@lenne.tech/nest-server 11.41.1 → 11.41.3

package/.claude/rules/package-management.md

@@ -169,7 +169,7 @@ Two ordering rules, both enforced by the contract test:
 Package overrides live in the `overrides:` section of **`pnpm-workspace.yaml`** (they moved out of `package.json`'s `pnpm.overrides` in the pnpm 11 upgrade). They force transitive dependencies to a security-patched version.
 
 **Keep the set minimal.** On the pnpm 11 upgrade the list was pruned from 36 to the 9 then still
-load-bearing (it has since grown back to 17 as new advisories landed) — an override is only necessary if removing it lets the package resolve back INTO its vulnerable range (verify with a with/without lockfile diff; `pnpm audit` is the arbiter). Each surviving entry carries its CVE rationale as a comment. Remove an entry once its parent dependency ships a fixed version.
+load-bearing (it has since grown back to 18 as new advisories landed) — an override is only necessary if removing it lets the package resolve back INTO its vulnerable range (verify with a with/without lockfile diff; `pnpm audit` is the arbiter). Each surviving entry carries its CVE rationale as a comment. Remove an entry once its parent dependency ships a fixed version.
 
 ### Rule: Override Targets MUST Be Fixed Versions
 

package/.claude/rules/testing.md

@@ -266,7 +266,7 @@ pnpm run check:mutations -- --id=<id>       # one mutation
 pnpm run check:mutations -- --list          # the registry, without running anything
 pnpm run check:mutations -- --allow-dirty   # when the fix and its evidence share a working tree
 pnpm run check:mutations -- --jobs=4        # N mutations at a time (default: 2, or 4 on >=12 cores)
-pnpm run check:mutations -- --no-infra      # only the 66 that need no MongoDB
+pnpm run check:mutations -- --no-infra      # only the 67 that need no MongoDB
 pnpm run check:mutations -- --since=<ref>   # only mutations touching files changed since <ref>
 ```
 
@@ -285,7 +285,7 @@ when the registry, a vitest config or a setup file changed, since those can move
 commit, so selective re-running would save ~10 minutes a release. The price is a cache that has to
 model each spec's full dependency closure correctly, and getting that wrong produces a stale PASS
 for a test that has since gone vacuous — exactly what the gate is there to prevent. Bad trade
-at 112 mutations — past the threshold this paragraph has carried since the gate was written,
+at 113 mutations — past the threshold this paragraph has carried since the gate was written,
 now reached exactly. The full run is approaching half an hour. **The re-evaluation is due now**: the
 next person to add a mutation should decide whether selective re-running has become worth its
 failure mode (a stale PASS for a test that has since gone vacuous), not bump this number again.
@@ -329,7 +329,7 @@ exactly the environment where the answer matters.
 
 Worth knowing before optimising the wrong thing: the specs behind all 46 e2e mutations add up to
 **~40 seconds**. The step takes ~740s. The remaining ~700s is paying vitest's startup — process
-spawn, transform, module graph, mongod connect, DB create and drop — once per mutation, 112 times.
+spawn, transform, module graph, mongod connect, DB create and drop — once per mutation, 113 times.
 That work is largely single-threaded I/O and barely scales with cores: the full registry measures
 **744s on a 12-core laptop and 777s on a 4-vCPU CI runner**.
 

package/FRAMEWORK-API.md

@@ -1,6 +1,6 @@
 # @lenne.tech/nest-server — Framework API Reference
 
-> Auto-generated from source code as of 2026-09-08 (v11.41.1)
+> Auto-generated from source code as of 2026-09-21 (v11.41.3)
 > File: `FRAMEWORK-API.md` — compact, machine-readable API surface for Claude Code
 
 ## CoreModule.forRoot()

package/docs/security-overrides.md

@@ -11,17 +11,18 @@ A green `pnpm audit` inside the framework repo says nothing about your tree.
 
 ## What this concretely means for you
 
-The framework pulls in two transitive packages that resolve to a **vulnerable** version unless you
+The framework pulls in three transitive packages that resolve to a **vulnerable** version unless you
 override them yourself:
 
 | Package | Advisory | Why it cannot resolve forward on its own |
 |---------|----------|------------------------------------------|
 | `ws` | [GHSA-96hv-2xvq-fx4p](https://github.com/advisories/GHSA-96hv-2xvq-fx4p) — high: memory-exhaustion DoS + uninitialized memory disclosure. Patched `>=8.21.0` | `@nestjs/graphql` declares `"ws": "8.20.1"` — an **exact pin**, not a caret. No amount of updating moves it |
 | `js-yaml` | [GHSA-pm4m-ph32-ghv5](https://github.com/advisories/GHSA-pm4m-ph32-ghv5) — high: exponential parsing time in flow collections (DoS). Patched `>=5.2.2` | `@nestjs/swagger` declares `"js-yaml": "5.2.1"` — an **exact pin**, the same shape as the `ws` case. It cannot resolve forward |
+| `multer` | [GHSA-wc9g-mqfw-jrwm](https://github.com/advisories/GHSA-wc9g-mqfw-jrwm), [GHSA-535w-7cp7-47q4](https://github.com/advisories/GHSA-535w-7cp7-47q4), [GHSA-qfvm-cv95-jqjf](https://github.com/advisories/GHSA-qfvm-cv95-jqjf) — high: DoS via crafted multipart input; [GHSA-qvfw-j98x-7q72](https://github.com/advisories/GHSA-qvfw-j98x-7q72) — low: file size limit bypass. Patched `>=2.3.0` | `@nestjs/platform-express` declares `"multer": "2.2.0"` — an **exact pin** in every 11.2.x. The framework's own `multer: 2.3.0` dependency does not move it: you get both copies, and FileInterceptor uses the vulnerable one |
 
 `@nestjs/graphql` is a plain `dependencies` entry, so `ws` is installed even when you run with
-`graphQl: false`. `@nestjs/swagger` is likewise a plain `dependencies` entry. Neither is optional in
-practice.
+`graphQl: false`. `@nestjs/swagger` and `@nestjs/platform-express` are likewise plain `dependencies`
+entries. None of them is optional in practice.
 
 ## The fix
 
@@ -40,6 +41,11 @@ overrides:
   # Same shape as the ws entry: an exact pin cannot resolve forward.
   # Remove once @nestjs/swagger stops pinning it.
   'js-yaml@>=5.0.0 <5.2.2': '5.2.2'
+
+  # @nestjs/platform-express exact-pins multer@2.2.0 (GHSA-wc9g-mqfw-jrwm and three more, patched >=2.3.0).
+  # Keep the target in LOCKSTEP with the multer version @lenne.tech/nest-server declares.
+  # Remove once @nestjs/platform-express requests >=2.3.0 itself.
+  'multer@>=2.0.0 <2.3.0': '2.3.0'
 ```
 
 ### Retired: `@hono/node-server` (removed 2026-08-22, nest-server 11.36.1)

package/migration-guides/11.41.1-to-11.41.2.md

@@ -0,0 +1,75 @@
+# Migration Guide: 11.41.1 → 11.41.2
+
+## Overview
+
+| Category | Effort | Applies to |
+|----------|--------|-----------|
+| **Security** | none | `nodemailer` 9.0.5 → 9.1.1 (four advisories, one high) arrives through this package's `dependencies` |
+| **Security** | one override, ~2 min | `multer` 2.2.0 → 2.3.0 (three high, one low): **your project has to add an override** — see below |
+| Tooling | none | Framework repo only: `oxlint --fix-suggestions` removed, `.gitattributes`, non-blocking Windows CI |
+
+No API change and no configuration change. The multer fix does enforce file size limits that crafted uploads could previously bypass.
+
+## Quick Migration
+
+```bash
+pnpm update @lenne.tech/nest-server
+```
+
+```bash
+# Is a vulnerable multer still in your tree? Anything below 2.3.0 means: add the override below.
+pnpm why multer
+pnpm audit
+```
+
+## Security: multer needs an override in your project
+
+`@lenne.tech/nest-server` now declares `multer: 2.3.0`, but that does not reach the copy that
+uploads actually go through. `@nestjs/platform-express` declares `"multer": "2.2.0"` as an **exact
+pin** in every 11.2.x, so your tree ends up with both versions, and `FileInterceptor` uses 2.2.0.
+The advisories ([GHSA-wc9g-mqfw-jrwm](https://github.com/advisories/GHSA-wc9g-mqfw-jrwm),
+[GHSA-535w-7cp7-47q4](https://github.com/advisories/GHSA-535w-7cp7-47q4),
+[GHSA-qfvm-cv95-jqjf](https://github.com/advisories/GHSA-qfvm-cv95-jqjf) — DoS via crafted multipart
+input; [GHSA-qvfw-j98x-7q72](https://github.com/advisories/GHSA-qvfw-j98x-7q72) — file size limit
+bypass) are in that copy.
+
+Overrides declared in this package do not travel with it (see
+[docs/security-overrides.md](../docs/security-overrides.md)). Add the entry to your project's
+`pnpm-workspace.yaml` (pnpm 11+; `pnpm.overrides` in `package.json` on pnpm 10 and earlier):
+
+```yaml
+overrides:
+  # @nestjs/platform-express exact-pins multer@2.2.0 (GHSA-wc9g-mqfw-jrwm and three more, patched >=2.3.0).
+  # Keep the target in LOCKSTEP with the multer version @lenne.tech/nest-server declares.
+  # Remove once @nestjs/platform-express requests >=2.3.0 itself.
+  'multer@>=2.0.0 <2.3.0': '2.3.0'
+```
+
+If your project declares `multer` directly, raise it to `2.3.0` as well, so the tree carries exactly
+one copy.
+
+```bash
+pnpm install
+pnpm why multer   # expect a single multer@2.3.0
+```
+
+Projects created from nest-server-starter after 2026-09-15 already carry both.
+
+Vendor-mode projects adopt the `multer` and `nodemailer` bumps through the core update instead of
+`pnpm update`. The override is needed there all the same, because `@nestjs/platform-express` is
+installed from npm in both modes.
+
+## Under the hood
+
+Changes to the framework repository that do not reach consumers:
+
+- `oxlint --fix-suggestions` is gone from `lint:fix`, the pre-commit `lint-staged` config and
+  `scripts/check.mjs`. oxlint's `no-console` suggestion deletes the whole call, so a commit or a
+  `pnpm run check:fix` silently removed `console.log` statements from `src/` and `tests/`.
+- The `hono` and `js-yaml` 4.x overrides were raised to 4.13.7 and 4.3.2. Both are inert: their
+  consumers reach the fixed versions on their own ranges. Nothing to mirror.
+- `.gitattributes` pins LF line endings, so a Windows checkout no longer turns
+  `docker-entrypoint.sh`, the `Dockerfile` and `bin/migrate.js` into CRLF.
+- `extras/sync-version.ts` stages the lockfile with `execFileSync`, so a repository path containing
+  a space works.
+- A non-blocking Windows CI job (`windows.yml`) runs install, build and unit tests.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lenne.tech/nest-server",
-  "version": "11.41.1",
+  "version": "11.41.3",
   "description": "Modern, fast, powerful Node.js web framework in TypeScript based on Nest with a GraphQL API and a connection to MongoDB (or other databases).",
   "keywords": [
     "node",
@@ -20,7 +20,7 @@
     "build:copy-types": "mkdir -p dist/types && cp src/types/*.d.ts dist/types/",
     "build:dev": "pnpm run build",
     "build:framework-api": "tsx scripts/generate-framework-api.ts",
-    "build:pack": "pnpm pack && echo 'use file:/ROOT_PATH_TO_TGZ_FILE to integrate the package'",
+    "build:pack": "pnpm pack && echo \"use file:/ROOT_PATH_TO_TGZ_FILE to integrate the package\"",
     "c": "pnpm run check",
     "cf": "pnpm run check:fix",
     "check": "node scripts/check.mjs",
@@ -39,7 +39,7 @@
     "format": "oxfmt --write src/ scripts/",
     "format:check": "oxfmt --check src/ scripts/",
     "lint": "oxlint --ignore-path .oxlintignore src/ tests/ scripts/",
-    "lint:fix": "oxlint --fix --fix-suggestions --ignore-path .oxlintignore src/ tests/ scripts/",
+    "lint:fix": "oxlint --fix --ignore-path .oxlintignore src/ tests/ scripts/",
     "prepack": "pnpm run prestart:prod",
     "prepublishOnly": "pnpm run lint && pnpm run test:ci",
     "prestart:prod": "pnpm run build",
@@ -53,10 +53,10 @@
     "start:debug": "nodemon --config nodemon-debug.json",
     "start:dev": "nodemon",
     "start:dev:swc": "nest start -b swc -w --type-check",
-    "start:local": "NODE_ENV=local nodemon",
-    "start:local:swc": "NODE_ENV=local nest start -b swc -w --type-check",
+    "start:local": "cross-env NODE_ENV=local nodemon",
+    "start:local:swc": "cross-env NODE_ENV=local nest start -b swc -w --type-check",
     "start:nodemon": "ts-node -r tsconfig-paths/register src/main.ts",
-    "start:prod": "NODE_ENV=production node dist/main.js",
+    "start:prod": "cross-env NODE_ENV=production node dist/main.js",
     "test": "pnpm run vitest:unit && pnpm run vitest",
     "test:ci": "pnpm run vitest:unit && pnpm run vitest:ci",
     "test:cleanup": "find tests -type f \\( -name '*.txt' -o -name '*.bin' -o -name '*.png' \\) -not -name '.gitkeep' -delete && echo 'Test artifacts cleaned up'",
@@ -68,12 +68,12 @@
     "test:types": "tsc --noEmit --skipLibCheck -p tests/types/tsconfig.json",
     "test:unit:watch": "vitest --config vitest.config.ts",
     "typecheck:tests": "tsc --noEmit -p tsconfig.tests.json",
-    "vitest": "NODE_ENV=e2e vitest run --config vitest-e2e.config.ts",
-    "vitest:ci": "NODE_ENV=ci vitest run --config vitest-e2e.config.ts",
-    "vitest:cov": "NODE_ENV=e2e vitest run --coverage --config vitest-e2e.config.ts",
+    "vitest": "cross-env NODE_ENV=e2e vitest run --config vitest-e2e.config.ts",
+    "vitest:ci": "cross-env NODE_ENV=ci vitest run --config vitest-e2e.config.ts",
+    "vitest:cov": "cross-env NODE_ENV=e2e vitest run --coverage --config vitest-e2e.config.ts",
     "vitest:unit": "vitest run --config vitest.config.ts",
     "vitest:unit:cov": "vitest run --coverage --config vitest.config.ts",
-    "vitest:watch": "NODE_ENV=e2e vitest --config vitest-e2e.config.ts",
+    "vitest:watch": "cross-env NODE_ENV=e2e vitest --config vitest-e2e.config.ts",
     "watch": "npm-watch"
   },
   "repository": {
@@ -127,9 +127,9 @@
     "lodash": "4.18.1",
     "mongodb": "7.5.0",
     "mongoose": "9.9.3",
-    "multer": "2.2.0",
+    "multer": "2.3.0",
     "node-mailjet": "6.0.11",
-    "nodemailer": "9.0.5",
+    "nodemailer": "9.1.1",
     "passport": "0.7.0",
     "passport-jwt": "4.0.1",
     "reflect-metadata": "0.2.2",
@@ -201,6 +201,7 @@
     "ansi-colors": "4.1.3",
     "better-auth": "1.7.1",
     "bullmq": "6.2.0",
+    "cross-env": "10.1.0",
     "find-file-up": "2.0.1",
     "husky": "9.1.7",
     "ioredis": "6.0.0",