Skip to content

fix(deps): update weekly-non-major-updates - #64

Merged
sleidig merged 1 commit into
mainfrom
renovate/weekly-non-major-updates
Nov 9, 2026
Merged

fix(deps): update weekly-non-major-updates#64
sleidig merged 1 commit into
mainfrom
renovate/weekly-non-major-updates

Conversation

@renovate

@renovate renovate Bot commented Nov 8, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
@nestjs/cli ^12.0.11 → ^12.0.12 age confidence
@nestjs/common (source) ^12.3.2 → ^12.4.0 age confidence
@nestjs/config ^12.0.1 → ^12.1.1 age confidence
@nestjs/core (source) ^12.3.2 → ^12.4.0 age confidence
@nestjs/jwt ^12.0.3 → ^12.0.4 age confidence
@nestjs/passport ^12.0.0 → ^12.0.1 age confidence
@nestjs/platform-express (source) ^12.3.2 → ^12.4.0 age confidence
@nestjs/schematics ^12.0.12 → ^12.0.13 age confidence
@nestjs/swagger ^12.0.5 → ^12.1.1 age confidence
@nestjs/testing (source) ^12.3.2 → ^12.4.0 age confidence
@nestjs/typeorm ^12.0.2 → ^12.0.3 age confidence
@sentry/nestjs (source) ^11.10.0 → ^11.11.0 age confidence
@sentry/profiling-node (source) ^11.10.0 → ^11.11.0 age confidence
supertest ^7.3.1 → ^7.3.2 age confidence

Release Notes

nestjs/nest-cli (@​nestjs/cli)

v12.0.12

Compare Source

What's Changed

New Contributors

Full Changelog: nestjs/nest-cli@12.0.11...12.0.12

nestjs/nest (@​nestjs/common)

v12.4.0

Compare Source

v12.4.0 (2026-11-06)
Features
Bug fixes
Enhancements
Dependencies
Committers: 8

v12.3.3

Compare Source

nestjs/config (@​nestjs/config)

v12.1.1

Compare Source

Dependencies
  • fix(deps): update dependency es-toolkit to v1.53.1 in #​2470

Full Changelog: nestjs/config@12.1.0...12.1.1

v12.1.0

Compare Source

Security

This release fixes several security issues in how ConfigService resolves property paths and how ConfigModule.forRoot() loads and validates environment variables. See GHSA-q989-84g5-qg72 for details. Upgrading is recommended.

Behavior changes

Some fixes change what ConfigService returns. Please review them before upgrading:

  • Property paths only resolve members a configuration object defines (own properties and members of your own classes). Members inherited from built-ins resolve to undefined, e.g. get('database.toString'), get('constructor.prototype') or get('cert.length') for a Buffer. set() never writes through them, and paths through __proto__, constructor or prototype are ignored.
  • Validated variables take precedence:
    • A variable that the validator maps to undefined is no longer served from process.env. get(key, defaultValue) returns the default.
    • A variable that a validationSchema declares and removes (e.g. Joi .strip()) is no longer merged back. Undeclared variables are still kept.
    • With skipProcessEnv: true and a validationSchema, undeclared variables from process.env are no longer served. Declared ones still are. A validate function's output is served as it is.
    • With validatePredefined: false, a predefined variable now takes precedence over a different value from the env file, and get() returns it as it is.
    • A second validated forRoot() no longer replaces the converted values of another one.
  • expandVariables:
    • Expanded values are assigned to process.env after validation, not before.
    • Several env files are expanded once, so $ and \$ in earlier files are no longer expanded again.
    • With override: true, a variable's reference to itself (e.g. PATH=/opt/bin:$PATH) expands to its previous value.
  • Env files: a value containing a NUL character now fails startup instead of being truncated in process.env. __proto__ keys returned by a custom parser are ignored.
  • ConfigService.set():
    • Dependent variables are re-expanded from the definitions loaded at startup. The env files are not read again.
    • Values passed to earlier set() calls and variables set in the environment are kept.
    • The expandVariables.processEnv target is honored.
    • A re-expanded value longer than 128 KiB throws.
  • Load order:
    • ConfigService from a plain imports: [ConfigModule] or ConfigModule.forFeature() is provided once forRoot() has merged its load factories.
    • ConfigModule.envVariablesLoaded (used by ConditionalModule.registerWhen()) waits until every forRoot() in progress has loaded its environment variables.
  • Validation errors no longer include the rejected value: Joi pattern() messages leave it out, and a quoted value is replaced with [redacted].

Features

  • validate may be an async function. A rejected promise stops startup.
  • ConfigService.set() re-interpolates variables that depend on the changed key, including chains of references (#​2463).

Bug fixes

  • override: true takes precedence when expanding variables (#​2465).
  • get('_PROCESS_ENV_VALIDATED') no longer returns the internal snapshot of validated variables.

Deprecations

  • ConfigService.setEnvFilePaths() and ConfigService.setParser(). ConfigModule.forRoot() no longer uses them.

Full Changelog: nestjs/config@12.0.1...12.1.0

nestjs/jwt (@​nestjs/jwt)

v12.0.4

Compare Source

Bug fixes

Full Changelog: nestjs/jwt@12.0.3...12.0.4

nestjs/passport (@​nestjs/passport)

v12.0.1

Compare Source

Bug fixes

Full Changelog: nestjs/passport@12.0.0...12.0.1

nestjs/schematics (@​nestjs/schematics)

v12.0.13

Compare Source

What's Changed

Full Changelog: nestjs/schematics@12.0.12...12.0.13

nestjs/swagger (@​nestjs/swagger)

v12.1.1

Compare Source

Bug fixes
Dependencies
  • fix(deps): update dependency es-toolkit to v1.53.1 in #​4208
  • fix(deps): update dependency swagger-ui-dist to v5.34.1 in #​4228

Full Changelog: nestjs/swagger@12.1.0...12.1.1

v12.1.0

Compare Source

Behavior changes

  • PartialType() / DeepPartialType(): documented properties without validators are now stripped or rejected by a whitelisting ValidationPipe.
  • swagger-ui-init.js ignores the url query parameter of the docs page. Use swaggerUrl or swaggerOptions.url / urls instead.
  • When the setup path ends in a route parameter (e.g. docs/:tenant), the /<last segment>/ aliases for the init script and static assets are no longer registered.
  • DocumentBuilder: addGlobalParameters() and addGlobalResponse() apply only to documents created from that builder's config, and build() returns a new copy on every call.
  • The demo page (index.html) and the LICENSE file of swagger-ui-dist are never served, and the static assets no longer serve directory index files.
  • @ApiHideProperty() hides a property inherited from a parent class, and a property decorated with both @ApiProperty() and @ApiHideProperty() is hidden.
  • @ApiIncludeEndpoint(false) counts as not decorated under onlyIncludeDecoratedEndpoints, and controllers without any documented endpoint no longer register their class-level models.
  • A default holding a model lists only the properties the model documents.
  • Inline OmitType() / PickType() schema names spell only documented keys, and mapped type names are resolved when they are read.
  • The CLI plugin metadata of a class that re-declares an inherited property takes precedence over what was inferred for the parent class. Options set with decorators still apply.
  • Routes sharing a path and method document the union of their security requirements.
  • OpenAPI < 3.1: a webhook sharing its path and method with a route is left out of the document (with a warning) instead of replacing the route.
  • Response links to operations that are not in the document are removed.

Fixes

  • fix(type-helpers): make only validated properties optional in partial types (3254eb6)
  • fix(swagger-module): skip asset aliases when the path ends in a param (ab1e33d)
  • fix(swagger-ui): ignore the url query parameter in swagger-ui-init.js (820cb61)
  • fix(type-helpers): match numeric keys in OmitType and PickType (74776cc)
  • fix(document-builder): scope global metadata and built configs to the builder (5245be9)
  • fix(schema): omit hidden model properties from property defaults (933d8e6)
  • fix(explorer): apply endpoint exclusion before exploring a controller (cc75875)
  • fix(explorer): stop sharing security metadata between targets and operations (a79603d)
  • fix(swagger-module): keep routes that share a path with a webhook (4934af4)
  • fix(decorators): let @​ApiHideProperty() hide inherited properties (5beb329)
  • fix(plugin): honor aliased and parameter-level hide decorators (d77fdf2)
  • fix(explorer): apply plugin metadata to the methods its class declares (68c5b45)
  • fix(transformer): keep security requirements of routes sharing a path (1c45e42)
  • fix(services): document only the parameters an override declares (66635c9)
  • fix(swagger-module): drop links to operations missing from the document (d3edf0a)
  • fix(swagger-module): never serve the demo page and license of swagger-ui-dist (332865b)
  • fix(type-helpers): spell only documented keys in mapped type names (134d45e)
  • fix(services): prefer a re-declaration's plugin metadata over inferred metadata (3def7ca)
  • fix(deps): update dependency @​nestjs/mapped-types to v12.0.1 (b2293a0)

What's Changed

New Contributors

Full Changelog: nestjs/swagger@12.0.5...12.1.0

nestjs/typeorm (@​nestjs/typeorm)

v12.0.3

Compare Source

Bug fixes
  • fix(core): keep object map entities when auto loading entities by @​RaphaelFakhri in #​2753
  • fix(core): check mongodb before tree repositories and test e2e (5d6362d)
  • fix(core): provide tree repository for entity schema trees (365a578)
  • fix(decorators): accept data source options in inject repository (2bf9505)
  • fix(common): resolve data source names in one place (7cd2256)
Other changes
  • refactor(common): merge data source name resolvers into one helper (7df73a6)

Full Changelog: nestjs/typeorm@12.0.2...12.0.3

getsentry/sentry-javascript (@​sentry/nestjs)

v11.11.0

Compare Source

Important Changes

  • ref(cloudflare): Use the shared request handler wrapper (#​25588)

    Cloudflare Workers now use the same request handler wrapper as Deno.serve and Bun.serve. Changes for Cloudflare users:

    • Request spans now set client.address from the CF-Connecting-IP header (or another forwarding header), as on the other runtimes. This follows dataCollection.userInfo, which is true by default. To leave it out, set dataCollection: { userInfo: false }.
    • Request spans now have the response header attributes, and events have the response context with the status code.
    • When the source of a streamed response fails, the SDK now captures the error and marks the span as failed. With captureErrors: false, it does not capture it.
    • Request spans now list every Set-Cookie header of a response, as on Deno and Bun.
    • Without AsyncLocalStorage (for example on Shopify Oxygen), events now also get the request URL and method.

  • feat(nestjs): Add an option to monitor every @​Cron method (#​25471)

    Set monitorCronJobs: true on nestIntegration() to send check-ins for every @Cron() method, without adding @SentryCron to each one. It's off by default. Each monitored job creates a monitor in Sentry, and monitors are billed. Use excludeCronJobs to skip jobs by slug. Methods that also have @SentryCron check in once, with the slug and options passed to @SentryCron.

  • feat(node): Add cronJobIntegration to monitor cron jobs (#​25477)

    Add Sentry.cronJobIntegration() to integrations to send check-ins for every named CronJob of the cron package (4.3+), with the job name as the monitor slug. It's off by default. Each monitored job creates a monitor in Sentry, and monitors are billed. Use excludeJobs to skip jobs by name. Sentry.cron.instrumentCron is deprecated; use cronJobIntegration instead.

  • fix(server-utils): Instrument @​anthropic-ai/sdk 1.x and turn off its own OTel spans (#​25750)

    The Anthropic integration now instruments @anthropic-ai/sdk 1.x. Since 0.134 the SDK also records its own OpenTelemetry spans, such as anthropic.messages.create, which duplicated Sentry's gen_ai spans. Once Sentry instruments the SDK, it sets ANTHROPIC_OPEN_TELEMETRY=false to turn those spans off. To keep them, set ANTHROPIC_OPEN_TELEMETRY=true or pass the openTelemetry option to the Anthropic client.

  • feat(nextjs): Mark pageloads of cached pages (#​25318)

    When Next.js serves a page from its cache, for example an ISR page or a cacheComponents shell, the pageload now has the page.server_rendering.type attribute. It is static if the whole page came from the cache, and partially_static if parts of it rendered for this request. Then the pageload stays connected to this request, as before. If the request that rendered the cached page was sampled, the pageload also links to it. So in Sentry, a cached page no longer looks like missing server instrumentation.

Other Changes
  • feat(astro): Add @sentry/astro/integration entry for the Astro integration (#​25726)
  • feat(bundler-plugins): Add sourcemaps.deleteSourcemapsAfterUpload and staged uploads (#​25637)
  • feat(nestjs): Derive SentryCron monitor config from @​Cron (#​25013)
  • feat(nextjs): Add applicationKeyExcludeDependencies option (#​25818)
  • feat(node): Add awsLambdaWebIntegration for Lambda Web Functions (#​25355)
  • feat(node): Add BullMQ integration (#​21777)
  • feat(node): Add nodeCronIntegration to monitor node-cron tasks (#​25473)
  • feat(node): Add nodeScheduleIntegration to monitor node-schedule jobs (#​25474)
  • feat(node): Support postgres v4 through its native tracing channels (#​26076)
  • feat(server-utils): Extract getSqlSpanName for SQL span names (#​25929)
  • feat(server-utils): Move to new getSqlQueryAttributes helper for consistency (#​25927)
  • feat(server-utils): Record AI SDK v7 runtime and tool context on Vercel AI spans (#​25774)
  • feat(server-utils): Set db.operation.name on SQL spans (#​25850)
  • feat(server-utils): Support @​mistralai/mistralai v3 (#​25827)
  • feat(solidstart): Export withSentry from @sentry/solidstart/vite (#​25725)
  • fix(astro): Initialize the server SDK on the first endpoint request (#​25731)
  • fix(browser): Attribute long animation frame spans to the longest script (#​25990)
  • fix(bundler-plugins): Inject debug IDs into every esbuild rebuild (#​26099)
  • fix(bundler-plugins): upload literal artifact paths (#​25356)
  • fix(cloudflare): Run build-time instrumentation in vite dev (#​25777)
  • fix(core): Call native toString without page-replaceable lookups in FunctionToString (#​25921)
  • fix(core): Enforce linked error limits for aggregate and suppressed errors (#​25873)
  • fix(core): Only create Supabase db spans when there is a parent span (#​25807)
  • fix(core): preserve span links through beforeSendSpan (#​25566)
  • fix(core): Respect header collection for session user agents (#​25871)
  • fix(deps): Bump glob to 14 and drop the direct dependency from react-router (#​26014)
  • fix(nextjs): Don't abort Cache Components renders on Cloudflare Workers when requests overlap (#​25315)
  • fix(nextjs): Drop tunnel requests under the Next.request proxy root span (#​26096)
  • fix(nextjs): Fork isolation scope for Next.request proxy root spans (#​26084)
  • fix(nextjs): Strip source map comments before trailing debug IDs (#​25881)
  • fix(nitro): Capture errors thrown in tasks (#​26089)
  • fix(nuxt): Keep storage instrumentation plugin synchronous (#​25949)
  • fix(replay): Skip buffered replays for captureMessage stacks from the attachStacktrace default (#​25846)
  • fix(server-utils): Fix orchestrion source maps of instrumented modules (#​25772)
  • fix(server-utils): Read the pi-durable session id in every phase outside a run (#​25838)
  • fix(server-utils): Require a parent span for Firestore operations (#​25855)
  • fix(server-utils): Require a parent span for Tedious queries (#​25822)
  • fix(server-utils): Use onlyIfParent for Firestore spans (#​25877)
  • fix(server-utils): Use onlyIfParent for Tedious spans (#​25876)
  • fix(solidstart): Serve the managed tunnel under Vite's base on SolidStart 2 (#​25848)
  • fix(sveltekit): Resolve Handle and ResolveOptions types on SvelteKit 3 (#​26085)
  • fix(wasm): Skip length prefix in 16-byte build IDs (#​24857)
  • ref(core): Deprecate the released handleTunnelRequest form and reword the serveTunnelIntegration docs (#​25844)
Internal Changes

[!IMPORTANT]
✂ PR body was truncated to here.

Configuration

📅 Schedule: (in timezone Etc/UTC)

  • Branch creation
    • Only on Sunday (* * * * 0)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot added the dependencies label Nov 8, 2026
@renovate
renovate Bot requested review from Abhinegi2 and sleidig November 8, 2026 01:11
@coderabbitai

coderabbitai Bot commented Nov 8, 2026

Copy link
Copy Markdown

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

  • Source mode: Auto
  • Repository: Unavailable
  • Branch: Unavailable
  • File: No configuration file from this repository applied
  • Commit: Unavailable
  • Layers: Organization UI
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: 56e0c3fa-6761-4d32-960f-5ef5dd396dc2

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • Trigger review
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

@socket-security

socket-security Bot commented Nov 8, 2026

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updated@​sentry/​nestjs@​11.10.0 ⏵ 11.11.0100 +110081 +195 -1100
Updated@​nestjs/​passport@​12.0.0 ⏵ 12.0.1100 +110084 +189 +1100
Updated@​nestjs/​schematics@​12.0.12 ⏵ 12.0.13100 +110084 +197 +1100
Updated@​nestjs/​typeorm@​12.0.2 ⏵ 12.0.399 +110085 +187100
Updated@​nestjs/​config@​12.0.1 ⏵ 12.1.19810086 +191100
Updated@​nestjs/​cli@​12.0.11 ⏵ 12.0.1298 +110086 +197 +1100
Updated@​nestjs/​swagger@​12.0.5 ⏵ 12.1.199 +110087 +197 +1100
Updatedsupertest@​7.3.1 ⏵ 7.3.299100100 +190100
Updated@​sentry/​profiling-node@​11.10.0 ⏵ 11.11.010010092 +196100
Updated@​nestjs/​jwt@​12.0.3 ⏵ 12.0.410010010093 +1100
Updated@​nestjs/​common@​12.3.2 ⏵ 12.4.099 +1100100 +196100
Updated@​nestjs/​core@​12.3.2 ⏵ 12.4.099 +1100100 +196 +1100
Updated@​nestjs/​testing@​12.3.2 ⏵ 12.4.0100 +1100100 +196 +1100
Updated@​nestjs/​platform-express@​12.3.2 ⏵ 12.4.0100 +110010097 +1100

View full report

@sleidig
sleidig merged commit 0e5c7d0 into main Nov 9, 2026
23 checks passed
@sleidig
sleidig deleted the renovate/weekly-non-major-updates branch November 9, 2026 07:41
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@sleidig sleidig sleidig approved these changes
@Abhinegi2 Abhinegi2 Awaiting requested review from Abhinegi2

Assignees

No one assigned

Labels

dependencies

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@sleidig