@lenne.tech/nest-server 11.41.1 → 11.41.2

package/.claude/rules/package-management.md

@@ -169,7 +169,7 @@ Two ordering rules, both enforced by the contract test:
 Package overrides live in the `overrides:` section of **`pnpm-workspace.yaml`** (they moved out of `package.json`'s `pnpm.overrides` in the pnpm 11 upgrade). They force transitive dependencies to a security-patched version.
 
 **Keep the set minimal.** On the pnpm 11 upgrade the list was pruned from 36 to the 9 then still
-load-bearing (it has since grown back to 17 as new advisories landed) — an override is only necessary if removing it lets the package resolve back INTO its vulnerable range (verify with a with/without lockfile diff; `pnpm audit` is the arbiter). Each surviving entry carries its CVE rationale as a comment. Remove an entry once its parent dependency ships a fixed version.
+load-bearing (it has since grown back to 18 as new advisories landed) — an override is only necessary if removing it lets the package resolve back INTO its vulnerable range (verify with a with/without lockfile diff; `pnpm audit` is the arbiter). Each surviving entry carries its CVE rationale as a comment. Remove an entry once its parent dependency ships a fixed version.
 
 ### Rule: Override Targets MUST Be Fixed Versions
 

package/FRAMEWORK-API.md

@@ -1,6 +1,6 @@
 # @lenne.tech/nest-server — Framework API Reference
 
-> Auto-generated from source code as of 2026-09-08 (v11.41.1)
+> Auto-generated from source code as of 2026-09-15 (v11.41.2)
 > File: `FRAMEWORK-API.md` — compact, machine-readable API surface for Claude Code
 
 ## CoreModule.forRoot()

package/docs/security-overrides.md

@@ -11,17 +11,18 @@ A green `pnpm audit` inside the framework repo says nothing about your tree.
 
 ## What this concretely means for you
 
-The framework pulls in two transitive packages that resolve to a **vulnerable** version unless you
+The framework pulls in three transitive packages that resolve to a **vulnerable** version unless you
 override them yourself:
 
 | Package | Advisory | Why it cannot resolve forward on its own |
 |---------|----------|------------------------------------------|
 | `ws` | [GHSA-96hv-2xvq-fx4p](https://github.com/advisories/GHSA-96hv-2xvq-fx4p) — high: memory-exhaustion DoS + uninitialized memory disclosure. Patched `>=8.21.0` | `@nestjs/graphql` declares `"ws": "8.20.1"` — an **exact pin**, not a caret. No amount of updating moves it |
 | `js-yaml` | [GHSA-pm4m-ph32-ghv5](https://github.com/advisories/GHSA-pm4m-ph32-ghv5) — high: exponential parsing time in flow collections (DoS). Patched `>=5.2.2` | `@nestjs/swagger` declares `"js-yaml": "5.2.1"` — an **exact pin**, the same shape as the `ws` case. It cannot resolve forward |
+| `multer` | [GHSA-wc9g-mqfw-jrwm](https://github.com/advisories/GHSA-wc9g-mqfw-jrwm), [GHSA-535w-7cp7-47q4](https://github.com/advisories/GHSA-535w-7cp7-47q4), [GHSA-qfvm-cv95-jqjf](https://github.com/advisories/GHSA-qfvm-cv95-jqjf) — high: DoS via crafted multipart input; [GHSA-qvfw-j98x-7q72](https://github.com/advisories/GHSA-qvfw-j98x-7q72) — low: file size limit bypass. Patched `>=2.3.0` | `@nestjs/platform-express` declares `"multer": "2.2.0"` — an **exact pin** in every 11.2.x. The framework's own `multer: 2.3.0` dependency does not move it: you get both copies, and FileInterceptor uses the vulnerable one |
 
 `@nestjs/graphql` is a plain `dependencies` entry, so `ws` is installed even when you run with
-`graphQl: false`. `@nestjs/swagger` is likewise a plain `dependencies` entry. Neither is optional in
-practice.
+`graphQl: false`. `@nestjs/swagger` and `@nestjs/platform-express` are likewise plain `dependencies`
+entries. None of them is optional in practice.
 
 ## The fix
 
@@ -40,6 +41,11 @@ overrides:
   # Same shape as the ws entry: an exact pin cannot resolve forward.
   # Remove once @nestjs/swagger stops pinning it.
   'js-yaml@>=5.0.0 <5.2.2': '5.2.2'
+
+  # @nestjs/platform-express exact-pins multer@2.2.0 (GHSA-wc9g-mqfw-jrwm and three more, patched >=2.3.0).
+  # Keep the target in LOCKSTEP with the multer version @lenne.tech/nest-server declares.
+  # Remove once @nestjs/platform-express requests >=2.3.0 itself.
+  'multer@>=2.0.0 <2.3.0': '2.3.0'
 ```
 
 ### Retired: `@hono/node-server` (removed 2026-08-22, nest-server 11.36.1)

package/migration-guides/11.41.1-to-11.41.2.md

@@ -0,0 +1,75 @@
+# Migration Guide: 11.41.1 → 11.41.2
+
+## Overview
+
+| Category | Effort | Applies to |
+|----------|--------|-----------|
+| **Security** | none | `nodemailer` 9.0.5 → 9.1.1 (four advisories, one high) arrives through this package's `dependencies` |
+| **Security** | one override, ~2 min | `multer` 2.2.0 → 2.3.0 (three high, one low): **your project has to add an override** — see below |
+| Tooling | none | Framework repo only: `oxlint --fix-suggestions` removed, `.gitattributes`, non-blocking Windows CI |
+
+No API change and no configuration change. The multer fix does enforce file size limits that crafted uploads could previously bypass.
+
+## Quick Migration
+
+```bash
+pnpm update @lenne.tech/nest-server
+```
+
+```bash
+# Is a vulnerable multer still in your tree? Anything below 2.3.0 means: add the override below.
+pnpm why multer
+pnpm audit
+```
+
+## Security: multer needs an override in your project
+
+`@lenne.tech/nest-server` now declares `multer: 2.3.0`, but that does not reach the copy that
+uploads actually go through. `@nestjs/platform-express` declares `"multer": "2.2.0"` as an **exact
+pin** in every 11.2.x, so your tree ends up with both versions, and `FileInterceptor` uses 2.2.0.
+The advisories ([GHSA-wc9g-mqfw-jrwm](https://github.com/advisories/GHSA-wc9g-mqfw-jrwm),
+[GHSA-535w-7cp7-47q4](https://github.com/advisories/GHSA-535w-7cp7-47q4),
+[GHSA-qfvm-cv95-jqjf](https://github.com/advisories/GHSA-qfvm-cv95-jqjf) — DoS via crafted multipart
+input; [GHSA-qvfw-j98x-7q72](https://github.com/advisories/GHSA-qvfw-j98x-7q72) — file size limit
+bypass) are in that copy.
+
+Overrides declared in this package do not travel with it (see
+[docs/security-overrides.md](../docs/security-overrides.md)). Add the entry to your project's
+`pnpm-workspace.yaml` (pnpm 11+; `pnpm.overrides` in `package.json` on pnpm 10 and earlier):
+
+```yaml
+overrides:
+  # @nestjs/platform-express exact-pins multer@2.2.0 (GHSA-wc9g-mqfw-jrwm and three more, patched >=2.3.0).
+  # Keep the target in LOCKSTEP with the multer version @lenne.tech/nest-server declares.
+  # Remove once @nestjs/platform-express requests >=2.3.0 itself.
+  'multer@>=2.0.0 <2.3.0': '2.3.0'
+```
+
+If your project declares `multer` directly, raise it to `2.3.0` as well, so the tree carries exactly
+one copy.
+
+```bash
+pnpm install
+pnpm why multer   # expect a single multer@2.3.0
+```
+
+Projects created from nest-server-starter after 2026-09-15 already carry both.
+
+Vendor-mode projects adopt the `multer` and `nodemailer` bumps through the core update instead of
+`pnpm update`. The override is needed there all the same, because `@nestjs/platform-express` is
+installed from npm in both modes.
+
+## Under the hood
+
+Changes to the framework repository that do not reach consumers:
+
+- `oxlint --fix-suggestions` is gone from `lint:fix`, the pre-commit `lint-staged` config and
+  `scripts/check.mjs`. oxlint's `no-console` suggestion deletes the whole call, so a commit or a
+  `pnpm run check:fix` silently removed `console.log` statements from `src/` and `tests/`.
+- The `hono` and `js-yaml` 4.x overrides were raised to 4.13.7 and 4.3.2. Both are inert: their
+  consumers reach the fixed versions on their own ranges. Nothing to mirror.
+- `.gitattributes` pins LF line endings, so a Windows checkout no longer turns
+  `docker-entrypoint.sh`, the `Dockerfile` and `bin/migrate.js` into CRLF.
+- `extras/sync-version.ts` stages the lockfile with `execFileSync`, so a repository path containing
+  a space works.
+- A non-blocking Windows CI job (`windows.yml`) runs install, build and unit tests.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lenne.tech/nest-server",
-  "version": "11.41.1",
+  "version": "11.41.2",
   "description": "Modern, fast, powerful Node.js web framework in TypeScript based on Nest with a GraphQL API and a connection to MongoDB (or other databases).",
   "keywords": [
     "node",
@@ -39,7 +39,7 @@
     "format": "oxfmt --write src/ scripts/",
     "format:check": "oxfmt --check src/ scripts/",
     "lint": "oxlint --ignore-path .oxlintignore src/ tests/ scripts/",
-    "lint:fix": "oxlint --fix --fix-suggestions --ignore-path .oxlintignore src/ tests/ scripts/",
+    "lint:fix": "oxlint --fix --ignore-path .oxlintignore src/ tests/ scripts/",
     "prepack": "pnpm run prestart:prod",
     "prepublishOnly": "pnpm run lint && pnpm run test:ci",
     "prestart:prod": "pnpm run build",
@@ -127,9 +127,9 @@
     "lodash": "4.18.1",
     "mongodb": "7.5.0",
     "mongoose": "9.9.3",
-    "multer": "2.2.0",
+    "multer": "2.3.0",
     "node-mailjet": "6.0.11",
-    "nodemailer": "9.0.5",
+    "nodemailer": "9.1.1",
     "passport": "0.7.0",
     "passport-jwt": "4.0.1",
     "reflect-metadata": "0.2.2",