@lenne.tech/nest-server 11.27.0 → 11.27.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/FRAMEWORK-API.md
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
# @lenne.tech/nest-server — Framework API Reference
|
|
2
2
|
|
|
3
|
-
> Auto-generated from source code on 2026-06-
|
|
3
|
+
> Auto-generated from source code on 2026-06-22 (v11.27.2)
|
|
4
4
|
> File: `FRAMEWORK-API.md` — compact, machine-readable API surface for Claude Code
|
|
5
5
|
|
|
6
6
|
## CoreModule.forRoot()
|
|
@@ -0,0 +1,256 @@
|
|
|
1
|
+
# Migration Guide: 11.27.0 → 11.27.1
|
|
2
|
+
|
|
3
|
+
## Overview
|
|
4
|
+
|
|
5
|
+
| Category | Details |
|
|
6
|
+
|----------|---------|
|
|
7
|
+
| **Breaking Changes** | None |
|
|
8
|
+
| **New Features** | None |
|
|
9
|
+
| **Bugfixes** | None |
|
|
10
|
+
| **Security** | Security maintenance pass: 7 new / refreshed `pnpm.overrides` entries forcing transitive dependencies onto CVE-patched versions — `ws`, `form-data`, `vite`, `hono`, `nodemailer`, `multer`, `js-yaml`. All framework-internal; consumer projects only need to mirror the entries if their own `pnpm audit` flags the same advisories. |
|
|
11
|
+
| **Tooling** | New `scripts/check.mjs` — a quiet, report-driven wrapper around the `check` pipeline (audit + format + lint + test + build + server-start). Replaces the inline shell chain in `pnpm run check`; the original chain is preserved as `pnpm run check:raw`. Repo-internal only — not shipped via npm. |
|
|
12
|
+
| **Migration Effort** | 0 minutes (automatic) — `pnpm update` is enough. ~5 minutes optional to mirror the security overrides into your own project's `package.json`. |
|
|
13
|
+
|
|
14
|
+
This is a **maintenance release**. No source-code or config changes are required.
|
|
15
|
+
The bulk of the work hardens transitive-dependency advisories that `pnpm audit`
|
|
16
|
+
flagged on the framework after `npm`/`pnpm` resolved newer CVEs against 11.27.0's
|
|
17
|
+
lockfile. A new in-repo wrapper around the `check` script trims runtime noise and
|
|
18
|
+
auto-fixes every fixable format/lint finding.
|
|
19
|
+
|
|
20
|
+
---
|
|
21
|
+
|
|
22
|
+
## Quick Migration
|
|
23
|
+
|
|
24
|
+
No code changes required.
|
|
25
|
+
|
|
26
|
+
```bash
|
|
27
|
+
# Update package
|
|
28
|
+
pnpm add @lenne.tech/nest-server@11.27.1
|
|
29
|
+
|
|
30
|
+
# Verify build
|
|
31
|
+
pnpm run build
|
|
32
|
+
|
|
33
|
+
# Run tests
|
|
34
|
+
pnpm test
|
|
35
|
+
|
|
36
|
+
# Re-run audit to confirm advisories cleared
|
|
37
|
+
pnpm audit
|
|
38
|
+
```
|
|
39
|
+
|
|
40
|
+
---
|
|
41
|
+
|
|
42
|
+
## What's New in 11.27.1
|
|
43
|
+
|
|
44
|
+
### 1. Security overrides refreshed
|
|
45
|
+
|
|
46
|
+
`pnpm.overrides` in this repo's `package.json` gained / refreshed seven entries.
|
|
47
|
+
Every override targets a **fixed version** (per `.claude/rules/package-management.md`
|
|
48
|
+
override rules — no `>=` / `^` / `~`):
|
|
49
|
+
|
|
50
|
+
| Package | Override | Advisory | Pulled in via |
|
|
51
|
+
|---------|----------|----------|---------------|
|
|
52
|
+
| `ws` (8.x) | `8.21.0` (was `8.20.1`) | Memory exhaustion DoS + uninitialized memory disclosure (`GHSA-96hv-2xvq-fx4p`) | `@nestjs/graphql` |
|
|
53
|
+
| `ws` (7.x) | `7.5.11` *(new)* | Memory exhaustion DoS in `ws@7.x` (`GHSA-96hv-2xvq-fx4p`) | `@nestjs/graphql > subscriptions-transport-ws` |
|
|
54
|
+
| `form-data` | `4.0.6` *(new)* | CRLF injection via unescaped multipart field names / filenames (`GHSA-hmw2-7cc7-3qxx`) | `@getbrevo/brevo > axios`, `node-mailjet > axios` |
|
|
55
|
+
| `vite` | `8.0.16` *(new)* | `fs.deny` bypass on Windows alternate paths + file-read CVEs | `better-auth > vitest` |
|
|
56
|
+
| `hono` | `4.12.25` *(new)* | Prototype pollution, `bodyLimit` / `Vary` bypass, JWT `NumericDate` (multiple CVEs `<4.12.25`) | `@nestjs/terminus > prisma > @prisma/dev` |
|
|
57
|
+
| `nodemailer` | `9.0.1` *(new)* | Email / header-injection CVEs `<9.0.1` | direct dependency (forced major bump for transitive consumers — see note) |
|
|
58
|
+
| `multer` | `2.2.0` *(new)* | Unhandled multipart errors / DoS `<2.2.0` | `@nestjs/platform-express` |
|
|
59
|
+
| `js-yaml` | `4.2.0` *(new)* | Special-character handling / prototype pollution (patched in `4.2.0`; `4.1.2` was never published) | `@nestjs/swagger` |
|
|
60
|
+
|
|
61
|
+
> **Why an override per package and not a direct upgrade?**
|
|
62
|
+
> `pnpm.overrides` is the safest single-knob fix when the vulnerable copy comes
|
|
63
|
+
> in transitively. Every entry uses the same `Pkg@<patched>` → `<patched>` selector
|
|
64
|
+
> as the existing overrides, keeps the fix scoped to the vulnerable range, and is
|
|
65
|
+
> documented in the `//overrides` comment block above the actual entries.
|
|
66
|
+
|
|
67
|
+
#### Heads-up: `nodemailer` and `multer`
|
|
68
|
+
|
|
69
|
+
The framework's **direct** `dependencies` still pin `nodemailer@8.0.8` and
|
|
70
|
+
`multer@2.1.1` to preserve the historical lockfile reference. The overrides
|
|
71
|
+
above force these onto `9.0.1` / `2.2.0` at install time. The framework's own
|
|
72
|
+
`EmailService` and `multer*` file-helper usage was verified against the bumped
|
|
73
|
+
versions — no API surface changes affect framework code.
|
|
74
|
+
|
|
75
|
+
If your project uses `nodemailer` or `multer` directly:
|
|
76
|
+
|
|
77
|
+
- **`nodemailer 8 → 9`** is a major bump (Node.js `>=18`, dropped legacy
|
|
78
|
+
`OAuth2` client constructor, `customCustomHeaders` / `customHeaders` casing
|
|
79
|
+
cleanup, `BURL`/`stub-transport` removals). Skim the
|
|
80
|
+
[nodemailer 9 release notes](https://github.com/nodemailer/nodemailer/releases)
|
|
81
|
+
if you call `nodemailer.createTransport` / `sendMail` from project code.
|
|
82
|
+
- **`multer 1 → 2`** has been on `2.x` for two releases now; the `2.1 → 2.2`
|
|
83
|
+
jump is a patch-grade bump and needs no action.
|
|
84
|
+
|
|
85
|
+
#### Why your project may still see CVEs after upgrading
|
|
86
|
+
|
|
87
|
+
`pnpm.overrides` is **scoped to the package that declares it**. The framework's
|
|
88
|
+
overrides do **not** propagate into consumer projects' lockfiles. If your own
|
|
89
|
+
`pnpm audit` flags `ws / form-data / vite / hono / nodemailer / multer / js-yaml`,
|
|
90
|
+
mirror the entries into your project's `package.json`:
|
|
91
|
+
|
|
92
|
+
```jsonc
|
|
93
|
+
// projects/api/package.json (or your project's package.json)
|
|
94
|
+
"pnpm": {
|
|
95
|
+
"//overrides": {
|
|
96
|
+
"ws@>=8.0.0 <8.21.0": "Security: Memory exhaustion DoS + uninitialized memory disclosure (GHSA-96hv-2xvq-fx4p) - transitive via @nestjs/graphql",
|
|
97
|
+
"ws@>=7.0.0 <7.5.11": "Security: Memory exhaustion DoS in ws 7.x (GHSA-96hv-2xvq-fx4p) - transitive via @nestjs/graphql>subscriptions-transport-ws",
|
|
98
|
+
"form-data@<4.0.6": "Security: CRLF injection (GHSA-hmw2-7cc7-3qxx) - transitive via axios",
|
|
99
|
+
"vite@>=8.0.0 <8.0.16": "Security: fs.deny bypass on Windows + file-read CVEs - transitive via better-auth>vitest",
|
|
100
|
+
"hono@<4.12.25": "Security: multiple CVEs <4.12.25 - transitive via @nestjs/terminus>prisma>@prisma/dev",
|
|
101
|
+
"nodemailer@<9.0.1": "Security: email/header injection CVEs <9.0.1",
|
|
102
|
+
"multer@<2.2.0": "Security: unhandled multipart errors / DoS <2.2.0 - transitive via @nestjs/platform-express",
|
|
103
|
+
"js-yaml@<4.2.0": "Security: special-character handling / prototype pollution (patched 4.2.0; 4.1.2 unpublished) - transitive via @nestjs/swagger"
|
|
104
|
+
},
|
|
105
|
+
"overrides": {
|
|
106
|
+
"ws@>=8.0.0 <8.21.0": "8.21.0",
|
|
107
|
+
"ws@>=7.0.0 <7.5.11": "7.5.11",
|
|
108
|
+
"form-data@<4.0.6": "4.0.6",
|
|
109
|
+
"vite@>=8.0.0 <8.0.16": "8.0.16",
|
|
110
|
+
"hono@<4.12.25": "4.12.25",
|
|
111
|
+
"nodemailer@<9.0.1": "9.0.1",
|
|
112
|
+
"multer@<2.2.0": "2.2.0",
|
|
113
|
+
"js-yaml@<4.2.0": "4.2.0"
|
|
114
|
+
}
|
|
115
|
+
}
|
|
116
|
+
```
|
|
117
|
+
|
|
118
|
+
After adding, run `pnpm install && pnpm audit && pnpm test`.
|
|
119
|
+
|
|
120
|
+
### 2. New `scripts/check.mjs` wrapper (repo-internal)
|
|
121
|
+
|
|
122
|
+
The `check` script now points at a Node-based wrapper:
|
|
123
|
+
|
|
124
|
+
```diff
|
|
125
|
+
- "check": "pnpm audit && pnpm run format:check && pnpm run lint && pnpm test && pnpm run build && bash scripts/check-server-start.sh",
|
|
126
|
+
+ "check": "node scripts/check.mjs",
|
|
127
|
+
+ "check:raw": "pnpm audit && pnpm run format:check && pnpm run lint && pnpm test && pnpm run build && bash scripts/check-server-start.sh",
|
|
128
|
+
```
|
|
129
|
+
|
|
130
|
+
What changes when you run `pnpm run check`:
|
|
131
|
+
|
|
132
|
+
- **One status line per running step** instead of streaming every tool's output
|
|
133
|
+
— the spinner shows the currently running step and elapsed time.
|
|
134
|
+
- **Aborts on the first failing step** and prints the captured reason instead
|
|
135
|
+
of letting later steps spam the log.
|
|
136
|
+
- **Auto-fixes every fixable finding** — `oxfmt` writes, `oxlint --fix` runs in
|
|
137
|
+
place. Only non-fixable lint errors remain and fail the run. Bypass with
|
|
138
|
+
`--no-fix` for a read-only gate.
|
|
139
|
+
- **Final report** lists every executed step with key metrics (audit
|
|
140
|
+
vulnerabilities per severity, Vitest passed/failed/files, lint
|
|
141
|
+
errors/warnings, etc.).
|
|
142
|
+
|
|
143
|
+
Available flags:
|
|
144
|
+
|
|
145
|
+
| Flag | Purpose |
|
|
146
|
+
|------|---------|
|
|
147
|
+
| `--verbose` / `-v` | Stream the full tool output live (deep debugging) |
|
|
148
|
+
| `--sequential` / `--seq` | Run projects one after another (default: parallel) |
|
|
149
|
+
| `--no-fix` | Read-only gate — do not auto-fix format / lint |
|
|
150
|
+
| `--project=<substr>` | Restrict to matching workspace projects (repeatable) |
|
|
151
|
+
|
|
152
|
+
The original raw command remains available as `pnpm run check:raw` if you
|
|
153
|
+
need the previous behaviour (CI logs, exact ordering, no auto-fix).
|
|
154
|
+
|
|
155
|
+
> **Consumer impact:** None. `scripts/` is **not** part of the npm package's
|
|
156
|
+
> `files` list (see `package.json` `files`: `dist`, `src`, `bin`, `CLAUDE.md`,
|
|
157
|
+
> `FRAMEWORK-API.md`, `.claude/rules`, `docs`, `migration-guides`). The wrapper
|
|
158
|
+
> is repo-internal tooling for framework development — but you may copy it
|
|
159
|
+
> verbatim into your own project's `scripts/` directory if you want the same
|
|
160
|
+
> behaviour for your `check` pipeline. It auto-discovers each workspace
|
|
161
|
+
> project's `check` chain via `package.json`, so no further adaptation is
|
|
162
|
+
> needed.
|
|
163
|
+
|
|
164
|
+
---
|
|
165
|
+
|
|
166
|
+
## Breaking Changes
|
|
167
|
+
|
|
168
|
+
None.
|
|
169
|
+
|
|
170
|
+
---
|
|
171
|
+
|
|
172
|
+
## Compatibility Notes
|
|
173
|
+
|
|
174
|
+
- **`IServerOptions` / `CoreModule.forRoot()`:** unchanged.
|
|
175
|
+
- **`FRAMEWORK-API.md`:** regenerated for the new version stamp only — no API
|
|
176
|
+
surface differences vs. 11.27.0.
|
|
177
|
+
- **`config.env.ts`:** no new fields, no deprecations.
|
|
178
|
+
- **Vendor-mode consumers:** nothing to sync. The override changes live in
|
|
179
|
+
`package.json` at the **repo root**, which is excluded from
|
|
180
|
+
`convertCloneToVendored`. The `scripts/check.mjs` wrapper also lives outside
|
|
181
|
+
`src/core/`, so vendor projects keep their existing `check` setup.
|
|
182
|
+
- **Custom controllers / resolvers extending Core* classes:** no impact —
|
|
183
|
+
no Core method signatures changed.
|
|
184
|
+
- **Tests:** all 1751 framework tests pass against the new overrides.
|
|
185
|
+
|
|
186
|
+
---
|
|
187
|
+
|
|
188
|
+
## Verifying
|
|
189
|
+
|
|
190
|
+
```bash
|
|
191
|
+
# 1. Update + install
|
|
192
|
+
pnpm add @lenne.tech/nest-server@11.27.1
|
|
193
|
+
pnpm install
|
|
194
|
+
|
|
195
|
+
# 2. Confirm advisories cleared (or only show unaffected residuals)
|
|
196
|
+
pnpm audit
|
|
197
|
+
|
|
198
|
+
# 3. Smoke-test the new check wrapper (only relevant in this repo)
|
|
199
|
+
pnpm run check # quiet, report-driven
|
|
200
|
+
pnpm run check:raw # original chain, full noise
|
|
201
|
+
|
|
202
|
+
# 4. Tests + build
|
|
203
|
+
pnpm test
|
|
204
|
+
pnpm run build
|
|
205
|
+
```
|
|
206
|
+
|
|
207
|
+
---
|
|
208
|
+
|
|
209
|
+
## Troubleshooting
|
|
210
|
+
|
|
211
|
+
### `pnpm audit` in my consumer project still reports `ws` / `vite` / `nodemailer` ...
|
|
212
|
+
|
|
213
|
+
Expected — `pnpm.overrides` is scoped to the declaring package. Mirror the
|
|
214
|
+
entries listed under [Why your project may still see CVEs after upgrading](#why-your-project-may-still-see-cves-after-upgrading).
|
|
215
|
+
|
|
216
|
+
### Tests fail with `nodemailer.createTransport is not a function` or similar
|
|
217
|
+
|
|
218
|
+
You're calling a `nodemailer` API removed in v9 (the override forces `9.0.1`).
|
|
219
|
+
Check the [v9 release notes](https://github.com/nodemailer/nodemailer/releases)
|
|
220
|
+
and update the call site, or pin your project to `nodemailer@8.x` explicitly
|
|
221
|
+
(*not* recommended — keeps the CVE open).
|
|
222
|
+
|
|
223
|
+
### `pnpm run check` hangs or doesn't show output
|
|
224
|
+
|
|
225
|
+
The wrapper hides per-step output by design. Re-run with `--verbose`:
|
|
226
|
+
|
|
227
|
+
```bash
|
|
228
|
+
pnpm run check -- --verbose
|
|
229
|
+
# or
|
|
230
|
+
node scripts/check.mjs --verbose
|
|
231
|
+
```
|
|
232
|
+
|
|
233
|
+
To restore the previous behaviour entirely, use `pnpm run check:raw`.
|
|
234
|
+
|
|
235
|
+
### I want the old `check` behaviour back in CI
|
|
236
|
+
|
|
237
|
+
Switch your CI job to invoke `pnpm run check:raw` — it is an exact preservation
|
|
238
|
+
of the inline chain that was on `check` in 11.27.0.
|
|
239
|
+
|
|
240
|
+
---
|
|
241
|
+
|
|
242
|
+
## Module Documentation
|
|
243
|
+
|
|
244
|
+
No module documentation changes in this release. Reference documentation:
|
|
245
|
+
|
|
246
|
+
- **Package management rules:** [`.claude/rules/package-management.md`](../.claude/rules/package-management.md) — fixed-version overrides only, never ranges
|
|
247
|
+
- **Framework compatibility:** [`.claude/rules/framework-compatibility.md`](../.claude/rules/framework-compatibility.md) — what ships in the npm package
|
|
248
|
+
|
|
249
|
+
---
|
|
250
|
+
|
|
251
|
+
## References
|
|
252
|
+
|
|
253
|
+
- [Migration Guide 11.26.3 → 11.27.0](./11.26.3-to-11.27.0.md) — Previous release (build identity in health check)
|
|
254
|
+
- [nest-server-starter](https://github.com/lenneTech/nest-server-starter) — reference implementation
|
|
255
|
+
- [nodemailer v9 release notes](https://github.com/nodemailer/nodemailer/releases) — for projects calling `nodemailer` directly
|
|
256
|
+
- [multer v2 changelog](https://github.com/expressjs/multer/releases) — for projects calling `multer` directly
|
|
@@ -0,0 +1,191 @@
|
|
|
1
|
+
# Migration Guide: 11.27.1 → 11.27.2
|
|
2
|
+
|
|
3
|
+
## Overview
|
|
4
|
+
|
|
5
|
+
| Category | Details |
|
|
6
|
+
|----------|---------|
|
|
7
|
+
| **Breaking Changes** | None |
|
|
8
|
+
| **New Features** | None |
|
|
9
|
+
| **Bugfixes** | `scripts/check.mjs` no longer hides devDependency vulnerabilities for library packages. The audit step now runs the chain's own audit command verbatim (same scope / `--prod` flag / `--audit-level`) instead of a hardcoded `pnpm audit --prod --json`. Repo-internal tooling — no consumer impact. |
|
|
10
|
+
| **Security** | 3 new / refreshed `pnpm.overrides` entries — `undici` range widened to `<7.28.0`, plus new entries for `piscina <4.9.3` and `@babel/core <7.29.6`. All transitive via the build/test toolchain. |
|
|
11
|
+
| **Migration Effort** | 0 minutes (automatic) — `pnpm update` is enough. ~2 minutes optional to mirror the security overrides into your own project's `package.json`. |
|
|
12
|
+
|
|
13
|
+
This is a **maintenance release**. No source-code or config changes are required.
|
|
14
|
+
|
|
15
|
+
---
|
|
16
|
+
|
|
17
|
+
## Quick Migration
|
|
18
|
+
|
|
19
|
+
No code changes required.
|
|
20
|
+
|
|
21
|
+
```bash
|
|
22
|
+
# Update package
|
|
23
|
+
pnpm add @lenne.tech/nest-server@11.27.2
|
|
24
|
+
|
|
25
|
+
# Verify build
|
|
26
|
+
pnpm run build
|
|
27
|
+
|
|
28
|
+
# Run tests
|
|
29
|
+
pnpm test
|
|
30
|
+
|
|
31
|
+
# Re-run audit to confirm advisories cleared
|
|
32
|
+
pnpm audit
|
|
33
|
+
```
|
|
34
|
+
|
|
35
|
+
---
|
|
36
|
+
|
|
37
|
+
## What's New in 11.27.2
|
|
38
|
+
|
|
39
|
+
### 1. Security overrides refreshed
|
|
40
|
+
|
|
41
|
+
`pnpm.overrides` in this repo's `package.json` gained two new entries and
|
|
42
|
+
widened one existing range. Every override targets a **fixed version** (per
|
|
43
|
+
`.claude/rules/package-management.md` override rules — no `>=` / `^` / `~`):
|
|
44
|
+
|
|
45
|
+
| Package | Override | Advisory | Pulled in via |
|
|
46
|
+
|---------|----------|----------|---------------|
|
|
47
|
+
| `undici` | `7.28.0` (was `7.25.0`) | Various CVEs `<7.28.0` (incl. high) | `@compodoc/compodoc > cheerio`, `better-auth` |
|
|
48
|
+
| `piscina` | `4.9.3` *(new)* | High CVE in `piscina <4.9.3` | build/test toolchain |
|
|
49
|
+
| `@babel/core` | `7.29.6` *(new)* | `@babel/core <7.29.6` advisory | `@compodoc/compodoc > @babel/preset-env` |
|
|
50
|
+
|
|
51
|
+
#### Why your project may still see CVEs after upgrading
|
|
52
|
+
|
|
53
|
+
`pnpm.overrides` is **scoped to the package that declares it**. The framework's
|
|
54
|
+
overrides do **not** propagate into consumer projects' lockfiles. If your own
|
|
55
|
+
`pnpm audit` flags `undici / piscina / @babel/core`, mirror the entries into
|
|
56
|
+
your project's `package.json`:
|
|
57
|
+
|
|
58
|
+
```jsonc
|
|
59
|
+
// projects/api/package.json (or your project's package.json)
|
|
60
|
+
"pnpm": {
|
|
61
|
+
"//overrides": {
|
|
62
|
+
"undici@>=7.0.0 <7.28.0": "Security: various CVEs <7.28.0 (incl. high) - transitive via @compodoc/compodoc>cheerio + better-auth",
|
|
63
|
+
"piscina@<4.9.3": "Security: high CVE in piscina <4.9.3 - transitive via the build/test toolchain",
|
|
64
|
+
"@babel/core@<7.29.6": "Security: @babel/core <7.29.6 advisory - transitive via @compodoc/compodoc>@babel/preset-env"
|
|
65
|
+
},
|
|
66
|
+
"overrides": {
|
|
67
|
+
"undici@>=7.0.0 <7.28.0": "7.28.0",
|
|
68
|
+
"piscina@<4.9.3": "4.9.3",
|
|
69
|
+
"@babel/core@<7.29.6": "7.29.6"
|
|
70
|
+
}
|
|
71
|
+
}
|
|
72
|
+
```
|
|
73
|
+
|
|
74
|
+
After adding, run `pnpm install && pnpm audit && pnpm test`.
|
|
75
|
+
|
|
76
|
+
### 2. `scripts/check.mjs` audit step is now chain-faithful
|
|
77
|
+
|
|
78
|
+
The audit step in the `check.mjs` wrapper previously hardcoded
|
|
79
|
+
`pnpm audit --prod --json` with a separate gate level extracted from the
|
|
80
|
+
chain's `--audit-level` flag. For library packages where dev-only dependencies
|
|
81
|
+
ship vulnerabilities, this **masked the vulnerabilities** that a bare
|
|
82
|
+
`pnpm audit` would have surfaced — because `--prod` excludes devDependencies.
|
|
83
|
+
|
|
84
|
+
The audit step now runs the **chain's own audit command verbatim** (same scope,
|
|
85
|
+
same `--prod` flag if any, same `--audit-level` if any), only appending `--json`
|
|
86
|
+
for the structured counts. The blocking gate becomes the command's own exit
|
|
87
|
+
code, so `check` blocks **precisely when a bare `<auditCmd>` would** —
|
|
88
|
+
never with a narrower scope than the chain.
|
|
89
|
+
|
|
90
|
+
What this means in practice:
|
|
91
|
+
|
|
92
|
+
- **Library packages** (this repo, plus any consumer that runs `pnpm audit` —
|
|
93
|
+
not `pnpm audit --prod` — in their `check` script) now see devDep vulns
|
|
94
|
+
surface in the wrapper run, matching what their bare audit command reports.
|
|
95
|
+
- **Application packages** that use `pnpm audit --prod` keep the exact same
|
|
96
|
+
behaviour — their scope is unchanged.
|
|
97
|
+
- The status header now shows the **full audit command** (e.g.
|
|
98
|
+
`audit: pnpm audit --audit-level=high`) instead of just `audit gate: high`,
|
|
99
|
+
so the gate is auditable at a glance.
|
|
100
|
+
|
|
101
|
+
If your `check` chain has no audit step at all, the wrapper now correctly
|
|
102
|
+
**skips** the audit phase (previously it ran a hardcoded one anyway).
|
|
103
|
+
|
|
104
|
+
> **Consumer impact:** None unless you copied `scripts/check.mjs` into your
|
|
105
|
+
> own project from 11.27.1. If you did, the upgrade fixes a silent gap in your
|
|
106
|
+
> security gate — review the next `pnpm run check` for previously hidden
|
|
107
|
+
> devDep findings.
|
|
108
|
+
|
|
109
|
+
---
|
|
110
|
+
|
|
111
|
+
## Breaking Changes
|
|
112
|
+
|
|
113
|
+
None.
|
|
114
|
+
|
|
115
|
+
---
|
|
116
|
+
|
|
117
|
+
## Compatibility Notes
|
|
118
|
+
|
|
119
|
+
- **`IServerOptions` / `CoreModule.forRoot()`:** unchanged.
|
|
120
|
+
- **`FRAMEWORK-API.md`:** regenerated for the new version stamp only — no API
|
|
121
|
+
surface differences vs. 11.27.1.
|
|
122
|
+
- **`config.env.ts`:** no new fields, no deprecations.
|
|
123
|
+
- **Vendor-mode consumers:** nothing to sync. The override changes live in
|
|
124
|
+
`package.json` at the **repo root**, which is excluded from
|
|
125
|
+
`convertCloneToVendored`. The `scripts/check.mjs` wrapper also lives outside
|
|
126
|
+
`src/core/`, so vendor projects keep their existing `check` setup.
|
|
127
|
+
- **Custom controllers / resolvers extending Core* classes:** no impact —
|
|
128
|
+
no Core method signatures changed.
|
|
129
|
+
|
|
130
|
+
---
|
|
131
|
+
|
|
132
|
+
## Verifying
|
|
133
|
+
|
|
134
|
+
```bash
|
|
135
|
+
# 1. Update + install
|
|
136
|
+
pnpm add @lenne.tech/nest-server@11.27.2
|
|
137
|
+
pnpm install
|
|
138
|
+
|
|
139
|
+
# 2. Confirm advisories cleared (or only show unaffected residuals)
|
|
140
|
+
pnpm audit
|
|
141
|
+
|
|
142
|
+
# 3. Smoke-test the new check wrapper (only relevant in this repo)
|
|
143
|
+
pnpm run check # quiet, report-driven — audit now mirrors the chain
|
|
144
|
+
pnpm run check:raw # original chain, full noise
|
|
145
|
+
|
|
146
|
+
# 4. Tests + build
|
|
147
|
+
pnpm test
|
|
148
|
+
pnpm run build
|
|
149
|
+
```
|
|
150
|
+
|
|
151
|
+
---
|
|
152
|
+
|
|
153
|
+
## Troubleshooting
|
|
154
|
+
|
|
155
|
+
### `pnpm audit` in my consumer project still reports `undici` / `piscina` / `@babel/core`
|
|
156
|
+
|
|
157
|
+
Expected — `pnpm.overrides` is scoped to the declaring package. Mirror the
|
|
158
|
+
entries listed under [Why your project may still see CVEs after upgrading](#why-your-project-may-still-see-cves-after-upgrading).
|
|
159
|
+
|
|
160
|
+
### `pnpm run check` suddenly reports more vulnerabilities than 11.27.1
|
|
161
|
+
|
|
162
|
+
Working as intended — the previous wrapper silently narrowed the audit to
|
|
163
|
+
`--prod` scope. The new wrapper mirrors your chain's own audit command, so
|
|
164
|
+
devDep vulnerabilities a bare `pnpm audit` would have flagged now appear in
|
|
165
|
+
the wrapper run. Either:
|
|
166
|
+
|
|
167
|
+
- Mirror the relevant overrides from this guide (recommended), or
|
|
168
|
+
- Narrow your chain's audit command to `pnpm audit --prod --audit-level=high`
|
|
169
|
+
if devDep vulns are out of scope for your gate.
|
|
170
|
+
|
|
171
|
+
### Audit step is skipped — "audit: none" in the header
|
|
172
|
+
|
|
173
|
+
Your `check` chain has no audit step. Add `pnpm audit` (or
|
|
174
|
+
`pnpm audit --prod --audit-level=high`) at the start of the chain in
|
|
175
|
+
`package.json` to re-enable the gate.
|
|
176
|
+
|
|
177
|
+
---
|
|
178
|
+
|
|
179
|
+
## Module Documentation
|
|
180
|
+
|
|
181
|
+
No module documentation changes in this release. Reference documentation:
|
|
182
|
+
|
|
183
|
+
- **Package management rules:** [`.claude/rules/package-management.md`](../.claude/rules/package-management.md) — fixed-version overrides only, never ranges
|
|
184
|
+
- **Framework compatibility:** [`.claude/rules/framework-compatibility.md`](../.claude/rules/framework-compatibility.md) — what ships in the npm package
|
|
185
|
+
|
|
186
|
+
---
|
|
187
|
+
|
|
188
|
+
## References
|
|
189
|
+
|
|
190
|
+
- [Migration Guide 11.27.0 → 11.27.1](./11.27.0-to-11.27.1.md) — Previous release (initial `scripts/check.mjs` introduction + 7 security overrides)
|
|
191
|
+
- [nest-server-starter](https://github.com/lenneTech/nest-server-starter) — reference implementation
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@lenne.tech/nest-server",
|
|
3
|
-
"version": "11.27.
|
|
3
|
+
"version": "11.27.2",
|
|
4
4
|
"description": "Modern, fast, powerful Node.js web framework in TypeScript based on Nest with a GraphQL API and a connection to MongoDB (or other databases).",
|
|
5
5
|
"keywords": [
|
|
6
6
|
"node",
|
|
@@ -22,7 +22,8 @@
|
|
|
22
22
|
"build:pack": "pnpm pack && echo 'use file:/ROOT_PATH_TO_TGZ_FILE to integrate the package'",
|
|
23
23
|
"build:dev": "pnpm run build",
|
|
24
24
|
"c": "pnpm run check",
|
|
25
|
-
"check": "
|
|
25
|
+
"check": "node scripts/check.mjs",
|
|
26
|
+
"check:raw": "pnpm audit && pnpm run format:check && pnpm run lint && pnpm test && pnpm run build && bash scripts/check-server-start.sh",
|
|
26
27
|
"check:fix": "pnpm install && pnpm audit --fix && pnpm run format && pnpm run lint:fix && pnpm test && pnpm run build && bash scripts/check-server-start.sh",
|
|
27
28
|
"check:naf": "pnpm install && pnpm run format && pnpm run lint:fix && pnpm test && pnpm run build && bash scripts/check-server-start.sh",
|
|
28
29
|
"cf": "pnpm run check:fix",
|
|
@@ -191,7 +192,9 @@
|
|
|
191
192
|
"minimatch@>=10.0.0 <10.2.5": "Security: RegExp DoS - transitive via @nestjs/apollo>ts-morph>@ts-morph/common and nodemon",
|
|
192
193
|
"ajv@<6.14.0": "Security: prototype pollution - transitive via @getbrevo/brevo>rewire>eslint",
|
|
193
194
|
"ajv@>=7.0.0-alpha.0 <8.18.0": "Security: prototype pollution - transitive via @nestjs/cli>@angular-devkit",
|
|
194
|
-
"undici@>=7.0.0 <7.
|
|
195
|
+
"undici@>=7.0.0 <7.28.0": "Security: various CVEs <7.28.0 (incl. high) - transitive via @compodoc/compodoc>cheerio + better-auth",
|
|
196
|
+
"piscina@<4.9.3": "Security: high CVE in piscina <4.9.3 - transitive via the build/test toolchain",
|
|
197
|
+
"@babel/core@<7.29.6": "Security: @babel/core <7.29.6 advisory - transitive via @compodoc/compodoc>@babel/preset-env",
|
|
195
198
|
"handlebars@>=4.0.0 <4.7.9": "Security: prototype pollution (GHSA-q42p-pg8m-cqh6) - transitive via @compodoc/compodoc",
|
|
196
199
|
"brace-expansion@<1.1.13": "Security: RegExp DoS - transitive via eslint>minimatch",
|
|
197
200
|
"brace-expansion@>=4.0.0 <5.0.6": "Security: RegExp DoS - Large numeric range defeats brace expansion (GHSA-jxxr-4gwj-5jf2) - transitive via nodemon>minimatch and @ts-morph/common>minimatch and @compodoc/compodoc>glob>minimatch",
|
|
@@ -200,13 +203,20 @@
|
|
|
200
203
|
"path-to-regexp@>=8.0.0 <8.4.2": "Security: ReDoS (GHSA-rhx6-c78j-4q9w) - transitive via express>router",
|
|
201
204
|
"kysely@>=0.26.0 <0.28.17": "Security: JSON-path traversal injection via unsanitized input (SQL injection) - transitive via better-auth>@better-auth/passkey>@better-auth/core",
|
|
202
205
|
"@protobufjs/utf8@<=1.1.0": "Security: overlong UTF-8 decoding - transitive via @apollo/server>@apollo/usage-reporting-protobuf",
|
|
203
|
-
"ws@>=8.0.0 <8.
|
|
206
|
+
"ws@>=8.0.0 <8.21.0": "Security: Memory exhaustion DoS + uninitialized memory disclosure (GHSA-96hv-2xvq-fx4p) - transitive via @nestjs/graphql",
|
|
207
|
+
"ws@>=7.0.0 <7.5.11": "Security: Memory exhaustion DoS in ws 7.x (GHSA-96hv-2xvq-fx4p) - transitive via @nestjs/graphql>subscriptions-transport-ws",
|
|
204
208
|
"qs@>=6.11.1 <=6.15.1": "Security: remotely triggerable DoS in qs.stringify with comma-format arrays (GHSA-q8mj-m7cp-5q26) - transitive via @compodoc/compodoc>body-parser",
|
|
205
209
|
"lodash@>=4.0.0 <4.18.0": "Security: CVE in lodash@4.17.x - transitive via @nestjs/graphql. 4.18.1 is the latest patched version",
|
|
206
210
|
"defu@<=6.1.6": "Security: prototype pollution via __proto__ key - transitive via better-auth",
|
|
207
211
|
"follow-redirects@<=1.15.11": "Security: Custom Authentication Headers leak on cross-domain redirect (GHSA-r4q5-vmmm-2653) - transitive via axios>@getbrevo/brevo and axios>node-mailjet",
|
|
208
212
|
"uuid@<14.0.0": "Security: Missing buffer bounds check in v3/v5/v6 (GHSA-w5hq-g745-h8pq) - transitive via @compodoc/compodoc and @compodoc/compodoc>@compodoc/live-server>http-auth",
|
|
209
|
-
"postcss@<8.5.10": "Security: XSS via Unescaped </style> in CSS Stringify Output (GHSA-qx2v-qp2m-jg93) - transitive via vite. Remove when vite ships with postcss>=8.5.10"
|
|
213
|
+
"postcss@<8.5.10": "Security: XSS via Unescaped </style> in CSS Stringify Output (GHSA-qx2v-qp2m-jg93) - transitive via vite. Remove when vite ships with postcss>=8.5.10",
|
|
214
|
+
"form-data@<4.0.6": "Security: CRLF injection via unescaped multipart field names/filenames (GHSA-hmw2-7cc7-3qxx) - transitive via @getbrevo/brevo>axios and node-mailjet>axios",
|
|
215
|
+
"vite@>=8.0.0 <8.0.16": "Security: fs.deny bypass on Windows alternate paths + file read CVEs - transitive via better-auth>vitest",
|
|
216
|
+
"hono@<4.12.25": "Security: multiple CVEs <4.12.25 (prototype pollution, bodyLimit/Vary bypass, JWT NumericDate) - transitive via @nestjs/terminus>prisma>@prisma/dev",
|
|
217
|
+
"nodemailer@<9.0.1": "Security: email/header injection CVEs <9.0.1 - direct dependency",
|
|
218
|
+
"multer@<2.2.0": "Security: unhandled multipart errors / DoS <2.2.0 - transitive via @nestjs/platform-express",
|
|
219
|
+
"js-yaml@<4.2.0": "Security: special-character handling / prototype pollution (patched in 4.2.0; 4.1.2 was never published) - transitive via @nestjs/swagger"
|
|
210
220
|
},
|
|
211
221
|
"overrides": {
|
|
212
222
|
"axios@<1.16.0": "1.16.0",
|
|
@@ -217,7 +227,9 @@
|
|
|
217
227
|
"minimatch@>=10.0.0 <10.2.5": "10.2.5",
|
|
218
228
|
"ajv@<6.14.0": "6.14.0",
|
|
219
229
|
"ajv@>=7.0.0-alpha.0 <8.18.0": "8.18.0",
|
|
220
|
-
"undici@>=7.0.0 <7.
|
|
230
|
+
"undici@>=7.0.0 <7.28.0": "7.28.0",
|
|
231
|
+
"piscina@<4.9.3": "4.9.3",
|
|
232
|
+
"@babel/core@<7.29.6": "7.29.6",
|
|
221
233
|
"handlebars@>=4.0.0 <4.7.9": "4.7.9",
|
|
222
234
|
"brace-expansion@<1.1.13": "1.1.13",
|
|
223
235
|
"brace-expansion@>=4.0.0 <5.0.6": "5.0.6",
|
|
@@ -226,14 +238,21 @@
|
|
|
226
238
|
"path-to-regexp@>=8.0.0 <8.4.2": "8.4.2",
|
|
227
239
|
"kysely@>=0.26.0 <0.28.17": "0.28.17",
|
|
228
240
|
"@protobufjs/utf8@<=1.1.0": "1.1.1",
|
|
229
|
-
"ws@>=8.0.0 <8.
|
|
241
|
+
"ws@>=8.0.0 <8.21.0": "8.21.0",
|
|
242
|
+
"ws@>=7.0.0 <7.5.11": "7.5.11",
|
|
230
243
|
"qs@>=6.11.1 <=6.15.1": "6.15.2",
|
|
231
244
|
"lodash@>=4.0.0 <4.18.0": "4.18.1",
|
|
232
245
|
"defu@<=6.1.6": "6.1.7",
|
|
233
246
|
"follow-redirects@<=1.15.11": "1.16.0",
|
|
234
247
|
"uuid@<14.0.0": "14.0.0",
|
|
235
248
|
"postcss@<8.5.10": "8.5.12",
|
|
236
|
-
"esbuild@>=0.17.0 <0.28.1": "0.28.1"
|
|
249
|
+
"esbuild@>=0.17.0 <0.28.1": "0.28.1",
|
|
250
|
+
"form-data@<4.0.6": "4.0.6",
|
|
251
|
+
"vite@>=8.0.0 <8.0.16": "8.0.16",
|
|
252
|
+
"hono@<4.12.25": "4.12.25",
|
|
253
|
+
"nodemailer@<9.0.1": "9.0.1",
|
|
254
|
+
"multer@<2.2.0": "2.2.0",
|
|
255
|
+
"js-yaml@<4.2.0": "4.2.0"
|
|
237
256
|
},
|
|
238
257
|
"//peerDependencyRules": "allowedVersions: deps lag behind our newer majors (graphql-upload wants @types/express@^4, the deprecated apollo playground plugin wants @apollo/server@^4) — both work with our v5. ignoreMissing: browser-only vis-network peers pulled in transitively via yuml-diagram (server-side UML generation never renders, so these are not needed).",
|
|
239
258
|
"peerDependencyRules": {
|