@lenne.tech/nest-server 11.42.9 → 11.42.10
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -18,7 +18,7 @@ used to **exact-pin**, to a vulnerable version:
|
|
|
18
18
|
|---------|----------|------------------------------------------|
|
|
19
19
|
| `ws` | [GHSA-96hv-2xvq-fx4p](https://github.com/advisories/GHSA-96hv-2xvq-fx4p) — high: memory-exhaustion DoS + uninitialized memory disclosure. Patched `>=8.21.0` | Older `@nestjs/graphql` releases declare `"ws": "8.20.1"` — an **exact pin**, not a caret. 13.4.5, the version this framework declares, pins `8.21.3` |
|
|
20
20
|
| `js-yaml` | [GHSA-pm4m-ph32-ghv5](https://github.com/advisories/GHSA-pm4m-ph32-ghv5) — high: exponential parsing time in flow collections (DoS), patched `>=5.2.2`; [GHSA-r3ph-w7gj-g6xm](https://github.com/advisories/GHSA-r3ph-w7gj-g6xm) — moderate: `maxTotalMergeKeys` does not bound CPU use for empty merge sources, covers `<=5.4.0`, patched `>=5.4.1` (published 2026-09-29) | `@nestjs/swagger` declares js-yaml as an **exact pin**, the same shape as the `ws` case: older releases `5.2.1`, 11.4.7 — the version this framework declares, and the newest 11.x — `5.3.0`. No swagger update reaches the fix, so **this entry is load-bearing again** |
|
|
21
|
-
| `@graphql-tools/utils` | [GHSA-7mx3-vvmw-hjmv](https://github.com/advisories/GHSA-7mx3-vvmw-hjmv) — high: prototype pollution in `mergeDeep`, which runs while the GraphQL schema is assembled. Covers `<=12.0.0`, patched `>=12.0.1` (added 2026-10-06) | `@nestjs/graphql` 13.4.5 — the version this framework declares, and the newest 13.x — declares `"@graphql-tools/utils": "12.0.0"`, an **exact pin**. Only `@nestjs/graphql` 14.x moves it, so **this entry is load-bearing**. `@apollo/server` reaches it too, through `@graphql-tools/schema` / `merge` — and in a lockfile that still holds schema 10.0.x (resolved before 2026-08-12), as **utils 11.x**: vulnerable too, with no 11.x fix, and outside the override key. Lift it with `pnpm update --depth Infinity @graphql-tools/schema @graphql-tools/merge`; the current releases request utils `^12.0.3`, which needs Node >=22.15 |
|
|
21
|
+
| `@graphql-tools/utils` | [GHSA-7mx3-vvmw-hjmv](https://github.com/advisories/GHSA-7mx3-vvmw-hjmv) — high: prototype pollution in `mergeDeep`, which runs while the GraphQL schema is assembled. Covers `<=12.0.0`, patched `>=12.0.1` (added 2026-10-06) | `@nestjs/graphql` 13.4.5 — the version this framework declares, and the newest 13.x — declares `"@graphql-tools/utils": "12.0.0"`, an **exact pin**. Only `@nestjs/graphql` 14.x moves it, so **this entry is load-bearing**. `@apollo/server` reaches it too, through `@graphql-tools/schema` / `merge` — and in a lockfile that still holds schema 10.0.x (resolved before 2026-08-12), as **utils 11.x**: vulnerable too, with no 11.x fix, and outside the override key. Lift it with `pnpm update --depth Infinity @graphql-tools/schema @graphql-tools/merge`; the current releases request utils `^12.0.3`, which needs Node >=22.15 — the framework's own floor since 11.42.10, which is why the snippet below targets 12.0.3 |
|
|
22
22
|
| `multer` | [GHSA-wc9g-mqfw-jrwm](https://github.com/advisories/GHSA-wc9g-mqfw-jrwm), [GHSA-535w-7cp7-47q4](https://github.com/advisories/GHSA-535w-7cp7-47q4), [GHSA-qfvm-cv95-jqjf](https://github.com/advisories/GHSA-qfvm-cv95-jqjf) — high: DoS via crafted multipart input; [GHSA-qvfw-j98x-7q72](https://github.com/advisories/GHSA-qvfw-j98x-7q72) — low: file size limit bypass. Patched `>=2.3.0` | `@nestjs/platform-express` up to 11.2.5 declares `"multer": "2.2.0"` — an **exact pin**. A direct `multer` dependency does not move it: you get both copies, and FileInterceptor uses the vulnerable one. 11.2.6, which this framework declared from 11.41.4, pins `2.4.0`, and so does 11.2.7, declared since 11.41.7 |
|
|
23
23
|
|
|
24
24
|
**Status since 11.42.4:** `@graphql-tools/utils` joins `js-yaml` as load-bearing — no `@nestjs/graphql`
|
|
@@ -64,12 +64,13 @@ overrides:
|
|
|
64
64
|
'multer@>=2.0.0 <2.4.0': '2.4.0'
|
|
65
65
|
|
|
66
66
|
# @nestjs/graphql 13.4.5 exact-pins @graphql-tools/utils@12.0.0 — GHSA-7mx3-vvmw-hjmv (high, patched >=12.0.1).
|
|
67
|
-
# Target
|
|
68
|
-
#
|
|
67
|
+
# Target the newest 12.x, so the caret requesters (@graphql-tools/schema / merge) are not held back.
|
|
68
|
+
# 12.0.2+ requires Node >=22.15 via @whatwg-node/promise-helpers@2 — the floor this framework declares
|
|
69
|
+
# since 11.42.10. On an older Node, take 12.0.1 instead.
|
|
69
70
|
# Does NOT reach a utils 11.x pulled in by an older @graphql-tools/schema 10.0.x — refresh that one instead:
|
|
70
|
-
# pnpm update --depth Infinity @graphql-tools/schema @graphql-tools/merge
|
|
71
|
+
# pnpm update --depth Infinity @graphql-tools/schema @graphql-tools/merge
|
|
71
72
|
# Remove once @nestjs/graphql pins >=12.0.1 in the major you use.
|
|
72
|
-
'@graphql-tools/utils@>=12.0.0 <12.0.
|
|
73
|
+
'@graphql-tools/utils@>=12.0.0 <12.0.3': '12.0.3'
|
|
73
74
|
```
|
|
74
75
|
|
|
75
76
|
### Retired: `@hono/node-server` (removed 2026-08-22, nest-server 11.36.1)
|
|
@@ -0,0 +1,111 @@
|
|
|
1
|
+
# Migration Guide: 11.42.9 → 11.42.10
|
|
2
|
+
|
|
3
|
+
## Overview
|
|
4
|
+
|
|
5
|
+
| Category | Details |
|
|
6
|
+
| -------------------- | --------------------------------------------------------------------------------------------------------- |
|
|
7
|
+
| **Requirement** | `engines.node` is now `>= 22.15` (was `>= 22.12`). In practice the floor already applied — see §1 |
|
|
8
|
+
| **Security** | Recommended `@graphql-tools/utils` override target moves from 12.0.1 to 12.0.3 (§2) |
|
|
9
|
+
| **Dependencies** | `nodemailer` 10.0.16 (bug fixes only). Dev tooling: transitive `handlebars` 4.7.10 (§3) |
|
|
10
|
+
| **Breaking Changes** | None in the API |
|
|
11
|
+
| **Migration Effort** | None for projects on Node ≥ 22.15. Projects that carry their own `@graphql-tools/utils` override should raise it (§2) |
|
|
12
|
+
|
|
13
|
+
## Quick Migration
|
|
14
|
+
|
|
15
|
+
```bash
|
|
16
|
+
pnpm update @lenne.tech/nest-server
|
|
17
|
+
```
|
|
18
|
+
|
|
19
|
+
Vendor-mode projects pick it up with the core update. No code or configuration change is required.
|
|
20
|
+
|
|
21
|
+
## 1. Node ≥ 22.15
|
|
22
|
+
|
|
23
|
+
The declared minimum Node version rises from 22.12 to 22.15. This changes the declaration, not the reality:
|
|
24
|
+
`@apollo/server` resolves `@graphql-tools/schema` 10.1.3, which requests `@graphql-tools/utils ^12.0.3`, and
|
|
25
|
+
that in turn requires `@whatwg-node/promise-helpers` 2 — whose own `engines` field demands Node `>=22.15.0`.
|
|
26
|
+
Every fresh install of a GraphQL-enabled project has carried that requirement since those releases came out.
|
|
27
|
+
The framework's `engines` field now says so instead of promising a floor its own dependency tree does not
|
|
28
|
+
honour.
|
|
29
|
+
|
|
30
|
+
Check the Node version wherever the server runs:
|
|
31
|
+
|
|
32
|
+
```bash
|
|
33
|
+
node --version # must print v22.15.0 or newer (any Node 24 qualifies)
|
|
34
|
+
```
|
|
35
|
+
|
|
36
|
+
The places to look: the Docker base image (`FROM node:…`), the CI runner's Node version, and the version a
|
|
37
|
+
host or PaaS pins. The starter's Dockerfile and the framework's own CI already run Node 24.
|
|
38
|
+
|
|
39
|
+
## 2. `@graphql-tools/utils` override: target 12.0.3
|
|
40
|
+
|
|
41
|
+
Overrides in this package's `pnpm-workspace.yaml` do not reach your project (see
|
|
42
|
+
[security-overrides.md](../docs/security-overrides.md)), so a project that copied the
|
|
43
|
+
`@graphql-tools/utils` entry for GHSA-7mx3-vvmw-hjmv holds its own. Until now the recommended target was
|
|
44
|
+
12.0.1, because 12.0.2+ needs Node ≥ 22.15. With the framework's floor at 22.15, take the newest 12.x:
|
|
45
|
+
|
|
46
|
+
```yaml
|
|
47
|
+
# Before
|
|
48
|
+
overrides:
|
|
49
|
+
'@graphql-tools/utils@>=12.0.0 <12.0.1': '12.0.1'
|
|
50
|
+
|
|
51
|
+
# After
|
|
52
|
+
overrides:
|
|
53
|
+
'@graphql-tools/utils@>=12.0.0 <12.0.3': '12.0.3'
|
|
54
|
+
```
|
|
55
|
+
|
|
56
|
+
```bash
|
|
57
|
+
pnpm install
|
|
58
|
+
pnpm update --depth Infinity @graphql-tools/schema @graphql-tools/merge
|
|
59
|
+
```
|
|
60
|
+
|
|
61
|
+
Why it matters beyond tidiness: the key intersects the `^12.0.0` range that `@graphql-tools/schema` and
|
|
62
|
+
`@graphql-tools/merge` request, so a target behind the newest 12.x holds them back too. Commit
|
|
63
|
+
`pnpm-workspace.yaml` and `pnpm-lock.yaml` together — a workspace file without the re-installed lockfile fails
|
|
64
|
+
every `pnpm install --frozen-lockfile`, typically in the Docker build.
|
|
65
|
+
|
|
66
|
+
Afterwards `@nestjs/graphql` 13.4.5 still brings its own exact-pinned `@graphql-tools/schema` 10.1.0 /
|
|
67
|
+
`merge` 9.2.3 next to the 10.1.3 / 9.2.6 that `@apollo/server` uses. That is expected: both copies share the
|
|
68
|
+
single overridden `@graphql-tools/utils` 12.0.3 and the single `graphql`.
|
|
69
|
+
|
|
70
|
+
Projects still on Node < 22.15 keep the 12.0.1 target until they upgrade Node.
|
|
71
|
+
|
|
72
|
+
## 3. Dependency updates
|
|
73
|
+
|
|
74
|
+
- **`nodemailer` 10.0.15 → 10.0.16** — bug fixes in the address parser and cookie handling, no API change.
|
|
75
|
+
A project that carries a lock-step `nodemailer` override (nest-server-starter does) should raise it to
|
|
76
|
+
`'nodemailer@<10.0.16': '10.0.16'`.
|
|
77
|
+
- **`handlebars` 4.7.10 (dev tooling only)** — three advisories (GHSA-8r5x-fm3f-whwj, GHSA-p8wg-vrv2-v86f,
|
|
78
|
+
GHSA-xw65-4hp5-5hc7) reach projects through `@compodoc/compodoc`, which already allows the fixed version.
|
|
79
|
+
If `pnpm audit` reports them in your project, refresh the stale lockfile entry instead of adding an override:
|
|
80
|
+
|
|
81
|
+
```bash
|
|
82
|
+
pnpm update --depth Infinity handlebars
|
|
83
|
+
```
|
|
84
|
+
|
|
85
|
+
## Compatibility Notes
|
|
86
|
+
|
|
87
|
+
| Pattern | Status |
|
|
88
|
+
| ------- | ------ |
|
|
89
|
+
| Projects on Node 24 (starter Dockerfile, CI) | Unaffected |
|
|
90
|
+
| Projects on Node 22.12 – 22.14 | Already outside what `@graphql-tools/utils` 12.0.3 declares; upgrade Node |
|
|
91
|
+
| Vendor-mode projects | The core carries no `engines` field — check the Node version of your own runtime (§1) |
|
|
92
|
+
| `engine-strict=true` in `.npmrc` | Installs now fail on Node < 22.15 instead of warning |
|
|
93
|
+
|
|
94
|
+
## Troubleshooting
|
|
95
|
+
|
|
96
|
+
| Symptom | Cause | Fix |
|
|
97
|
+
| ------- | ----- | --- |
|
|
98
|
+
| `pnpm install` warns `Unsupported engine` for `@whatwg-node/promise-helpers` | Node older than 22.15 | Upgrade Node (§1) |
|
|
99
|
+
| `ERR_PNPM_UNSUPPORTED_ENGINE` for `@lenne.tech/nest-server` | `engine-strict` with Node < 22.15 | Upgrade Node (§1) |
|
|
100
|
+
| `pnpm audit` reports `@graphql-tools/utils` after updating | Your own override still targets an older version, or an old `@graphql-tools/schema` 10.0.x pulls utils 11.x | Raise the override and refresh schema / merge (§2) |
|
|
101
|
+
| `pnpm audit` reports `handlebars` via `@compodoc/compodoc` | Stale lockfile entry | `pnpm update --depth Infinity handlebars` (§3) |
|
|
102
|
+
|
|
103
|
+
## Module Documentation
|
|
104
|
+
|
|
105
|
+
- [Security overrides](../docs/security-overrides.md) — which overrides are load-bearing and how to write your own
|
|
106
|
+
- `.claude/rules/package-management.md` — override and suppression rules
|
|
107
|
+
|
|
108
|
+
## References
|
|
109
|
+
|
|
110
|
+
- [GHSA-7mx3-vvmw-hjmv](https://github.com/advisories/GHSA-7mx3-vvmw-hjmv) — `@graphql-tools/utils` prototype pollution
|
|
111
|
+
- [nest-server-starter](https://github.com/lenneTech/nest-server-starter) — reference project
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@lenne.tech/nest-server",
|
|
3
|
-
"version": "11.42.
|
|
3
|
+
"version": "11.42.10",
|
|
4
4
|
"description": "Modern, fast, powerful Node.js web framework in TypeScript based on Nest with a GraphQL API and a connection to MongoDB (or other databases).",
|
|
5
5
|
"keywords": [
|
|
6
6
|
"node",
|
|
@@ -84,10 +84,10 @@
|
|
|
84
84
|
"url": "https://github.com/lenneTech/nest-server/issues"
|
|
85
85
|
},
|
|
86
86
|
"engines": {
|
|
87
|
-
"node": ">= 22.
|
|
87
|
+
"node": ">= 22.15",
|
|
88
88
|
"pnpm": "^11.0.0"
|
|
89
89
|
},
|
|
90
|
-
"packageManager": "pnpm@11.
|
|
90
|
+
"packageManager": "pnpm@11.28.5+sha512.484563d30b4c2ad27cb48aa94ff2b302dbcebc8ff6bf28816c2589886e146ce7f76f354f3bc1a438e6f5e9768c302aa0a6f7add8232903cd4cf81426cbc14d9e",
|
|
91
91
|
"dependencies": {
|
|
92
92
|
"@apollo/server": "5.5.1",
|
|
93
93
|
"@as-integrations/express5": "1.1.2",
|
|
@@ -129,7 +129,7 @@
|
|
|
129
129
|
"mongoose": "9.10.4",
|
|
130
130
|
"multer": "2.4.0",
|
|
131
131
|
"node-mailjet": "6.0.11",
|
|
132
|
-
"nodemailer": "10.0.
|
|
132
|
+
"nodemailer": "10.0.16",
|
|
133
133
|
"passport": "0.7.0",
|
|
134
134
|
"passport-jwt": "4.0.1",
|
|
135
135
|
"reflect-metadata": "0.2.2",
|
|
@@ -182,9 +182,9 @@
|
|
|
182
182
|
}
|
|
183
183
|
},
|
|
184
184
|
"devDependencies": {
|
|
185
|
-
"@aws-sdk/client-s3": "3.
|
|
186
|
-
"@aws-sdk/lib-storage": "3.
|
|
187
|
-
"@aws-sdk/s3-request-presigner": "3.
|
|
185
|
+
"@aws-sdk/client-s3": "3.1147.0",
|
|
186
|
+
"@aws-sdk/lib-storage": "3.1147.0",
|
|
187
|
+
"@aws-sdk/s3-request-presigner": "3.1147.0",
|
|
188
188
|
"@better-auth/core": "1.7.7",
|
|
189
189
|
"@better-auth/passkey": "1.7.7",
|
|
190
190
|
"@compodoc/compodoc": "2.0.0",
|
|
@@ -203,7 +203,6 @@
|
|
|
203
203
|
"@types/node": "26.6.4",
|
|
204
204
|
"@types/passport": "1.0.17",
|
|
205
205
|
"@vitest/coverage-v8": "4.1.11",
|
|
206
|
-
"ansi-colors": "4.1.3",
|
|
207
206
|
"better-auth": "1.7.7",
|
|
208
207
|
"bullmq": "6.3.11",
|
|
209
208
|
"cross-env": "10.1.0",
|