chore(deps): bump the npm-dependencies group across 1 directory with 37 updates

[dependabot]

Bumps the npm-dependencies group with 37 updates in the / directory:

Package	From	To
@fastify/helmet	13.1.0	13.1.2
@fastify/static	10.1.2	10.1.5
@keyv/redis	5.1.6	6.1.0
@nestjs/cache-manager	3.1.3	12.0.1
@nestjs/common	11.1.28	12.1.2
@nestjs/config	4.0.4	12.0.1
@nestjs/core	11.1.28	12.1.2
@nestjs/platform-fastify	11.1.28	12.1.2
@nestjs/swagger	11.4.6	12.0.2
@nestjs/throttler	6.5.0	6.7.1
@prisma/adapter-pg	7.9.0	7.10.0
@prisma/client	7.9.0	7.10.0
@scalar/nestjs-api-reference	1.2.11	1.2.28
dotenv	17.4.2	18.0.6
fastify	5.12.1	5.12.5
ioredis	5.11.1	6.0.0
keyv	5.6.0	6.1.0
nestjs-i18n	10.8.4	10.8.5
nestjs-pino	4.6.1	5.3.1
nestjs-zod	5.4.0	5.5.0
pg	8.22.0	8.23.1
@types/pg	8.20.0	8.23.1
prisma	7.9.0	7.9.1
zod	4.4.3	4.6.5
@biomejs/biome	2.5.2	2.5.15
@commitlint/cli	21.2.0	21.2.3
@commitlint/config-conventional	21.2.0	21.2.3
@nestjs/cli	11.0.23	12.0.8
@nestjs/schematics	11.1.0	12.0.6
@nestjs/testing	11.1.28	12.1.2
@types/node	26.1.0	26.6.4
@types/pg	8.20.0	8.23.1
jest	30.4.2	30.5.2
lint-staged	17.0.8	17.6.0
supertest	7.2.2	7.3.1
@types/supertest	7.2.0	7.2.1
ts-jest	29.4.11	29.4.14
typescript	6.0.3	7.0.2

Updates @fastify/helmet from 13.1.0 to 13.1.2

Release notes

Sourced from @​fastify/helmet's releases.

v13.1.2

What's Changed

• ci: enable trusted publishing releases by @​Puppo in fastify/fastify-helmet#322

New Contributors

• @​Puppo made their first contribution in fastify/fastify-helmet#322

Full Changelog: fastify/fastify-helmet@v13.1.1...v13.1.2

v13.1.1

What's Changed

• test: fix CSP header order assertions for helmet@8.3.x by @​Tony133 in fastify/fastify-helmet#318
• ci: pin actions to commit-hash by @​Fdawgs in fastify/fastify-helmet#316
• chore: bump c8 from 11.0.0 to 12.0.0 by @​dependabot[bot] in fastify/fastify-helmet#317
• chore: bump fastify/workflows/.github/workflows/lock-threads.yml from 6.0.0 to 7.0.0 by @​dependabot[bot] in fastify/fastify-helmet#320
• chore: bump fastify/workflows/.github/workflows/plugins-ci.yml from 6.0.0 to 7.0.0 by @​dependabot[bot] in fastify/fastify-helmet#321
• chore(.npmrc): add min-release-age by @​Fdawgs in fastify/fastify-helmet#319

Full Changelog: fastify/fastify-helmet@v13.1.0...v13.1.1

Commits

• 6e3234f Bumped v13.1.2
• 4b0aac4 ci: enable trusted publishing releases
• 8854d49 Bumped v13.1.1
• c4bbcb2 chore(.npmrc): add min-release-age (#319)
• 8406fa8 chore: bump fastify/workflows/.github/workflows/plugins-ci.yml (#321)
• d8da457 chore: bump fastify/workflows/.github/workflows/lock-threads.yml (#320)
• 655cd3a chore: bump c8 from 11.0.0 to 12.0.0 (#317)
• 928d9b5 ci: pin actions to commit-hash
• 7c9cda3 test: fix CSP header order assertions for helmet@8.3.x
• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​fastify/helmet since your current version.

Updates @fastify/static from 10.1.2 to 10.1.5

Release notes

Sourced from @​fastify/static's releases.

v10.1.5

What's Changed

• fix: use registered root for relative downloads by @​lprnmns in fastify/fastify-static#610

New Contributors

• @​lprnmns made their first contribution in fastify/fastify-static#610

Full Changelog: fastify/fastify-static@v10.1.4...v10.1.5

v10.1.4

This is a security release for GHSA-r799-r9gc-m956 (CVE-2026-90982).

It fixes a route guard and allowedPath bypass on case-insensitive filesystems. Users should upgrade to @fastify/static 10.1.4.

Full Changelog: fastify/fastify-static@v10.1.3...v10.1.4

v10.1.3

What's Changed

• chore: bump c8 from 11.0.0 to 12.0.0 by @​dependabot[bot] in fastify/fastify-static#602
• chore(.npmrc): add min-release-age by @​Fdawgs in fastify/fastify-static#603
• chore: bump fastify/workflows/.github/workflows/lock-threads.yml from 6.0.0 to 7.0.0 by @​dependabot[bot] in fastify/fastify-static#605

Full Changelog: fastify/fastify-static@v10.1.2...v10.1.3

Commits

• 2f0953a Bumped v10.1.5
• 275d87e fix: use registered root for relative downloads (#610)
• a39a464 Bumped v10.1.4
• ac46015 Ignore .pi
• 6288466 test: consume compressed response bodies
• 04134a4 test: cover rootless path validation on Windows
• d9a8c0a test: make case-folding fallback portable
• dbe65e8 Merge commit from fork
• 48b821f chore: bump content-disposition in the dependencies group (#607)
• ee3f89d chore: bump fastify/workflows/.github/workflows/plugins-ci.yml (#604)
• Additional commits viewable in compare view

Updates @keyv/redis from 5.1.6 to 6.1.0

Release notes

Sourced from @​keyv/redis's releases.

v6.1.0

keyv@6.1.0 — 2026-10-06

First stable release of Keyv v6, published to npm's latest tag.

All 20 published packages release in lockstep at 6.1.0; there is no 6.0.0. @keyv/website is private and not published.

Coming from v5? Follow the v5 to v6 migration guide, or point your coding agent at https://keyv.org/skills/migrate. v5 stays in maintenance; install it with keyv@5.

⚠ BREAKING CHANGES

These are changes since 6.0.0-rc.1. Coming from v5, start with the migration guide.

• keyv, adapters: the namespace separator option is namespaceSeparator on every adapter that joins the namespace and the key, and it defaults to ::; keySeparator and keyPrefixSeparator are gone (d0bc310, #2189) Migration from rc.1: rename the option. To keep reading namespaced data rc.1 wrote, set namespaceSeparator: ':' on the memory and bridge adapters, @keyv/etcd, @keyv/dynamo, @keyv/cloudflare-kv and @keyv/valkey. @keyv/redis already used :: in rc.1. Migration from v5: v5's Keyv also prefixed every key with <namespace>:, so the setting depends on the adapter. A default v5 @keyv/redis setup stored keyv::keyv:foo, which v6 reads with new Keyv(new KeyvRedis(uri, { namespaceSeparator: '::keyv:' }), { namespace: 'keyv' }). If you used createKeyv(), set only the same namespace. For other adapters, see The Default keyv Namespace Was Removed.
• keyv: throwOnErrors is removed; a failed call returns a fallback value when an error listener is attached and rejects when none is (860dba7, #2155) Migration: remove throwOnErrors, and attach an error listener if you want fallback values instead of rejections.
• keyv: a namespace set on the storage adapter is used when Keyv has none (c6e88e7, #2156) Migration: data rc.1 wrote in that setup has no namespace; remove the adapter's namespace to keep reading it, or let it refill.
• keyv: a namespaced clear() fails instead of wiping a store it can't list (790eb3c, #2186) Migration: give the store keys() or iterator(), or call clear() on a Keyv instance without a namespace to empty it.
• keyv: writes fail when an encryption adapter is set and serialization is off; rc.1 stored those values unencrypted (b73ee16, #2176) Migration: keep serialization on, which is the default, when you use encryption.
• postgres, sqlite, mongo, dynamo, cloudflare-kv, etcd: keys that start with <namespace>: are stored as given instead of being treated as already prefixed (9dec04c, #2159) Migration: entries rc.1 wrote under such keys read as missing; write them again.
• encrypt-node, encrypt-web: @keyv/encrypt-node accepts only AES-GCM, AES-CCM and ChaCha20-Poly1305 with base64, base64url or hex output, and @keyv/encrypt-web accepts only AES-GCM; AES-CBC is removed (b06ec8b, #2187) Migration: the defaults are unchanged; re-encrypt values written with any other algorithm or encoding before you upgrade.
• dynamo: keys written without a TTL no longer expire, and sixHoursInMilliseconds is removed (476761d, #2161) Migration: set Keyv's ttl option for a default expiry, as in new Keyv(store, { ttl: 6 * 60 * 60 * 1000 }).
• etcd: the lease property is removed, and the store ttl applies to each key from its own write (6ba3096, #2160) Migration: remove code that reads or sets store.lease.
• etcd: without a namespace, clear() and iterator() only touch entries Keyv wrote without a namespace (8a77946, #2173) Migration: set noNamespaceAffectsAll: true for the rc.1 behavior, and namespaceSeparator: ':' while etcd still holds namespaced rc.1 entries.
• memcache: clear() only removes the store's own entries, and values rc.1 wrote read as missing (12415c5, #2179) Migration: let the cache refill; set noNamespaceAffectsAll: true on a store without a namespace to flush the whole server.
• bigmap: setting storeSize keeps every entry and no longer emits clear (b80b44d, #2178) Migration: call clear() yourself if you resized the map to empty it.

Features

• add the keyv-migrate agent skill, which upgrades a project from Keyv v4 or v5 to v6; it is published at https://keyv.org/skills/migrate (bae30d5, #2171)

  npx skills add jaredwray/keyv --skill keyv-migrate

• add a namespaceSeparator option to every adapter that joins the namespace and the key; it defaults to :: (d0bc310, #2189)

  import Keyv from 'keyv';
  import KeyvEtcd from '@keyv/etcd';

... (truncated)

Commits

• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​keyv/redis since your current version.

Updates @nestjs/cache-manager from 3.1.3 to 12.0.1

Release notes

Sourced from @​nestjs/cache-manager's releases.

Release 12.0.1

What's Changed

• fix: apply module namespace and ttl to keyv instance stores by @​Asadshah7950 in nestjs/cache-manager#1188

New Contributors

• @​Asadshah7950 made their first contribution in nestjs/cache-manager#1188

Full Changelog: nestjs/cache-manager@12.0.0...12.0.1

Release 12.0.0

What's Changed

@nestjs/cache-manager is now a native ES module, and the major version is aligned with the Nest 12 release line (there is no 4.x — 3.1.3 goes straight to 12.0.0).

ESM migration

The package is published as pure ESM ("type": "module", compiled with NodeNext) behind a proper exports map. The legacy root index.js / index.d.ts / index.ts shims are gone, and deep imports into build internals are no longer resolvable — import from the package root:

import { CacheModule, CacheInterceptor, CacheKey, CacheTTL } from '@nestjs/cache-manager';

require(esm) — CommonJS still works

You do not need to convert your app to ESM. Thanks to Node's require(esm) support, CommonJS consumers can keep using require('@nestjs/cache-manager') unchanged — the exports map points both import and require at the same ESM build, and Node loads it natively.

This is why the supported Node range is now enforced via engines:

"engines": {
  "node": "^20.19.0 || ^22.12.0 || >=24.0.0"
}

Those are the Node versions where require(esm) is available unflagged. On older Node versions, requiring this package from CommonJS will fail with ERR_REQUIRE_ESM.

Upgrading

npm i @nestjs/cache-manager@12

Checklist:

• Ensure you're on Node ^20.19.0, ^22.12.0, or >=24.0.0.
• Replace any deep imports (e.g. @nestjs/cache-manager/dist/...) with root imports.
• No changes needed to CacheModule.register() / registerAsync(), interceptors, or decorators.

Commits

• ba7b70a chore(): release v12.0.1
• 867c15e chore(deps): update dependency @​types/node to v24.19.1 (#1186)
• 0cb657c Merge pull request #1185 from nestjs/renovate/vite-8.x
• 947038e chore(deps): update dependency vite to v8.3.3
• 0deb091 Merge pull request #1183 from nestjs/renovate/oxlint-monorepo
• 2ef8516 chore(deps): update dependency oxlint to v1.87.0
• 872fd03 Merge pull request #1182 from nestjs/renovate/nest-monorepo
• 4b42dba Merge pull request #1184 from nestjs/renovate/vitest-monorepo
• 0bcad8a Merge pull request #1189 from nestjs/renovate/supertest-7.x
• 8c43fc8 Merge pull request #1190 from nestjs/renovate/release-it-21.x
• Additional commits viewable in compare view

Updates @nestjs/common from 11.1.28 to 12.1.2

Release notes

Sourced from @​nestjs/common's releases.

v12.1.1 (2026-09-28)

Bug fixes

• common, core, microservices, testing
  • #17893 fix(common): logger bugs in json output, level changes, fatal and buffered logs (@​kamilmysliwiec)
• microservices
  • #17891 fix(microservices): let the mqtt client retry after a failed connect (@​hktitof)
  • #17888 fix(microservices): keep tcp event listeners across reconnects (@​KAPUIST)
  • #17887 fix(microservices): ignore events from a replaced tcp client socket (@​KAPUIST)
  • #17878 fix(microservices): keep a newer nats connection when a stale one fails (@​hktitof)
  • #17869 fix(microservices): keep a newer kafka connection when a stale one fails (@​kamilmysliwiec)
  • #17865 fix(microservices): let the rmq client retry after a failed connect (@​hktitof)
  • #17866 fix(microservices): reply on the request channel when redis wildcards are enabled (@​fadiroot)
  • #17861 fix(microservices): recover the nats client after it gives up reconnecting (@​xia-chao)
• common
  • #17884 fix(common): preserve string enum values matching numeric member names (@​KAPUIST)
• core
  • #17871 fix(core): detect circular dependencies across more than two providers (@​erezcor)
• platform-fastify
  • #17867 fix(fastify): treat a JSON content type with parameters as JSON in reply() (@​fadiroot)
• core, testing
  • #17860 fix(core): honor class and factory overrides of value providers (@​lehafari)

Enhancements

• common
  • #17876 fix(common): reject non-numeric items in ParseArrayPipe with items Number (@​SulimanAbdulrazzaq)
• microservices
  • #17863 feat(microservices): export deserializers from the package root (@​lazerg)

Committers: 13

• Abdellatif Anaflous (@​hktitof)
• Alejandro (@​lehafari)
• Daniel Pinto (@​Cayan)
• Dharmik Sondagar (@​DharmikSondagar)
• Kamil Mysliwiec (@​kamilmysliwiec)
• Lazizbek Ergashev (@​lazerg)
• Luke Son (@​KAPUIST)
• Micael Levi L. Cavalcante (@​micalevisk)
• Roman Khegay (@​thekhegay)
• Suliman Abdulrazzaq (@​SulimanAbdulrazzaq)
• Xia Chao (@​xia-chao)
• @​erezcor
• fadi romdhan (@​fadiroot)

v12.1.0 (2026-09-23)

Bug fixes

• core
  • #17838 fix(core): inherit optional ctor params when the ctor is not redeclared (@​kamilmysliwiec)
  • #17819 fix(core): name the module when metadata entries are invalid (@​thekhegay)

... (truncated)

Commits

• 8ab60aa chore(release): publish v12.1.2 release
• ab3fb3d chore(release): publish v12.1.2 release
• 50fb722 docs(core): fix resolve() @​returns tags to match their Promise signatures (#1...
• 4ea29cc feat(common): export UUIDVersion and support 'all' and numeric versions in Pa...
• a054312 fix(common): keep StreamableFile from mutating the caller options (#17925)
• 41a3a54 feat(common): support uuid v1, v2, v6 and v8 in ParseUUIDPipe (#17904)
• 9feedff chore(release): publish v12.1.1 release
• daf6883 fix(common): logger bugs in json output, level changes, fatal and buffered lo...
• 34c9965 fix(common): preserve string enum values matching numeric member names (#17884)
• 1fbe1c5 fix(common): reject non-numeric items in ParseArrayPipe with items Number (#1...
• Additional commits viewable in compare view

Updates @nestjs/config from 4.0.4 to 12.0.1

Release notes

Sourced from @​nestjs/config's releases.

Release 12.0.1

What's Changed

• fix(config): prevent prefix corruption and escape propertyPath in updateInterpolatedEnv by @​Asadshah7950 in nestjs/config#2427
• fix(deps): update dependency dotenv to v18.0.3 by @​renovate[bot] in nestjs/config#2444

New Contributors

• @​Asadshah7950 made their first contribution in nestjs/config#2427

Full Changelog: nestjs/config@12.0.0...12.0.1

12.0.0

What's Changed

@nestjs/config is now a native ES module, environment validation is built on Standard Schema instead of Joi-specific code, and the major version is aligned with the Nest 12 release line (there is no 5.x — 4.0.4 goes straight to 12.0.0).

ESM migration

The package is published as pure ESM ("type": "module", compiled with NodeNext) behind a proper exports map. The legacy root index.js / index.d.ts shims are gone, and deep imports into build internals are no longer resolvable — import from the package root.

// ✅
import { ConfigModule, ConfigService } from '@nestjs/config';
// ❌ no longer resolvable
import { ConfigService } from '@​nestjs/config/dist/config.service';

require(esm) — CommonJS still works

You do not need to convert your app to ESM. Thanks to Node's require(esm) support (Node 20.19+ / 22.12+), a CommonJS app can keep using require('@nestjs/config') unchanged.

Validation is now Standard Schema based

validationSchema accepts any schema implementing the Standard Schema spec — Zod (v3, v4, v4-mini), Valibot, ArkType, Joi 18+, and anything else that adopts it. There is no longer any Joi-specific code path in the module, and Joi is no longer implied as the validation library.

ConfigModule.forRoot({
  validationSchema: z.object({
    PORT: z.coerce.number().default(3000),
    DATABASE_NAME: z.string(),
  }),
});

Joi keeps working — it implements Standard Schema as of v18 — and the historical abortEarly: false / allowUnknown: true defaults are still applied automatically for Joi schemas, so existing Joi setups behave as before.

Breaking: validationOptions shape

Options are now the Standard Schema Options object, and library-specific settings move under libraryOptions:

... (truncated)

Commits

• 2785b5f chore(): release v12.0.1
• 0c0a0d6 fix(deps): update dependency dotenv to v18.0.3 (#2444)
• 130ee69 fix(deps): update dependency es-toolkit to v1.52.0 (#2411)
• ab84892 chore(deps): update node.js to v24.21.0 (#2420)
• d71b4a8 fix(config): prevent prefix corruption and escape propertyPath in updateInter...
• 498b207 fix(deps): update dependency dotenv to v18 (#2437)
• c32556f chore(deps): update dependency oxlint to v1.85.0 (#2443)
• 58af4ad chore(deps): update nest monorepo to v12.0.4 (#2442)
• 56fdf53 chore(deps): update commitlint monorepo to v21.2.3 (#2441)
• 73353eb chore(deps): update dependency @​types/node to v24.13.6 (#2440)
• Additional commits viewable in compare view

Updates @nestjs/core from 11.1.28 to 12.1.2

Release notes

Sourced from @​nestjs/core's releases.

v12.1.1 (2026-09-28)

Bug fixes

• common, core, microservices, testing
  • #17893 fix(common): logger bugs in json output, level changes, fatal and buffered logs (@​kamilmysliwiec)
• microservices
  • #17891 fix(microservices): let the mqtt client retry after a failed connect (@​hktitof)
  • #17888 fix(microservices): keep tcp event listeners across reconnects (@​KAPUIST)
  • #17887 fix(microservices): ignore events from a replaced tcp client socket (@​KAPUIST)
  • #17878 fix(microservices): keep a newer nats connection when a stale one fails (@​hktitof)
  • #17869 fix(microservices): keep a newer kafka connection when a stale one fails (@​kamilmysliwiec)
  • #17865 fix(microservices): let the rmq client retry after a failed connect (@​hktitof)
  • #17866 fix(microservices): reply on the request channel when redis wildcards are enabled (@​fadiroot)
  • #17861 fix(microservices): recover the nats client after it gives up reconnecting (@​xia-chao)
• common
  • #17884 fix(common): preserve string enum values matching numeric member names (@​KAPUIST)
• core
  • #17871 fix(core): detect circular dependencies across more than two providers (@​erezcor)
• platform-fastify
  • #17867 fix(fastify): treat a JSON content type with parameters as JSON in reply() (@​fadiroot)
• core, testing
  • #17860 fix(core): honor class and factory overrides of value providers (@​lehafari)

Enhancements

• common
  • #17876 fix(common): reject non-numeric items in ParseArrayPipe with items Number (@​SulimanAbdulrazzaq)
• microservices
  • #17863 feat(microservices): export deserializers from the package root (@​lazerg)

Committers: 13

• Abdellatif Anaflous (@​hktitof)
• Alejandro (@​lehafari)
• Daniel Pinto (@​Cayan)
• Dharmik Sondagar (@​DharmikSondagar)
• Kamil Mysliwiec (@​kamilmysliwiec)
• Lazizbek Ergashev (@​lazerg)
• Luke Son (@​KAPUIST)
• Micael Levi L. Cavalcante (@​micalevisk)
• Roman Khegay (@​thekhegay)
• Suliman Abdulrazzaq (@​SulimanAbdulrazzaq)
• Xia Chao (@​xia-chao)
• @​erezcor
• fadi romdhan (@​fadiroot)

v12.1.0 (2026-09-23)

Bug fixes

• core
  • #17838 fix(core): inherit optional ctor params when the ctor is not redeclared (@​kamilmysliwiec)
  • #17819 fix(core): name the module when metadata entries are invalid (@​thekhegay)

... (truncated)

Commits

• 8ab60aa chore(release): publish v12.1.2 release
• ab3fb3d chore(release): publish v12.1.2 release
• 50fb722 docs(core): fix resolve() @​returns tags to match their Promise signatures (#1...
• dee19bb fix(core): resolve durable global filters with the strategy's context id (#17...
• 9feedff chore(release): publish v12.1.1 release
• daf6883 fix(common): logger bugs in json output, level changes, fatal and buffered lo...
• b1014b6 fix(core): detect circular dependencies across more than two providers (#17871)
• b5f3273 fix(core): honor class and factory overrides of value providers (#17860)
• 5100837 fix(core): recommend {*path} in the legacy wildcard warning (#17859)
• 6739656 chore(release): publish v12.1.0 release
• Additional commits viewable in compare view

Updates @nestjs/platform-fastify from 11.1.28 to 12.1.2

Release notes

Sourced from @​nestjs/platform-fastify's releases.

v12.1.1 (2026-09-28)

Bug fixes

• common, core, microservices, testing
  • #17893 fix(common): logger bugs in json output, level changes, fatal and buffered logs (@​kamilmysliwiec)
• microservices
  • #17891 fix(microservices): let the mqtt client retry after a failed connect (@​hktitof)
  • #17888 fix(microservices): keep tcp event listeners across reconnects (@​KAPUIST)
  • #17887 fix(microservices): ignore events from a replaced tcp client socket (@​KAPUIST)
  • #17878 fix(microservices): keep a newer nats connection when a stale one fails (@​hktitof)
  • #17869 fix(microservices): keep a newer kafka connection when a stale one fails (@​kamilmysliwiec)
  • #17865 fix(microservices): let the rmq client retry after a failed connect (@​hktitof)
  • #17866 fix(microservices): reply on the request channel when redis wildcards are enabled (@​fadiroot)
  • #17861 fix(microservices): recover the nats client after it gives up reconnecting (@​xia-chao)
• common
  • #17884 fix(common): preserve string enum values matching numeric member names (@​KAPUIST)
• core
  • #17871 fix(core): detect circular dependencies across more than two providers (@​erezcor)
• platform-fastify
  • #17867 fix(fastify): treat a JSON content type with parameters as JSON in reply() (@​fadiroot)
• core, testing
  • #17860 fix(core): honor class and factory overrides of value providers (@​lehafari)

Enhancements

• common
  • #17876 fix(common): reject non-numeric items in ParseArrayPipe with items Number (@​SulimanAbdulrazzaq)
• microservices
  • #17863 feat(microservices): export deserializers from the package root (@​lazerg)

Committers: 13

• Abdellatif Anaflous (@​hktitof)
• Alejandro (@​lehafari)
• Daniel Pinto (@​Cayan)
• Dharmik Sondagar (@​DharmikSondagar)
• Kamil Mysliwiec (@​kamilmysliwiec)
• Lazizbek Ergashev (@​lazerg)
• Luke Son (@​KAPUIST)
• Micael Levi L. Cavalcante (@​micalevisk)
• Roman Khegay (@​thekhegay)
• Suliman Abdulrazzaq (@​SulimanAbdulrazzaq)
• Xia Chao (@​xia-chao)
• @​erezcor
• fadi romdhan (@​fadiroot)

v12.1.0 (2026-09-23)

Bug fixes

• core
  • #17838 fix(core): inherit optional ctor params when the ctor is not redeclared (@​kamilmysliwiec)
  • #17819 fix(core): name the module when metadata entries are invalid (@​thekhegay)

... (truncated)

Commits

• 8ab60aa chore(release): publish v12.1.2 release
• ab3fb3d chore(release): publish v12.1.2 release
• 1685a43 fix(express,fastify): keep +json content types on error replies (#17916)
• 697ff89 fix(express,fastify): read media type version from any accept param
• 9feedff chore(release): publish v12.1.1 release
• 3e903a0 fix(fastify): treat a JSON content type with parameters as JSON in reply() (#...
• 233a88e fix(fastify): register static assets and view engine before listen (#17854)
• 6739656 chore(release): publish v12.1.0 release
• ea0d2cc fix(fastify): honor Nest forceCloseConnections in initHttpServer (#17824)
• d232dda feat(fastify): add file upload interceptors backed by @​fastify/multipart (#17...
• Additional commits viewable in compare view

Updates @nestjs/swagger from 11.4.6 to 12.0.2

Release notes

Sourced from @​nestjs/swagger's releases.

12.0.2

What's Changed

• fix(plugin): treat single literal types as enums by @​y-hsgw in nestjs/swagger#4097
• fix(deps): update dependency es-toolkit to v1.52.0 by @​renovate[bot] in nestjs/swagger#4081
• fix(swagger): merge standard schema query params with @​ApiQuery by @​TadejPolajnar in nestjs/swagger#4090
• fix(plugin): keep the source package specifier for workspace imports by @​mhalikosen in nestjs/swagger#4086
• fix: resolve @​fastify/static through a bundler-visible dynamic import by @​kamilmysliwiec in nestjs/swagger#4115
• fix(standard-schema): promote schema description to parameter object by @​tjsousa in nestjs/swagger#4140
• fix: declare typescript as an optional peer dependency by @​lazerg in nestjs/swagger#4134
• fix(deps): update dependency swagger-ui-dist to v5.33.0 by @​renovate[bot] in nestjs/swagger#4128
• fix(deps): update dependency @​microsoft/tsdoc to v0.17.0 by @​renovate[bot] in nestjs/swagger#4124
• feat: support the HTTP QUERY method (RFC 10008) by @​gentritabazi in nestjs/swagger#4007
• fix(swagger-ui): preserve $ characters when building swagger-ui-init.js by @​csulit in nestjs/swagger#4119

New Contributors

• @​mhalikosen made their first contribution in nestjs/swagger#4087
• @​TadejPolajnar made their first contribution in nestjs/swagger#4090
• @​tjsousa made their first contribution in nestjs/swagger#4140
• @​lazerg made their first contribution in nestjs/swagger#4134
• @​gentritabazi made their first contribution in nestjs/swagger#4007
• @​csulit made their first contribution in nestjs/swagger#4119

Full Changelog: nestjs/swagger@12.0.1...12.0.2

Release 12.0.1

12.0.1 (2026-08-28)

Bug fixes

• #4082 fix: esm hoist static imports (@​kamilmysliwiec)

Dependencies

• #4077 chore(deps): update dependency swagger-ui-dist to v5.32.14 (@​renovate[bot])

Committers: 1

• Kamil Mysliwiec (@​kamilmysliwiec)

Release 12.0.0

What's Changed

@nestjs/swagger is now a native ES module, requires Nest 12, and changes how nullable schemas are spelled in the generated document.

ESM migration

The package is published as pure ESM ("type": "module", compiled with NodeNext) behind a proper exports map. The legacy root index.ts / plugin.js / plugin.ts shims are gone, and deep imports into build internals are no longer resolvable — import from the package root (@nestjs/swagger) or from @nestjs/swagger/plugin.

require(esm) — CommonJS still works

You do not need to convert your app to ESM. Thanks to Node's require(esm) support, a CommonJS app can keep doing const { SwaggerModule } = require('@nestjs/swagger'). The CLI plugin entry (@nestjs/swagger/plugin) also keeps a require condition so nest-cli.json setups load it unchanged.

This is why the package now declares "engines": { "node": "^20.19.0 || >=22.12.0" } — those are the Node versions where require(esm) is available without a flag.

... (truncated)

Commits

• 8f00eb9 chore(): release v12.0.2
• bfb2315 fix(swagger-ui): preserve $ characters when building swagger-ui-init.js (#4119)
• 2bea96a feat: support the HTTP QUERY method (RFC 10008) (#4007)
• 752e5c7 chore(deps): update dependency supertest to v7.3.0 (#4142)
• 4faed70 fix(deps): update dependency @​microsoft/tsdoc to v0.17.0 (#4124)