@depup/nestjs__common 12.0.4-depup.0 → 12.1.1-depup.0

package/README.md

@@ -13,8 +13,8 @@ npm install @depup/nestjs__common
 
 | Field | Value |
 |-------|-------|
-| Original | [@nestjs/common](https://www.npmjs.com/package/@nestjs/common) @ 12.0.4 |
-| Processed | 2026-09-21 |
+| Original | [@nestjs/common](https://www.npmjs.com/package/@nestjs/common) @ 12.1.1 |
+| Processed | 2026-09-28 |
 | Smoke test | passed |
 | Deps updated | 0 |
 

package/changes.json

@@ -1,5 +1,5 @@
 {
   "bumped": {},
-  "timestamp": "2026-09-21T08:13:01.677Z",
+  "timestamp": "2026-09-28T16:10:42.807Z",
   "totalUpdated": 0
 }

package/decorators/http/route-params.decorator.d.ts

@@ -591,6 +591,54 @@ export declare function HostParam(): ParameterDecorator;
  * @publicApi
  */
 export declare function HostParam(property: string): ParameterDecorator;
+/**
+ * Route handler parameter decorator. Extracts the cookies sent with the
+ * request (all of them, or a single one by name) and populates the decorated
+ * parameter with that value. May also apply pipes to the bound parameter.
+ *
+ * Works the same on every HTTP adapter, with no extra package: the `Cookie`
+ * header is parsed once per request. When a cookie middleware (such as
+ * `cookie-parser` or `@fastify/cookie`) already populated `req.cookies`, that
+ * object is used instead. Signatures are not verified here; read signed
+ * cookies with `@SignedCookies()`.
+ *
+ * For example:
+ * ```typescript
+ * findAll(@Cookies('theme') theme?: string)
+ * ```
+ *
+ * @param property name of a single cookie to extract
+ * @param pipes one or more pipes to apply to the bound parameter
+ *
+ * @see [Cookies](https://docs.nestjs.com/techniques/cookies)
+ *
+ * @publicApi
+ */
+export declare function Cookies(property?: string | (Type<PipeTransform> | PipeTransform), ...pipes: (Type<PipeTransform> | PipeTransform)[]): ParameterDecorator;
+/**
+ * Route handler parameter decorator. Extracts the signed cookies sent with
+ * the request (all of them, or a single one by name), verified against the
+ * `cookies.secret` application option, and populates the decorated parameter
+ * with the unsigned value. A cookie whose signature does not verify resolves
+ * to `undefined` (and is left out when reading all signed cookies).
+ *
+ * Without a `cookies.secret`, falls back to `req.signedCookies` as populated
+ * by `cookie-parser`; when neither is available, resolving the parameter
+ * throws.
+ *
+ * For example:
+ * ```typescript
+ * profile(@SignedCookies('uid') userId?: string)
+ * ```
+ *
+ * @param property name of a single signed cookie to extract
+ * @param pipes one or more pipes to apply to the bound parameter
+ *
+ * @see [Cookies](https://docs.nestjs.com/techniques/cookies)
+ *
+ * @publicApi
+ */
+export declare function SignedCookies(property?: string | (Type<PipeTransform> | PipeTransform), ...pipes: (Type<PipeTransform> | PipeTransform)[]): ParameterDecorator;
 /**
  * Route handler parameter decorator. Extracts the `Request`
  * object from the underlying platform and populates the decorated

package/decorators/http/route-params.decorator.js

@@ -334,6 +334,64 @@ export function Param(property, optionsOrPipe, ...pipes) {
 export function HostParam(property) {
     return createRouteParamDecorator(RouteParamtypes.HOST)(property);
 }
+/**
+ * Route handler parameter decorator. Extracts the cookies sent with the
+ * request (all of them, or a single one by name) and populates the decorated
+ * parameter with that value. May also apply pipes to the bound parameter.
+ *
+ * Works the same on every HTTP adapter, with no extra package: the `Cookie`
+ * header is parsed once per request. When a cookie middleware (such as
+ * `cookie-parser` or `@fastify/cookie`) already populated `req.cookies`, that
+ * object is used instead. Signatures are not verified here; read signed
+ * cookies with `@SignedCookies()`.
+ *
+ * For example:
+ * ```typescript
+ * findAll(@Cookies('theme') theme?: string)
+ * ```
+ *
+ * @param property name of a single cookie to extract
+ * @param pipes one or more pipes to apply to the bound parameter
+ *
+ * @see [Cookies](https://docs.nestjs.com/techniques/cookies)
+ *
+ * @publicApi
+ */
+export function Cookies(property, ...pipes) {
+    return createPipesRouteParamDecorator(RouteParamtypes.COOKIES)({
+        data: property,
+        pipes,
+    });
+}
+/**
+ * Route handler parameter decorator. Extracts the signed cookies sent with
+ * the request (all of them, or a single one by name), verified against the
+ * `cookies.secret` application option, and populates the decorated parameter
+ * with the unsigned value. A cookie whose signature does not verify resolves
+ * to `undefined` (and is left out when reading all signed cookies).
+ *
+ * Without a `cookies.secret`, falls back to `req.signedCookies` as populated
+ * by `cookie-parser`; when neither is available, resolving the parameter
+ * throws.
+ *
+ * For example:
+ * ```typescript
+ * profile(@SignedCookies('uid') userId?: string)
+ * ```
+ *
+ * @param property name of a single signed cookie to extract
+ * @param pipes one or more pipes to apply to the bound parameter
+ *
+ * @see [Cookies](https://docs.nestjs.com/techniques/cookies)
+ *
+ * @publicApi
+ */
+export function SignedCookies(property, ...pipes) {
+    return createPipesRouteParamDecorator(RouteParamtypes.SIGNED_COOKIES)({
+        data: property,
+        pipes,
+    });
+}
 /**
  * Route handler parameter decorator. Extracts the `Request`
  * object from the underlying platform and populates the decorated

package/enums/route-paramtypes.enum.d.ts

@@ -12,5 +12,7 @@ export declare enum RouteParamtypes {
     HOST = 10,
     IP = 11,
     RAW_BODY = 12,
-    ACK = 13
+    ACK = 13,
+    COOKIES = 14,
+    SIGNED_COOKIES = 15
 }

package/enums/route-paramtypes.enum.js

@@ -14,4 +14,6 @@ export var RouteParamtypes;
     RouteParamtypes[RouteParamtypes["IP"] = 11] = "IP";
     RouteParamtypes[RouteParamtypes["RAW_BODY"] = 12] = "RAW_BODY";
     RouteParamtypes[RouteParamtypes["ACK"] = 13] = "ACK";
+    RouteParamtypes[RouteParamtypes["COOKIES"] = 14] = "COOKIES";
+    RouteParamtypes[RouteParamtypes["SIGNED_COOKIES"] = 15] = "SIGNED_COOKIES";
 })(RouteParamtypes || (RouteParamtypes = {}));

package/index.d.ts

@@ -3,7 +3,7 @@ export * from './decorators/index.js';
 export * from './enums/index.js';
 export * from './exceptions/index.js';
 export * from './file-stream/index.js';
-export { Abstract, ArgumentMetadata, ArgumentsHost, BeforeApplicationShutdown, CallHandler, CanActivate, ClassProvider, ContextType, DynamicModule, ExceptionFilter, ExecutionContext, ExistingProvider, FactoryProvider, ForwardReference, HttpServer, HttpExceptionBody, HttpExceptionBodyMessage, HttpRedirectResponse, INestApplication, INestApplicationContext, INestMicroservice, ITransportServer, InjectionToken, IntrospectionResult, MessageEvent, MiddlewareConsumer, ModuleMetadata, NestApplicationOptions, NestHybridApplicationOptions, NestInterceptor, NestMiddleware, PreRequestHook, NestModule, OnApplicationBootstrap, OnApplicationShutdown, OnModuleDestroy, OnModuleInit, OptionalFactoryDependency, Paramtype, PipeTransform, Provider, RawBodyRequest, RouteConflictPolicy, RouteConflictPolicyLevel, RouteResolutionStrategy, RpcExceptionFilter, Scope, ScopeOptions, Type, ValidationError, ValueProvider, VersioningOptions, VERSION_NEUTRAL, WebSocketAdapter, WsExceptionFilter, WsMessageHandler, } from './interfaces/index.js';
+export { Abstract, ArgumentMetadata, ArgumentsHost, BeforeApplicationShutdown, CallHandler, CanActivate, ClassProvider, ContentSecurityPolicyDirectiveValue, ContentSecurityPolicyOptions, ContextType, CookieSerializeOptions, CookiesOptions, CsrfProtectionOptions, DynamicModule, ExceptionFilter, ExecutionContext, ExistingProvider, FactoryProvider, ForwardReference, HttpServer, HttpExceptionBody, HttpExceptionBodyMessage, HttpRedirectResponse, INestApplication, INestApplicationContext, INestMicroservice, ITransportServer, InjectionToken, IntrospectionResult, MessageEvent, MiddlewareConsumer, ModuleMetadata, NestApplicationOptions, NestHybridApplicationOptions, NestInterceptor, NestMiddleware, PreRequestHook, NestModule, OnApplicationBootstrap, OnApplicationShutdown, OnModuleDestroy, OnModuleInit, OptionalFactoryDependency, Paramtype, PipeTransform, Provider, RawBodyRequest, ReferrerPolicyToken, RouteConflictPolicy, RouteConflictPolicyLevel, RouteResolutionStrategy, RpcExceptionFilter, Scope, ScopeOptions, SecurityHeadersOptions, Type, ValidationError, ValueProvider, VersioningOptions, VERSION_NEUTRAL, WebSocketAdapter, WsExceptionFilter, WsMessageHandler, } from './interfaces/index.js';
 export * from './module-utils/index.js';
 export * from './pipes/index.js';
 export * from './serializer/index.js';

package/interfaces/http/cookie-options.interface.d.ts

@@ -0,0 +1,79 @@
+/**
+ * Attributes of a `Set-Cookie` header written by `HttpServer.setCookie()` and
+ * `HttpServer.clearCookie()`.
+ *
+ * @see [RFC 6265, section 4.1](https://datatracker.ietf.org/doc/html/rfc6265#section-4.1)
+ *
+ * @publicApi
+ */
+export interface CookieSerializeOptions {
+    /**
+     * `Path` attribute.
+     *
+     * @default '/'
+     */
+    path?: string;
+    /**
+     * `Domain` attribute. Omitted by default, which makes the cookie host-only.
+     */
+    domain?: string;
+    /**
+     * `Max-Age` attribute, in **seconds**, as in RFC 6265 and `@fastify/cookie`.
+     * Must be an integer.
+     *
+     * **Not milliseconds**: Express' `res.cookie()` takes `maxAge` in
+     * milliseconds, so a value carried over from it would make the cookie live
+     * 1000 times longer. For one day, pass `60 * 60 * 24`.
+     */
+    maxAge?: number;
+    /**
+     * `Expires` attribute. Browsers give precedence to `maxAge` when both are
+     * set.
+     */
+    expires?: Date;
+    /**
+     * `HttpOnly` attribute.
+     */
+    httpOnly?: boolean;
+    /**
+     * `Secure` attribute.
+     */
+    secure?: boolean;
+    /**
+     * `SameSite` attribute. `'none'` requires `secure: true`, since browsers
+     * reject `SameSite=None` cookies that are not `Secure`.
+     */
+    sameSite?: 'strict' | 'lax' | 'none';
+    /**
+     * `Partitioned` attribute (CHIPS). Requires `secure: true`, since browsers
+     * reject partitioned cookies that are not `Secure`.
+     */
+    partitioned?: boolean;
+    /**
+     * `Priority` attribute (non-standard, honored by Chromium).
+     */
+    priority?: 'low' | 'medium' | 'high';
+    /**
+     * Whether to sign the value with the first secret configured through the
+     * `cookies.secret` application option. Signed cookies are read with the
+     * `@SignedCookies()` decorator.
+     *
+     * @default false
+     */
+    signed?: boolean;
+}
+/**
+ * The `cookies` option of `NestFactory.create()`.
+ *
+ * @publicApi
+ */
+export interface CookiesOptions {
+    /**
+     * Secret (or secrets) used to sign and verify cookies. When an array is
+     * given, cookies are signed with the first secret and verified against all
+     * of them, which allows rotating secrets without invalidating cookies
+     * signed with a previous one. An empty string, an empty array or an empty
+     * entry throws when the application is created.
+     */
+    secret?: string | string[];
+}

package/interfaces/http/cookie-options.interface.js

@@ -0,0 +1 @@
+export {};

package/interfaces/http/csrf-protection-options.interface.d.ts

@@ -0,0 +1,47 @@
+import type { RouteInfo } from '../middleware/middleware-configuration.interface.js';
+/**
+ * Options for `app.enableCsrfProtection()`.
+ *
+ * The protection is based on Fetch Metadata (`Sec-Fetch-Site`) with an
+ * `Origin`/`Host` fallback, following the algorithm of Go's
+ * `net/http.CrossOriginProtection`. It is not a token scheme: it relies on the
+ * browser telling the server where a request comes from, which every
+ * evergreen browser does since 2023.
+ *
+ * Browsers only send `Sec-Fetch-Site` to secure origins (HTTPS or
+ * `localhost`). Otherwise the `Origin` header is compared with the `Host`
+ * header the server receives (`X-Forwarded-Host` is ignored). Behind a proxy
+ * that rewrites `Host`, preserve it, or list the public origin in
+ * `trustedOrigins`.
+ *
+ * @publicApi
+ */
+export interface CsrfProtectionOptions<TRequest = any> {
+    /**
+     * Origins that may send cross-origin, state-changing requests, e.g.
+     * `https://admin.example.com`. Each entry must be a serialized origin:
+     * `scheme://host[:port]`, without a path, query string, fragment or
+     * wildcard. Entries are normalized the way browsers serialize `Origin`
+     * (lower-case, without the default port), and a request is exempt when its
+     * `Origin` header equals one of them.
+     *
+     * Origins allowed by CORS are not trusted implicitly: list them here too.
+     */
+    trustedOrigins?: string[];
+    /**
+     * Requests that skip the protection altogether (for example webhook
+     * endpoints called by third-party servers that send a foreign `Origin`).
+     *
+     * Either a list of routes, or a predicate receiving the platform request
+     * object. Only consulted for requests that would otherwise be rejected.
+     *
+     * Routes are declared like `MiddlewareConsumer.exclude()`: a path, or
+     * `{ path, method, version? }` to narrow by method (and URI version),
+     * without the global prefix, which is added unless the route is excluded
+     * from it. Unlike `exclude()`, the match is exact: case-sensitive, without
+     * an optional trailing slash, and never for non-canonical request paths
+     * (`//`, dot segments, `;`, encoded `/` or `.`), which a router could
+     * resolve to a route that is not excluded.
+     */
+    exclude?: (string | RouteInfo)[] | ((request: TRequest) => boolean);
+}

package/interfaces/http/csrf-protection-options.interface.js

@@ -0,0 +1 @@
+export {};

package/interfaces/http/http-server.interface.d.ts

@@ -1,6 +1,7 @@
 import { RequestMethod } from '../../enums/index.js';
 import { NestApplicationOptions } from '../../interfaces/nest-application-options.interface.js';
 import { VersionValue, VersioningOptions } from '../version-options.interface.js';
+import { CookieSerializeOptions } from './cookie-options.interface.js';
 /**
  * Shape of the error-layer callback that Nest hands to
  * {@link HttpServer.setErrorHandler}.
@@ -37,6 +38,19 @@ export type ErrorHandler<TRequest = any, TResponse = any> = (error: any, req: TR
  * @publicApi
  */
 export type RequestHandler<TRequest = any, TResponse = any> = (req: TRequest, res: TResponse, next?: Function) => any;
+/**
+ * Request hook of the built-in HTTP security features, handed to
+ * {@link HttpServer.registerSecurityHook}. It receives the request and the
+ * Node.js `ServerResponse` (of which it only uses `setHeader()` and
+ * `removeHeader()`), and returns the error to hand to the exception layer
+ * when the request must be rejected.
+ *
+ * @publicApi
+ */
+export type SecurityRequestHook<TRequest = any> = (request: TRequest, response: {
+    setHeader(name: string, value: string): unknown;
+    removeHeader(name: string): unknown;
+}) => Error | undefined;
 /**
  * Contract between the Nest core (`NestApplication`, the router, the
  * middleware module and the exception layer) and an HTTP platform such as
@@ -356,6 +370,20 @@ export interface HttpServer<TRequest = any, TResponse = any, ServerInstance = an
      * right after {@link HttpServer.status}. Not awaited.
      */
     setHeader(response: any, name: string, value: string): any;
+    /**
+     * Appends a `Set-Cookie` header to the response, so several cookies set
+     * during the same request accumulate. Not called by the core;
+     * `AbstractHttpAdapter` implements it on top of its `appendHeader()`.
+     * Throws a `TypeError` when the name, the value or an attribute is not
+     * valid per RFC 6265. Note that `options.maxAge` is in seconds.
+     */
+    setCookie?(response: TResponse, name: string, value: string, options?: CookieSerializeOptions): any;
+    /**
+     * Appends a `Set-Cookie` header that expires the cookie. `path` and
+     * `domain` must match the ones the cookie was set with. Not called by the
+     * core; `AbstractHttpAdapter` implements it.
+     */
+    clearCookie?(response: TResponse, name: string, options?: CookieSerializeOptions): any;
     /**
      * Installs the global exception layer: an {@link ErrorHandler} that
      * forwards errors to the registered exception filters. The core calls it
@@ -479,6 +507,29 @@ export interface HttpServer<TRequest = any, TResponse = any, ServerInstance = an
      * for `cors: true`.
      */
     enableCors(options: any): any;
+    /**
+     * Installs the request hook of the built-in HTTP security features
+     * (`app.enableCsrfProtection()`, `app.useSecurityHeaders()`). The core
+     * composes the features into this one hook and owns their logic; the
+     * adapter only decides where the hook runs.
+     *
+     * Called at most once, before `app.init()`, the first time one of the
+     * features is enabled. The hook must run for every request (matched routes,
+     * unmatched requests, routes outside the global prefix) before Nest
+     * middleware, guards and route handlers, and before body parsing when the
+     * platform allows it; registering a framework-level middleware or request
+     * hook at call time satisfies that on Express and Fastify. It receives the
+     * request and the Node.js `ServerResponse` (`reply.raw` on Fastify), on
+     * which it may set headers that route handlers, `@Header()` and exception
+     * filters can still override.
+     *
+     * When the hook returns an error, the adapter must not continue to the
+     * route: it hands the error to the exception layer installed through
+     * {@link HttpServer.setErrorHandler} (`next(error)` on Express,
+     * `done(error)` in a Fastify hook), so exception filters shape the
+     * response. Optional: when absent, enabling a feature throws.
+     */
+    registerSecurityHook?(hook: SecurityRequestHook<TRequest>): any;
     /**
      * Returns the native HTTP server created by
      * {@link HttpServer.initHttpServer}. It must behave like a Node.js

package/interfaces/http/index.d.ts

@@ -1,5 +1,8 @@
+export * from './cookie-options.interface.js';
+export * from './csrf-protection-options.interface.js';
 export * from './http-exception-body.interface.js';
 export * from './http-redirect-response.interface.js';
 export * from './http-server.interface.js';
 export * from './message-event.interface.js';
 export * from './raw-body-request.interface.js';
+export * from './security-headers-options.interface.js';

package/interfaces/http/index.js

@@ -1,5 +1,8 @@
+export * from './cookie-options.interface.js';
+export * from './csrf-protection-options.interface.js';
 export * from './http-exception-body.interface.js';
 export * from './http-redirect-response.interface.js';
 export * from './http-server.interface.js';
 export * from './message-event.interface.js';
 export * from './raw-body-request.interface.js';
+export * from './security-headers-options.interface.js';

package/interfaces/http/security-headers-options.interface.d.ts

@@ -0,0 +1,142 @@
+/**
+ * Value of a Content-Security-Policy directive:
+ *
+ * - a string or a list of strings: the directive's source expressions
+ *   (keywords must be quoted, e.g. `"'self'"`);
+ * - `true` or an empty list: a directive without value (e.g.
+ *   `upgrade-insecure-requests`);
+ * - `null` or `false`: removes the directive, including a default one.
+ *
+ * @publicApi
+ */
+export type ContentSecurityPolicyDirectiveValue = string | readonly string[] | boolean | null;
+/**
+ * @publicApi
+ */
+export interface ContentSecurityPolicyOptions {
+    /**
+     * Whether `directives` are merged into the default directives. When
+     * `false`, only `directives` are sent, and they must include `default-src`
+     * (or remove it explicitly with `defaultSrc: null`).
+     *
+     * @default true
+     */
+    useDefaults?: boolean;
+    /**
+     * Directives keyed by name, in camelCase (`scriptSrc`) or kebab-case
+     * (`'script-src'`). A directive given here replaces the default directive
+     * of the same name.
+     */
+    directives?: Record<string, ContentSecurityPolicyDirectiveValue>;
+    /**
+     * Sends `Content-Security-Policy-Report-Only` instead, so violations are
+     * reported (see the `report-to` directive) but not blocked.
+     *
+     * @default false
+     */
+    reportOnly?: boolean;
+}
+/**
+ * Options for `app.useSecurityHeaders()`.
+ *
+ * Each key controls one header and accepts `false` to leave that header out,
+ * `true` for its default value (the same defaults as helmet 8), or an object
+ * to configure it. Option names match helmet's, so existing helmet
+ * configurations carry over, except for helmet's legacy aliases (`hsts`,
+ * `frameguard`, ...). Unknown options are rejected.
+ *
+ * @publicApi
+ */
+export interface SecurityHeadersOptions {
+    /**
+     * `Content-Security-Policy`. Default: `default-src 'self'; base-uri 'self';
+     * font-src 'self' https: data:; form-action 'self'; frame-ancestors 'self';
+     * img-src 'self' data:; object-src 'none'; script-src 'self';
+     * script-src-attr 'none'; style-src 'self' https: 'unsafe-inline';
+     * upgrade-insecure-requests` (serialized without spaces after `;`).
+     */
+    contentSecurityPolicy?: boolean | ContentSecurityPolicyOptions;
+    /**
+     * `Cross-Origin-Embedder-Policy`. Not sent by default; `true` sends
+     * `require-corp`.
+     */
+    crossOriginEmbedderPolicy?: boolean | {
+        policy?: 'require-corp' | 'credentialless' | 'unsafe-none';
+    };
+    /**
+     * `Cross-Origin-Opener-Policy`. Default: `same-origin`.
+     */
+    crossOriginOpenerPolicy?: boolean | {
+        policy?: 'same-origin' | 'same-origin-allow-popups' | 'noopener-allow-popups' | 'unsafe-none';
+    };
+    /**
+     * `Cross-Origin-Resource-Policy`. Default: `same-origin`.
+     */
+    crossOriginResourcePolicy?: boolean | {
+        policy?: 'same-origin' | 'same-site' | 'cross-origin';
+    };
+    /**
+     * `Origin-Agent-Cluster: ?1`.
+     */
+    originAgentCluster?: boolean;
+    /**
+     * `Referrer-Policy`. Default: `no-referrer`. A list is sent as a fallback
+     * chain (the browser uses the last one it supports).
+     */
+    referrerPolicy?: boolean | {
+        policy?: ReferrerPolicyToken | readonly ReferrerPolicyToken[];
+    };
+    /**
+     * `Strict-Transport-Security`. Default: `max-age=31536000;
+     * includeSubDomains`. Browsers ignore it over plain HTTP.
+     */
+    strictTransportSecurity?: boolean | {
+        /** In seconds. @default 31536000 (365 days) */
+        maxAge?: number;
+        /** @default true */
+        includeSubDomains?: boolean;
+        /** @default false */
+        preload?: boolean;
+    };
+    /**
+     * `X-Content-Type-Options: nosniff`.
+     */
+    xContentTypeOptions?: boolean;
+    /**
+     * `X-DNS-Prefetch-Control`. Default: `off`; `{ allow: true }` sends `on`.
+     */
+    xDnsPrefetchControl?: boolean | {
+        allow?: boolean;
+    };
+    /**
+     * `X-Download-Options: noopen`.
+     */
+    xDownloadOptions?: boolean;
+    /**
+     * `X-Frame-Options`. Default: `SAMEORIGIN`. Superseded by the CSP
+     * `frame-ancestors` directive, kept for older browsers.
+     */
+    xFrameOptions?: boolean | {
+        action?: 'deny' | 'sameorigin';
+    };
+    /**
+     * `X-Permitted-Cross-Domain-Policies`. Default: `none`.
+     */
+    xPermittedCrossDomainPolicies?: boolean | {
+        permittedPolicies?: 'none' | 'master-only' | 'by-content-type' | 'all';
+    };
+    /**
+     * Removes the `X-Powered-By` header (on Express, also disables the
+     * `x-powered-by` setting). `false` leaves it untouched.
+     */
+    xPoweredBy?: boolean;
+    /**
+     * `X-XSS-Protection: 0`, which disables the legacy XSS auditor of old
+     * browsers (a source of vulnerabilities itself).
+     */
+    xXssProtection?: boolean;
+}
+/**
+ * @publicApi
+ */
+export type ReferrerPolicyToken = '' | 'no-referrer' | 'no-referrer-when-downgrade' | 'same-origin' | 'origin' | 'strict-origin' | 'origin-when-cross-origin' | 'strict-origin-when-cross-origin' | 'unsafe-url';

package/interfaces/http/security-headers-options.interface.js

@@ -0,0 +1 @@
+export {};

package/interfaces/nest-application-options.interface.d.ts

@@ -1,5 +1,6 @@
 import { CorsOptions, CorsOptionsDelegate } from './external/cors-options.interface.js';
 import { HttpsOptions } from './external/https-options.interface.js';
+import { CookiesOptions } from './http/cookie-options.interface.js';
 import { NestApplicationContextOptions } from './nest-application-context-options.interface.js';
 import { RouteConflictPolicy, RouteResolutionStrategy } from './router-options.interface.js';
 /**
@@ -47,4 +48,10 @@ export interface NestApplicationOptions extends NestApplicationContextOptions {
      * to `'declaration'`.
      */
     routeResolutionStrategy?: RouteResolutionStrategy;
+    /**
+     * Built-in cookie support. `secret` enables signing cookies with
+     * `setCookie(..., { signed: true })` and reading them with
+     * `@SignedCookies()`.
+     */
+    cookies?: CookiesOptions;
 }

package/interfaces/nest-application.interface.d.ts

@@ -1,7 +1,9 @@
 import { CanActivate } from './features/can-activate.interface.js';
 import { NestInterceptor } from './features/nest-interceptor.interface.js';
 import { GlobalPrefixOptions } from './global-prefix-options.interface.js';
+import { CsrfProtectionOptions } from './http/csrf-protection-options.interface.js';
 import { HttpServer } from './http/http-server.interface.js';
+import { SecurityHeadersOptions } from './http/security-headers-options.interface.js';
 import { ExceptionFilter, INestMicroservice, NestHybridApplicationOptions, PipeTransform } from './index.js';
 import { INestApplicationContext } from './nest-application-context.interface.js';
 import { VersioningOptions } from './version-options.interface.js';
@@ -25,6 +27,47 @@ export interface INestApplication<TServer = any> extends INestApplicationContext
      * @returns {void}
      */
     enableCors(options?: any): void;
+    /**
+     * Enables protection against cross-site request forgery (CSRF) for every
+     * route, based on Fetch Metadata (`Sec-Fetch-Site`) with an `Origin`/`Host`
+     * fallback (the algorithm of Go's `net/http.CrossOriginProtection`).
+     *
+     * `GET`, `HEAD` and `OPTIONS` requests are always allowed. Other requests
+     * are rejected with a `ForbiddenException`, which goes through the
+     * exception filters, when the browser reports them as cross-origin.
+     * Requests carrying neither `Sec-Fetch-Site` nor `Origin` (non-browser
+     * clients) are allowed.
+     *
+     * Must be called once, before `app.init()` / `app.listen()`. The check runs
+     * before Nest middleware, body parsing, guards and handlers. It shares one
+     * request hook with `app.useSecurityHeaders()`, registered where the first
+     * of the two is called: middleware registered with `app.use()` before that
+     * runs before the check.
+     *
+     * @param {CsrfProtectionOptions} options
+     * @returns {this}
+     */
+    enableCsrfProtection(options?: CsrfProtectionOptions): this;
+    /**
+     * Sets security-related response headers on every response (routes,
+     * `404`s and errors, including rejections of `enableCsrfProtection()`):
+     * the same headers and defaults as helmet 8, including a default
+     * Content-Security-Policy, and removes `X-Powered-By`.
+     *
+     * Pass `false` for a header to leave it out, `true` for its default, or an
+     * object to configure it. Options are validated when this method is
+     * called. Route handlers and `@Header()` can still override a header per
+     * route.
+     *
+     * Must be called once, before `app.init()` / `app.listen()`. It shares one
+     * request hook with `app.enableCsrfProtection()`, registered where the
+     * first of the two is called: middleware registered with `app.use()` before
+     * that runs first, so responses it ends itself do not carry the headers.
+     *
+     * @param {SecurityHeadersOptions} options
+     * @returns {this}
+     */
+    useSecurityHeaders(options?: SecurityHeadersOptions): this;
     /**
      * Enables Versioning for the application.
      * By default, URI-based versioning is used.

package/internal.d.ts

@@ -25,7 +25,7 @@ export type { MiddlewareConfiguration, RouteInfo, } from './interfaces/middlewar
 export type { MiddlewareConfigProxy } from './interfaces/middleware/middleware-config-proxy.interface.js';
 export type { ModuleMetadata } from './interfaces/modules/module-metadata.interface.js';
 export type { HttpArgumentsHost, RpcArgumentsHost, WsArgumentsHost, } from './interfaces/features/arguments-host.interface.js';
-export type { RequestHandler } from './interfaces/http/http-server.interface.js';
+export type { RequestHandler, SecurityRequestHook, } from './interfaces/http/http-server.interface.js';
 export type { GetOrResolveOptions, SelectOptions, } from './interfaces/nest-application-context.interface.js';
 export type { ShutdownHooksOptions } from './interfaces/shutdown-hooks-options.interface.js';
 export { assignMetadata } from './decorators/http/route-params.decorator.js';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@depup/nestjs__common",
-  "version": "12.0.4-depup.0",
+  "version": "12.1.1-depup.0",
   "description": "Nest - modern, fast, powerful node.js web framework (@common) (with updated dependencies)",
   "author": "Kamil Mysliwiec",
   "homepage": "https://nestjs.com",
@@ -44,7 +44,7 @@
       "optional": true
     }
   },
-  "gitHead": "899dbe3a0c1e59d1d0fb7e0c7ad0b2d2aa4ae771",
+  "gitHead": "9feedffde8ef8c86f0cd521153740575dc579d88",
   "keywords": [
     "@nestjs/common",
     "depup",
@@ -57,8 +57,8 @@
     "changes": {},
     "depsUpdated": 0,
     "originalPackage": "@nestjs/common",
-    "originalVersion": "12.0.4",
-    "processedAt": "2026-09-21T08:13:04.687Z",
+    "originalVersion": "12.1.1",
+    "processedAt": "2026-09-28T16:10:47.564Z",
     "smokeTest": "passed"
   }
 }