@depup/nestjs__common 12.0.1-depup.1 → 12.0.3-depup.0

package/README.md

@@ -13,16 +13,10 @@ npm install @depup/nestjs__common
 
 | Field | Value |
 |-------|-------|
-| Original | [@nestjs/common](https://www.npmjs.com/package/@nestjs/common) @ 12.0.1 |
-| Processed | 2026-09-11 |
+| Original | [@nestjs/common](https://www.npmjs.com/package/@nestjs/common) @ 12.0.3 |
+| Processed | 2026-09-15 |
 | Smoke test | passed |
-| Deps updated | 1 |
-
-## Dependency Changes
-
-| Dependency | From | To |
-|------------|------|-----|
-| file-type | 22.0.2 | ^22.1.0 |
+| Deps updated | 0 |
 
 ---
 

package/changes.json

@@ -1,10 +1,5 @@
 {
-  "bumped": {
-    "file-type": {
-      "from": "22.0.2",
-      "to": "^22.1.0"
-    }
-  },
-  "timestamp": "2026-09-11T16:09:53.836Z",
-  "totalUpdated": 1
+  "bumped": {},
+  "timestamp": "2026-09-15T08:11:56.730Z",
+  "totalUpdated": 0
 }

package/decorators/modules/module.decorator.js

@@ -18,7 +18,7 @@ export function Module(metadata) {
     validateModuleKeys(propsKeys);
     return (target) => {
         for (const property in metadata) {
-            if (Object.hasOwnProperty.call(metadata, property)) {
+            if (Object.hasOwn(metadata, property)) {
                 Reflect.defineMetadata(property, metadata[property], target);
             }
         }

package/exceptions/bad-gateway.exception.js

@@ -34,6 +34,6 @@ export class BadGatewayException extends HttpException {
      */
     constructor(objectOrError, descriptionOrOptions = 'Bad Gateway') {
         const { description = 'Bad Gateway', httpExceptionOptions } = HttpException.extractDescriptionAndOptionsFrom(descriptionOrOptions);
-        super(HttpException.createBody(objectOrError, description, HttpStatus.BAD_GATEWAY), HttpStatus.BAD_GATEWAY, httpExceptionOptions);
+        super(HttpException.createBody(objectOrError, description, HttpStatus.BAD_GATEWAY, httpExceptionOptions?.errorCode), HttpStatus.BAD_GATEWAY, httpExceptionOptions);
     }
 }

package/exceptions/bad-request.exception.js

@@ -34,6 +34,6 @@ export class BadRequestException extends HttpException {
      */
     constructor(objectOrError, descriptionOrOptions = 'Bad Request') {
         const { description = 'Bad Request', httpExceptionOptions } = HttpException.extractDescriptionAndOptionsFrom(descriptionOrOptions);
-        super(HttpException.createBody(objectOrError, description, HttpStatus.BAD_REQUEST), HttpStatus.BAD_REQUEST, httpExceptionOptions);
+        super(HttpException.createBody(objectOrError, description, HttpStatus.BAD_REQUEST, httpExceptionOptions?.errorCode), HttpStatus.BAD_REQUEST, httpExceptionOptions);
     }
 }

package/exceptions/conflict.exception.js

@@ -34,6 +34,6 @@ export class ConflictException extends HttpException {
      */
     constructor(objectOrError, descriptionOrOptions = 'Conflict') {
         const { description = 'Conflict', httpExceptionOptions } = HttpException.extractDescriptionAndOptionsFrom(descriptionOrOptions);
-        super(HttpException.createBody(objectOrError, description, HttpStatus.CONFLICT), HttpStatus.CONFLICT, httpExceptionOptions);
+        super(HttpException.createBody(objectOrError, description, HttpStatus.CONFLICT, httpExceptionOptions?.errorCode), HttpStatus.CONFLICT, httpExceptionOptions);
     }
 }

package/exceptions/forbidden.exception.js

@@ -34,6 +34,6 @@ export class ForbiddenException extends HttpException {
      */
     constructor(objectOrError, descriptionOrOptions = 'Forbidden') {
         const { description = 'Forbidden', httpExceptionOptions } = HttpException.extractDescriptionAndOptionsFrom(descriptionOrOptions);
-        super(HttpException.createBody(objectOrError, description, HttpStatus.FORBIDDEN), HttpStatus.FORBIDDEN, httpExceptionOptions);
+        super(HttpException.createBody(objectOrError, description, HttpStatus.FORBIDDEN, httpExceptionOptions?.errorCode), HttpStatus.FORBIDDEN, httpExceptionOptions);
     }
 }

package/exceptions/gateway-timeout.exception.js

@@ -34,6 +34,6 @@ export class GatewayTimeoutException extends HttpException {
      */
     constructor(objectOrError, descriptionOrOptions = 'Gateway Timeout') {
         const { description = 'Gateway Timeout', httpExceptionOptions } = HttpException.extractDescriptionAndOptionsFrom(descriptionOrOptions);
-        super(HttpException.createBody(objectOrError, description, HttpStatus.GATEWAY_TIMEOUT), HttpStatus.GATEWAY_TIMEOUT, httpExceptionOptions);
+        super(HttpException.createBody(objectOrError, description, HttpStatus.GATEWAY_TIMEOUT, httpExceptionOptions?.errorCode), HttpStatus.GATEWAY_TIMEOUT, httpExceptionOptions);
     }
 }

package/exceptions/gone.exception.js

@@ -34,6 +34,6 @@ export class GoneException extends HttpException {
      */
     constructor(objectOrError, descriptionOrOptions = 'Gone') {
         const { description = 'Gone', httpExceptionOptions } = HttpException.extractDescriptionAndOptionsFrom(descriptionOrOptions);
-        super(HttpException.createBody(objectOrError, description, HttpStatus.GONE), HttpStatus.GONE, httpExceptionOptions);
+        super(HttpException.createBody(objectOrError, description, HttpStatus.GONE, httpExceptionOptions?.errorCode), HttpStatus.GONE, httpExceptionOptions);
     }
 }

package/exceptions/http-version-not-supported.exception.js

@@ -34,6 +34,6 @@ export class HttpVersionNotSupportedException extends HttpException {
      */
     constructor(objectOrError, descriptionOrOptions = 'HTTP Version Not Supported') {
         const { description = 'HTTP Version Not Supported', httpExceptionOptions } = HttpException.extractDescriptionAndOptionsFrom(descriptionOrOptions);
-        super(HttpException.createBody(objectOrError, description, HttpStatus.HTTP_VERSION_NOT_SUPPORTED), HttpStatus.HTTP_VERSION_NOT_SUPPORTED, httpExceptionOptions);
+        super(HttpException.createBody(objectOrError, description, HttpStatus.HTTP_VERSION_NOT_SUPPORTED, httpExceptionOptions?.errorCode), HttpStatus.HTTP_VERSION_NOT_SUPPORTED, httpExceptionOptions);
     }
 }

package/exceptions/im-a-teapot.exception.js

@@ -37,6 +37,6 @@ export class ImATeapotException extends HttpException {
      */
     constructor(objectOrError, descriptionOrOptions = `I'm a teapot`) {
         const { description = `I'm a teapot`, httpExceptionOptions } = HttpException.extractDescriptionAndOptionsFrom(descriptionOrOptions);
-        super(HttpException.createBody(objectOrError, description, HttpStatus.I_AM_A_TEAPOT), HttpStatus.I_AM_A_TEAPOT, httpExceptionOptions);
+        super(HttpException.createBody(objectOrError, description, HttpStatus.I_AM_A_TEAPOT, httpExceptionOptions?.errorCode), HttpStatus.I_AM_A_TEAPOT, httpExceptionOptions);
     }
 }

package/exceptions/internal-server-error.exception.js

@@ -34,6 +34,6 @@ export class InternalServerErrorException extends HttpException {
      */
     constructor(objectOrError, descriptionOrOptions = 'Internal Server Error') {
         const { description = 'Internal Server Error', httpExceptionOptions } = HttpException.extractDescriptionAndOptionsFrom(descriptionOrOptions);
-        super(HttpException.createBody(objectOrError, description, HttpStatus.INTERNAL_SERVER_ERROR), HttpStatus.INTERNAL_SERVER_ERROR, httpExceptionOptions);
+        super(HttpException.createBody(objectOrError, description, HttpStatus.INTERNAL_SERVER_ERROR, httpExceptionOptions?.errorCode), HttpStatus.INTERNAL_SERVER_ERROR, httpExceptionOptions);
     }
 }

package/exceptions/method-not-allowed.exception.js

@@ -34,6 +34,6 @@ export class MethodNotAllowedException extends HttpException {
      */
     constructor(objectOrError, descriptionOrOptions = 'Method Not Allowed') {
         const { description = 'Method Not Allowed', httpExceptionOptions } = HttpException.extractDescriptionAndOptionsFrom(descriptionOrOptions);
-        super(HttpException.createBody(objectOrError, description, HttpStatus.METHOD_NOT_ALLOWED), HttpStatus.METHOD_NOT_ALLOWED, httpExceptionOptions);
+        super(HttpException.createBody(objectOrError, description, HttpStatus.METHOD_NOT_ALLOWED, httpExceptionOptions?.errorCode), HttpStatus.METHOD_NOT_ALLOWED, httpExceptionOptions);
     }
 }

package/exceptions/misdirected.exception.js

@@ -34,6 +34,6 @@ export class MisdirectedException extends HttpException {
      */
     constructor(objectOrError, descriptionOrOptions = 'Misdirected') {
         const { description = 'Misdirected', httpExceptionOptions } = HttpException.extractDescriptionAndOptionsFrom(descriptionOrOptions);
-        super(HttpException.createBody(objectOrError, description, HttpStatus.MISDIRECTED), HttpStatus.MISDIRECTED, httpExceptionOptions);
+        super(HttpException.createBody(objectOrError, description, HttpStatus.MISDIRECTED, httpExceptionOptions?.errorCode), HttpStatus.MISDIRECTED, httpExceptionOptions);
     }
 }

package/exceptions/not-acceptable.exception.js

@@ -34,6 +34,6 @@ export class NotAcceptableException extends HttpException {
      */
     constructor(objectOrError, descriptionOrOptions = 'Not Acceptable') {
         const { description = 'Not Acceptable', httpExceptionOptions } = HttpException.extractDescriptionAndOptionsFrom(descriptionOrOptions);
-        super(HttpException.createBody(objectOrError, description, HttpStatus.NOT_ACCEPTABLE), HttpStatus.NOT_ACCEPTABLE, httpExceptionOptions);
+        super(HttpException.createBody(objectOrError, description, HttpStatus.NOT_ACCEPTABLE, httpExceptionOptions?.errorCode), HttpStatus.NOT_ACCEPTABLE, httpExceptionOptions);
     }
 }

package/exceptions/not-found.exception.js

@@ -34,6 +34,6 @@ export class NotFoundException extends HttpException {
      */
     constructor(objectOrError, descriptionOrOptions = 'Not Found') {
         const { description = 'Not Found', httpExceptionOptions } = HttpException.extractDescriptionAndOptionsFrom(descriptionOrOptions);
-        super(HttpException.createBody(objectOrError, description, HttpStatus.NOT_FOUND), HttpStatus.NOT_FOUND, httpExceptionOptions);
+        super(HttpException.createBody(objectOrError, description, HttpStatus.NOT_FOUND, httpExceptionOptions?.errorCode), HttpStatus.NOT_FOUND, httpExceptionOptions);
     }
 }

package/exceptions/not-implemented.exception.js

@@ -34,6 +34,6 @@ export class NotImplementedException extends HttpException {
      */
     constructor(objectOrError, descriptionOrOptions = 'Not Implemented') {
         const { description = 'Not Implemented', httpExceptionOptions } = HttpException.extractDescriptionAndOptionsFrom(descriptionOrOptions);
-        super(HttpException.createBody(objectOrError, description, HttpStatus.NOT_IMPLEMENTED), HttpStatus.NOT_IMPLEMENTED, httpExceptionOptions);
+        super(HttpException.createBody(objectOrError, description, HttpStatus.NOT_IMPLEMENTED, httpExceptionOptions?.errorCode), HttpStatus.NOT_IMPLEMENTED, httpExceptionOptions);
     }
 }

package/exceptions/payload-too-large.exception.js

@@ -34,6 +34,6 @@ export class PayloadTooLargeException extends HttpException {
      */
     constructor(objectOrError, descriptionOrOptions = 'Payload Too Large') {
         const { description = 'Payload Too Large', httpExceptionOptions } = HttpException.extractDescriptionAndOptionsFrom(descriptionOrOptions);
-        super(HttpException.createBody(objectOrError, description, HttpStatus.PAYLOAD_TOO_LARGE), HttpStatus.PAYLOAD_TOO_LARGE, httpExceptionOptions);
+        super(HttpException.createBody(objectOrError, description, HttpStatus.PAYLOAD_TOO_LARGE, httpExceptionOptions?.errorCode), HttpStatus.PAYLOAD_TOO_LARGE, httpExceptionOptions);
     }
 }

package/exceptions/precondition-failed.exception.js

@@ -34,6 +34,6 @@ export class PreconditionFailedException extends HttpException {
      */
     constructor(objectOrError, descriptionOrOptions = 'Precondition Failed') {
         const { description = 'Precondition Failed', httpExceptionOptions } = HttpException.extractDescriptionAndOptionsFrom(descriptionOrOptions);
-        super(HttpException.createBody(objectOrError, description, HttpStatus.PRECONDITION_FAILED), HttpStatus.PRECONDITION_FAILED, httpExceptionOptions);
+        super(HttpException.createBody(objectOrError, description, HttpStatus.PRECONDITION_FAILED, httpExceptionOptions?.errorCode), HttpStatus.PRECONDITION_FAILED, httpExceptionOptions);
     }
 }

package/exceptions/request-timeout.exception.js

@@ -34,6 +34,6 @@ export class RequestTimeoutException extends HttpException {
      */
     constructor(objectOrError, descriptionOrOptions = 'Request Timeout') {
         const { description = 'Request Timeout', httpExceptionOptions } = HttpException.extractDescriptionAndOptionsFrom(descriptionOrOptions);
-        super(HttpException.createBody(objectOrError, description, HttpStatus.REQUEST_TIMEOUT), HttpStatus.REQUEST_TIMEOUT, httpExceptionOptions);
+        super(HttpException.createBody(objectOrError, description, HttpStatus.REQUEST_TIMEOUT, httpExceptionOptions?.errorCode), HttpStatus.REQUEST_TIMEOUT, httpExceptionOptions);
     }
 }

package/exceptions/service-unavailable.exception.js

@@ -34,6 +34,6 @@ export class ServiceUnavailableException extends HttpException {
      */
     constructor(objectOrError, descriptionOrOptions = 'Service Unavailable') {
         const { description = 'Service Unavailable', httpExceptionOptions } = HttpException.extractDescriptionAndOptionsFrom(descriptionOrOptions);
-        super(HttpException.createBody(objectOrError, description, HttpStatus.SERVICE_UNAVAILABLE), HttpStatus.SERVICE_UNAVAILABLE, httpExceptionOptions);
+        super(HttpException.createBody(objectOrError, description, HttpStatus.SERVICE_UNAVAILABLE, httpExceptionOptions?.errorCode), HttpStatus.SERVICE_UNAVAILABLE, httpExceptionOptions);
     }
 }

package/exceptions/unauthorized.exception.js

@@ -34,6 +34,6 @@ export class UnauthorizedException extends HttpException {
      */
     constructor(objectOrError, descriptionOrOptions = 'Unauthorized') {
         const { description = 'Unauthorized', httpExceptionOptions } = HttpException.extractDescriptionAndOptionsFrom(descriptionOrOptions);
-        super(HttpException.createBody(objectOrError, description, HttpStatus.UNAUTHORIZED), HttpStatus.UNAUTHORIZED, httpExceptionOptions);
+        super(HttpException.createBody(objectOrError, description, HttpStatus.UNAUTHORIZED, httpExceptionOptions?.errorCode), HttpStatus.UNAUTHORIZED, httpExceptionOptions);
     }
 }

package/exceptions/unprocessable-entity.exception.js

@@ -34,6 +34,6 @@ export class UnprocessableEntityException extends HttpException {
      */
     constructor(objectOrError, descriptionOrOptions = 'Unprocessable Entity') {
         const { description = 'Unprocessable Entity', httpExceptionOptions } = HttpException.extractDescriptionAndOptionsFrom(descriptionOrOptions);
-        super(HttpException.createBody(objectOrError, description, HttpStatus.UNPROCESSABLE_ENTITY), HttpStatus.UNPROCESSABLE_ENTITY, httpExceptionOptions);
+        super(HttpException.createBody(objectOrError, description, HttpStatus.UNPROCESSABLE_ENTITY, httpExceptionOptions?.errorCode), HttpStatus.UNPROCESSABLE_ENTITY, httpExceptionOptions);
     }
 }

package/exceptions/unsupported-media-type.exception.js

@@ -34,6 +34,6 @@ export class UnsupportedMediaTypeException extends HttpException {
      */
     constructor(objectOrError, descriptionOrOptions = 'Unsupported Media Type') {
         const { description = 'Unsupported Media Type', httpExceptionOptions } = HttpException.extractDescriptionAndOptionsFrom(descriptionOrOptions);
-        super(HttpException.createBody(objectOrError, description, HttpStatus.UNSUPPORTED_MEDIA_TYPE), HttpStatus.UNSUPPORTED_MEDIA_TYPE, httpExceptionOptions);
+        super(HttpException.createBody(objectOrError, description, HttpStatus.UNSUPPORTED_MEDIA_TYPE, httpExceptionOptions?.errorCode), HttpStatus.UNSUPPORTED_MEDIA_TYPE, httpExceptionOptions);
     }
 }

package/interfaces/http/http-server.interface.d.ts

@@ -1,74 +1,578 @@
 import { RequestMethod } from '../../enums/index.js';
 import { NestApplicationOptions } from '../../interfaces/nest-application-options.interface.js';
 import { VersionValue, VersioningOptions } from '../version-options.interface.js';
+/**
+ * Shape of the error-layer callback that Nest hands to
+ * {@link HttpServer.setErrorHandler}.
+ *
+ * The adapter invokes it with the error as the first argument. It is the
+ * safety net for errors that never went through Nest: route handlers and
+ * middleware registered by Nest already run their errors through the
+ * exception filters, so this callback receives what is left, such as failures
+ * of middleware registered directly on the framework (e.g. with `app.use()`),
+ * body-parser errors, and values passed to `next(err)`. `next` may be omitted
+ * when the underlying framework has no notion of an error-continuation
+ * callback.
+ *
+ * @publicApi
+ */
 export type ErrorHandler<TRequest = any, TResponse = any> = (error: any, req: TRequest, res: TResponse, next?: Function) => any;
+/**
+ * Shape of every callback Nest registers through the adapter: route handlers,
+ * middleware, and the not-found handler.
+ *
+ * The adapter must invoke them as `(req, res, next)`, where `next` continues
+ * with the next matching middleware or route. Nest relies on it: middleware
+ * calls it to continue the chain, routes of a `@Controller({ host })` call it
+ * when the request host does not match (and the core throws
+ * `InternalServerErrorException` when it is missing), and the handlers
+ * returned by {@link HttpServer.applyVersionFilter} typically call it when the
+ * requested version does not match.
+ *
+ * The callbacks may return a promise. For route handlers it settles once
+ * {@link HttpServer.reply} (or `render`/`redirect`) has been called, so an
+ * adapter for a framework that expects the response to be ready when its
+ * handler returns must await it.
+ *
+ * @publicApi
+ */
 export type RequestHandler<TRequest = any, TResponse = any> = (req: TRequest, res: TResponse, next?: Function) => any;
+/**
+ * Contract between the Nest core (`NestApplication`, the router, the
+ * middleware module and the exception layer) and an HTTP platform such as
+ * Express or Fastify.
+ *
+ * Implementations normally extend `AbstractHttpAdapter` from `@nestjs/core`,
+ * which supplies defaults for the methods that can simply delegate to the
+ * underlying framework instance. This interface is the source of truth for
+ * *when* the core calls each method and *what* it expects back; the class
+ * documents only what it adds on top.
+ *
+ * ### Lifecycle
+ *
+ * 1. `NestFactory.create()` awaits {@link HttpServer.init} before scanning the
+ *    module graph, then constructs the application, which calls
+ *    {@link HttpServer.initHttpServer} so that
+ *    {@link HttpServer.getHttpServer} returns a native server before
+ *    `app.init()` runs. `TestingModule.createNestApplication()` only
+ *    constructs the application, so it skips that first `init()` call.
+ * 2. `app.init()` applies the `cors` option through
+ *    {@link HttpServer.enableCors}, awaits {@link HttpServer.init} again and
+ *    calls {@link HttpServer.registerParserMiddleware} (unless
+ *    `bodyParser: false`). It then connects the WebSocket gateways (which
+ *    share the native server unless they set their own port), registers
+ *    middleware through {@link HttpServer.createMiddlewareFactory} and routes
+ *    through the verb methods, and runs the `OnModuleInit` hooks. Only then
+ *    does it call {@link HttpServer.setNotFoundHandler} and
+ *    {@link HttpServer.setErrorHandler}, before the `OnApplicationBootstrap`
+ *    hooks run.
+ * 3. `app.listen()` runs `app.init()` if that has not happened yet, then calls
+ *    {@link HttpServer.listen}.
+ * 4. `app.close()` awaits {@link HttpServer.beforeClose}, runs the
+ *    `OnModuleDestroy` and `BeforeApplicationShutdown` hooks, closes the
+ *    WebSocket gateways and the microservice clients, awaits
+ *    {@link HttpServer.close}, closes the connected microservices, and
+ *    finally runs the `OnApplicationShutdown` hooks.
+ *
+ * ### Requirements on the request, response and server objects
+ *
+ * Responses are written through the adapter, but the core also accesses the
+ * framework objects directly:
+ *
+ * - The route parameter decorators read properties of `TRequest`, so the
+ *   adapter must make sure they are set by the time a route handler runs
+ *   when the framework does not provide them: `body` (`@Body()`), `params`
+ *   (`@Param()`), `query` (`@Query()`), `headers` keyed by lower-case name
+ *   (`@Headers()`), `ip` (`@Ip()`) and, with the `rawBody` option, `rawBody`
+ *   (`@RawBody()`). `session`, `file` and `files` (`@Session()`,
+ *   `@UploadedFile()`, `@UploadedFiles()`) are usually set by third-party
+ *   middleware.
+ * - The core attaches its own properties to `TRequest`: `hosts` for
+ *   `@HostParam()`, the context id of request-scoped providers, and the abort
+ *   controller of `@Sse()` routes, so the request has to be an extensible
+ *   object. Request-scoped providers share one context between middleware
+ *   and the route handler only if both receive the same request object, or if
+ *   the handler's request exposes the middleware's one as `raw`.
+ * - Server-Sent Events (`@Sse()`) write straight to the Node.js response as a
+ *   writable stream (`writeHead`, `write`, `end`, `writableEnded`) and watch
+ *   `request.socket` to detect client disconnects. The core uses `res.raw`
+ *   and `req.raw` when present, and the objects themselves otherwise, so they
+ *   must be or expose a Node.js `ServerResponse` and `IncomingMessage`.
+ * - The value returned by {@link HttpServer.getHttpServer} must behave like a
+ *   Node.js `net.Server`: `app.listen()` subscribes to its `'error'` event and
+ *   reads `address()`, and the WebSocket adapters attach to it.
+ *
+ * ### Optional members
+ *
+ * Most members marked optional are checked for presence before being called,
+ * and the fallback behavior is described on each one. The exceptions are
+ * {@link HttpServer.getRequestHostname}, {@link HttpServer.getRequestMethod}
+ * and {@link HttpServer.getRequestUrl}, which the core calls unconditionally
+ * in some code paths, so treat them as required. Note that
+ * `AbstractHttpAdapter` declares several optional members abstract, so a
+ * class-based adapter has to implement them anyway.
+ *
+ * ### Synchronous and asynchronous members
+ *
+ * The core awaits only {@link HttpServer.init},
+ * {@link HttpServer.createMiddlewareFactory}, {@link HttpServer.beforeClose}
+ * and {@link HttpServer.close}, as well as {@link HttpServer.reply} and
+ * {@link HttpServer.render} when the router calls them. Every other member is
+ * called synchronously and a returned promise is ignored. In particular, the
+ * registration methods (`use()`, the verb methods, the parser and CORS
+ * methods, ...) must take effect before they return, or the registration
+ * order the core relies on is lost.
+ *
+ * @typeParam TRequest - Type of the framework request object handed to
+ * handlers and to the `getRequest*` helpers.
+ * @typeParam TResponse - Type of the framework response object handed to
+ * handlers and to the `reply`/`status`/`setHeader` family.
+ * @typeParam ServerInstance - Type of the framework application instance
+ * returned by {@link HttpServer.getInstance} (e.g. the Express `Application`),
+ * as opposed to the native HTTP server returned by
+ * {@link HttpServer.getHttpServer}.
+ *
+ * @see [HTTP adapter](https://docs.nestjs.com/faq/http-adapter)
+ *
+ * @publicApi
+ */
 export interface HttpServer<TRequest = any, TResponse = any, ServerInstance = any> {
+    /**
+     * Registers a global middleware, optionally mounted under `path`.
+     *
+     * Called by `app.use()`, by the core when registering the parser and
+     * exception layers, and as the fallback route registrar when an optional
+     * HTTP-verb method (e.g. `propfind`) is not implemented, in which case the
+     * route matches every method.
+     *
+     * The handler may be a {@link RequestHandler} or an {@link ErrorHandler};
+     * Express-style adapters distinguish them by arity.
+     */
     use(handler: RequestHandler<TRequest, TResponse> | ErrorHandler<TRequest, TResponse>): any;
     use(path: string, handler: RequestHandler<TRequest, TResponse> | ErrorHandler<TRequest, TResponse>): any;
+    /**
+     * Registers an additional body parser, called by `app.useBodyParser()`.
+     *
+     * The core inserts the application's `rawBody` option as the **second**
+     * argument, so the effective call is
+     * `useBodyParser(type, rawBody, ...userArgs)`. When `rawBody` is `true` the
+     * parser must expose the unparsed payload as `req.rawBody` (see
+     * `RawBodyRequest`).
+     *
+     * When not implemented, `app.useBodyParser()` logs a warning and does
+     * nothing.
+     */
     useBodyParser?(...args: any[]): any;
+    /**
+     * Registers a `GET` route.
+     *
+     * Every verb method receives the already normalized path (see
+     * {@link HttpServer.normalizePath}) and a {@link RequestHandler} that the
+     * adapter must invoke as `(req, res, next)`. Routes are registered in the
+     * order the core resolves them; see
+     * {@link HttpServer.isRouteOrderSensitive}.
+     */
     get(handler: RequestHandler<TRequest, TResponse>): any;
     get(path: string, handler: RequestHandler<TRequest, TResponse>): any;
+    /**
+     * Registers a `POST` route. See {@link HttpServer.get} for the handler
+     * contract.
+     */
     post(handler: RequestHandler<TRequest, TResponse>): any;
     post(path: string, handler: RequestHandler<TRequest, TResponse>): any;
+    /**
+     * Registers a `HEAD` route. See {@link HttpServer.get} for the handler
+     * contract.
+     */
     head(handler: RequestHandler<TRequest, TResponse>): any;
     head(path: string, handler: RequestHandler<TRequest, TResponse>): any;
+    /**
+     * Registers a `DELETE` route. See {@link HttpServer.get} for the handler
+     * contract.
+     */
     delete(handler: RequestHandler<TRequest, TResponse>): any;
     delete(path: string, handler: RequestHandler<TRequest, TResponse>): any;
+    /**
+     * Registers a `PUT` route. See {@link HttpServer.get} for the handler
+     * contract.
+     */
     put(handler: RequestHandler<TRequest, TResponse>): any;
     put(path: string, handler: RequestHandler<TRequest, TResponse>): any;
+    /**
+     * Registers a `PATCH` route. See {@link HttpServer.get} for the handler
+     * contract.
+     */
     patch(handler: RequestHandler<TRequest, TResponse>): any;
     patch(path: string, handler: RequestHandler<TRequest, TResponse>): any;
+    /**
+     * Registers a WebDAV `PROPFIND` route. Optional: when not implemented the
+     * core falls back to {@link HttpServer.use}, which matches every method.
+     */
     propfind?(handler: RequestHandler<TRequest, TResponse>): any;
     propfind?(path: string, handler: RequestHandler<TRequest, TResponse>): any;
+    /**
+     * Registers a WebDAV `PROPPATCH` route. Optional: when not implemented the
+     * core falls back to {@link HttpServer.use}, which matches every method.
+     */
     proppatch?(handler: RequestHandler<TRequest, TResponse>): any;
     proppatch?(path: string, handler: RequestHandler<TRequest, TResponse>): any;
+    /**
+     * Registers a WebDAV `MKCOL` route. Optional: when not implemented the
+     * core falls back to {@link HttpServer.use}, which matches every method.
+     */
     mkcol?(handler: RequestHandler<TRequest, TResponse>): any;
     mkcol?(path: string, handler: RequestHandler<TRequest, TResponse>): any;
+    /**
+     * Registers a WebDAV `COPY` route. Optional: when not implemented the
+     * core falls back to {@link HttpServer.use}, which matches every method.
+     */
     copy?(handler: RequestHandler<TRequest, TResponse>): any;
     copy?(path: string, handler: RequestHandler<TRequest, TResponse>): any;
+    /**
+     * Registers a WebDAV `MOVE` route. Optional: when not implemented the
+     * core falls back to {@link HttpServer.use}, which matches every method.
+     */
     move?(handler: RequestHandler<TRequest, TResponse>): any;
     move?(path: string, handler: RequestHandler<TRequest, TResponse>): any;
+    /**
+     * Registers a WebDAV `LOCK` route. Optional: when not implemented the
+     * core falls back to {@link HttpServer.use}, which matches every method.
+     */
     lock?(handler: RequestHandler<TRequest, TResponse>): any;
     lock?(path: string, handler: RequestHandler<TRequest, TResponse>): any;
+    /**
+     * Registers a WebDAV `UNLOCK` route. Optional: when not implemented the
+     * core falls back to {@link HttpServer.use}, which matches every method.
+     */
     unlock?(handler: RequestHandler<TRequest, TResponse>): any;
     unlock?(path: string, handler: RequestHandler<TRequest, TResponse>): any;
+    /**
+     * Registers a route for every HTTP method (`@All()`). See
+     * {@link HttpServer.get} for the handler contract.
+     */
     all(path: string, handler: RequestHandler<TRequest, TResponse>): any;
     all(handler: RequestHandler<TRequest, TResponse>): any;
+    /**
+     * Registers an `OPTIONS` route. See {@link HttpServer.get} for the handler
+     * contract.
+     */
     options(handler: RequestHandler<TRequest, TResponse>): any;
     options(path: string, handler: RequestHandler<TRequest, TResponse>): any;
+    /**
+     * Registers a `SEARCH` route. Optional: when not implemented the core falls
+     * back to {@link HttpServer.use}, which matches every method.
+     */
     search?(handler: RequestHandler<TRequest, TResponse>): any;
     search?(path: string, handler: RequestHandler<TRequest, TResponse>): any;
+    /**
+     * Registers a `QUERY` route. Optional: when not implemented the core falls
+     * back to {@link HttpServer.use}, which matches every method.
+     */
     query?(handler: RequestHandler<TRequest, TResponse>): any;
     query?(path: string, handler: RequestHandler<TRequest, TResponse>): any;
+    /**
+     * Starts accepting connections; called by `app.listen()` once the
+     * application has been initialized.
+     *
+     * The core always appends its own callback as the **last** argument, and
+     * strips any callback the user passed to `app.listen()`. The adapter must
+     * invoke that callback once the server is listening, or with an `Error` as
+     * first argument when it failed to bind; the core rejects the `listen()`
+     * promise in that case. The core additionally subscribes to the `'error'`
+     * event of {@link HttpServer.getHttpServer} while binding.
+     *
+     * On success, the `app.listen()` promise only resolves if
+     * `getHttpServer().address()` returns a non-null value when the callback
+     * runs; otherwise it stays pending.
+     *
+     * @param port Port number, or a string such as a pipe/socket path.
+     * @param hostname Optional host to bind to.
+     * @param callback Invoked as `(err?)` once listening or on failure.
+     */
     listen(port: number | string, callback?: () => void): any;
     listen(port: number | string, hostname: string, callback?: () => void): any;
+    /**
+     * Sends the final response body. The router calls it for every handler
+     * that does not take over the response with `@Res()` (without
+     * `passthrough: true`) or `@Next()`, except for `@Render()`, `@Redirect()`
+     * and `@Sse()` handlers, which go through {@link HttpServer.render},
+     * {@link HttpServer.redirect} and the raw response respectively. The
+     * built-in exception filter uses it as well, so it has to cover the
+     * following cases:
+     *
+     * - `statusCode` provided: apply it before sending.
+     * - `body` is `null`/`undefined`: end the response with an empty body.
+     * - `body` is a `StreamableFile`: set `Content-Type`, `Content-Disposition`
+     *   and `Content-Length` from `body.getHeaders()` unless already present,
+     *   pipe `body.getStream()` into the response, route stream errors to
+     *   `body.errorHandler(err, response)` and log write errors through
+     *   `body.errorLogger(err)`.
+     * - `body` is an object or array: serialize as JSON.
+     * - anything else: send `String(body)`.
+     *
+     * The router awaits a returned promise, but the exception filter does not,
+     * so an asynchronous implementation must handle its own errors.
+     *
+     * @param response Framework response object.
+     * @param body Value returned by the route handler (after interceptors).
+     * @param statusCode Status to apply, when the router determined one.
+     */
     reply(response: any, body: any, statusCode?: number): any;
+    /**
+     * Sets the status code without sending the response. Called for every
+     * route once the guards have passed, before the interceptors and the
+     * handler run, with the status derived from `@HttpCode()` or the method
+     * default (`201` for `POST`, `200` otherwise). Not awaited.
+     */
     status(response: any, statusCode: number): any;
+    /**
+     * Terminates the response, optionally writing `message` first. The
+     * exception layer uses it when {@link HttpServer.isHeadersSent} reports that
+     * a reply already started, so the adapter must not attempt to set headers
+     * or a status here.
+     */
     end(response: any, message?: string): any;
+    /**
+     * Renders a view template; called for handlers decorated with `@Render()`
+     * with the (awaited) handler result as `options`.
+     */
     render(response: any, view: string, options: any): any;
+    /**
+     * Issues a redirect; called for handlers decorated with `@Redirect()`.
+     * `statusCode` is always provided (defaults to `302`), and `url` may come
+     * from the handler result `{ url, statusCode }` overriding the decorator.
+     */
     redirect(response: any, statusCode: number, url: string): any;
+    /**
+     * Reports whether the response headers have already been flushed. The
+     * exception layer checks it to decide between {@link HttpServer.reply} and
+     * {@link HttpServer.end}. It must return a boolean synchronously: the result
+     * is not awaited, and a promise is truthy, so every error response would be
+     * cut short through {@link HttpServer.end}.
+     */
     isHeadersSent(response: any): boolean;
+    /**
+     * Sets (replaces) a response header; called once per `@Header()` decorator,
+     * right after {@link HttpServer.status}. Not awaited.
+     */
     setHeader(response: any, name: string, value: string): any;
+    /**
+     * Installs the global exception layer: an {@link ErrorHandler} that
+     * forwards errors to the registered exception filters. The core calls it
+     * once, after every route has been registered, and skips it when not
+     * implemented.
+     *
+     * Errors thrown by the route handlers and middleware that Nest registers
+     * normally don't reach it, because the core already runs them through the
+     * exception filters. The adapter must route every other error to it:
+     * failures of middleware registered directly on the framework (e.g. with
+     * `app.use()`), body-parser errors, and values passed to `next(err)`. The
+     * handler first passes the error to the adapter's `mapException()` so
+     * framework-native errors can be translated to `HttpException`s; that method
+     * is defined by `AbstractHttpAdapter`, so an adapter implementing this
+     * interface directly must provide it too.
+     *
+     * @param handler The `(err, req, res, next)` callback.
+     * @param prefix The global prefix (`app.setGlobalPrefix()`), when set.
+     * Routes excluded from the prefix still live at the root, so an adapter that
+     * scopes error handlers by path must cover both.
+     */
     setErrorHandler?(handler: Function, prefix?: string): any;
+    /**
+     * Installs the catch-all handler for unmatched requests. The core calls it
+     * once, after every route has been registered, and skips it when not
+     * implemented.
+     *
+     * The handler is a {@link RequestHandler} that throws `NotFoundException`
+     * through the exception filters, so the adapter only has to make sure it
+     * runs after all routes and middleware, and only for requests no route
+     * matched. It builds its message with {@link HttpServer.getRequestMethod}
+     * and {@link HttpServer.getRequestUrl}, so both must be implemented.
+     *
+     * @param handler The `(req, res, next)` callback.
+     * @param prefix The global prefix (`app.setGlobalPrefix()`), when set.
+     */
     setNotFoundHandler?(handler: Function, prefix?: string): any;
+    /**
+     * Serves static files; pass-through for `app.useStaticAssets()`. The
+     * arguments are platform-specific. When not implemented,
+     * `app.useStaticAssets()` silently does nothing.
+     */
     useStaticAssets?(...args: any[]): this;
+    /**
+     * Sets the directory (or directories) where view templates live;
+     * pass-through for `app.setBaseViewsDir()`. When not implemented,
+     * `app.setBaseViewsDir()` silently does nothing.
+     */
     setBaseViewsDir?(path: string | string[]): this;
+    /**
+     * Configures the template engine used by {@link HttpServer.render};
+     * pass-through for `app.setViewEngine()`. The argument is
+     * platform-specific (an engine name for Express, an options object for
+     * Fastify). When not implemented, `app.setViewEngine()` silently does
+     * nothing.
+     */
     setViewEngine?(engineOrOptions: any): this;
+    /**
+     * Returns a function the middleware module uses to mount Nest middleware
+     * (`MiddlewareConsumer`) for one HTTP method.
+     *
+     * The returned function is called as `(path, callback)` once per route
+     * path the middleware applies to, where `callback` is a
+     * {@link RequestHandler} that calls `next()` to continue the chain. The core
+     * passes `/` for empty or root paths. When `method` is not
+     * `RequestMethod.ALL`, the core already wraps `callback` to skip requests
+     * whose {@link HttpServer.getRequestMethod} does not match (treating `HEAD`
+     * as `GET`), so a framework that cannot register method-specific middleware
+     * may mount it for every method. Without
+     * {@link HttpServer.getRequestMethod}, that check never matches and such
+     * middleware silently never runs.
+     *
+     * May return a promise (e.g. when a middleware plugin has to be loaded
+     * first); the core awaits it.
+     */
     createMiddlewareFactory(method: RequestMethod): ((path: string, callback: Function) => any) | Promise<(path: string, callback: Function) => any>;
+    /**
+     * Returns the request host name (without port), used to match
+     * `@Controller({ host })`. The core calls it without checking for its
+     * presence, so it is required whenever host filtering is used.
+     */
     getRequestHostname?(request: TRequest): string;
+    /**
+     * Returns the request method as the upper-case verb (`'GET'`, `'HEAD'`,
+     * ...), i.e. a key of the `RequestMethod` enum. Effectively required: the
+     * not-found handler and `MiddlewareConsumer.exclude()` call it without
+     * checking for its presence, and without it middleware bound to a specific
+     * method silently never runs.
+     */
     getRequestMethod?(request: TRequest): string;
+    /**
+     * Returns the original request URL, including the query string and
+     * independent of any router mount point (Express `req.originalUrl`, not
+     * `req.url`). The core strips the query string itself when it needs the
+     * pathname, e.g. to evaluate `MiddlewareConsumer.exclude()`. Effectively
+     * required: the not-found handler and `exclude()` call it without checking
+     * for its presence.
+     */
     getRequestUrl?(request: TRequest): string;
+    /**
+     * Returns the framework application instance (e.g. the Express
+     * `Application`) that the adapter delegates to. Exposed to users through
+     * `app.getHttpAdapter().getInstance()`.
+     */
     getInstance(): ServerInstance;
+    /**
+     * Registers the default body parsers. Called once during `app.init()`
+     * unless the application was created with `bodyParser: false`, as
+     * `registerParserMiddleware(globalPrefix, rawBody)`.
+     *
+     * Implementations should register JSON and URL-encoded parsers, and, when
+     * `rawBody` is `true`, expose the unparsed payload as `req.rawBody` (see
+     * `RawBodyRequest`). Because users may register the same parsers
+     * beforehand, this should be idempotent.
+     */
     registerParserMiddleware(...args: any[]): any;
+    /**
+     * Enables CORS. Called by `app.enableCors(options)` and during
+     * `app.init()` when the `cors` application option is set; `options` is
+     * then either the `CorsOptions`/delegate the user provided, or `undefined`
+     * for `cors: true`.
+     */
     enableCors(options: any): any;
+    /**
+     * Returns the native HTTP server created by
+     * {@link HttpServer.initHttpServer}. It must behave like a Node.js
+     * `net.Server` (`listen`, `close`, `address`, `on('error')`), since
+     * `app.listen()` and the WebSocket adapters use it directly.
+     */
     getHttpServer(): any;
+    /**
+     * Creates the native HTTP(S) server so that {@link HttpServer.getHttpServer}
+     * can return it. Called once, synchronously, when the application is
+     * constructed (by `NestFactory.create()` or
+     * `TestingModule.createNestApplication()`), before `app.init()`.
+     *
+     * The adapter is responsible for honoring the relevant application
+     * options: `httpsOptions` (create an HTTPS server),
+     * `forceCloseConnections` (track sockets so {@link HttpServer.close} can
+     * destroy them) and `return503OnClosing` (reject requests once
+     * {@link HttpServer.beforeClose} ran).
+     */
     initHttpServer(options: NestApplicationOptions): void;
+    /**
+     * Stops the server and releases its resources. Called by `app.close()`
+     * after the `OnModuleDestroy` and `BeforeApplicationShutdown` hooks and
+     * after the WebSocket gateways and microservice clients have been closed,
+     * but before connected microservices are closed and the
+     * `OnApplicationShutdown` hooks run. May return a promise; the core awaits
+     * it.
+     */
     close(): any;
+    /**
+     * Called by `app.close()` **before** any shutdown hook (`OnModuleDestroy`,
+     * `BeforeApplicationShutdown`, `OnApplicationShutdown`) runs, so the
+     * adapter can flip into a "shutting down" state, e.g. start answering `503`
+     * when `return503OnClosing` is enabled. May return a promise; the core
+     * awaits it.
+     */
     beforeClose?(): any;
+    /**
+     * Returns a stable identifier for the platform (`'express'`, `'fastify'`).
+     * The core does not read it, but ecosystem packages (e.g. `@nestjs/swagger`,
+     * `@nestjs/serve-static`) branch on it to pick platform-specific code
+     * paths, so custom adapters wrapping one of the built-in frameworks should
+     * return the matching value.
+     */
     getType(): string;
+    /**
+     * Asynchronous setup hook for work that cannot happen in the constructor,
+     * such as loading a plugin. It can run twice: `NestFactory.create()` awaits
+     * it before the module graph is scanned (and before
+     * {@link HttpServer.initHttpServer}), and `app.init()` awaits it again after
+     * the `cors` option has been applied and before the parsers, middleware and
+     * routes are registered. `TestingModule.createNestApplication()` only
+     * triggers the second call. Implementations must therefore be idempotent,
+     * e.g. by guarding the work with a flag as `FastifyAdapter` does.
+     */
     init?(): Promise<void>;
+    /**
+     * Wraps a route handler so that it only runs for requests carrying a
+     * matching version. Called once per versioned route for the `HEADER`,
+     * `MEDIA_TYPE` and `CUSTOM` versioning types; URI versioning is expressed
+     * in the path and never reaches this method.
+     *
+     * Two strategies are valid:
+     * - return a `(req, res, next)` function that extracts the requested
+     *   version, invokes `handler` when it matches and calls `next()` otherwise
+     *   (Express), or
+     * - return `handler` itself, annotated so the framework's own routing can
+     *   apply the constraint (Fastify).
+     *
+     * @param handler The route handler to guard.
+     * @param version Version(s) the route serves: a string, an array of
+     * strings, or `VERSION_NEUTRAL`. An array may include `VERSION_NEUTRAL`,
+     * meaning the route also serves requests that carry no version.
+     * @param versioningOptions The options passed to `app.enableVersioning()`.
+     */
     applyVersionFilter(handler: Function, version: VersionValue, versioningOptions: VersioningOptions): (req: TRequest, res: TResponse, next: () => void) => Function;
+    /**
+     * Converts a Nest route path into the syntax the underlying router
+     * expects, and validates it. Called once per route path (already prefixed
+     * and versioned) before it is handed to a verb method; should throw when
+     * the path is invalid so misconfigured routes fail at startup. When not
+     * implemented the path is used verbatim.
+     */
     normalizePath?(path: string): string;
+    /**
+     * Tells the core whether the underlying router picks the **first**
+     * registered route that matches (`true`, e.g. Express) or the most specific
+     * one regardless of order (`false`, e.g. Fastify). Defaults to `true` when
+     * not implemented.
+     *
+     * When `true` and the `specificity` route resolution strategy is enabled,
+     * the core sorts routes before registering them. A `false` value is
+     * currently also taken to mean that the router rejects duplicate
+     * `(method, path)` registrations itself.
+     */
     isRouteOrderSensitive?(): boolean;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@depup/nestjs__common",
-  "version": "12.0.1-depup.1",
+  "version": "12.0.3-depup.0",
   "description": "Nest - modern, fast, powerful node.js web framework (@common) (with updated dependencies)",
   "author": "Kamil Mysliwiec",
   "homepage": "https://nestjs.com",
@@ -24,7 +24,7 @@
   },
   "dependencies": {
     "@standard-schema/spec": "1.1.0",
-    "file-type": "^22.1.0",
+    "file-type": "22.1.0",
     "iterare": "1.2.1",
     "load-esm": "1.0.3",
     "tslib": "2.8.1",
@@ -44,7 +44,7 @@
       "optional": true
     }
   },
-  "gitHead": "4c751c503bc753095f4b4f052e106f95218cc33f",
+  "gitHead": "14151790e1abe870abc3bbf00f88786fc3ebe509",
   "keywords": [
     "@nestjs/common",
     "depup",
@@ -54,16 +54,11 @@
     "patched"
   ],
   "depup": {
-    "changes": {
-      "file-type": {
-        "from": "22.0.2",
-        "to": "^22.1.0"
-      }
-    },
-    "depsUpdated": 1,
+    "changes": {},
+    "depsUpdated": 0,
     "originalPackage": "@nestjs/common",
-    "originalVersion": "12.0.1",
-    "processedAt": "2026-09-11T16:09:57.020Z",
+    "originalVersion": "12.0.3",
+    "processedAt": "2026-09-15T08:12:01.047Z",
     "smokeTest": "passed"
   }
 }

package/pipes/file/parse-file.pipe.js

@@ -2,7 +2,7 @@ import { __decorate, __metadata, __param } from "tslib";
 import { Injectable, Optional } from '../../decorators/core/index.js';
 import { HttpStatus } from '../../enums/index.js';
 import { HttpErrorByCode } from '../../utils/http-error-by-code.util.js';
-import { isEmptyArray, isObject, isUndefined, } from '../../utils/shared.utils.js';
+import { isEmptyArray, isNil, isObject } from '../../utils/shared.utils.js';
 /**
  * Defines the built-in ParseFile Pipe. This pipe can be used to validate incoming files
  * with `@UploadedFile()` decorator. You can use either other specific built-in validators
@@ -45,7 +45,7 @@ let ParseFilePipe = class ParseFilePipe {
     }
     thereAreNoFilesIn(value) {
         const isEmptyObject = isObject(value) && isEmptyArray(Object.keys(value));
-        return isUndefined(value) || isEmptyArray(value) || isEmptyObject;
+        return isNil(value) || isEmptyArray(value) || isEmptyObject;
     }
     async validate(file) {
         for (const validator of this.validators) {

package/pipes/parse-array.pipe.js

@@ -38,7 +38,7 @@ let ParseArrayPipe = class ParseArrayPipe {
      * @param metadata contains metadata about the currently processed route argument
      */
     async transform(value, metadata) {
-        if (!value && !this.options.optional) {
+        if (isNil(value) && !this.options.optional) {
             throw this.exceptionFactory(VALIDATION_ERROR_MESSAGE);
         }
         else if (isNil(value) && this.options.optional) {

package/pipes/parse-enum.pipe.d.ts

@@ -33,6 +33,7 @@ export declare class ParseEnumPipe<T = any> implements PipeTransform<T> {
     protected readonly enumType: T;
     protected readonly options?: ParseEnumPipeOptions | undefined;
     protected exceptionFactory: (error: string) => any;
+    private cachedEnumValues?;
     constructor(enumType: T, options?: ParseEnumPipeOptions | undefined);
     /**
      * Method that accesses and performs optional transformation on argument for
@@ -43,4 +44,12 @@ export declare class ParseEnumPipe<T = any> implements PipeTransform<T> {
      */
     transform(value: unknown, metadata: ArgumentMetadata): Promise<T | undefined | null>;
     protected isEnum(value: unknown): boolean;
+    /**
+     * Returns the enum member that `value` refers to, or `undefined` if there is none.
+     * Numeric members also match their string representation (e.g. `'1'` for `1`),
+     * since HTTP route and query params always arrive as strings.
+     */
+    protected toEnumValue(value: unknown): string | number | undefined;
+    protected getEnumValues(): (string | number)[];
+    private computeEnumValues;
 }

package/pipes/parse-enum.pipe.js

@@ -14,6 +14,7 @@ let ParseEnumPipe = class ParseEnumPipe {
     enumType;
     options;
     exceptionFactory;
+    cachedEnumValues;
     constructor(enumType, options) {
         this.enumType = enumType;
         this.options = options;
@@ -40,17 +41,35 @@ let ParseEnumPipe = class ParseEnumPipe {
         if (!this.isEnum(value)) {
             throw this.exceptionFactory('Validation failed (enum string is expected)');
         }
-        return value;
+        return (this.toEnumValue(value) ?? value);
     }
     isEnum(value) {
-        const enumValues = Object.keys(this.enumType)
+        return this.toEnumValue(value) !== undefined;
+    }
+    /**
+     * Returns the enum member that `value` refers to, or `undefined` if there is none.
+     * Numeric members also match their string representation (e.g. `'1'` for `1`),
+     * since HTTP route and query params always arrive as strings.
+     */
+    toEnumValue(value) {
+        return this.getEnumValues().find(enumValue => enumValue === value ||
+            (typeof enumValue === 'number' &&
+                typeof value === 'string' &&
+                String(enumValue) === value));
+    }
+    getEnumValues() {
+        // The enum object never changes after construction, so the values are
+        // computed once and reused on every request.
+        return (this.cachedEnumValues ??= this.computeEnumValues());
+    }
+    computeEnumValues() {
+        return Object.keys(this.enumType)
             .filter(key => {
             const enumValue = this.enumType[key];
             return !(typeof enumValue === 'string' &&
                 typeof this.enumType[enumValue] === 'number');
         })
             .map(key => this.enumType[key]);
-        return enumValues.includes(value);
     }
 };
 ParseEnumPipe = __decorate([

package/pipes/parse-uuid.pipe.js

@@ -16,11 +16,12 @@ let ParseUUIDPipe = class ParseUUIDPipe {
     static { ParseUUIDPipe_1 = this; }
     options;
     static uuidRegExps = {
-        3: /^[0-9A-F]{8}-[0-9A-F]{4}-3[0-9A-F]{3}-[0-9A-F]{4}-[0-9A-F]{12}$/i,
+        3: /^[0-9A-F]{8}-[0-9A-F]{4}-3[0-9A-F]{3}-[89AB][0-9A-F]{3}-[0-9A-F]{12}$/i,
         4: /^[0-9A-F]{8}-[0-9A-F]{4}-4[0-9A-F]{3}-[89AB][0-9A-F]{3}-[0-9A-F]{12}$/i,
         5: /^[0-9A-F]{8}-[0-9A-F]{4}-5[0-9A-F]{3}-[89AB][0-9A-F]{3}-[0-9A-F]{12}$/i,
         7: /^[0-9A-F]{8}-[0-9A-F]{4}-7[0-9A-F]{3}-[89AB][0-9A-F]{3}-[0-9A-F]{12}$/i,
-        all: /^[0-9A-F]{8}-[0-9A-F]{4}-[0-9A-F]{4}-[0-9A-F]{4}-[0-9A-F]{12}$/i,
+        // Versions 1-8 with the RFC variant, or the Nil and Max UUIDs (RFC 9562, sections 5.9, 5.10)
+        all: /^(?:[0-9A-F]{8}-[0-9A-F]{4}-[1-8][0-9A-F]{3}-[89AB][0-9A-F]{3}-[0-9A-F]{12}|00000000-0000-0000-0000-000000000000|FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFF)$/i,
     };
     version;
     exceptionFactory;

package/pipes/standard-schema-validation.pipe.d.ts

@@ -84,8 +84,5 @@ export declare class StandardSchemaValidationPipe implements PipeTransform {
      * @returns The validation result
      */
     protected validate<T = unknown>(value: unknown, schema: StandardSchemaV1, options?: Record<string, unknown>): Promise<StandardSchemaV1.Result<T>> | StandardSchemaV1.Result<T>;
-    /**
-     * Strips dangerous prototype pollution keys from an object.
-     */
     protected stripProtoKeys(value: any): void;
 }

package/pipes/standard-schema-validation.pipe.js

@@ -1,14 +1,10 @@
 import { __decorate, __metadata, __param } from "tslib";
-import { types } from 'util';
 import { Injectable } from '../decorators/core/injectable.decorator.js';
 import { Optional } from '../decorators/core/optional.decorator.js';
 import { HttpStatus } from '../enums/http-status.enum.js';
 import { HttpErrorByCode, } from '../utils/http-error-by-code.util.js';
-/**
- * Built-in JavaScript types that should be excluded from prototype stripping
- * to avoid conflicts with test frameworks like Jest's useFakeTimers
- */
-const BUILT_IN_TYPES = [Date, RegExp, Error, Map, Set, WeakMap, WeakSet];
+import { isObject } from '../utils/shared.utils.js';
+import { stripProtoKeys } from '../utils/strip-proto-keys.util.js';
 /**
  * Defines the built-in StandardSchemaValidation Pipe.
  *
@@ -45,7 +41,10 @@ let StandardSchemaValidationPipe = class StandardSchemaValidationPipe {
     formatIssueMessages(issues) {
         return issues.map(issue => {
             if (issue.path?.length) {
-                return `${issue.path.map(String).join('.')}: ${issue.message}`;
+                const stringPath = issue.path
+                    .map(segment => String(isObject(segment) ? segment.key : segment))
+                    .join('.');
+                return `${stringPath}: ${issue.message}`;
             }
             return issue.message;
         });
@@ -95,33 +94,8 @@ let StandardSchemaValidationPipe = class StandardSchemaValidationPipe {
     validate(value, schema, options) {
         return schema['~standard'].validate(value, options);
     }
-    /**
-     * Strips dangerous prototype pollution keys from an object.
-     */
     stripProtoKeys(value) {
-        if (value == null ||
-            typeof value !== 'object' ||
-            types.isTypedArray(value)) {
-            return;
-        }
-        if (BUILT_IN_TYPES.some(type => value instanceof type)) {
-            return;
-        }
-        if (Array.isArray(value)) {
-            for (const v of value) {
-                this.stripProtoKeys(v);
-            }
-            return;
-        }
-        delete value.__proto__;
-        delete value.prototype;
-        const constructorType = value?.constructor;
-        if (constructorType && !BUILT_IN_TYPES.includes(constructorType)) {
-            delete value.constructor;
-        }
-        for (const key in value) {
-            this.stripProtoKeys(value[key]);
-        }
+        stripProtoKeys(value);
     }
 };
 StandardSchemaValidationPipe = __decorate([

package/pipes/validation.pipe.d.ts

@@ -59,8 +59,8 @@ export declare class ValidationPipe implements PipeTransform {
     protected toValidate(metadata: ArgumentMetadata): boolean;
     protected transformPrimitive(value: unknown, metadata: ArgumentMetadata): unknown;
     protected toEmptyIfNil<T = any, R = T>(value: unknown, metatype: Type<unknown> | object): R | object | string;
-    protected stripProtoKeys(value: any): void;
     protected isPrimitive(value: unknown): boolean;
+    protected stripProtoKeys(value: any): void;
     protected validate(object: object, validatorOptions?: ValidatorOptions): Promise<ValidationError[]> | ValidationError[];
     protected flattenValidationErrors(validationErrors: ValidationError[]): string[];
     protected groupValidationErrors(validationErrors: ValidationError[], parentPath?: string): Record<string, string[]>;

package/pipes/validation.pipe.js

@@ -1,19 +1,14 @@
 import { __decorate, __metadata, __param } from "tslib";
 import { iterate } from 'iterare';
-import { types } from 'util';
 import { Injectable } from '../decorators/core/index.js';
 import { Optional } from '../decorators/index.js';
 import { HttpStatus } from '../enums/http-status.enum.js';
 import { HttpErrorByCode, } from '../utils/http-error-by-code.util.js';
 import { loadPackage } from '../utils/load-package.util.js';
 import { isNil, isUndefined } from '../utils/shared.utils.js';
+import { stripProtoKeys } from '../utils/strip-proto-keys.util.js';
 let classValidator = {};
 let classTransformer = {};
-/**
- * Built-in JavaScript types that should be excluded from prototype stripping
- * to avoid conflicts with test frameworks like Jest's useFakeTimers
- */
-const BUILT_IN_TYPES = [Date, RegExp, Error, Map, Set, WeakMap, WeakSet];
 /**
  * @see [Validation](https://docs.nestjs.com/techniques/validation)
  *
@@ -187,37 +182,12 @@ let ValidationPipe = class ValidationPipe {
         // @see [https://github.com/nestjs/nest/issues/12680](https://github.com/nestjs/nest/issues/12680)
         return '';
     }
-    stripProtoKeys(value) {
-        if (value == null ||
-            typeof value !== 'object' ||
-            types.isTypedArray(value)) {
-            return;
-        }
-        // Skip built-in JavaScript primitives to avoid Jest useFakeTimers conflicts
-        if (BUILT_IN_TYPES.some(type => value instanceof type)) {
-            return;
-        }
-        if (Array.isArray(value)) {
-            for (const v of value) {
-                this.stripProtoKeys(v);
-            }
-            return;
-        }
-        // Delete dangerous prototype pollution keys
-        delete value.__proto__;
-        delete value.prototype;
-        // Only delete constructor if it's NOT a built-in type
-        const constructorType = value?.constructor;
-        if (constructorType && !BUILT_IN_TYPES.includes(constructorType)) {
-            delete value.constructor;
-        }
-        for (const key in value) {
-            this.stripProtoKeys(value[key]);
-        }
-    }
     isPrimitive(value) {
         return ['number', 'boolean', 'string'].includes(typeof value);
     }
+    stripProtoKeys(value) {
+        stripProtoKeys(value);
+    }
     validate(object, validatorOptions) {
         return classValidator.validate(object, validatorOptions);
     }

package/utils/index.d.ts

@@ -1 +1,2 @@
 export * from './forward-ref.util.js';
+export * from './strip-proto-keys.util.js';

package/utils/index.js

@@ -1 +1,2 @@
 export * from './forward-ref.util.js';
+export * from './strip-proto-keys.util.js';

package/utils/shared.utils.js

@@ -8,7 +8,7 @@ export const isPlainObject = (fn) => {
     if (proto === null) {
         return true;
     }
-    const ctor = Object.prototype.hasOwnProperty.call(proto, 'constructor') &&
+    const ctor = Object.hasOwn(proto, 'constructor') &&
         proto.constructor;
     return (typeof ctor === 'function' &&
         ctor instanceof ctor &&
@@ -20,11 +20,7 @@ export const addLeadingSlash = (path) => path && typeof path === 'string'
         ? '/' + path
         : path
     : '';
-export const normalizePath = (path) => path
-    ? path.startsWith('/')
-        ? ('/' + path.replace(/\/+$/, '')).replace(/\/+/g, '/')
-        : '/' + path.replace(/\/+$/, '')
-    : '/';
+export const normalizePath = (path) => path ? ('/' + path.replace(/\/+$/, '')).replace(/\/+/g, '/') : '/';
 export const stripEndSlash = (path) => path.endsWith('/') ? path.slice(0, -1) : path;
 export const isFunction = (val) => typeof val === 'function';
 export const isString = (val) => typeof val === 'string';

package/utils/strip-proto-keys.util.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Strips dangerous prototype pollution keys (__proto__, prototype, constructor)
+ * from an object recursively.
+ */
+export declare function stripProtoKeys(value: any): void;

package/utils/strip-proto-keys.util.js

@@ -0,0 +1,36 @@
+import { types } from 'util';
+/**
+ * Built-in JavaScript types that should be excluded from prototype stripping
+ * to avoid conflicts with test frameworks like Jest's useFakeTimers
+ */
+const BUILT_IN_TYPES = [Date, RegExp, Error, Map, Set, WeakMap, WeakSet];
+/**
+ * Strips dangerous prototype pollution keys (__proto__, prototype, constructor)
+ * from an object recursively.
+ */
+export function stripProtoKeys(value) {
+    if (value == null || typeof value !== 'object' || types.isTypedArray(value)) {
+        return;
+    }
+    // Skip built-in JavaScript primitives to avoid Jest useFakeTimers conflicts
+    if (BUILT_IN_TYPES.some(type => value instanceof type)) {
+        return;
+    }
+    if (Array.isArray(value)) {
+        for (const v of value) {
+            stripProtoKeys(v);
+        }
+        return;
+    }
+    // Delete dangerous prototype pollution keys
+    delete value.__proto__;
+    delete value.prototype;
+    // Only delete constructor if it's NOT a built-in type
+    const constructorType = value?.constructor;
+    if (constructorType && !BUILT_IN_TYPES.includes(constructorType)) {
+        delete value.constructor;
+    }
+    for (const key in value) {
+        stripProtoKeys(value[key]);
+    }
+}