build(deps): bump the nestjs group across 1 directory with 5 updates by dependabot[bot] · Pull Request #2897 · SciCatProject/backend

dependabot · 2026-08-17T15:04:25Z

Bumps the nestjs group with 5 updates in the / directory:

Package	From	To
@nestjs-modules/mailer	`2.3.4`	`2.3.7`
@nestjs/platform-express	`11.1.28`	`11.2.1`
@nestjs/swagger	`11.4.2`	`11.4.7`
@nestjs/cli	`11.0.21`	`11.0.24`
@nestjs/testing	`11.1.19`	`11.2.1`

Updates @nestjs-modules/mailer from 2.3.4 to 2.3.7

Release notes

Sourced from @nestjs-modules/mailer's releases.

@nestjs-modules/mailer@2.3.7

Patch Changes

#1313 3d92210 Thanks @juandav! - Fix several issues in the mailer package:

MjmlAdapter: handle the Promise returned by mjml2html in mjml v5+, so rendered HTML is no longer undefined (#1312). The adapter now also propagates errors from the inner engine.

MailerQueueModule: support a global option in both register and registerAsync, allowing MailerQueueService to be injected across the application without re-importing the module (#1311).

TransportType: re-export TransportType from the package entry point so custom transports can type their getTransport() return value without deep imports (#1309).

@nestjs-modules/mailer@2.3.6

Patch Changes

Auto-release patch version with latest changes.

@nestjs-modules/mailer@2.3.5

Patch Changes

Auto-release patch version with latest changes.

Commits

747db09 chore(release): version packages (#1314)
3d92210 fix(mailer): mjml v5 promise, queue global option, export TransportType (#1313)
3f5932b chore(release): version packages (#1305)
b487484 fix(security): patch remaining Dependabot alerts across monorepo (#1304)
a1f3c42 chore(release): version packages (#1303)
0c5ed1d fix(security): update vulnerable dependencies to patched versions (#1302)
See full diff in compare view

Updates @nestjs/platform-express from 11.1.28 to 11.2.1

Release notes

Sourced from @nestjs/platform-express's releases.

v11.2.1

What's Changed

fix(core): early-return SSE abort issue by @kamilmysliwiec

Full Changelog: nestjs/nest@v11.2.0...v11.2.1

v11.2.0

What's Changed

fix(core): share existing singleton providers with lazily loaded modules by @shariyerShazan in nestjs/nest#17430

fix(common): match string file types containing regex metacharacters by @Jaybhade in nestjs/nest#17435

fix(core): convert adjacent wildcard segments in legacy route converter by @eeshsaxena in nestjs/nest#17416

fix(fastify): run middleware on routes excluded from global prefix by @Arun445 in nestjs/nest#17377

fix(fastify): avoid double prefixing inherited middleware by @GiHoon1123 in nestjs/nest#17350

fix(core): scan pre-registered dynamic imports of lazy modules by @johnnyhuirilef in nestjs/nest#17464

feat(core,common,platform-fastify): add query http method support by @gacardinal in nestjs/nest#17162

fix(common): exclude reverse-mapped keys from numeric enum validation in ParseEnumPipe by @LeSingh1 in nestjs/nest#17086

test(testing): Add e2e integration tests for HTTP QUERY method (RFC 10008) by @brayanjeshua in nestjs/nest#17310

feat(core): sse signal by @kamilmysliwiec in nestjs/nest#17469

chore(deps): update dependency fastify to v5.12.0 by @renovate[bot] in nestjs/nest#17473

New Contributors

@shariyerShazan made their first contribution in nestjs/nest#17430

@Jaybhade made their first contribution in nestjs/nest#17435

@eeshsaxena made their first contribution in nestjs/nest#17416

@Arun445 made their first contribution in nestjs/nest#17377

@GiHoon1123 made their first contribution in nestjs/nest#17350

@johnnyhuirilef made their first contribution in nestjs/nest#17464

@gacardinal made their first contribution in nestjs/nest#17162

@LeSingh1 made their first contribution in nestjs/nest#17086

@brayanjeshua made their first contribution in nestjs/nest#17310

Full Changelog: nestjs/nest@v11.1.29...v11.2.0

v11.1.29

What's Changed

fix(core): stop import lookup after first direct export match by @malekelkssas in nestjs/nest#17141

chore: update multerExceptions constant by @bo0tzz in nestjs/nest#17328

fix(microservices): correct pub/sub client type in redis listeners by @zaewc in nestjs/nest#17331

feat(common): add override mimetype option to file type validator by @Ativ3k in nestjs/nest#17333

fix(core): drop the g flag from middleware overlap regexes by @dchaudhari7177 in nestjs/nest#17335

feat(core): support sse comments by @kyu4583 in nestjs/nest#17327

fix(core): resolve barrier immediately when target count is zero by @ikrbasak in nestjs/nest#17393

fix(common): exclude pipe options from validator options by @coxxny in nestjs/nest#17399

fix(core): serialize SSE retry field when value is zero by @kyu4583 in nestjs/nest#17360

fix(microservices): nullify grpcclient on close when tryshutdown fails by @Se3do in nestjs/nest#17394

fix(express): map missing multer field nesting error by @Se3do in nestjs/nest#17421

New Contributors

@malekelkssas made their first contribution in nestjs/nest#17141

@hjc0930 made their first contribution in nestjs/nest#17311

... (truncated)

Commits

4535f43 chore(release): publish v11.2.1 release
f2a7e4b chore(release): publish v11.2.0 release
03587a1 chore(release): publish v11.1.29 release
4e4f8f0 Merge pull request #17421 from Se3do/fix/express-multer-limit-field-nesting
2a532e7 chore: fix misspelled spec filenames
4a40978 fix(express): map missing multer field nesting error
7285778 chore: update multerExceptions constant
92bc05d chore: update readme
See full diff in compare view

Updates @nestjs/swagger from 11.4.2 to 11.4.7

Release notes

Sourced from @nestjs/swagger's releases.

11.4.7

What's Changed

fix(plugin): preserve inferred responses for enum error statuses by @GiHoon1123 in nestjs/swagger#4014

chore(deps): update dependency @fastify/static to v10 [security] by @renovate[bot] in nestjs/swagger#4028

feat(interfaces): export full OpenAPI object-model types in public API by @Fcmam5 in nestjs/swagger#4048

fix(plugin): handle decorators with property access expressions in getIdentifierFromName by @jorenl in nestjs/swagger#4042

fix(deps): update dependency js-yaml to v5.3.0 by @renovate[bot] in nestjs/swagger#4053

feat(api-header): support custom OpenAPI extensions by @kyungseopk1m in nestjs/swagger#4047

fix(type-helpers): apply deep partial substitution to plugin metadata by @kyungseopk1m in nestjs/swagger#4030

fix(plugin): rebase readonly import paths onto the output directory by @kyungseopk1m in nestjs/swagger#4019

fix(plugin): generate object examples from @example doc tags by @y-hsgw in nestjs/swagger#4005

New Contributors

@GiHoon1123 made their first contribution in nestjs/swagger#4014

@Fcmam5 made their first contribution in nestjs/swagger#4048

@jorenl made their first contribution in nestjs/swagger#4042

Full Changelog: nestjs/swagger@11.4.6...11.4.7

Release 11.4.6

11.4.6 (2026-07-17)

Features

#3964 feat(plugin): infer ApiParam enum from @Param literal-union types (@y-hsgw)

Bug fixes

#3947 fix(type-helpers): preserve array-ness for nested DTO arrays in DeepPartialType (@yogeshwaran-c)

#3945 fix(mimetype-content-wrapper): clone object per mimetype to avoid shared references (@yogeshwaran-c)

#3972 fix: avoid inline PickType schema collisions (@cyphercodes)

#3969 fix: Added missing summary type to the response object (@MichielDeMey)

Enhancements

#3949 feat(api-query): support custom OpenAPI extensions (@yogeshwaran-c)

Dependencies

#3986 fix(deps): update dependency js-yaml to v5 (@renovate[bot])

Committers: 4

Michiel De Mey (@MichielDeMey)

Rayan Salhab (@cyphercodes)

Yogeshwaran C (@yogeshwaran-c)

Yukihiro Hasegawa (@y-hsgw)

11.4.5

What's Changed

feat(plugin): generate additionalProperties for Record/index-signature types by @y-hsgw in nestjs/swagger#3957

fix(deps): update dependency swagger-ui-dist to v5.32.8 by @renovate[bot] in nestjs/swagger#3973

fix(deps): update dependency js-yaml to v4.2.0 [security] by @renovate[bot] in nestjs/swagger#3988

... (truncated)

Commits

77e3d46 chore(): release v11.4.7
782cdc0 Merge pull request #4056 from nestjs/renovate/js-yaml-5.x-lockfile
4a5a4b0 Merge pull request #4005 from y-hsgw/fix/plugin-object-example
11b3fb6 chore(deps): update dependency js-yaml to v5.3.0
e5203bf Merge pull request #4019 from kyungseopk1m/fix/readonly-outdir-import-path
fccfa59 Merge pull request #4030 from kyungseopk1m/fix/deep-partial-type-plugin-metadata
91e5917 Merge pull request #4047 from kyungseopk1m/feat/api-header-extensions
1296583 Merge pull request #4053 from nestjs/renovate/js-yaml-5.x
f436f56 Merge pull request #4054 from nestjs/renovate/fastify-static-10.x
b293944 Merge pull request #4042 from jorenl/bugfix/plugin-get-identifier-from-name-p...
Additional commits viewable in compare view

Updates @nestjs/cli from 11.0.21 to 11.0.24

Release notes

Sourced from @nestjs/cli's releases.

Release 11.0.24

fix(compiler): fail fast when typescript lacks the programmatic api (3c6b4ac4)

refactor: move available languages closer to first usage (1697b7fd)

refactor: delete unused gulp tool utility helper file (75b57c4e)

fix(runners): remove duplicated binary in failed command message (54b08ae0)

Release 11.0.23

Revert "fix(compiler): validate delete out dir paths before rm" (0dd0e3ef)

Revert "fix(compiler): validate asset output paths" (728f80cf)

Release 11.0.22

fix(cli): resolve Windows path separator bug in plugin loader (9e502bda)

fix(compiler): validate asset output paths (c4342b2c)

fix: Update CRUD option to accept a value for generating entry points (4c0e2cab)

feat: Add type and CRUD options in generate command (b19856a3)

Commits

c8a68da chore(): release v11.0.24
e5fda8c Merge pull request #3478 from ruban-s/fix/typescript-7-unsupported-api
3c6b4ac fix(compiler): fail fast when typescript lacks the programmatic api
de85434 Merge pull request #3475 from abdulganiyy/refactor/move-languages-variable-cl...
1697b7f refactor: move available languages closer to first usage
2705bd4 Merge pull request #3472 from abdulganiyy/delete-unused-helper-file
75b57c4 refactor: delete unused gulp tool utility helper file
c2aefdf Merge pull request #3469 from iamkanguk97/fix/runner-duplicated-binary
54b08ae fix(runners): remove duplicated binary in failed command message
731a09b chore(): release v11.0.23
Additional commits viewable in compare view

Updates @nestjs/testing from 11.1.19 to 11.2.1

Release notes

Sourced from @nestjs/testing's releases.

v11.2.1

What's Changed

fix(core): early-return SSE abort issue by @kamilmysliwiec

Full Changelog: nestjs/nest@v11.2.0...v11.2.1

v11.2.0

What's Changed

fix(core): share existing singleton providers with lazily loaded modules by @shariyerShazan in nestjs/nest#17430

fix(common): match string file types containing regex metacharacters by @Jaybhade in nestjs/nest#17435

fix(core): convert adjacent wildcard segments in legacy route converter by @eeshsaxena in nestjs/nest#17416

fix(fastify): run middleware on routes excluded from global prefix by @Arun445 in nestjs/nest#17377

fix(fastify): avoid double prefixing inherited middleware by @GiHoon1123 in nestjs/nest#17350

fix(core): scan pre-registered dynamic imports of lazy modules by @johnnyhuirilef in nestjs/nest#17464

feat(core,common,platform-fastify): add query http method support by @gacardinal in nestjs/nest#17162

fix(common): exclude reverse-mapped keys from numeric enum validation in ParseEnumPipe by @LeSingh1 in nestjs/nest#17086

test(testing): Add e2e integration tests for HTTP QUERY method (RFC 10008) by @brayanjeshua in nestjs/nest#17310

feat(core): sse signal by @kamilmysliwiec in nestjs/nest#17469

chore(deps): update dependency fastify to v5.12.0 by @renovate[bot] in nestjs/nest#17473

New Contributors

@shariyerShazan made their first contribution in nestjs/nest#17430

@Jaybhade made their first contribution in nestjs/nest#17435

@eeshsaxena made their first contribution in nestjs/nest#17416

@Arun445 made their first contribution in nestjs/nest#17377

@GiHoon1123 made their first contribution in nestjs/nest#17350

@johnnyhuirilef made their first contribution in nestjs/nest#17464

@gacardinal made their first contribution in nestjs/nest#17162

@LeSingh1 made their first contribution in nestjs/nest#17086

@brayanjeshua made their first contribution in nestjs/nest#17310

Full Changelog: nestjs/nest@v11.1.29...v11.2.0

v11.1.29

What's Changed

fix(core): stop import lookup after first direct export match by @malekelkssas in nestjs/nest#17141

chore: update multerExceptions constant by @bo0tzz in nestjs/nest#17328

fix(microservices): correct pub/sub client type in redis listeners by @zaewc in nestjs/nest#17331

feat(common): add override mimetype option to file type validator by @Ativ3k in nestjs/nest#17333

fix(core): drop the g flag from middleware overlap regexes by @dchaudhari7177 in nestjs/nest#17335

feat(core): support sse comments by @kyu4583 in nestjs/nest#17327

fix(core): resolve barrier immediately when target count is zero by @ikrbasak in nestjs/nest#17393

fix(common): exclude pipe options from validator options by @coxxny in nestjs/nest#17399

fix(core): serialize SSE retry field when value is zero by @kyu4583 in nestjs/nest#17360

fix(microservices): nullify grpcclient on close when tryshutdown fails by @Se3do in nestjs/nest#17394

fix(express): map missing multer field nesting error by @Se3do in nestjs/nest#17421

New Contributors

@malekelkssas made their first contribution in nestjs/nest#17141

@hjc0930 made their first contribution in nestjs/nest#17311

... (truncated)

Commits

4535f43 chore(release): publish v11.2.1 release
f2a7e4b chore(release): publish v11.2.0 release
03587a1 chore(release): publish v11.1.29 release
92bc05d chore: update readme
dfaa376 chore(release): publish v11.1.28 release
660a124 chore(release): publish v11.1.27 release
aa5c4f1 chore: update readme and package.json
9ff83d5 chore(release): publish v11.1.26 release
02f8041 chore(release): publish v11.1.25 release
d8a0ab8 chore(release): publish v11.1.24 release
Additional commits viewable in compare view

sourcery-ai

Hey - I've found 1 security issue

Security issues:

js-yaml: Denial of Service via exponential parsing in flow collections (link)

Prompt for AI Agents

Please address the comments from this code review:

## Individual Comments

### Comment 1
<location path="package-lock.json" line_range="3166-3187" />
<code_context>

</code_context>
<issue_to_address>
**security (CVE-2026-73643):** js-yaml: Denial of Service via exponential parsing in flow collections

js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 until 5.2.2, parsing a small YAML document can take exponential time when an application calls load() or loadAll() on untrusted input. In src/parser/parser.ts, readFlowCollection uses restoreState and calls parseNode a second time when a flow-sequence entry is recognized as a key: value pair. If the key is a nested flow sequence of the same shape, every level is parsed twice, causing O(2^n) work and allowing an input under 200 bytes to keep one CPU busy for minutes, block the Node.js event loop, and stall the process. No anchors, aliases, merges, tags, or nondefault options are required. This issue is fixed in version 5.2.2.

*Source: trivy*
</issue_to_address>

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}

Bumps the nestjs group with 5 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@nestjs-modules/mailer](https://github.com/nest-modules/mailer) | `2.3.4` | `2.3.7` | | [@nestjs/platform-express](https://github.com/nestjs/nest/tree/HEAD/packages/platform-express) | `11.1.28` | `11.2.1` | | [@nestjs/swagger](https://github.com/nestjs/swagger) | `11.4.2` | `11.4.7` | | [@nestjs/cli](https://github.com/nestjs/nest-cli) | `11.0.21` | `11.0.24` | | [@nestjs/testing](https://github.com/nestjs/nest/tree/HEAD/packages/testing) | `11.1.19` | `11.2.1` | Updates `@nestjs-modules/mailer` from 2.3.4 to 2.3.7 - [Release notes](https://github.com/nest-modules/mailer/releases) - [Commits](https://github.com/nest-modules/mailer/compare/@nestjs-modules/mailer@2.3.4...@nestjs-modules/mailer@2.3.7) Updates `@nestjs/platform-express` from 11.1.28 to 11.2.1 - [Release notes](https://github.com/nestjs/nest/releases) - [Commits](https://github.com/nestjs/nest/commits/v11.2.1/packages/platform-express) Updates `@nestjs/swagger` from 11.4.2 to 11.4.7 - [Release notes](https://github.com/nestjs/swagger/releases) - [Commits](nestjs/swagger@11.4.2...11.4.7) Updates `@nestjs/cli` from 11.0.21 to 11.0.24 - [Release notes](https://github.com/nestjs/nest-cli/releases) - [Commits](nestjs/nest-cli@11.0.21...11.0.24) Updates `@nestjs/testing` from 11.1.19 to 11.2.1 - [Release notes](https://github.com/nestjs/nest/releases) - [Commits](https://github.com/nestjs/nest/commits/v11.2.1/packages/testing) --- updated-dependencies: - dependency-name: "@nestjs-modules/mailer" dependency-version: 2.3.7 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nestjs - dependency-name: "@nestjs/cli" dependency-version: 11.0.24 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: nestjs - dependency-name: "@nestjs/platform-express" dependency-version: 11.2.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nestjs - dependency-name: "@nestjs/swagger" dependency-version: 11.4.6 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nestjs - dependency-name: "@nestjs/testing" dependency-version: 11.2.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: nestjs ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-08-31T08:41:25Z

Looks like these dependencies are updatable in another way, so this is no longer needed.

dependabot Bot added dependencies Pull requests that update a dependency file npm labels Aug 17, 2026

dependabot Bot requested a review from a team as a code owner August 17, 2026 15:04

dependabot Bot added dependencies Pull requests that update a dependency file npm labels Aug 17, 2026

sourcery-ai Bot reviewed Aug 17, 2026

View reviewed changes

Comment thread package-lock.json

dependabot Bot force-pushed the dependabot/npm_and_yarn/nestjs-93cdd3c202 branch from 692fbfc to 6a2f23f Compare August 24, 2026 15:03

github-actions Bot approved these changes Aug 24, 2026

View reviewed changes

github-actions Bot enabled auto-merge August 24, 2026 15:04

dependabot Bot force-pushed the dependabot/npm_and_yarn/nestjs-93cdd3c202 branch 3 times, most recently from 2074f6b to 67c8762 Compare August 27, 2026 12:22

dependabot Bot force-pushed the dependabot/npm_and_yarn/nestjs-93cdd3c202 branch from 67c8762 to 093a6c5 Compare August 27, 2026 12:33

dependabot Bot closed this Aug 31, 2026

auto-merge was automatically disabled August 31, 2026 08:41
Pull request was closed

dependabot Bot deleted the dependabot/npm_and_yarn/nestjs-93cdd3c202 branch August 31, 2026 08:41

Navigation Menu

Uh oh!

build(deps): bump the nestjs group across 1 directory with 5 updates - #2897

build(deps): bump the nestjs group across 1 directory with 5 updates#2897
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/nestjs-93cdd3c202

dependabot Bot commented on behalf of github Aug 17, 2026 •

edited

Loading

Uh oh!

sourcery-ai Bot left a comment

Uh oh!

Uh oh!

dependabot Bot commented on behalf of github Aug 31, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Aug 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

@​nestjs-modules/mailer@​2.3.7

Patch Changes

@​nestjs-modules/mailer@​2.3.6

Patch Changes

@​nestjs-modules/mailer@​2.3.5

Patch Changes

v11.2.1

What's Changed

v11.2.0

What's Changed

New Contributors

v11.1.29

What's Changed

New Contributors

11.4.7

What's Changed

New Contributors

Release 11.4.6

11.4.6 (2026-07-17)

Features

Bug fixes

Enhancements

Dependencies

Committers: 4

11.4.5

What's Changed

Release 11.0.24

Release 11.0.23

Release 11.0.22

v11.2.1

What's Changed

v11.2.0

What's Changed

New Contributors

v11.1.29

What's Changed

New Contributors

Uh oh!

sourcery-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

dependabot Bot commented on behalf of github Aug 31, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Aug 17, 2026 •

edited

Loading

`@nestjs-modules/mailer@2`.3.7

`@nestjs-modules/mailer@2`.3.6

`@nestjs-modules/mailer@2`.3.5