayIndexLimit (#18074) now default to 32 and 1000; set them to Infinity to lift the limits – 94fcc93770
• ValidationPipe validates with validationError.target: false unless the options set it, so an exceptionFactory that reads error.target gets undefined; set validationError.target to true for the old errors – 8c5a59bf63
• ValidationPipe answers an array or a primitive sent for a validated class with a 400 – 197371c1f3
• FileTypeValidator matches a string fileType up to the end of a name (e.g. font/woff no longer accepts font/woff2; use a RegExp for that) – 770c6f1a19
• @SerializeOptions({}) on a handler no longer turns off the class schema – d27cb7017f
• BaseExceptionFilter answers http-errors errors created with expose: false (the default from 500) with the standard reason phrase instead of their message – 9ed572f853
• A StreamableFile error still gets a 400, but the body no longer carries the error message – 2f28d91afb
• Files uploaded with a request that a pipe rejected are removed from storage – acb98de89e
• @nestjs/platform-fastify: a route with fileSize: undefined (or null) falls back to the plugin's limit; set it to Infinity to keep uploads unlimited – dd549e1a74
• @nestjs/platform-express: object error bodies are sent as application/json on routes with a non-JSON Content-Type – 7dc6e349d5
• ConsoleLogger in JSON mode cuts a record short past about a million characters – ad4915eaa3
• A global enhancer that the injector failed to instantiate now fails the application at startup – ae78524ced
• A request- or transient-scoped APP_FILTER now logs a startup warning, as it only applies to exceptions thrown from controllers – df5275c5e1
• Microservices: a pattern key longer than 256 characters matches no handler – accd27e66c
• Kafka: a message may carry up to 10,000 header values (e419ff540b); headers given as a string or array are not sent (312777743f); reply headers are decoded as text (ee94f6aaae)
• gRPC: request streams are paused while their replies wait to be written – 37e5cf7706
• Deprecation: on TCP, Redis, NATS, MQTT and RabbitMQ, an @EventPattern() handler that replies to ClientProxy#send() now logs a deprecation warning. The reply is unchanged; in the next major version event handlers will not reply to send(), as on Kafka already – ba3668d36b

Middleware exclusions

• MiddlewareConsumer.exclude() now compiles excluded routes with the router's case and trailing-slash matching (08d8677c8d). Update @nestjs/core together with @nestjs/platform-express / @nestjs/platform-fastify: with an adapter that does not implement getRouteMatchingOptions(), excluded routes are matched exactly (f5aa875e40), so on a lenient router other spellings of an excluded path run the middleware.
• With header, media type or custom versioning, exclude({ path, method, version }) and enableCsrfProtection({ exclude }) apply only to requests that ask for one of the excluded versions – 1a7a31fa46
• @nestjs/platform-fastify: the request hook used by enableCsrfProtection() and useSecurityHeaders() now runs before Nest and app.use() middleware with NestFactory.create() too, including middleware registered before either call, as it already did with Test.createNestApplication() – 8351806290

Bug fixes

• platform-fastify
  • 614d1ac7ea fix(fastify): send the status of an exception whose body is an error (@​kamilmysliwiec)
  • 8b420f788f fix(fastify): apply middleware to plugins registered before init (@​kamilmysliwiec)
  • #18175 fix(fastify): keep raw-response cookies in the header helpers (@​johnnyhuirilef)
  • c215fd9b4f fix(fastify): match middleware paths like a case-insensitive router (@​kamilmysliwiec)
  • 43d4420205 fix(fastify): pass version extractor errors to the error handler (@​kamilmysliwiec)
  • 1435ed22f4 fix(fastify): pass middleware rejections to the error handler (@​kamilmysliwiec)
  • 84c947faf9 fix(fastify): stop reading a streamable file for a head request (@​kamilmysliwiec)
  • dd549e1a74 fix(fastify): let undefined upload limits fall back to the defaults (@​kamilmysliwiec)
  • 4735f8d050 fix(fastify): free memory storage chunks once a file is buffered (@​kamilmysliwiec)
  • 3e3e6eea6f fix(fastify): remove uploads cut off after their last chunk (@​kamilmysliwiec)
  • c04a9182b9 fix(fastify): set the security headers on router error responses (@​kamilmysliwiec)

... (truncated)

Commits

• af37111 chore(release): publish v12.2.0 release
• 770c6f1 fix(common): match a file type string up to the end of a name
• 8c5a59b fix(common): stop exposing the validated object on validation errors
• 086c1c5 fix(common): limit the length of validation error messages by default
• e77ceba fix(common): stop copying nested validation errors for each level
• 197371c fix(common): reject arrays and primitives for validated classes
• b34a359 fix(common): validate parsed array items one at a time
• 1a7a31f fix(core,common): exclude a version only for requests that ask for it
• 2f05ad9 fix(core): make the sse pending data limit configurable
• 2f28d91 fix(common): keep StreamableFile error messages out of responses
• Additional commits viewable in compare view

Updates @nestjs/core from 12.1.3 to 12.2.0

Release notes

Sourced from @​nestjs/core's releases.

v12.2.0 (2026-10-19)

Notable changes

New options

• @Sse({ maxPendingDataLength }) sets how many characters of event data may wait for a client that is not reading its events (4M by default; 0 or Infinity lifts the limit) – 2f05ad954e
• IoAdapter and WsAdapter take maxConcurrentMessages, the number of a client's messages handled at once (1000 by default; Infinity lifts it) – 0bd0810ed7
• ValidationPipe takes maxErrorMessagesLength (1,000,000 characters by default); messages past it are replaced by a "Further validation errors were omitted" entry – 086c1c514f
• Kafka: parser.maxMessageSize (16 MiB after decompression by default); larger messages are logged and skipped – 9bdf844fca
• TCP server: drainTimeout (30 s by default, 0 disables) disconnects a peer that leaves its responses unread – 583d6077ad
• MQTT server: reconnectOnConnackError is now enabled by default, so a refused connection attempt is retried; set it to false for the previous behaviour – a63cea600a
• HttpServer.getRouteMatchingOptions(), an optional adapter hook that tells core how the router matches paths (see "Middleware exclusions" below) – 08d8677c8d

New defaults and behaviour changes

• @nestjs/platform-express, @nestjs/platform-fastify: fieldNestingDepth and fieldArrayIndexLimit (#18074) now default to 32 and 1000; set them to Infinity to lift the limits – 94fcc93770
• ValidationPipe validates with validationError.target: false unless the options set it, so an exceptionFactory that reads error.target gets undefined; set validationError.target to true for the old errors – 8c5a59bf63
• ValidationPipe answers an array or a primitive sent for a validated class with a 400 – 197371c1f3
• FileTypeValidator matches a string fileType up to the end of a name (e.g. font/woff no longer accepts font/woff2; use a RegExp for that) – 770c6f1a19
• @SerializeOptions({}) on a handler no longer turns off the class schema – d27cb7017f
• BaseExceptionFilter answers http-errors errors created with expose: false (the default from 500) with the standard reason phrase instead of their message – 9ed572f853
• A StreamableFile error still gets a 400, but the body no longer carries the error message – 2f28d91afb
• Files uploaded with a request that a pipe rejected are removed from storage – acb98de89e
• @nestjs/platform-fastify: a route with fileSize: undefined (or null) falls back to the plugin's limit; set it to Infinity to keep uploads unlimited – dd549e1a74
• @nestjs/platform-express: object error bodies are sent as application/json on routes with a non-JSON Content-Type – 7dc6e349d5
• ConsoleLogger in JSON mode cuts a record short past about a million characters – ad4915eaa3
• A global enhancer that the injector failed to instantiate now fails the application at startup – ae78524ced
• A request- or transient-scoped APP_FILTER now logs a startup warning, as it only applies to exceptions thrown from controllers – df5275c5e1
• Microservices: a pattern key longer than 256 characters matches no handler – accd27e66c
• Kafka: a message may carry up to 10,000 header values (e419ff540b); headers given as a string or array are not sent (312777743f); reply headers are decoded as text (ee94f6aaae)
• gRPC: request streams are paused while their replies wait to be written – 37e5cf7706
• Deprecation: on TCP, Redis, NATS, MQTT and RabbitMQ, an @EventPattern() handler that replies to ClientProxy#send() now logs a deprecation warning. The reply is unchanged; in the next major version event handlers will not reply to send(), as on Kafka already – ba3668d36b

Middleware exclusions

• MiddlewareConsumer.exclude() now compiles excluded routes with the router's case and trailing-slash matching (08d8677c8d). Update @nestjs/core together with @nestjs/platform-express / @nestjs/platform-fastify: with an adapter that does not implement getRouteMatchingOptions(), excluded routes are matched exactly (f5aa875e40), so on a lenient router other spellings of an excluded path run the middleware.
• With header, media type or custom versioning, exclude({ path, method, version }) and enableCsrfProtection({ exclude }) apply only to requests that ask for one of the excluded versions – 1a7a31fa46
• @nestjs/platform-fastify: the request hook used by enableCsrfProtection() and useSecurityHeaders() now runs before Nest and app.use() middleware with NestFactory.create() too, including middleware registered before either call, as it already did with Test.createNestApplication() – 8351806290

Bug fixes

• platform-fastify
  • 614d1ac7ea fix(fastify): send the status of an exception whose body is an error (@​kamilmysliwiec)
  • 8b420f788f fix(fastify): apply middleware to plugins registered before init (@​kamilmysliwiec)
  • #18175 fix(fastify): keep raw-response cookies in the header helpers (@​johnnyhuirilef)
  • c215fd9b4f fix(fastify): match middleware paths like a case-insensitive router (@​kamilmysliwiec)
  • 43d4420205 fix(fastify): pass version extractor errors to the error handler (@​kamilmysliwiec)
  • 1435ed22f4 fix(fastify): pass middleware rejections to the error handler (@​kamilmysliwiec)
  • 84c947faf9 fix(fastify): stop reading a streamable file for a head request (@​kamilmysliwiec)
  • dd549e1a74 fix(fastify): let undefined upload limits fall back to the defaults (@​kamilmysliwiec)
  • 4735f8d050 fix(fastify): free memory storage chunks once a file is buffered (@​kamilmysliwiec)
  • 3e3e6eea6f fix(fastify): remove uploads cut off after their last chunk (@​kamilmysliwiec)
  • c04a9182b9 fix(fastify): set the security headers on router error responses (@​kamilmysliwiec)

... (truncated)

Commits

• af37111 chore(release): publish v12.2.0 release
• 85d0a0b fix(core): run interceptor, pipe and filter classes without a name
• 8a53d08 fix(core): detect cycles in request-scoped forward references (#18186)
• 92136a6 fix(core): give a module that extends another module its own id (#18180)
• bafce3b fix(core): answer http requests an rpc exception filter leaves
• 8f9fbfd fix(core): settle async param decorator values before pipes run
• 9b77f56 fix(core,microservices): let only the hybrid application bind gateways
• fec478e fix(core): subscribe to guard observables from other copies of rxjs
• 034ef09 fix(core): run guards bound as classes without a name
• a190887 fix(core,websockets): run transient enhancers bound to static gateways
• Additional commits viewable in compare view

Updates @nestjs/platform-express from 12.1.3 to 12.2.0

Release notes

Sourced from @​nestjs/platform-express's releases.

v12.2.0 (2026-10-19)

Notable changes

New options

• @Sse({ maxPendingDataLength }) sets how many characters of event data may wait for a client that is not reading its events (4M by default; 0 or Infinity lifts the limit) – 2f05ad954e
• IoAdapter and WsAdapter take maxConcurrentMessages, the number of a client's messages handled at once (1000 by default; Infinity lifts it) – 0bd0810ed7
• ValidationPipe takes maxErrorMessagesLength (1,000,000 characters by default); messages past it are replaced by a "Further validation errors were omitted" entry – 086c1c514f
• Kafka: parser.maxMessageSize (16 MiB after decompression by default); larger messages are logged and skipped – 9bdf844fca
• TCP server: drainTimeout (30 s by default, 0 disables) disconnects a peer that leaves its responses unread – 583d6077ad
• MQTT server: reconnectOnConnackError is now enabled by default, so a refused connection attempt is retried; set it to false for the previous behaviour – a63cea600a
• HttpServer.getRouteMatchingOptions(), an optional adapter hook that tells core how the router matches paths (see "Middleware exclusions" below) – 08d8677c8d

New defaults and behaviour changes

• @nestjs/platform-express, @nestjs/platform-fastify: fieldNestingDepth and fieldArrayIndexLimit (#18074) now default to 32 and 1000; set them to Infinity to lift the limits – 94fcc93770
• ValidationPipe validates with validationError.target: false unless the options set it, so an exceptionFactory that reads error.target gets undefined; set validationError.target to true for the old errors – 8c5a59bf63
• ValidationPipe answers an array or a primitive sent for a validated class with a 400 – 197371c1f3
• FileTypeValidator matches a string fileType up to the end of a name (e.g. font/woff no longer accepts font/woff2; use a RegExp for that) – 770c6f1a19
• @SerializeOptions({}) on a handler no longer turns off the class schema – d27cb7017f
• BaseExceptionFilter answers http-errors errors created with expose: false (the default from 500) with the standard reason phrase instead of their message – 9ed572f853
• A StreamableFile error still gets a 400, but the body no longer carries the error message – 2f28d91afb
• Files uploaded with a request that a pipe rejected are removed from storage – acb98de89e
• @nestjs/platform-fastify: a route with fileSize: undefined (or null) falls back to the plugin's limit; set it to Infinity to keep uploads unlimited – dd549e1a74
• @nestjs/platform-express: object error bodies are sent as application/json on routes with a non-JSON Content-Type – 7dc6e349d5
• ConsoleLogger in JSON mode cuts a record short past about a million characters – ad4915eaa3
• A global enhancer that the injector failed to instantiate now fails the application at startup – ae78524ced
• A request- or transient-scoped APP_FILTER now logs a startup warning, as it only applies to exceptions thrown from controllers – df5275c5e1
• Microservices: a pattern key longer than 256 characters matches no handler – accd27e66c
• Kafka: a message may carry up to 10,000 header values (e419ff540b); headers given as a string or array are not sent (312777743f); reply headers are decoded as text (ee94f6aaae)
• gRPC: request streams are paused while their replies wait to be written – 37e5cf7706
• Deprecation: on TCP, Redis, NATS, MQTT and RabbitMQ, an @EventPattern() handler that replies to ClientProxy#send() now logs a deprecation warning. The reply is unchanged; in the next major version event handlers will not reply to send(), as on Kafka already – ba3668d36b

Middleware exclusions

• MiddlewareConsumer.exclude() now compiles excluded routes with the router's case and trailing-slash matching (08d8677c8d). Update @nestjs/core together with @nestjs/platform-express / @nestjs/platform-fastify: with an adapter that does not implement getRouteMatchingOptions(), excluded routes are matched exactly (f5aa875e40), so on a lenient router other spellings of an excluded path run the middleware.
• With header, media type or custom versioning, exclude({ path, method, version }) and enableCsrfProtection({ exclude }) apply only to requests that ask for one of the excluded versions – 1a7a31fa46
• @nestjs/platform-fastify: the request hook used by enableCsrfProtection() and useSecurityHeaders() now runs before Nest and app.use() middleware with NestFactory.create() too, including middleware registered before either call, as it already did with Test.createNestApplication() – 8351806290

Bug fixes

• platform-fastify
  • 614d1ac7ea fix(fastify): send the status of an exception whose body is an error (@​kamilmysliwiec)
  • 8b420f788f fix(fastify): apply middleware to plugins registered before init (@​kamilmysliwiec)
  • #18175 fix(fastify): keep raw-response cookies in the header helpers (@​johnnyhuirilef)
  • c215fd9b4f fix(fastify): match middleware paths like a case-insensitive router (@​kamilmysliwiec)
  • 43d4420205 fix(fastify): pass version extractor errors to the error handler (@​kamilmysliwiec)
  • 1435ed22f4 fix(fastify): pass middleware rejections to the error handler (@​kamilmysliwiec)
  • 84c947faf9 fix(fastify): stop reading a streamable file for a head request (@​kamilmysliwiec)
  • dd549e1a74 fix(fastify): let undefined upload limits fall back to the defaults (@​kamilmysliwiec)
  • 4735f8d050 fix(fastify): free memory storage chunks once a file is buffered (@​kamilmysliwiec)
  • 3e3e6eea6f fix(fastify): remove uploads cut off after their last chunk (@​kamilmysliwiec)
  • c04a9182b9 fix(fastify): set the security headers on router error responses (@​kamilmysliwiec)

... (truncated)

Commits

• af37111 chore(release): publish v12.2.0 release
• c8923bd fix(express,fastify): parse quoted media type version parameters (#18178)
• fb8c2ca fix(core): mount wildcard middleware on every path when "/" is excluded
• b75244f fix(express): run wildcard middleware on "/api/" for a named wildcard
• 8b8e839 fix(express): stop reading a streamable file for a head request
• acb98de fix(core,express,fastify): remove uploads of requests a pipe rejected
• 1933cc9 fix(express,fastify): handle a StreamableFile that cannot be streamed
• 7dc6e34 fix(express): send object error bodies with a json content type
• e075cda fix(express,fastify): let a route's dest replace the module's storage
• 84a16fe fix(deps): update dependency express to v5.3.0 (#18150)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions