@depup/nestjs__common 12.1.0-depup.0 → 12.1.1-depup.0

package/README.md

@@ -13,8 +13,8 @@ npm install @depup/nestjs__common
 
 | Field | Value |
 |-------|-------|
-| Original | [@nestjs/common](https://www.npmjs.com/package/@nestjs/common) @ 12.1.0 |
-| Processed | 2026-09-23 |
+| Original | [@nestjs/common](https://www.npmjs.com/package/@nestjs/common) @ 12.1.1 |
+| Processed | 2026-09-28 |
 | Smoke test | passed |
 | Deps updated | 0 |
 

package/changes.json

@@ -1,5 +1,5 @@
 {
   "bumped": {},
-  "timestamp": "2026-09-23T08:11:51.547Z",
+  "timestamp": "2026-09-28T16:10:42.807Z",
   "totalUpdated": 0
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@depup/nestjs__common",
-  "version": "12.1.0-depup.0",
+  "version": "12.1.1-depup.0",
   "description": "Nest - modern, fast, powerful node.js web framework (@common) (with updated dependencies)",
   "author": "Kamil Mysliwiec",
   "homepage": "https://nestjs.com",
@@ -44,7 +44,7 @@
       "optional": true
     }
   },
-  "gitHead": "6739656fa3e8c98bd55883f0363a2254e6412232",
+  "gitHead": "9feedffde8ef8c86f0cd521153740575dc579d88",
   "keywords": [
     "@nestjs/common",
     "depup",
@@ -57,8 +57,8 @@
     "changes": {},
     "depsUpdated": 0,
     "originalPackage": "@nestjs/common",
-    "originalVersion": "12.1.0",
-    "processedAt": "2026-09-23T08:11:53.954Z",
+    "originalVersion": "12.1.1",
+    "processedAt": "2026-09-28T16:10:47.564Z",
     "smokeTest": "passed"
   }
 }

package/pipes/parse-array.pipe.d.ts

@@ -51,4 +51,5 @@ export declare class ParseArrayPipe implements PipeTransform {
     transform(value: unknown, metadata: ArgumentMetadata): Promise<any>;
     protected isExpectedTypePrimitive(): boolean;
     protected validatePrimitive(originalValue: any, index?: number): any;
+    protected isNumeric(value: unknown): boolean;
 }

package/pipes/parse-array.pipe.js

@@ -121,11 +121,10 @@ let ParseArrayPipe = class ParseArrayPipe {
     }
     validatePrimitive(originalValue, index) {
         if (this.options.items === Number) {
-            const value = originalValue !== null && originalValue !== '' ? +originalValue : NaN;
-            if (isNaN(value)) {
+            if (!this.isNumeric(originalValue)) {
                 throw this.exceptionFactory(`${isUndefined(index) ? '' : `[${index}] `}item must be a number`);
             }
-            return value;
+            return Number(originalValue);
         }
         else if (this.options.items === String) {
             if (!isString(originalValue)) {
@@ -139,6 +138,22 @@ let ParseArrayPipe = class ParseArrayPipe {
         }
         return originalValue;
     }
+    isNumeric(value) {
+        if (typeof value === 'number') {
+            return Number.isFinite(value);
+        }
+        // Booleans, arrays and blank strings coerce to numbers (`+true === 1`,
+        // `+[2] === 2`, `+' ' === 0`), so only strings are converted.
+        if (typeof value !== 'string' || value.trim() === '') {
+            return false;
+        }
+        // Reject radix prefixes (`Number('0x10') === 16`), as ParseIntPipe and
+        // ParseFloatPipe do.
+        if (/^0[box]/i.test(value.trim())) {
+            return false;
+        }
+        return Number.isFinite(Number(value));
+    }
 };
 ParseArrayPipe = __decorate([
     Injectable(),

package/pipes/parse-enum.pipe.js

@@ -66,8 +66,10 @@ let ParseEnumPipe = class ParseEnumPipe {
         return Object.keys(this.enumType)
             .filter(key => {
             const enumValue = this.enumType[key];
+            // Only numeric reverse mappings point back to their own key.
             return !(typeof enumValue === 'string' &&
-                typeof this.enumType[enumValue] === 'number');
+                typeof this.enumType[enumValue] === 'number' &&
+                String(this.enumType[enumValue]) === key);
         })
             .map(key => this.enumType[key]);
     }

package/services/console-logger.service.d.ts

@@ -6,6 +6,9 @@ import { LoggerService, LogLevel } from './logger.service.js';
 export interface ConsoleLoggerOptions {
     /**
      * Enabled log levels.
+     * When not set, the levels are read from the `NEST_LOG_LEVEL` environment
+     * variable (e.g. `warn`, `>=debug` or `warn,error`) the first time the
+     * logger checks a level. Without it, every level is enabled.
      */
     logLevels?: LogLevel[];
     /**
@@ -97,6 +100,22 @@ export interface ConsoleLoggerOptions {
      * @default false
      */
     flattenParams?: boolean;
+    /**
+     * Properties to mask in logged values, as key names (`'password'`, matched
+     * at any depth) or dotted paths (`'user.password'`, matched by the last
+     * keys leading to the property, at any depth). Keys are compared
+     * case-insensitively, and array indices are skipped.
+     * Applies to structured params and to messages that are not strings
+     * (objects, arrays, errors), in text and JSON mode. String messages, the
+     * error message and the stack trace are printed as is.
+     * The logged values are not mutated: only the objects that contain a
+     * matching property are copied.
+     * Pass an object to replace the default censor (`"[REDACTED]"`).
+     */
+    redact?: string[] | {
+        paths: string[];
+        censor?: string;
+    };
 }
 /**
  * @publicApi
@@ -122,6 +141,10 @@ export declare class ConsoleLogger implements LoggerService {
      * The last timestamp at which the log message was printed.
      */
     protected static lastTimestampAt?: number;
+    /**
+     * Masks the properties set in the `redact` option.
+     */
+    private readonly redactor?;
     constructor();
     constructor(context: string);
     constructor(options: ConsoleLoggerOptions);
@@ -159,10 +182,11 @@ export declare class ConsoleLogger implements LoggerService {
     verbose(message: any, ...optionalParams: [...any, string?]): void;
     /**
      * Write a 'fatal' level log, if the configured level allows for it.
-     * Prints to `stdout` with newline.
+     * Prints to `stderr` with newline.
      */
-    fatal(message: any, context?: string): void;
-    fatal(message: any, ...optionalParams: [...any, string?]): void;
+    fatal(message: any, stackOrContext?: string): void;
+    fatal(message: any, stack?: string, context?: string): void;
+    fatal(message: any, ...optionalParams: [...any, string?, string?]): void;
     /**
      * Set log levels
      * @param levels log levels
@@ -178,6 +202,14 @@ export declare class ConsoleLogger implements LoggerService {
      */
     resetContext(): void;
     isLevelEnabled(level: LogLevel): boolean;
+    /**
+     * Returns the levels used when none were passed to the constructor: the
+     * `NEST_LOG_LEVEL` environment variable if it is set, every level otherwise.
+     * Called on the first level check rather than in the constructor, so that
+     * the default logger also sees variables loaded after "@nestjs/common" was
+     * imported (for example, from a `.env` file).
+     */
+    protected getDefaultLogLevels(): LogLevel[];
     protected getTimestamp(): string;
     protected printMessages(messages: unknown[], context?: string, logLevel?: LogLevel, writeStreamType?: 'stdout' | 'stderr', errorStack?: unknown, params?: Record<string, any>): void;
     protected printAsJson(message: unknown, options: {
@@ -186,6 +218,7 @@ export declare class ConsoleLogger implements LoggerService {
         writeStreamType?: 'stdout' | 'stderr';
         errorStack?: unknown;
         params?: Record<string, any>;
+        error?: Error;
     }): void;
     protected getJsonLogObject(message: unknown, options: {
         context: string;
@@ -193,6 +226,7 @@ export declare class ConsoleLogger implements LoggerService {
         writeStreamType?: 'stdout' | 'stderr';
         errorStack?: unknown;
         params?: Record<string, any>;
+        error?: Error;
     }): {
         [key: string]: unknown;
         level: LogLevel;
@@ -201,18 +235,51 @@ export declare class ConsoleLogger implements LoggerService {
         message: unknown;
         context?: string;
         stack?: unknown;
+        error?: Record<string, unknown>;
         params?: Record<string, any>;
     };
+    /**
+     * Pulls the first `Error` out of the messages so that it can be attached to
+     * the log record as a structured `error` field instead of being printed as
+     * a separate record. When the error is the message itself, the record's
+     * message becomes the error's message.
+     */
+    protected extractJsonError(messages: unknown[]): {
+        messages: unknown[];
+        error?: Error;
+    };
+    /**
+     * Converts an error into a plain object: `name`, `message`, `stack`, own
+     * primitive properties (e.g. `code`), and, recursively, `cause` and the
+     * `errors` of an `AggregateError`, up to a fixed depth.
+     */
+    protected serializeError(error: Error, depth?: number, ancestors?: Set<Error>): Record<string, unknown>;
+    /**
+     * Masks the properties set in the `redact` option. Returns the value itself
+     * when the option isn't set or nothing matched.
+     */
+    protected redact(value: unknown): unknown;
     protected formatPid(pid: number): string;
     protected formatContext(context: string): string;
     protected formatMessage(logLevel: LogLevel, message: unknown, pidMessage: string, formattedLogLevel: string, contextMessage: string, timestampDiff: string, params?: Record<string, any>): string;
     protected stringifyParams(params: Record<string, any>): string;
-    protected stringifyMessage(message: unknown, logLevel: LogLevel): any;
+    /**
+     * Resolves a message passed as a function: a class resolves to its name,
+     * any other function is called (lazy message) and its result re-resolved.
+     */
+    protected resolveMessage(message: unknown): unknown;
+    protected stringifyMessage(message: unknown, logLevel: LogLevel): string;
     protected colorize(message: string, logLevel: LogLevel): string;
     protected printStackTrace(stack: string): void;
     protected updateAndGetTimestampDiff(): string;
     protected formatTimestampDiff(timestampDiff: number): string;
     protected getInspectOptions(): InspectOptions;
+    /**
+     * Serializes a JSON log object without ever throwing: circular references
+     * are replaced with "[Circular]", and a value that cannot be serialized
+     * (e.g. a throwing `toJSON()`) makes the whole record fall back to `inspect`.
+     */
+    protected stringifyJsonLogObject(logObject: Record<string, unknown>): string;
     protected stringifyReplacer(key: string, value: unknown): unknown;
     protected getContextAndMessagesToPrint(args: unknown[]): {
         messages: unknown[];

package/services/console-logger.service.js

@@ -4,8 +4,15 @@ import { inspect } from 'util';
 import { Injectable, Optional } from '../decorators/core/index.js';
 import { clc, yellow, isColorAllowed } from '../utils/cli-colors.util.js';
 import { isFunction, isPlainObject, isString, isUndefined, } from '../utils/shared.utils.js';
+import { getEnvLogLevels, LOG_LEVEL_ENV_VAR, } from './utils/get-env-log-levels.util.js';
 import { isLogLevelEnabled } from './utils/is-log-level-enabled.util.js';
+import { createRedactor } from './utils/redact.util.js';
 const DEFAULT_DEPTH = 5;
+/**
+ * How many levels of nested errors (`cause`, `AggregateError#errors`) are
+ * serialized in JSON mode.
+ */
+const MAX_ERROR_DEPTH = 5;
 const DEFAULT_LOG_LEVELS = [
     'log',
     'error',
@@ -14,6 +21,11 @@ const DEFAULT_LOG_LEVELS = [
     'verbose',
     'fatal',
 ];
+/**
+ * The last invalid `NEST_LOG_LEVEL` value that was reported, so that loggers
+ * sharing the environment warn about it once.
+ */
+let reportedInvalidEnvLogLevel;
 const dateTimeFormatter = new Intl.DateTimeFormat(undefined, {
     year: 'numeric',
     hour: 'numeric',
@@ -47,6 +59,10 @@ let ConsoleLogger = class ConsoleLogger {
      * The last timestamp at which the log message was printed.
      */
     static lastTimestampAt;
+    /**
+     * Masks the properties set in the `redact` option.
+     */
+    redactor;
     constructor(contextOrOptions, options) {
         // eslint-disable-next-line prefer-const
         let [context, opts] = isString(contextOrOptions)
@@ -55,11 +71,15 @@ let ConsoleLogger = class ConsoleLogger {
                 ? [undefined, options]
                 : [contextOrOptions?.context, contextOrOptions];
         opts = opts ?? {};
-        opts.logLevels ??= DEFAULT_LOG_LEVELS;
         opts.colors ??= opts.colors ?? (opts.json ? false : isColorAllowed());
         opts.prefix ??= 'Nest';
         this.options = opts;
         this.inspectOptions = this.getInspectOptions();
+        if (opts.redact) {
+            this.redactor = Array.isArray(opts.redact)
+                ? createRedactor(opts.redact)
+                : createRedactor(opts.redact.paths, opts.redact.censor);
+        }
         if (context) {
             this.context = context;
             this.originalContext = context;
@@ -117,11 +137,9 @@ let ConsoleLogger = class ConsoleLogger {
         if (!this.isLevelEnabled('fatal')) {
             return;
         }
-        const { messages, context, params } = this.getContextAndMessagesToPrint([
-            message,
-            ...optionalParams,
-        ]);
-        this.printMessages(messages, context, 'fatal', 'stdout', undefined, params);
+        const { messages, context, stack, params } = this.getContextAndStackAndMessagesToPrint([message, ...optionalParams]);
+        this.printMessages(messages, context, 'fatal', 'stderr', stack, params);
+        this.printStackTrace(stack);
     }
     /**
      * Set log levels
@@ -147,24 +165,58 @@ let ConsoleLogger = class ConsoleLogger {
         this.context = this.originalContext;
     }
     isLevelEnabled(level) {
+        if (this.options && !this.options.logLevels) {
+            this.options.logLevels = this.getDefaultLogLevels();
+        }
         const logLevels = this.options?.logLevels;
         return isLogLevelEnabled(level, logLevels);
     }
+    /**
+     * Returns the levels used when none were passed to the constructor: the
+     * `NEST_LOG_LEVEL` environment variable if it is set, every level otherwise.
+     * Called on the first level check rather than in the constructor, so that
+     * the default logger also sees variables loaded after "@nestjs/common" was
+     * imported (for example, from a `.env` file).
+     */
+    getDefaultLogLevels() {
+        const envLogLevels = getEnvLogLevels();
+        if (envLogLevels !== false) {
+            return envLogLevels ?? DEFAULT_LOG_LEVELS;
+        }
+        const value = process.env[LOG_LEVEL_ENV_VAR];
+        if (reportedInvalidEnvLogLevel !== value) {
+            reportedInvalidEnvLogLevel = value;
+            // The default levels must be in place before this call, as "warn"
+            // checks the level again.
+            this.options.logLevels = DEFAULT_LOG_LEVELS;
+            this.warn(`Invalid ${LOG_LEVEL_ENV_VAR} value "${value}". Expected a log level ("warn"), a comma-separated list ("warn,error") or a threshold (">=warn"). Every log level is enabled instead.`, 'ConsoleLogger');
+        }
+        return DEFAULT_LOG_LEVELS;
+    }
     getTimestamp() {
         return dateTimeFormatter.format(Date.now());
     }
     printMessages(messages, context = '', logLevel = 'log', writeStreamType, errorStack, params) {
-        messages.forEach(message => {
-            if (this.options.json) {
+        if (this.redactor) {
+            messages = messages.map(message => this.redact(this.resolveMessage(message)));
+            params = params && this.redact(params);
+        }
+        if (this.options.json) {
+            const { messages: jsonMessages, error } = this.extractJsonError(messages.map(message => this.resolveMessage(message)));
+            jsonMessages.forEach((message, index) => {
                 this.printAsJson(message, {
                     context,
                     logLevel,
                     writeStreamType,
                     errorStack,
                     params,
+                    // The error belongs to the first record (the log message).
+                    error: index === 0 ? error : undefined,
                 });
-                return;
-            }
+            });
+            return;
+        }
+        messages.forEach(message => {
             const pidMessage = this.formatPid(process.pid);
             const contextMessage = this.formatContext(context);
             const timestampDiff = this.updateAndGetTimestampDiff();
@@ -186,7 +238,7 @@ let ConsoleLogger = class ConsoleLogger {
     printAsJson(message, options) {
         const logObject = this.getJsonLogObject(message, options);
         const formattedMessage = !this.options.colors && this.inspectOptions.compact === true
-            ? JSON.stringify(logObject, this.stringifyReplacer)
+            ? this.stringifyJsonLogObject(logObject)
             : inspect(logObject, this.inspectOptions);
         if (this.options.forceConsole) {
             if (options.writeStreamType === 'stderr') {
@@ -213,6 +265,9 @@ let ConsoleLogger = class ConsoleLogger {
         if (options.errorStack) {
             logObject.stack = options.errorStack;
         }
+        if (options.error) {
+            logObject.error = this.serializeError(options.error);
+        }
         if (options.params) {
             if (this.options.flattenParams) {
                 // Framework fields win on key collisions: a param named "message" or
@@ -229,6 +284,74 @@ let ConsoleLogger = class ConsoleLogger {
         }
         return logObject;
     }
+    /**
+     * Pulls the first `Error` out of the messages so that it can be attached to
+     * the log record as a structured `error` field instead of being printed as
+     * a separate record. When the error is the message itself, the record's
+     * message becomes the error's message.
+     */
+    extractJsonError(messages) {
+        const errorIndex = messages.findIndex(message => message instanceof Error);
+        if (errorIndex === -1) {
+            return { messages };
+        }
+        const error = messages[errorIndex];
+        const remainingMessages = errorIndex === 0
+            ? [error.message, ...messages.slice(1)]
+            : messages.filter((_, index) => index !== errorIndex);
+        return { messages: remainingMessages, error };
+    }
+    /**
+     * Converts an error into a plain object: `name`, `message`, `stack`, own
+     * primitive properties (e.g. `code`), and, recursively, `cause` and the
+     * `errors` of an `AggregateError`, up to a fixed depth.
+     */
+    serializeError(error, depth = 0, ancestors = new Set()) {
+        const serialized = {
+            name: error.name,
+            message: error.message,
+            stack: error.stack,
+        };
+        for (const [key, value] of Object.entries(error)) {
+            if (key in serialized || key === 'cause' || key === 'errors') {
+                continue;
+            }
+            const isPrimitive = value === null ||
+                (typeof value !== 'object' && typeof value !== 'function');
+            if (isPrimitive) {
+                serialized[key] = value;
+            }
+        }
+        const serializeNested = (value) => {
+            if (!(value instanceof Error)) {
+                return value;
+            }
+            if (ancestors.has(value)) {
+                return '[Circular]';
+            }
+            if (depth + 1 > MAX_ERROR_DEPTH) {
+                return '[Truncated]';
+            }
+            return this.serializeError(value, depth + 1, ancestors);
+        };
+        ancestors.add(error);
+        if (error.cause !== undefined) {
+            serialized.cause = serializeNested(error.cause);
+        }
+        const errors = error.errors;
+        if (Array.isArray(errors)) {
+            serialized.errors = errors.map(serializeNested);
+        }
+        ancestors.delete(error);
+        return serialized;
+    }
+    /**
+     * Masks the properties set in the `redact` option. Returns the value itself
+     * when the option isn't set or nothing matched.
+     */
+    redact(value) {
+        return this.redactor ? this.redactor(value) : value;
+    }
     formatPid(pid) {
         return `[${this.options.prefix}] ${pid}  - `;
     }
@@ -253,17 +376,25 @@ let ConsoleLogger = class ConsoleLogger {
             breakLength: Infinity,
         });
     }
-    stringifyMessage(message, logLevel) {
+    /**
+     * Resolves a message passed as a function: a class resolves to its name,
+     * any other function is called (lazy message) and its result re-resolved.
+     */
+    resolveMessage(message) {
         if (isFunction(message)) {
             const messageAsStr = Function.prototype.toString.call(message);
             const isClass = messageAsStr.startsWith('class ');
             if (isClass) {
                 // If the message is a class, we will display the class name.
-                return this.stringifyMessage(message.name, logLevel);
+                return message.name;
             }
             // If the message is a non-class function, call it and re-resolve its value.
-            return this.stringifyMessage(message(), logLevel);
+            return this.resolveMessage(message());
         }
+        return message;
+    }
+    stringifyMessage(message, logLevel) {
+        message = this.resolveMessage(message);
         if (typeof message === 'string') {
             return this.colorize(message, logLevel);
         }
@@ -333,6 +464,43 @@ let ConsoleLogger = class ConsoleLogger {
         }
         return inspectOptions;
     }
+    /**
+     * Serializes a JSON log object without ever throwing: circular references
+     * are replaced with "[Circular]", and a value that cannot be serialized
+     * (e.g. a throwing `toJSON()`) makes the whole record fall back to `inspect`.
+     */
+    stringifyJsonLogObject(logObject) {
+        const replacer = this.stringifyReplacer;
+        // Objects on the path from the root to the value being serialized.
+        const ancestors = [];
+        try {
+            return JSON.stringify(logObject, function (key, value) {
+                value = replacer.call(this, key, value);
+                if (typeof value !== 'object' || value === null) {
+                    return value;
+                }
+                // `this` is the object holding `key`, so everything above it on the
+                // stack belongs to an already-finished sibling branch.
+                while (ancestors.length > 0 &&
+                    ancestors[ancestors.length - 1] !== this) {
+                    ancestors.pop();
+                }
+                if (ancestors.includes(value)) {
+                    return '[Circular]';
+                }
+                ancestors.push(value);
+                return value;
+            });
+        }
+        catch {
+            return inspect(logObject, {
+                ...this.inspectOptions,
+                colors: false,
+                compact: true,
+                breakLength: Infinity,
+            });
+        }
+    }
     stringifyReplacer(key, value) {
         // Mimic util.inspect behavior for JSON logger with compact on and colors off
         if (typeof value === 'bigint') {

package/services/log-levels.constant.d.ts

@@ -0,0 +1,5 @@
+export declare const LOG_LEVELS: ["verbose", "debug", "log", "warn", "error", "fatal"];
+/**
+ * @publicApi
+ */
+export type LogLevel = (typeof LOG_LEVELS)[number];

package/services/log-levels.constant.js

@@ -0,0 +1,8 @@
+export const LOG_LEVELS = [
+    'verbose',
+    'debug',
+    'log',
+    'warn',
+    'error',
+    'fatal',
+];

package/services/logger.service.d.ts

@@ -1,8 +1,5 @@
-export declare const LOG_LEVELS: ["verbose", "debug", "log", "warn", "error", "fatal"];
-/**
- * @publicApi
- */
-export type LogLevel = (typeof LOG_LEVELS)[number];
+import { LogLevel } from './log-levels.constant.js';
+export { LOG_LEVELS, type LogLevel } from './log-levels.constant.js';
 /**
  * @publicApi
  */
@@ -60,6 +57,10 @@ export declare class Logger implements LoggerService {
     protected static logLevels?: LogLevel[];
     private static isBufferAttached;
     protected localInstanceRef?: LoggerService;
+    /**
+     * The `Logger.logLevels` the local instance was last configured with.
+     */
+    private localInstanceLogLevels?;
     private static WrapBuffer;
     constructor();
     constructor(context: string);
@@ -149,4 +150,3 @@ export declare class Logger implements LoggerService {
     static isLevelEnabled(level: LogLevel): boolean;
     private registerLocalInstanceRef;
 }
-export {};

package/services/logger.service.js

@@ -4,14 +4,9 @@ import { Injectable, Optional } from '../decorators/core/index.js';
 import { isObject } from '../utils/shared.utils.js';
 import { ConsoleLogger } from './console-logger.service.js';
 import { isLogLevelEnabled } from './utils/index.js';
-export const LOG_LEVELS = [
-    'verbose',
-    'debug',
-    'log',
-    'warn',
-    'error',
-    'fatal',
-];
+// Defined in a separate file so that the log level utilities don't import
+// this file (and, through it, "ConsoleLogger") at runtime.
+export { LOG_LEVELS } from './log-levels.constant.js';
 const DEFAULT_LOGGER = new ConsoleLogger();
 const dateTimeFormatter = new Intl.DateTimeFormat(undefined, {
     year: 'numeric',
@@ -33,6 +28,10 @@ let Logger = class Logger {
     static logLevels;
     static isBufferAttached;
     localInstanceRef;
+    /**
+     * The `Logger.logLevels` the local instance was last configured with.
+     */
+    localInstanceLogLevels;
     static WrapBuffer = (target, propertyKey, descriptor) => {
         const originalFn = descriptor.value;
         descriptor.value = function (...args) {
@@ -159,13 +158,30 @@ let Logger = class Logger {
         }
     }
     static isLevelEnabled(level) {
+        const instance = Logger_1.staticInstanceRef;
+        if (!instance) {
+            // Logging is disabled ("logger: false").
+            return false;
+        }
+        if (instance instanceof ConsoleLogger) {
+            return instance.isLevelEnabled(level);
+        }
         const logLevels = Logger_1.logLevels;
-        return isLogLevelEnabled(level, logLevels);
+        // Without explicitly set levels, every level is enabled.
+        return logLevels ? isLogLevelEnabled(level, logLevels) : true;
     }
     registerLocalInstanceRef() {
         if (this.localInstanceRef) {
+            // Levels set at runtime (e.g. "app.useLogger(['error'])") must also
+            // reach instances created before the change.
+            if (Logger_1.logLevels &&
+                this.localInstanceLogLevels !== Logger_1.logLevels) {
+                this.localInstanceRef.setLogLevels?.(Logger_1.logLevels);
+                this.localInstanceLogLevels = Logger_1.logLevels;
+            }
             return this.localInstanceRef;
         }
+        this.localInstanceLogLevels = Logger_1.logLevels;
         this.localInstanceRef = new ConsoleLogger(this.context, {
             timestamp: this.options?.timestamp,
             logLevels: Logger_1.logLevels,

package/services/utils/filter-log-levels.util.d.ts

@@ -1,4 +1,4 @@
-import { LogLevel } from '../logger.service.js';
+import { LogLevel } from '../log-levels.constant.js';
 /**
  * @publicApi
  */

package/services/utils/filter-log-levels.util.js

@@ -1,4 +1,4 @@
-import { LOG_LEVELS } from '../logger.service.js';
+import { LOG_LEVELS } from '../log-levels.constant.js';
 import { isLogLevel } from './is-log-level.util.js';
 /**
  * @publicApi

package/services/utils/get-env-log-levels.util.d.ts

@@ -0,0 +1,14 @@
+import { LogLevel } from '../log-levels.constant.js';
+/**
+ * The environment variable that sets the default log levels of `ConsoleLogger`.
+ */
+export declare const LOG_LEVEL_ENV_VAR = "NEST_LOG_LEVEL";
+/**
+ * Reads the log levels from the `NEST_LOG_LEVEL` environment variable.
+ * Accepts the formats of `filterLogLevels`: a level (`warn`, that level and
+ * above), a list (`warn,error`) or a threshold (`>=warn`, `>debug`).
+ *
+ * @returns `undefined` when the variable is unset or empty, `false` when its
+ * value can't be parsed, the log levels otherwise.
+ */
+export declare function getEnvLogLevels(): LogLevel[] | false | undefined;

package/services/utils/get-env-log-levels.util.js

@@ -0,0 +1,25 @@
+import { filterLogLevels } from './filter-log-levels.util.js';
+import { isLogLevel } from './is-log-level.util.js';
+/**
+ * The environment variable that sets the default log levels of `ConsoleLogger`.
+ */
+export const LOG_LEVEL_ENV_VAR = 'NEST_LOG_LEVEL';
+/**
+ * Reads the log levels from the `NEST_LOG_LEVEL` environment variable.
+ * Accepts the formats of `filterLogLevels`: a level (`warn`, that level and
+ * above), a list (`warn,error`) or a threshold (`>=warn`, `>debug`).
+ *
+ * @returns `undefined` when the variable is unset or empty, `false` when its
+ * value can't be parsed, the log levels otherwise.
+ */
+export function getEnvLogLevels() {
+    const value = process.env[LOG_LEVEL_ENV_VAR]?.replaceAll(' ', '');
+    if (!value) {
+        return undefined;
+    }
+    const threshold = /^>=?(.*)$/.exec(value.toLowerCase());
+    const isValid = threshold
+        ? isLogLevel(threshold[1])
+        : value.toLowerCase().split(',').every(isLogLevel);
+    return isValid ? filterLogLevels(value) : false;
+}

package/services/utils/is-log-level.util.d.ts

@@ -1,4 +1,4 @@
-import { LogLevel } from '../logger.service.js';
+import { LogLevel } from '../log-levels.constant.js';
 /**
  * @publicApi
  */

package/services/utils/is-log-level.util.js

@@ -1,4 +1,4 @@
-import { LOG_LEVELS } from '../logger.service.js';
+import { LOG_LEVELS } from '../log-levels.constant.js';
 /**
  * @publicApi
  */

package/services/utils/redact.util.d.ts

@@ -0,0 +1,27 @@
+export declare const DEFAULT_REDACT_CENSOR = "[REDACTED]";
+/**
+ * Returns a copy of the value in which the properties matching the paths are
+ * replaced with the censor, or the value itself when nothing matched.
+ */
+export type Redactor = (value: unknown) => unknown;
+/**
+ * Creates a function that masks properties of logged values.
+ *
+ * - A path without dots (`password`) matches a property with that name at any
+ *   depth.
+ * - A dotted path (`user.password`) matches when the last keys leading to a
+ *   property are those keys, at any depth. Array indices are not keys, so
+ *   `users.password` also matches `{ users: [{ password }] }`.
+ * - Keys are compared case-insensitively.
+ *
+ * Plain objects, arrays, class instances, errors (including `cause` and
+ * `AggregateError#errors`), `Map`s (string keys) and `Set`s are traversed.
+ * Only the objects on the way to a redacted property are copied; the rest is
+ * returned as is, and the input is never mutated. A circular reference is
+ * replaced with `"[Circular]"` (so the objects on the cycle are copied too). If
+ * the value can't be traversed (for example, a getter throws), the whole value
+ * is replaced with the censor.
+ *
+ * @returns `undefined` when there is nothing to redact.
+ */
+export declare function createRedactor(paths: string[], censor?: string): Redactor | undefined;

package/services/utils/redact.util.js

@@ -0,0 +1,225 @@
+export const DEFAULT_REDACT_CENSOR = '[REDACTED]';
+const CIRCULAR = '[Circular]';
+/**
+ * Creates a function that masks properties of logged values.
+ *
+ * - A path without dots (`password`) matches a property with that name at any
+ *   depth.
+ * - A dotted path (`user.password`) matches when the last keys leading to a
+ *   property are those keys, at any depth. Array indices are not keys, so
+ *   `users.password` also matches `{ users: [{ password }] }`.
+ * - Keys are compared case-insensitively.
+ *
+ * Plain objects, arrays, class instances, errors (including `cause` and
+ * `AggregateError#errors`), `Map`s (string keys) and `Set`s are traversed.
+ * Only the objects on the way to a redacted property are copied; the rest is
+ * returned as is, and the input is never mutated. A circular reference is
+ * replaced with `"[Circular]"` (so the objects on the cycle are copied too). If
+ * the value can't be traversed (for example, a getter throws), the whole value
+ * is replaced with the censor.
+ *
+ * @returns `undefined` when there is nothing to redact.
+ */
+export function createRedactor(paths, censor = DEFAULT_REDACT_CENSOR) {
+    const keys = new Set();
+    const dottedPaths = [];
+    for (const path of paths) {
+        const segments = path
+            .split('.')
+            .map(segment => segment.trim().toLowerCase())
+            .filter(segment => segment.length > 0);
+        if (segments.length === 1) {
+            keys.add(segments[0]);
+        }
+        else if (segments.length > 1) {
+            dottedPaths.push(segments);
+        }
+    }
+    if (keys.size === 0 && dottedPaths.length === 0) {
+        return undefined;
+    }
+    return (value) => {
+        // Lower-cased keys from the root to the value being visited.
+        const path = [];
+        // Objects on that path, to detect circular references.
+        const ancestors = [];
+        const isRedacted = (key) => {
+            if (keys.has(key)) {
+                return true;
+            }
+            return dottedPaths.some(segments => {
+                const last = segments.length - 1;
+                if (segments[last] !== key || last > path.length) {
+                    return false;
+                }
+                for (let i = 1; i <= last; i++) {
+                    if (segments[last - i] !== path[path.length - i]) {
+                        return false;
+                    }
+                }
+                return true;
+            });
+        };
+        // Each call starts with a fresh "path" and "ancestors", so an exception
+        // (caught below) doesn't need to restore them.
+        const visitProperty = (key, propertyValue) => {
+            const normalizedKey = key.toLowerCase();
+            if (isRedacted(normalizedKey)) {
+                return censor;
+            }
+            if (typeof propertyValue !== 'object' || propertyValue === null) {
+                return propertyValue;
+            }
+            path.push(normalizedKey);
+            const redacted = visit(propertyValue);
+            path.pop();
+            return redacted;
+        };
+        const visit = (current) => {
+            if (typeof current !== 'object' || current === null) {
+                return current;
+            }
+            if (ancestors.includes(current)) {
+                return CIRCULAR;
+            }
+            let redacted;
+            ancestors.push(current);
+            if (Array.isArray(current)) {
+                redacted = redactArray(current);
+            }
+            else if (Object.getPrototypeOf(current) === Object.prototype) {
+                redacted = redactObject(current);
+            }
+            else if (current instanceof Map) {
+                redacted = redactMap(current);
+            }
+            else if (current instanceof Set) {
+                redacted = redactSet(current);
+            }
+            else if (isOpaque(current)) {
+                redacted = current;
+            }
+            else {
+                redacted = redactObject(current);
+            }
+            ancestors.pop();
+            return redacted;
+        };
+        const redactArray = (array) => {
+            let copy;
+            for (let i = 0; i < array.length; i++) {
+                const redacted = visit(array[i]);
+                if (!Object.is(redacted, array[i])) {
+                    copy ??= array.slice();
+                    copy[i] = redacted;
+                }
+            }
+            return copy ?? array;
+        };
+        const redactMap = (map) => {
+            let changed = false;
+            const entries = [];
+            for (const [key, entryValue] of map) {
+                const redacted = typeof key === 'string'
+                    ? visitProperty(key, entryValue)
+                    : visit(entryValue);
+                changed ||= !Object.is(redacted, entryValue);
+                entries.push([key, redacted]);
+            }
+            return changed ? new Map(entries) : map;
+        };
+        const redactSet = (set) => {
+            let changed = false;
+            const values = [];
+            for (const setValue of set) {
+                const redacted = visit(setValue);
+                changed ||= !Object.is(redacted, setValue);
+                values.push(redacted);
+            }
+            return changed ? new Set(values) : set;
+        };
+        const redactObject = (object) => {
+            const source = object;
+            const keysToVisit = Object.keys(source);
+            if (object instanceof Error) {
+                // Non-enumerable, but part of the logged error.
+                for (const key of ['cause', 'errors']) {
+                    if (Object.prototype.hasOwnProperty.call(object, key) &&
+                        !keysToVisit.includes(key)) {
+                        keysToVisit.push(key);
+                    }
+                }
+            }
+            let changes;
+            for (const key of keysToVisit) {
+                const original = source[key];
+                const redacted = visitProperty(key, original);
+                if (!Object.is(redacted, original)) {
+                    changes ??= new Map();
+                    changes.set(key, redacted);
+                }
+            }
+            if (!changes) {
+                return object;
+            }
+            if (Object.getPrototypeOf(object) === Object.prototype) {
+                const copy = { ...source };
+                for (const [key, redacted] of changes) {
+                    if (key === '__proto__') {
+                        // An assignment would call the "__proto__" setter.
+                        Object.defineProperty(copy, key, {
+                            value: redacted,
+                            enumerable: true,
+                            writable: true,
+                            configurable: true,
+                        });
+                    }
+                    else {
+                        copy[key] = redacted;
+                    }
+                }
+                return copy;
+            }
+            // Keeps the prototype and the other properties (including the
+            // non-enumerable "message" and "stack" of errors).
+            const descriptors = Object.getOwnPropertyDescriptors(object);
+            if (object instanceof Error && descriptors.stack?.get) {
+                // V8 may define "stack" as an accessor that only works on the
+                // original error.
+                descriptors.stack = {
+                    value: object.stack,
+                    enumerable: descriptors.stack.enumerable,
+                    writable: true,
+                    configurable: true,
+                };
+            }
+            for (const [key, redacted] of changes) {
+                descriptors[key] = {
+                    value: redacted,
+                    enumerable: descriptors[key].enumerable,
+                    writable: true,
+                    configurable: true,
+                };
+            }
+            return Object.create(Object.getPrototypeOf(object), descriptors);
+        };
+        try {
+            return visit(value);
+        }
+        catch {
+            return censor;
+        }
+    };
+}
+/**
+ * Objects whose content isn't made of properties worth traversing.
+ */
+function isOpaque(value) {
+    return (value instanceof Date ||
+        value instanceof RegExp ||
+        value instanceof Promise ||
+        value instanceof WeakMap ||
+        value instanceof WeakSet ||
+        value instanceof ArrayBuffer ||
+        ArrayBuffer.isView(value));
+}