@lenne.tech/nest-server 11.42.9 → 11.42.11

package/docs/security-overrides.md

@@ -18,7 +18,7 @@ used to **exact-pin**, to a vulnerable version:
 |---------|----------|------------------------------------------|
 | `ws` | [GHSA-96hv-2xvq-fx4p](https://github.com/advisories/GHSA-96hv-2xvq-fx4p) — high: memory-exhaustion DoS + uninitialized memory disclosure. Patched `>=8.21.0` | Older `@nestjs/graphql` releases declare `"ws": "8.20.1"` — an **exact pin**, not a caret. 13.4.5, the version this framework declares, pins `8.21.3` |
 | `js-yaml` | [GHSA-pm4m-ph32-ghv5](https://github.com/advisories/GHSA-pm4m-ph32-ghv5) — high: exponential parsing time in flow collections (DoS), patched `>=5.2.2`; [GHSA-r3ph-w7gj-g6xm](https://github.com/advisories/GHSA-r3ph-w7gj-g6xm) — moderate: `maxTotalMergeKeys` does not bound CPU use for empty merge sources, covers `<=5.4.0`, patched `>=5.4.1` (published 2026-09-29) | `@nestjs/swagger` declares js-yaml as an **exact pin**, the same shape as the `ws` case: older releases `5.2.1`, 11.4.7 — the version this framework declares, and the newest 11.x — `5.3.0`. No swagger update reaches the fix, so **this entry is load-bearing again** |
-| `@graphql-tools/utils` | [GHSA-7mx3-vvmw-hjmv](https://github.com/advisories/GHSA-7mx3-vvmw-hjmv) — high: prototype pollution in `mergeDeep`, which runs while the GraphQL schema is assembled. Covers `<=12.0.0`, patched `>=12.0.1` (added 2026-10-06) | `@nestjs/graphql` 13.4.5 — the version this framework declares, and the newest 13.x — declares `"@graphql-tools/utils": "12.0.0"`, an **exact pin**. Only `@nestjs/graphql` 14.x moves it, so **this entry is load-bearing**. `@apollo/server` reaches it too, through `@graphql-tools/schema` / `merge` — and in a lockfile that still holds schema 10.0.x (resolved before 2026-08-12), as **utils 11.x**: vulnerable too, with no 11.x fix, and outside the override key. Lift it with `pnpm update --depth Infinity @graphql-tools/schema @graphql-tools/merge`; the current releases request utils `^12.0.3`, which needs Node >=22.15 |
+| `@graphql-tools/utils` | [GHSA-7mx3-vvmw-hjmv](https://github.com/advisories/GHSA-7mx3-vvmw-hjmv) — high: prototype pollution in `mergeDeep`, which runs while the GraphQL schema is assembled. Covers `<=12.0.0`, patched `>=12.0.1` (added 2026-10-06) | `@nestjs/graphql` 13.4.5 — the version this framework declares, and the newest 13.x — declares `"@graphql-tools/utils": "12.0.0"`, an **exact pin**. Only `@nestjs/graphql` 14.x moves it, so **this entry is load-bearing**. `@apollo/server` reaches it too, through `@graphql-tools/schema` / `merge` — and in a lockfile that still holds schema 10.0.x (resolved before 2026-08-12), as **utils 11.x**: vulnerable too, with no 11.x fix, and outside the override key. Lift it with `pnpm update --depth Infinity @graphql-tools/schema @graphql-tools/merge`; the current releases request utils `^12.0.3`, which needs Node >=22.15 — the framework's own floor since 11.42.10, which is why the snippet below targets 12.0.3 |
 | `multer` | [GHSA-wc9g-mqfw-jrwm](https://github.com/advisories/GHSA-wc9g-mqfw-jrwm), [GHSA-535w-7cp7-47q4](https://github.com/advisories/GHSA-535w-7cp7-47q4), [GHSA-qfvm-cv95-jqjf](https://github.com/advisories/GHSA-qfvm-cv95-jqjf) — high: DoS via crafted multipart input; [GHSA-qvfw-j98x-7q72](https://github.com/advisories/GHSA-qvfw-j98x-7q72) — low: file size limit bypass. Patched `>=2.3.0` | `@nestjs/platform-express` up to 11.2.5 declares `"multer": "2.2.0"` — an **exact pin**. A direct `multer` dependency does not move it: you get both copies, and FileInterceptor uses the vulnerable one. 11.2.6, which this framework declared from 11.41.4, pins `2.4.0`, and so does 11.2.7, declared since 11.41.7 |
 
 **Status since 11.42.4:** `@graphql-tools/utils` joins `js-yaml` as load-bearing — no `@nestjs/graphql`
@@ -64,12 +64,13 @@ overrides:
   'multer@>=2.0.0 <2.4.0': '2.4.0'
 
   # @nestjs/graphql 13.4.5 exact-pins @graphql-tools/utils@12.0.0 — GHSA-7mx3-vvmw-hjmv (high, patched >=12.0.1).
-  # Target 12.0.1 rather than the newest 12.x: 12.0.2+ requires Node >=22.15 via @whatwg-node/promise-helpers@2.
-  # If your engines floor is already >=22.15, prefer the newest 12.x, so the caret requesters are not held back.
+  # Target the newest 12.x, so the caret requesters (@graphql-tools/schema / merge) are not held back.
+  # 12.0.2+ requires Node >=22.15 via @whatwg-node/promise-helpers@2 — the floor this framework declares
+  # since 11.42.10. On an older Node, take 12.0.1 instead.
   # Does NOT reach a utils 11.x pulled in by an older @graphql-tools/schema 10.0.x — refresh that one instead:
-  #   pnpm update --depth Infinity @graphql-tools/schema @graphql-tools/merge   (current releases need Node >=22.15)
+  #   pnpm update --depth Infinity @graphql-tools/schema @graphql-tools/merge
   # Remove once @nestjs/graphql pins >=12.0.1 in the major you use.
-  '@graphql-tools/utils@>=12.0.0 <12.0.1': '12.0.1'
+  '@graphql-tools/utils@>=12.0.0 <12.0.3': '12.0.3'
 ```
 
 ### Retired: `@hono/node-server` (removed 2026-08-22, nest-server 11.36.1)

package/migration-guides/11.27.2-to-11.27.3.md

@@ -155,8 +155,10 @@ some projects copied `scripts/check.mjs` from 11.27.1+:
   no longer wipe each other's users/sessions mid-flight. A new reporter
   (`tests/db-lifecycle.reporter.ts`) drops the DB after a successful run and
   collects stale leftovers; after a failed run the DB is kept for debugging
-  until the next successful run. An externally set `MONGODB_URI` (CI) keeps
-  the previous behavior.
+  until the next successful run. An externally set `NSC__MONGOOSE__URI` (CI)
+  keeps the previous behavior. (This line originally said `MONGODB_URI`, the
+  variable the framework's own test setup reads; a starter-derived project's
+  `tests/global-setup.ts` reads `NSC__MONGOOSE__URI`.)
 
 ---
 

package/migration-guides/11.36.3-to-11.36.4.md

@@ -35,10 +35,15 @@ fix reaches an existing project.
 1. Your project's slug contains `ci`, `test`, `e2e` or `acctest` **as a substring** — including
    inside an ordinary word: `ci` hides in so**ci**al, spe**ci**al, finan**ci**al, invoi**ci**ng,
    pri**ci**ng, muni**ci**pal; `test` hides in la**test**, con**test**, **test**imonials.
-2. You use `lt dev up`, which exports `MONGODB_URI` pointing at `<slug>-local` — your **development**
-   database.
+2. You use `lt dev up`, which exports `NSC__MONGOOSE__URI` pointing at `<slug>-local` — your
+   **development** database, and the variable your `tests/global-setup.ts` drops when it is set.
 3. You started the e2e suite from that same shell.
 
+> **Correction (11.42.x):** earlier versions of this guide named `MONGODB_URI` throughout. That is
+> the variable the framework's OWN test setup reads; `lt dev` never sets it. A starter-derived
+> project's `tests/global-setup.ts` reads `NSC__MONGOOSE__URI`, which `lt dev` does export — so
+> the steps below are right for your project, only the variable name was wrong.
+
 Then `tests/global-setup.ts` dropped that database. The guard meant to prevent exactly this accepted
 it, because it matched the marker anywhere in the name rather than as a delimited segment.
 
@@ -82,7 +87,7 @@ cannot:
 
 **A second guard for the one drop site that has no other condition.** The startup sweep and the
 post-run collection both additionally require `isStaleTestDb()` — the name must belong to your own
-base. The externally-supplied-`MONGODB_URI` branch has no such backstop, and a project slug may
+base. The externally-supplied-`NSC__MONGOOSE__URI` branch has no such backstop, and a project slug may
 legitimately carry a marker as a *whole word*: `ci` is the ordinary German abbreviation for
 *Corporate Identity*, `test` a product noun for an exam. `ci-portal-local` passes the segment rule.
 
@@ -100,7 +105,7 @@ Then use `isDroppableTestDb(db.databaseName)` in place of `SAFE_TEST_DB_PATTERN.
 database into a leaked one.
 
 **Refuse a URI that names no database.** `mongodb://127.0.0.1` makes the driver fall back to its
-default database, `test` — a name the guard accepts, so a truncated `MONGODB_URI` dropped the
+default database, `test` — a name the guard accepts, so a truncated `NSC__MONGOOSE__URI` dropped the
 server's `test` database instead of failing. Note that this needs the `splitMongoUri()` fix too: the
 previous greedy form reported the **host** as the database name for such a URI, so the check could
 never fire.
@@ -125,7 +130,7 @@ refusal list *is* the specification, and reverting the anchoring turns 13 cases
 |---------|--------|
 | npm-mode projects | Unaffected by the package update; apply §1 to your own `tests/` |
 | Vendor-mode projects | Same — `tests/` is outside the vendor file set |
-| CI pipelines that pin `MONGODB_URI` | Unaffected, unless the pinned URI names no database or carries an environment suffix. A CI database called `myproject-ci` is fine; one called `myproject-ci-staging` is now refused |
+| CI pipelines that pin `NSC__MONGOOSE__URI` | Unaffected, unless the pinned URI names no database or carries an environment suffix. A CI database called `myproject-ci` is fine; one called `myproject-ci-staging` is now refused |
 | Projects not generated from `nest-server-starter` | Nothing to do |
 
 ---
@@ -133,11 +138,11 @@ refusal list *is* the specification, and reverting the anchoring turns 13 cases
 ## Troubleshooting
 
 **`Refusing to dropDatabase("…"): not a recognized disposable test database`**
-Your `MONGODB_URI` points at something the guard will not delete. That is the guard working. Check
+Your `NSC__MONGOOSE__URI` points at something the guard will not delete. That is the guard working. Check
 whether the URI is aimed at your development database — an `lt dev` shell exports it that way — and
 point it at a disposable test database instead. Do not loosen the pattern to get past this.
 
-**`Refusing to use MONGODB_URI="…": it names no database`**
+**`Refusing to use NSC__MONGOOSE__URI="…": it names no database`**
 The URI has no path (`mongodb://host` rather than `mongodb://host/mydb`). Add the database name.
 
 **`N stale database(s) skipped by the safety guard`**

package/migration-guides/11.42.10-to-11.42.11.md

@@ -0,0 +1,160 @@
+# Migration Guide: 11.42.10 → 11.42.11
+
+## Overview
+
+| Category             | Details                                                                                                  |
+| -------------------- | -------------------------------------------------------------------------------------------------------- |
+| **Framework API**    | No change                                                                                                |
+| **Test tooling**     | e2e low-resource cap fixed for Vitest 4, e2e run governor hardened, two `check.mjs` false greens closed (§1–§3) — reaches your project only through this guide |
+| **Tests**            | A race in tests that upload to a route a role guard refuses (§4)                                         |
+| **Documentation**    | `lt dev` exports `NSC__MONGOOSE__URI`, never `MONGODB_URI`; two older guides corrected (§5)              |
+| **Dependencies**     | `nodemailer` 10.1.0 (minor, no API change); dev tooling (§6)                                             |
+| **Breaking Changes** | None                                                                                                     |
+| **Migration Effort** | None for the package. Starter-derived projects older than starter 11.42.10 should port §1 and §2         |
+
+## Quick Migration
+
+```bash
+pnpm update @lenne.tech/nest-server
+```
+
+Vendor-mode projects pick it up with the core update. No code or configuration change is required for the
+framework itself.
+
+**Why the rest of this guide exists:** `tests/`, `scripts/` and `vitest-e2e.config.ts` do not ship in the npm
+tarball and are not part of the vendor file set. They are template files: `nest-server-starter` ships them,
+and every project generated from it holds a private copy that no update channel touches. The sections below
+say which starter version already carries each fix, so you can tell whether your copy needs it.
+
+## 1. e2e low-resource mode: `maxWorkers` instead of `poolOptions` (Vitest 4)
+
+Already in projects generated from **starter 11.42.10 or later**.
+
+Vitest 4 removed `test.poolOptions`. The low-resource mode in `vitest-e2e.config.ts` still set
+`poolOptions.forks.maxForks`, so the worker cap was announced on stderr and then discarded — measured: a run
+logging `maxForks=2` used 8 workers on a 12-core machine, the same run with `maxWorkers` used 2. Low-resource
+mode only raised the timeouts, and overlapping e2e runs (several sessions, `lt dev test` next to `check`) kept
+starving each other into spurious 401s and timeouts.
+
+```typescript
+// Before
+...(LOW_RESOURCE ? { poolOptions: { forks: { maxForks: LOW_RESOURCE_FORKS, minForks: 1 } } } : {}),
+
+// After
+maxWorkers: LOW_RESOURCE ? LOW_RESOURCE_FORKS : undefined,
+```
+
+`undefined` leaves Vitest's default in place for a normal run. `minWorkers` does not exist in Vitest 4 — drop
+`minForks` rather than translating it. Also rename the option in the stderr announcement, so the one line that
+reports the cap names an option that exists.
+
+A type check does not catch this: under `module: commonjs`, Vitest's config type collapses to `any`, so a
+removed option compiles cleanly. The starter pins it with `tests/unit/vitest-e2e-config.spec.ts`.
+
+**Not for your project: the framework's GitHub-runner exception.** nest-server additionally skips the cap when
+the load signal is the only trigger and `RUNNER_ENVIRONMENT === 'github-hosted'`: a GitHub-hosted runner runs
+one job per VM, so the load it sees is the job's own unit step, and the cap measurably slowed every build
+(133 s → 198 s mean e2e time). A shared GitLab runner sets `CI` but not `RUNNER_ENVIRONMENT`, and there the
+load is real contention — keep the cap.
+
+## 2. e2e run governor (`tests/e2e-run-slots.ts`) hardened
+
+Already in projects generated from **starter 11.42.10 or later**.
+
+The slot directory under `os.tmpdir()` is shared by every lt project on the machine. Three fixes, each pinned
+by a test in `tests/unit/e2e-run-slots.spec.ts`:
+
+| Defect | Fix |
+| ------ | --- |
+| A slot whose PID was recycled by an unrelated long-lived process counted as an active run forever | Reclaim a slot older than six hours even when its PID answers |
+| On a multi-user Linux host (`/tmp` world-writable) a planted `<pid>.slot` symlink made the write follow it | Create the directory `0o700`, unlink the own path first, write with `flag: 'wx', mode: 0o600` |
+| An unwritable slot directory threw out of `acquireRunSlot()` and aborted the suite, despite the documented fail-open | Catch the claim; the run proceeds ungoverned |
+
+The easiest port is to copy `tests/e2e-run-slots.ts` and its spec from the current starter; the file has no
+project-specific content.
+
+## 3. `scripts/check.mjs`: two false greens
+
+Already in projects generated from **starter 11.40.0 or later**. nest-server's own copy caught up in this
+release.
+
+- **The "Vulnerabilities" summary line tested `audit.counts` before `audit.degraded`.** A silent audit outage
+  (exit 0, all-zero JSON, advisory service unreachable) keeps `counts` set, so the summary printed
+  `critical 0 · high 0 · …` for a run that never reached the service. Test `degraded` first.
+- **The CLI guard compared `resolve(process.argv[1])` with the module's own path.** Node resolves the main
+  module's symlinks for `import.meta.url` but keeps `argv[1]` as typed, so a start through a symlink — on macOS
+  any absolute path under `/tmp` — skipped the pipeline and exited 0. Compare both sides through
+  `realpathSync`, and exit 1 when the entry cannot be resolved.
+
+## 4. Tests that upload to a refused route: send no file
+
+Already in projects generated from **starter 11.41.9 or later** (for the avatar upload test).
+
+When a role guard refuses a multipart upload route, it answers before the file interceptor reads the body. A
+test that still attaches a file races that answer: the 401/403 arrives while the client is writing the
+multipart body, and the write fails with `EPIPE` (observed 1 run in 14 in this repository with retries off).
+The file cannot change the guard's answer, so send none — an open route then answers 400 for the missing file,
+so the test still fails if the guard is gone:
+
+```typescript
+// Before
+await testHelper.rest('/files/upload', { attachments: { file: local }, statusCode: 401 });
+
+// After
+await testHelper.rest('/files/upload', { method: 'POST', statusCode: 401 });
+```
+
+Search your `tests/` for `attachments:` next to `statusCode: 401` or `403`.
+
+## 5. Documentation corrections: `NSC__MONGOOSE__URI`, not `MONGODB_URI`
+
+`lt dev` exports `NSC__MONGOOSE__URI` (and `DATABASE_URL`); it has never set `MONGODB_URI`. The guides
+[11.36.3 → 11.36.4](./11.36.3-to-11.36.4.md) and [11.27.2 → 11.27.3](./11.27.2-to-11.27.3.md) named
+`MONGODB_URI` where a starter-derived project's `tests/global-setup.ts` reads `NSC__MONGOOSE__URI`. Both are
+corrected. The steps in them were right for your project — only the variable name was wrong, so nothing needs
+redoing unless you adapted a script to the wrong name.
+
+## 6. Dependency updates
+
+- **`nodemailer` 10.0.16 → 10.1.0** — minor release: hardened message streams, SMTP connection and pool
+  handling, SMTP and encoding fixes. No API change; the framework's real-SMTP round-trip test passes. A project
+  that carries a lock-step `nodemailer` override (nest-server-starter does) should raise it:
+
+  ```yaml
+  # Before
+  overrides:
+    'nodemailer@<10.0.16': '10.0.16'
+
+  # After
+  overrides:
+    'nodemailer@<10.1.0': '10.1.0'
+  ```
+
+- **Development tooling only:** `@aws-sdk/*` 3.1149.0, `bullmq` 6.3.12, `smtp-server` 3.19.19, `vite` 8.3.4,
+  `@types/node` 26.6.5, `@types/lodash` 4.17.26. If your project pins `@types/node` exactly, raise it to 26.6.5
+  so a fresh install does not keep two copies.
+
+Unchanged on purpose: `express` stays 5.2.1, because `@nestjs/platform-express` 11.2.7 pins it exactly — a
+direct bump would put two copies of express into your tree. `better-auth` stays on 1.7.7, the current release.
+
+## Compatibility Notes
+
+| Pattern | Status |
+| ------- | ------ |
+| npm-mode and vendor-mode projects | Unaffected by the package update; §1–§4 apply to your own `tests/` and `scripts/` |
+| Projects generated from starter ≥ 11.42.10 | §1–§4 already present |
+| Projects not generated from `nest-server-starter` | Nothing to do |
+| CI on a shared GitLab runner | Keep the low-resource cap; do not add a GitHub-runner exception |
+
+## Troubleshooting
+
+**`[e2e] low-resource mode: … -> maxForks=…` in your log**
+Your copy still sets `poolOptions` — the cap is not applied. Port §1.
+
+**`[e2e-governor] could not claim a slot (…) — proceeding without the governor.`**
+The slot directory is not writable (owned by another user, read-only tmpdir). The run continues, ungoverned.
+Point `LT_E2E_SLOT_DIR` at a writable directory to get the governor back.
+
+## Module Documentation
+
+- [`.claude/rules/testing.md`](../.claude/rules/testing.md) — run governor, low-resource mode, drop guard

package/migration-guides/11.42.9-to-11.42.10.md

@@ -0,0 +1,111 @@
+# Migration Guide: 11.42.9 → 11.42.10
+
+## Overview
+
+| Category             | Details                                                                                                   |
+| -------------------- | --------------------------------------------------------------------------------------------------------- |
+| **Requirement**      | `engines.node` is now `>= 22.15` (was `>= 22.12`). In practice the floor already applied — see §1        |
+| **Security**         | Recommended `@graphql-tools/utils` override target moves from 12.0.1 to 12.0.3 (§2)                       |
+| **Dependencies**     | `nodemailer` 10.0.16 (bug fixes only). Dev tooling: transitive `handlebars` 4.7.10 (§3)                   |
+| **Breaking Changes** | None in the API                                                                                           |
+| **Migration Effort** | None for projects on Node ≥ 22.15. Projects that carry their own `@graphql-tools/utils` override should raise it (§2) |
+
+## Quick Migration
+
+```bash
+pnpm update @lenne.tech/nest-server
+```
+
+Vendor-mode projects pick it up with the core update. No code or configuration change is required.
+
+## 1. Node ≥ 22.15
+
+The declared minimum Node version rises from 22.12 to 22.15. This changes the declaration, not the reality:
+`@apollo/server` resolves `@graphql-tools/schema` 10.1.3, which requests `@graphql-tools/utils ^12.0.3`, and
+that in turn requires `@whatwg-node/promise-helpers` 2 — whose own `engines` field demands Node `>=22.15.0`.
+Every fresh install of a GraphQL-enabled project has carried that requirement since those releases came out.
+The framework's `engines` field now says so instead of promising a floor its own dependency tree does not
+honour.
+
+Check the Node version wherever the server runs:
+
+```bash
+node --version   # must print v22.15.0 or newer (any Node 24 qualifies)
+```
+
+The places to look: the Docker base image (`FROM node:…`), the CI runner's Node version, and the version a
+host or PaaS pins. The starter's Dockerfile and the framework's own CI already run Node 24.
+
+## 2. `@graphql-tools/utils` override: target 12.0.3
+
+Overrides in this package's `pnpm-workspace.yaml` do not reach your project (see
+[security-overrides.md](../docs/security-overrides.md)), so a project that copied the
+`@graphql-tools/utils` entry for GHSA-7mx3-vvmw-hjmv holds its own. Until now the recommended target was
+12.0.1, because 12.0.2+ needs Node ≥ 22.15. With the framework's floor at 22.15, take the newest 12.x:
+
+```yaml
+# Before
+overrides:
+  '@graphql-tools/utils@>=12.0.0 <12.0.1': '12.0.1'
+
+# After
+overrides:
+  '@graphql-tools/utils@>=12.0.0 <12.0.3': '12.0.3'
+```
+
+```bash
+pnpm install
+pnpm update --depth Infinity @graphql-tools/schema @graphql-tools/merge
+```
+
+Why it matters beyond tidiness: the key intersects the `^12.0.0` range that `@graphql-tools/schema` and
+`@graphql-tools/merge` request, so a target behind the newest 12.x holds them back too. Commit
+`pnpm-workspace.yaml` and `pnpm-lock.yaml` together — a workspace file without the re-installed lockfile fails
+every `pnpm install --frozen-lockfile`, typically in the Docker build.
+
+Afterwards `@nestjs/graphql` 13.4.5 still brings its own exact-pinned `@graphql-tools/schema` 10.1.0 /
+`merge` 9.2.3 next to the 10.1.3 / 9.2.6 that `@apollo/server` uses. That is expected: both copies share the
+single overridden `@graphql-tools/utils` 12.0.3 and the single `graphql`.
+
+Projects still on Node < 22.15 keep the 12.0.1 target until they upgrade Node.
+
+## 3. Dependency updates
+
+- **`nodemailer` 10.0.15 → 10.0.16** — bug fixes in the address parser and cookie handling, no API change.
+  A project that carries a lock-step `nodemailer` override (nest-server-starter does) should raise it to
+  `'nodemailer@<10.0.16': '10.0.16'`.
+- **`handlebars` 4.7.10 (dev tooling only)** — three advisories (GHSA-8r5x-fm3f-whwj, GHSA-p8wg-vrv2-v86f,
+  GHSA-xw65-4hp5-5hc7) reach projects through `@compodoc/compodoc`, which already allows the fixed version.
+  If `pnpm audit` reports them in your project, refresh the stale lockfile entry instead of adding an override:
+
+  ```bash
+  pnpm update --depth Infinity handlebars
+  ```
+
+## Compatibility Notes
+
+| Pattern | Status |
+| ------- | ------ |
+| Projects on Node 24 (starter Dockerfile, CI) | Unaffected |
+| Projects on Node 22.12 – 22.14 | Already outside what `@graphql-tools/utils` 12.0.3 declares; upgrade Node |
+| Vendor-mode projects | The core carries no `engines` field — check the Node version of your own runtime (§1) |
+| `engine-strict=true` in `.npmrc` | Installs now fail on Node < 22.15 instead of warning |
+
+## Troubleshooting
+
+| Symptom | Cause | Fix |
+| ------- | ----- | --- |
+| `pnpm install` warns `Unsupported engine` for `@whatwg-node/promise-helpers` | Node older than 22.15 | Upgrade Node (§1) |
+| `ERR_PNPM_UNSUPPORTED_ENGINE` for `@lenne.tech/nest-server` | `engine-strict` with Node < 22.15 | Upgrade Node (§1) |
+| `pnpm audit` reports `@graphql-tools/utils` after updating | Your own override still targets an older version, or an old `@graphql-tools/schema` 10.0.x pulls utils 11.x | Raise the override and refresh schema / merge (§2) |
+| `pnpm audit` reports `handlebars` via `@compodoc/compodoc` | Stale lockfile entry | `pnpm update --depth Infinity handlebars` (§3) |
+
+## Module Documentation
+
+- [Security overrides](../docs/security-overrides.md) — which overrides are load-bearing and how to write your own
+- `.claude/rules/package-management.md` — override and suppression rules
+
+## References
+
+- [GHSA-7mx3-vvmw-hjmv](https://github.com/advisories/GHSA-7mx3-vvmw-hjmv) — `@graphql-tools/utils` prototype pollution
+- [nest-server-starter](https://github.com/lenneTech/nest-server-starter) — reference project

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lenne.tech/nest-server",
-  "version": "11.42.9",
+  "version": "11.42.11",
   "description": "Modern, fast, powerful Node.js web framework in TypeScript based on Nest with a GraphQL API and a connection to MongoDB (or other databases).",
   "keywords": [
     "node",
@@ -34,7 +34,7 @@
     "check:server-start": "cross-env NODE_ENV=local node scripts/check-server-start.mjs --entry=dist/main.js --port-env=NSC__PORT --ready=\"Server starte[dt] at\" --path=/",
     "check:swc-tdz": "nest build -b swc -p tsconfig.swc-tdz.json && node scripts/check-swc-tdz.mjs",
     "cnaf": "pnpm run check:naf",
-    "docs": "pnpm run docs:ci && open http://127.0.0.1:8080/ && open ./public/index.html && compodoc -p tsconfig.json -s ",
+    "docs": "pnpm run docs:ci && node scripts/open.mjs http://127.0.0.1:8080/ ./public/index.html && compodoc -p tsconfig.json -s",
     "docs:bootstrap": "node extras/update-spectaql-version.mjs && node scripts/run-spectaql.mjs",
     "docs:ci": "ts-node ./scripts/init-server.ts && pnpm run docs:bootstrap && compodoc -p tsconfig.json",
     "format": "oxfmt --write src/ scripts/",
@@ -59,7 +59,7 @@
     "start:prod": "cross-env NODE_ENV=production node dist/main.js",
     "test": "pnpm run vitest:unit && pnpm run vitest",
     "test:ci": "pnpm run vitest:unit && pnpm run vitest:ci",
-    "test:cleanup": "find tests -type f \\( -name '*.txt' -o -name '*.bin' -o -name '*.png' \\) -not -name '.gitkeep' -delete && echo 'Test artifacts cleaned up'",
+    "test:cleanup": "node scripts/clean-test-artifacts.mjs",
     "test:cov": "pnpm run vitest:unit:cov && pnpm run vitest:cov",
     "test:e2e": "pnpm run vitest",
     "test:infra": "node scripts/test-infra.mjs up",
@@ -84,10 +84,10 @@
     "url": "https://github.com/lenneTech/nest-server/issues"
   },
   "engines": {
-    "node": ">= 22.12",
+    "node": ">= 22.15",
     "pnpm": "^11.0.0"
   },
-  "packageManager": "pnpm@11.13.1+sha512.b2fc7683b8a6525414e7d13e1ba28caaddde96bf66ec540bfaeb7e702b81f3e0be4d1f295edf7f9fe0396740a8dce4509c582ddf79891f4543fea32d37645f25",
+  "packageManager": "pnpm@11.28.5+sha512.484563d30b4c2ad27cb48aa94ff2b302dbcebc8ff6bf28816c2589886e146ce7f76f354f3bc1a438e6f5e9768c302aa0a6f7add8232903cd4cf81426cbc14d9e",
   "dependencies": {
     "@apollo/server": "5.5.1",
     "@as-integrations/express5": "1.1.2",
@@ -129,7 +129,7 @@
     "mongoose": "9.10.4",
     "multer": "2.4.0",
     "node-mailjet": "6.0.11",
-    "nodemailer": "10.0.15",
+    "nodemailer": "10.1.0",
     "passport": "0.7.0",
     "passport-jwt": "4.0.1",
     "reflect-metadata": "0.2.2",
@@ -182,9 +182,9 @@
     }
   },
   "devDependencies": {
-    "@aws-sdk/client-s3": "3.1146.0",
-    "@aws-sdk/lib-storage": "3.1146.0",
-    "@aws-sdk/s3-request-presigner": "3.1146.0",
+    "@aws-sdk/client-s3": "3.1149.0",
+    "@aws-sdk/lib-storage": "3.1149.0",
+    "@aws-sdk/s3-request-presigner": "3.1149.0",
     "@better-auth/core": "1.7.7",
     "@better-auth/passkey": "1.7.7",
     "@compodoc/compodoc": "2.0.0",
@@ -198,14 +198,13 @@
     "@types/cookie-parser": "1.4.10",
     "@types/ejs": "3.1.5",
     "@types/express": "5.0.6",
-    "@types/lodash": "4.17.25",
+    "@types/lodash": "4.17.26",
     "@types/multer": "2.3.0",
-    "@types/node": "26.6.4",
+    "@types/node": "26.6.5",
     "@types/passport": "1.0.17",
     "@vitest/coverage-v8": "4.1.11",
-    "ansi-colors": "4.1.3",
     "better-auth": "1.7.7",
-    "bullmq": "6.3.11",
+    "bullmq": "6.3.12",
     "cross-env": "10.1.0",
     "ioredis": "6.0.0",
     "nodemon": "3.1.14",
@@ -214,14 +213,14 @@
     "oxfmt": "0.71.0",
     "oxlint": "1.87.0",
     "rimraf": "6.1.3",
-    "smtp-server": "3.19.17",
+    "smtp-server": "3.19.19",
     "ts-node": "10.9.2",
     "tsconfig-paths": "4.2.0",
     "tsx": "4.23.15",
     "tus-js-client": "4.3.1",
     "typescript": "5.9.3",
     "unplugin-swc": "2.0.0",
-    "vite": "8.3.3",
+    "vite": "8.3.4",
     "vite-plugin-node": "8.0.0",
     "vitest": "4.1.11"
   },