@nestjs/common 12.1.2 → 12.2.0

package/constants.d.ts

@@ -35,6 +35,7 @@ export declare const HEADERS_METADATA = "__headers__";
 export declare const REDIRECT_METADATA = "__redirect__";
 export declare const RESPONSE_PASSTHROUGH_METADATA = "__responsePassthrough__";
 export declare const SSE_METADATA = "__sse__";
+export declare const SSE_OPTIONS_METADATA = "__sseOptions__";
 export declare const VERSION_METADATA = "__version__";
 export declare const INJECTABLE_WATERMARK = "__injectable__";
 export declare const CONTROLLER_WATERMARK = "__controller__";

package/constants.js

@@ -34,6 +34,7 @@ export const HEADERS_METADATA = '__headers__';
 export const REDIRECT_METADATA = '__redirect__';
 export const RESPONSE_PASSTHROUGH_METADATA = '__responsePassthrough__';
 export const SSE_METADATA = '__sse__';
+export const SSE_OPTIONS_METADATA = '__sseOptions__';
 export const VERSION_METADATA = '__version__';
 export const INJECTABLE_WATERMARK = '__injectable__';
 export const CONTROLLER_WATERMARK = '__controller__';

package/decorators/core/inject.decorator.js

@@ -44,7 +44,10 @@ export function Inject(token) {
             return;
         }
         let properties = Reflect.getMetadata(PROPERTY_DEPS_METADATA, target.constructor) || [];
-        properties = [...properties, { key, type }];
+        properties = [
+            ...properties.filter(property => property.key !== key),
+            { key, type },
+        ];
         Reflect.defineMetadata(PROPERTY_DEPS_METADATA, properties, target.constructor);
     };
 }

package/decorators/core/optional.decorator.js

@@ -20,7 +20,7 @@ export function Optional() {
             Reflect.defineMetadata(OPTIONAL_DEPS_METADATA, [...args, index], target);
             return;
         }
-        const properties = Reflect.getOwnMetadata(OPTIONAL_PROPERTY_DEPS_METADATA, target.constructor) || [];
+        const properties = Reflect.getMetadata(OPTIONAL_PROPERTY_DEPS_METADATA, target.constructor) || [];
         Reflect.defineMetadata(OPTIONAL_PROPERTY_DEPS_METADATA, [...properties, key], target.constructor);
     };
 }

package/decorators/http/create-route-param-metadata.decorator.js

@@ -24,34 +24,32 @@ export function createParamDecorator(factory, enhancers = []) {
         const hasParamData = isNil(data) || !isPipe(data);
         const paramData = hasParamData ? data : undefined;
         const paramPipes = hasParamData ? pipes : [data, ...pipes];
-        // Check if data itself is an options object (when used as the first argument)
-        const isDataOptions = hasParamData && !isNil(data) && isParameterDecoratorOptions(data);
-        // Check if the last pipe argument is actually an options object
-        const lastPipeArg = paramPipes.length > 0 ? paramPipes[paramPipes.length - 1] : undefined;
-        const isLastPipeOptions = !isDataOptions && isParameterDecoratorOptions(lastPipeArg);
-        let finalData;
+        // Custom data may also contain schema or pipes properties, so only treat
+        // the first argument as options when those are its only keys and their
+        // values, if defined, are a Standard Schema and an array of pipes.
+        const isDataOptions = hasParamData &&
+            !isNil(data) &&
+            isParameterDecoratorOptions(data) &&
+            Object.keys(data).every(key => key === 'schema' || key === 'pipes') &&
+            (data.schema === undefined ||
+                isFunction(data.schema?.['~standard']?.validate)) &&
+            (data.pipes === undefined ||
+                (Array.isArray(data.pipes) &&
+                    // Falsy entries are allowed, as the pipes context filters them out
+                    data.pipes.every(pipe => isNil(pipe) || isPipe(pipe))));
+        const finalData = isDataOptions ? undefined : paramData;
         let finalSchema;
-        let finalPipes;
-        if (isDataOptions) {
-            const opts = data;
-            finalData = undefined;
-            finalSchema = opts.schema;
-            // Merge positional pipes passed after the options object
-            finalPipes = [...(opts.pipes ?? []), ...paramPipes];
-        }
-        else if (isLastPipeOptions) {
-            const opts = lastPipeArg;
-            finalData = paramData;
-            finalSchema = opts.schema;
-            finalPipes = [
-                ...paramPipes.slice(0, -1),
-                ...(opts.pipes ?? []),
-            ];
-        }
-        else {
-            finalData = paramData;
-            finalSchema = undefined;
-            finalPipes = paramPipes;
+        const finalPipes = [];
+        // Options objects may also appear among the pipes, at any position.
+        // Their pipes are merged in place, and the first schema found is used.
+        for (const arg of isDataOptions ? [data, ...paramPipes] : paramPipes) {
+            if (isParameterDecoratorOptions(arg)) {
+                finalSchema ??= arg.schema;
+                finalPipes.push(...(arg.pipes ?? []));
+            }
+            else {
+                finalPipes.push(arg);
+            }
         }
         Reflect.defineMetadata(ROUTE_ARGS_METADATA, assignCustomParameterMetadata(args, paramtype, index, factory, finalData, finalSchema, ...finalPipes), target.constructor, key);
         enhancers.forEach(fn => fn(target, key, index));

package/decorators/http/sse.decorator.d.ts

@@ -1,10 +1,47 @@
-import { METHOD_METADATA } from '../../constants.js';
 import { RequestMethod } from '../../enums/request-method.enum.js';
+/**
+ * Interface defining options that can be passed to `@Sse()` decorator
+ *
+ * @publicApi
+ */
+export interface SseOptions {
+    /**
+     * HTTP request method of the route (default: `RequestMethod.GET`).
+     */
+    method?: RequestMethod;
+    /**
+     * Maximum number of characters of event data (`data` plus `comment`) that
+     * may wait for a client that is not reading its events (default:
+     * 4 * 1024 * 1024, i.e. 4M characters). Events wait once the stream and
+     * socket buffers are full, as the producer cannot be paused. Past this
+     * limit, the connection is dropped as if the client had disconnected, and
+     * a warning is logged. Set to 0 or `Infinity` to disable.
+     */
+    maxPendingDataLength?: number;
+}
 /**
  * Declares this route as a Server-Sent-Events endpoint
  *
+ * Events wait in memory for a client that is not reading them. Once more than
+ * `maxPendingDataLength` characters of event data (4M by default) wait for a
+ * client whose stream is backed up, its connection is dropped. An
+ * `EventSource` then reconnects, sending the id of the last event it received.
+ * Raise the limit for a route that streams bulk data faster than its clients
+ * read, or set it to 0 or `Infinity` to lift it.
+ *
+ * @param path route path (default: `/`)
+ * @param options `SseOptions` object specifying:
+ * - `method` - HTTP request method of the route (default: `GET`).
+ * - `maxPendingDataLength` - maximum number of characters of event data that
+ * may wait for a client that is not reading them (default: 4M). 0 or
+ * `Infinity` lifts the limit.
+ *
+ * @example
+ * ```ts
+ * @Sse('logs', { maxPendingDataLength: 64 * 1024 * 1024 })
+ * logs(): Observable<MessageEvent> { ... }
+ * ```
+ *
  * @publicApi
  */
-export declare function Sse(path?: string, options?: {
-    [METHOD_METADATA]?: RequestMethod;
-}): MethodDecorator;
+export declare function Sse(path?: string, options?: SseOptions): MethodDecorator;

package/decorators/http/sse.decorator.js

@@ -1,18 +1,37 @@
-import { METHOD_METADATA, PATH_METADATA, SSE_METADATA, } from '../../constants.js';
+import { METHOD_METADATA, PATH_METADATA, SSE_METADATA, SSE_OPTIONS_METADATA, } from '../../constants.js';
 import { RequestMethod } from '../../enums/request-method.enum.js';
 /**
  * Declares this route as a Server-Sent-Events endpoint
  *
+ * Events wait in memory for a client that is not reading them. Once more than
+ * `maxPendingDataLength` characters of event data (4M by default) wait for a
+ * client whose stream is backed up, its connection is dropped. An
+ * `EventSource` then reconnects, sending the id of the last event it received.
+ * Raise the limit for a route that streams bulk data faster than its clients
+ * read, or set it to 0 or `Infinity` to lift it.
+ *
+ * @param path route path (default: `/`)
+ * @param options `SseOptions` object specifying:
+ * - `method` - HTTP request method of the route (default: `GET`).
+ * - `maxPendingDataLength` - maximum number of characters of event data that
+ * may wait for a client that is not reading them (default: 4M). 0 or
+ * `Infinity` lifts the limit.
+ *
+ * @example
+ * ```ts
+ * @Sse('logs', { maxPendingDataLength: 64 * 1024 * 1024 })
+ * logs(): Observable<MessageEvent> { ... }
+ * ```
+ *
  * @publicApi
  */
-export function Sse(path, options = {
-    [METHOD_METADATA]: RequestMethod.GET,
-}) {
+export function Sse(path, options = {}) {
     return (target, key, descriptor) => {
         path = path && path.length ? path : '/';
         Reflect.defineMetadata(PATH_METADATA, path, descriptor.value);
-        Reflect.defineMetadata(METHOD_METADATA, options[METHOD_METADATA], descriptor.value);
+        Reflect.defineMetadata(METHOD_METADATA, options[METHOD_METADATA] ?? RequestMethod.GET, descriptor.value);
         Reflect.defineMetadata(SSE_METADATA, true, descriptor.value);
+        Reflect.defineMetadata(SSE_OPTIONS_METADATA, { maxPendingDataLength: options.maxPendingDataLength }, descriptor.value);
         return descriptor;
     };
 }

package/file-stream/streamable-file.js

@@ -20,8 +20,11 @@ export class StreamableFile {
             res.end();
             return;
         }
+        // The message may name the path the stream reads from, so it is
+        // logged rather than sent.
+        this.logError(err);
         res.statusCode = HttpStatus.BAD_REQUEST;
-        res.send(err.message);
+        res.send('Bad Request');
     };
     logError = (err) => {
         this.logger.error(err);
@@ -39,6 +42,13 @@ export class StreamableFile {
         }
         else if (bufferOrReadStream.pipe && isFunction(bufferOrReadStream.pipe)) {
             this.stream = bufferOrReadStream;
+            // Without a listener, an 'error' emitted before the adapter attaches
+            // its own (e.g. ENOENT from `fs.createReadStream()` while an
+            // interceptor awaits), or by a file that is never sent, would bring
+            // the process down.
+            if (isFunction(this.stream.on)) {
+                this.stream.on('error', () => { });
+            }
         }
     }
     getStream() {

package/interfaces/http/csrf-protection-options.interface.d.ts

@@ -36,12 +36,13 @@ export interface CsrfProtectionOptions<TRequest = any> {
      * object. Only consulted for requests that would otherwise be rejected.
      *
      * Routes are declared like `MiddlewareConsumer.exclude()`: a path, or
-     * `{ path, method, version? }` to narrow by method (and URI version),
-     * without the global prefix, which is added unless the route is excluded
-     * from it. Unlike `exclude()`, the match is exact: case-sensitive, without
-     * an optional trailing slash, and never for non-canonical request paths
-     * (`//`, dot segments, `;`, encoded `/` or `.`), which a router could
-     * resolve to a route that is not excluded.
+     * `{ path, method, version? }` to narrow by method and version (the
+     * version segment of the path with URI versioning, the version the request
+     * asks for otherwise), without the global prefix, which is added unless
+     * the route is excluded from it. Unlike `exclude()`, the match is exact:
+     * case-sensitive, without an optional trailing slash, and never for
+     * non-canonical request paths (`//`, dot segments, `;`, encoded `/` or
+     * `.`), which a router could resolve to a route that is not excluded.
      */
     exclude?: (string | RouteInfo)[] | ((request: TRequest) => boolean);
 }

package/interfaces/http/http-server.interface.d.ts

@@ -1,4 +1,5 @@
 import { RequestMethod } from '../../enums/index.js';
+import { RouteInfo } from '../middleware/middleware-configuration.interface.js';
 import { NestApplicationOptions } from '../../interfaces/nest-application-options.interface.js';
 import { VersionValue, VersioningOptions } from '../version-options.interface.js';
 import { CookieSerializeOptions } from './cookie-options.interface.js';
@@ -51,6 +52,22 @@ export type SecurityRequestHook<TRequest = any> = (request: TRequest, response:
     setHeader(name: string, value: string): unknown;
     removeHeader(name: string): unknown;
 }) => Error | undefined;
+/**
+ * How a router matches request paths against route paths, returned by
+ * {@link HttpServer.getRouteMatchingOptions}.
+ *
+ * @publicApi
+ */
+export interface RouteMatchingOptions {
+    /**
+     * Whether `/Users` and `/users` are different paths.
+     */
+    caseSensitive: boolean;
+    /**
+     * Whether `/users/` is served by the `/users` route.
+     */
+    ignoreTrailingSlash: boolean;
+}
 /**
  * Contract between the Nest core (`NestApplication`, the router, the
  * middleware module and the exception layer) and an HTTP platform such as
@@ -419,8 +436,14 @@ export interface HttpServer<TRequest = any, TResponse = any, ServerInstance = an
      *
      * @param handler The `(req, res, next)` callback.
      * @param prefix The global prefix (`app.setGlobalPrefix()`), when set.
+     * @param excludedRoutes The routes `app.setGlobalPrefix()` excluded from the
+     * prefix, when any. They live at the root, so an adapter that scopes the
+     * handler by `prefix` should also mount it on each of these paths, for
+     * every method: with `exclude: ['hello']` and only `GET /hello` declared,
+     * `POST /hello` is still an unmatched request for a route Nest owns. Paths
+     * arrive already converted to the framework's route syntax.
      */
-    setNotFoundHandler?(handler: Function, prefix?: string): any;
+    setNotFoundHandler?(handler: Function, prefix?: string, excludedRoutes?: RouteInfo[]): any;
     /**
      * Serves static files; pass-through for `app.useStaticAssets()`. The
      * arguments are platform-specific. When not implemented,
@@ -517,11 +540,15 @@ export interface HttpServer<TRequest = any, TResponse = any, ServerInstance = an
      * features is enabled. The hook must run for every request (matched routes,
      * unmatched requests, routes outside the global prefix) before Nest
      * middleware, guards and route handlers, and before body parsing when the
-     * platform allows it; registering a framework-level middleware or request
-     * hook at call time satisfies that on Express and Fastify. It receives the
-     * request and the Node.js `ServerResponse` (`reply.raw` on Fastify), on
-     * which it may set headers that route handlers, `@Header()` and exception
-     * filters can still override.
+     * platform allows it. Registering a framework-level middleware at call time
+     * satisfies that on Express. An adapter whose {@link HttpServer.init} sets
+     * up what runs Nest middleware cannot register at call time, as
+     * `NestFactory.create()` calls `init()` first: `FastifyAdapter` adds its
+     * request hook in the constructor, and only stores the hook here.
+     *
+     * The hook receives the request and the Node.js `ServerResponse`
+     * (`reply.raw` on Fastify), on which it may set headers that route
+     * handlers, `@Header()` and exception filters can still override.
      *
      * When the hook returns an error, the adapter must not continue to the
      * route: it hands the error to the exception layer installed through
@@ -626,4 +653,15 @@ export interface HttpServer<TRequest = any, TResponse = any, ServerInstance = an
      * `(method, path)` registrations itself.
      */
     isRouteOrderSensitive?(): boolean;
+    /**
+     * Tells the core how the underlying router matches request paths, so that
+     * the routes excluded with `MiddlewareConsumer.exclude()` are matched the
+     * same way: a request only skips the middleware when the router serves it
+     * with the excluded route. Called once per `forRoutes()` call, during
+     * `app.init()`. When not implemented, excluded routes are matched exactly:
+     * case-sensitively and without an optional trailing slash. With a more
+     * lenient router, a request for `/Users/login/` then runs the middleware
+     * excluded for `users/login` rather than skipping it.
+     */
+    getRouteMatchingOptions?(): RouteMatchingOptions;
 }

package/interfaces/middleware/middleware-config-proxy.interface.d.ts

@@ -8,6 +8,11 @@ export interface MiddlewareConfigProxy {
     /**
      * Routes to exclude from the current middleware.
      *
+     * A route given with a `version` is only excluded for the requests for that
+     * version: with URI versioning, through the version segment of its path,
+     * and with header, media type or custom versioning, by the version the
+     * request asks for.
+     *
      * @param {(string | RouteInfo)[]} routes
      * @returns {MiddlewareConfigProxy}
      */

package/interfaces/nest-application.interface.d.ts

@@ -40,9 +40,10 @@ export interface INestApplication<TServer = any> extends INestApplicationContext
      *
      * Must be called once, before `app.init()` / `app.listen()`. The check runs
      * before Nest middleware, body parsing, guards and handlers. It shares one
-     * request hook with `app.useSecurityHeaders()`, registered where the first
-     * of the two is called: middleware registered with `app.use()` before that
-     * runs before the check.
+     * request hook with `app.useSecurityHeaders()`. On Express, the hook is
+     * registered where the first of the two is called, so middleware registered
+     * with `app.use()` before that runs before the check. On Fastify, the check
+     * runs before all middleware.
      *
      * @param {CsrfProtectionOptions} options
      * @returns {this}
@@ -60,9 +61,10 @@ export interface INestApplication<TServer = any> extends INestApplicationContext
      * route.
      *
      * Must be called once, before `app.init()` / `app.listen()`. It shares one
-     * request hook with `app.enableCsrfProtection()`, registered where the
-     * first of the two is called: middleware registered with `app.use()` before
-     * that runs first, so responses it ends itself do not carry the headers.
+     * request hook with `app.enableCsrfProtection()`. On Express, the hook is
+     * registered where the first of the two is called, so middleware registered
+     * with `app.use()` before that runs first, and responses it ends itself do
+     * not carry the headers. On Fastify, the hook runs before all middleware.
      *
      * @param {SecurityHeadersOptions} options
      * @returns {this}

package/internal.d.ts

@@ -25,7 +25,7 @@ export type { MiddlewareConfiguration, RouteInfo, } from './interfaces/middlewar
 export type { MiddlewareConfigProxy } from './interfaces/middleware/middleware-config-proxy.interface.js';
 export type { ModuleMetadata } from './interfaces/modules/module-metadata.interface.js';
 export type { HttpArgumentsHost, RpcArgumentsHost, WsArgumentsHost, } from './interfaces/features/arguments-host.interface.js';
-export type { RequestHandler, SecurityRequestHook, } from './interfaces/http/http-server.interface.js';
+export type { RequestHandler, RouteMatchingOptions, SecurityRequestHook, } from './interfaces/http/http-server.interface.js';
 export type { GetOrResolveOptions, SelectOptions, } from './interfaces/nest-application-context.interface.js';
 export type { ShutdownHooksOptions } from './interfaces/shutdown-hooks-options.interface.js';
 export { assignMetadata } from './decorators/http/route-params.decorator.js';

package/module-utils/utils/get-injection-providers.util.js

@@ -22,10 +22,11 @@ export function getInjectionProviders(providers, tokens) {
         const match = (providers ?? []).filter(p => !result.includes(p) && // this prevents circular loops and duplication
             (search.includes(p) || search.includes(p?.provide)));
         result.push(...match);
-        // get injection tokens of the matched providers, if any
+        // Follow factory dependencies and aliases to existing providers.
         search = match
-            .filter(p => p?.inject)
-            .flatMap(p => p.inject)
+            .flatMap(p => p?.useExisting !== undefined
+            ? [p.useExisting]
+            : (p?.inject ?? []))
             .map(mapInjectToTokens);
     }
     return result;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nestjs/common",
-  "version": "12.1.2",
+  "version": "12.2.0",
   "description": "Nest - modern, fast, powerful node.js web framework (@common)",
   "author": "Kamil Mysliwiec",
   "homepage": "https://nestjs.com",
@@ -21,6 +21,7 @@
   "main": "./index.js",
   "exports": {
     ".": "./index.js",
+    "./package.json": "./package.json",
     "./internal": "./internal.js",
     "./*.js": "./*.js",
     "./*": "./*.js"
@@ -47,5 +48,5 @@
       "optional": true
     }
   },
-  "gitHead": "8ab60aa1b2927fbe0e23135ffc65d610c623236a"
+  "gitHead": "af37111368de7fd2dfab0bdec2f530c7845510c2"
 }

package/pipes/default-value.pipe.d.ts

@@ -2,6 +2,11 @@ import { ArgumentMetadata, PipeTransform } from '../interfaces/features/pipe-tra
 /**
  * Defines the built-in DefaultValue Pipe
  *
+ * A default value that is an array or a plain object is copied on every call
+ * (along with the arrays and plain objects nested in it), so that a handler
+ * that mutates its argument does not change it for subsequent requests. Any
+ * other object (e.g., a class instance, a `Date` or a `Map`) is returned as is.
+ *
  * @see [Built-in Pipes](https://docs.nestjs.com/pipes#built-in-pipes)
  *
  * @publicApi
@@ -10,4 +15,10 @@ export declare class DefaultValuePipe<T = any, R = any> implements PipeTransform
     protected readonly defaultValue: R;
     constructor(defaultValue: R);
     transform(value?: T, _metadata?: ArgumentMetadata): T | R;
+    /**
+     * Copies `value` if it is an array or a plain object, along with the arrays
+     * and plain objects nested in it. `copies` maps the objects copied so far
+     * to their copies, so that shared and circular references are preserved.
+     */
+    protected copyDefaultValue<V>(value: V, copies?: Map<unknown, unknown>): V;
 }

package/pipes/default-value.pipe.js

@@ -1,9 +1,14 @@
 import { __decorate, __metadata } from "tslib";
 import { Injectable } from '../decorators/core/injectable.decorator.js';
-import { isNil, isNumber } from '../utils/shared.utils.js';
+import { isNil, isNumber, isPlainObject } from '../utils/shared.utils.js';
 /**
  * Defines the built-in DefaultValue Pipe
  *
+ * A default value that is an array or a plain object is copied on every call
+ * (along with the arrays and plain objects nested in it), so that a handler
+ * that mutates its argument does not change it for subsequent requests. Any
+ * other object (e.g., a class instance, a `Date` or a `Map`) is returned as is.
+ *
  * @see [Built-in Pipes](https://docs.nestjs.com/pipes#built-in-pipes)
  *
  * @publicApi
@@ -16,10 +21,31 @@ let DefaultValuePipe = class DefaultValuePipe {
     transform(value, _metadata) {
         if (isNil(value) ||
             (isNumber(value) && isNaN(value))) {
-            return this.defaultValue;
+            return this.copyDefaultValue(this.defaultValue);
         }
         return value;
     }
+    /**
+     * Copies `value` if it is an array or a plain object, along with the arrays
+     * and plain objects nested in it. `copies` maps the objects copied so far
+     * to their copies, so that shared and circular references are preserved.
+     */
+    copyDefaultValue(value, copies) {
+        const isArray = Array.isArray(value) && Object.getPrototypeOf(value) === Array.prototype;
+        if (!isArray && !isPlainObject(value)) {
+            return value;
+        }
+        copies ??= new Map();
+        if (copies.has(value)) {
+            return copies.get(value);
+        }
+        const copy = Object.assign(isArray ? [] : Object.create(Object.getPrototypeOf(value)), value);
+        copies.set(value, copy);
+        for (const key of Reflect.ownKeys(copy)) {
+            copy[key] = this.copyDefaultValue(copy[key], copies);
+        }
+        return copy;
+    }
 };
 DefaultValuePipe = __decorate([
     Injectable(),

package/pipes/file/file-type.validator.d.ts

@@ -7,6 +7,10 @@ export type FileTypeValidatorOptions = {
      * Expected file type(s) for validation. Can be a string (MIME type)
      * or a regular expression to match multiple types.
      *
+     * A string matches a MIME type that contains it, up to the end of a name:
+     * 'image/png' or 'png' matches 'image/png', and 'audio/wav' does not match
+     * 'audio/wavpack'.
+     *
      * @example
      * // Match a single MIME type
      * fileType: 'image/png'

package/pipes/file/file-type.validator.js

@@ -107,6 +107,14 @@ export class FileTypeValidator extends FileValidator {
         if (typeof fileType === 'string' && mimetype === fileType) {
             return true;
         }
-        return !!mimetype.match(fileType);
+        if (typeof fileType === 'string') {
+            // A string that ends in a letter or a digit must match up to the end
+            // of a name, or "audio/wav" would accept "audio/wavpack" and
+            // "font/woff" would accept "font/woff2".
+            return !!mimetype.match(/[a-z\d]$/i.test(fileType) ? `(?:${fileType})(?![\\w-])` : fileType);
+        }
+        // Stateful expressions must start at zero for each file, without changing
+        // the caller's lastIndex (the validator can be reused across uploads).
+        return !!mimetype.match(new RegExp(fileType));
     }
 }

package/pipes/parse-array.pipe.js

@@ -66,7 +66,9 @@ let ParseArrayPipe = class ParseArrayPipe {
             };
             const isExpectedTypePrimitive = this.isExpectedTypePrimitive();
             const toClassInstance = (item, index) => {
-                if (this.options.items !== String) {
+                // `JSON.parse` stringifies its argument first, so an array holding a
+                // single item (`[1]` becomes `'1'`) would be parsed as that item.
+                if (this.options.items !== String && isString(item)) {
                     try {
                         item = JSON.parse(item);
                     }
@@ -82,8 +84,8 @@ let ParseArrayPipe = class ParseArrayPipe {
             if (this.options.stopAtFirstError === false) {
                 // strict compare to "false" to make sure
                 // that this option is disabled by default
-                let errors = [];
-                const targetArray = value;
+                const errors = [];
+                const targetArray = Array.from(value);
                 for (let i = 0; i < targetArray.length; i++) {
                     try {
                         targetArray[i] = await toClassInstance(targetArray[i]);
@@ -102,7 +104,17 @@ let ParseArrayPipe = class ParseArrayPipe {
                         else {
                             message = err;
                         }
-                        errors = errors.concat(message);
+                        // Appended in place, since `concat()` would copy all the errors so
+                        // far for each invalid item, and one at a time, since one item can
+                        // have more errors than `push(...message)` takes arguments.
+                        if (Array.isArray(message)) {
+                            for (const item of message) {
+                                errors.push(item);
+                            }
+                        }
+                        else {
+                            errors.push(message);
+                        }
                     }
                 }
                 if (errors.length > 0) {
@@ -111,7 +123,18 @@ let ParseArrayPipe = class ParseArrayPipe {
                 return targetArray;
             }
             else {
-                value = await Promise.all(value.map(toClassInstance));
+                // One item at a time, up to the first that fails: validating them all
+                // at once kept the validation and the exception of every item alive
+                // together, and a string splits into up to one item per character.
+                const targetArray = value;
+                const items = [];
+                for (let i = 0; i < targetArray.length; i++) {
+                    // As with `map()`, the holes of a sparse array are not validated.
+                    items.push(i in targetArray
+                        ? await toClassInstance(targetArray[i], i)
+                        : undefined);
+                }
+                value = items;
             }
         }
         return value;

package/pipes/validation.pipe.d.ts

@@ -35,6 +35,16 @@ export interface ValidationPipeOptions extends ValidatorOptions {
      * If you have exception filters or interceptors that assume `message` is always an array, they will need to be updated.
      */
     errorFormat?: ValidationErrorFormat;
+    /**
+     * Maximum total length, in characters, of the messages in an error response
+     * of the built-in exception factory, counting the property path that comes
+     * with each message. The errors past it are left out, and a last message
+     * (in the 'grouped' format, a '...' entry) says so. Set it to `Infinity` to
+     * lift the limit.
+     *
+     * @default 1_000_000
+     */
+    maxErrorMessagesLength?: number;
 }
 /**
  * @see [Validation](https://docs.nestjs.com/techniques/validation)
@@ -51,19 +61,31 @@ export declare class ValidationPipe implements PipeTransform {
     protected exceptionFactory: (errors: ValidationError[]) => any;
     protected validateCustomDecorators: boolean;
     protected errorFormat: ValidationErrorFormat;
+    protected maxErrorMessagesLength: number;
     constructor(options?: ValidationPipeOptions);
     protected loadValidator(validatorPackage?: ValidatorPackage): ValidatorPackage | Promise<ValidatorPackage>;
     protected loadTransformer(transformerPackage?: TransformerPackage): TransformerPackage | Promise<TransformerPackage>;
     transform(value: unknown, metadata: ArgumentMetadata): Promise<any>;
     createExceptionFactory(): (validationErrors?: ValidationError[]) => unknown;
+    /**
+     * Leaves out the errors that come after the first "maxErrorMessagesLength"
+     * characters of messages. Each message counts with the path of its
+     * property, which is what makes the response to a deeply nested payload
+     * grow faster than the payload. The errors past the limit are not visited.
+     */
+    protected limitValidationErrors(validationErrors: ValidationError[], budget: {
+        remaining: number;
+        isExceeded: boolean;
+    }, parentPathLength?: number): ValidationError[];
     protected toValidate(metadata: ArgumentMetadata): boolean;
     protected transformPrimitive(value: unknown, metadata: ArgumentMetadata): unknown;
     protected toEmptyIfNil<T = any, R = T>(value: unknown, metatype: Type<unknown> | object): R | object | string;
     protected isPrimitive(value: unknown): boolean;
     protected stripProtoKeys(value: any): void;
     protected validate(object: object, validatorOptions?: ValidatorOptions): Promise<ValidationError[]> | ValidationError[];
+    protected hasValidationRules(metatype: Type<unknown>): Promise<boolean>;
     protected flattenValidationErrors(validationErrors: ValidationError[]): string[];
-    protected groupValidationErrors(validationErrors: ValidationError[], parentPath?: string): Record<string, string[]>;
-    protected mapChildrenToValidationErrors(error: ValidationError, parentPath?: string): ValidationError[];
+    protected groupValidationErrors(validationErrors: ValidationError[], parentPath?: string, result?: Record<string, string[]>): Record<string, string[]>;
+    protected mapChildrenToValidationErrors(error: ValidationError, parentPath?: string, validationErrors?: ValidationError[]): ValidationError[];
     protected prependConstraintsWithParentProp(parentPath: string, error: ValidationError): ValidationError;
 }

package/pipes/validation.pipe.js

@@ -7,6 +7,8 @@ import { HttpErrorByCode, } from '../utils/http-error-by-code.util.js';
 import { loadPackage } from '../utils/load-package.util.js';
 import { isNil, isUndefined } from '../utils/shared.utils.js';
 import { stripProtoKeys } from '../utils/strip-proto-keys.util.js';
+const DEFAULT_MAX_ERROR_MESSAGES_LENGTH = 1_000_000;
+const OMITTED_ERRORS_MESSAGE = 'Further validation errors were omitted';
 let classValidator = {};
 let classTransformer = {};
 /**
@@ -24,9 +26,10 @@ let ValidationPipe = class ValidationPipe {
     exceptionFactory;
     validateCustomDecorators;
     errorFormat;
+    maxErrorMessagesLength;
     constructor(options) {
         options = options || {};
-        const { transform, disableErrorMessages, errorHttpStatusCode, expectedType, transformOptions, exceptionFactory, validatorPackage, transformerPackage, validateCustomDecorators, errorFormat, ...validatorOptions } = options;
+        const { transform, disableErrorMessages, errorHttpStatusCode, expectedType, transformOptions, exceptionFactory, validatorPackage, transformerPackage, validateCustomDecorators, errorFormat, maxErrorMessagesLength, ...validatorOptions } = options;
         // @see [https://github.com/nestjs/nest/issues/10683#issuecomment-1413690508](https://github.com/nestjs/nest/issues/10683#issuecomment-1413690508)
         this.validatorOptions = { forbidUnknownValues: false, ...validatorOptions };
         this.isTransformEnabled = !!transform;
@@ -36,6 +39,8 @@ let ValidationPipe = class ValidationPipe {
         this.errorHttpStatusCode = errorHttpStatusCode || HttpStatus.BAD_REQUEST;
         this.expectedType = expectedType;
         this.errorFormat = errorFormat || 'list';
+        this.maxErrorMessagesLength =
+            maxErrorMessagesLength ?? DEFAULT_MAX_ERROR_MESSAGES_LENGTH;
         this.exceptionFactory = exceptionFactory || this.createExceptionFactory();
         classValidator = this.loadValidator(validatorPackage);
         classTransformer = this.loadTransformer(transformerPackage);
@@ -77,10 +82,33 @@ let ValidationPipe = class ValidationPipe {
             // metatype defined inside the handler
             entity = { constructor: metatype };
         }
-        const errors = await this.validate(entity, this.validatorOptions);
+        const errors = await this.validate(entity, {
+            ...this.validatorOptions,
+            // The target of an error is the whole object it was found in, so an
+            // exception factory that sends the errors would repeat that object
+            // once per error.
+            validationError: {
+                target: false,
+                ...this.validatorOptions.validationError,
+            },
+        });
         if (errors.length > 0) {
             throw await this.exceptionFactory(errors);
         }
+        if (isCtorNotEqual &&
+            (isPrimitive || Array.isArray(value)) &&
+            (await this.hasValidationRules(metatype))) {
+            // An array or a primitive is never an instance of the class: the
+            // validation above has only seen a stand-in without any property set,
+            // which passes when none of them is required.
+            throw await this.exceptionFactory([
+                {
+                    property: metadata.data || metadata.type,
+                    constraints: { isObject: 'Validation failed (object is expected)' },
+                    children: [],
+                },
+            ]);
+        }
         if (originalValue === undefined && originalEntity === '') {
             // Since SWC requires empty string for validation (to avoid an error),
             // a fallback is needed to revert to the original value (when undefined).
@@ -111,8 +139,16 @@ let ValidationPipe = class ValidationPipe {
             if (this.isDetailedOutputDisabled) {
                 return new HttpErrorByCode[this.errorHttpStatusCode]();
             }
+            const budget = {
+                remaining: this.maxErrorMessagesLength,
+                isExceeded: false,
+            };
+            validationErrors = this.limitValidationErrors(validationErrors, budget);
             if (this.errorFormat === 'grouped') {
-                const errors = this.groupValidationErrors(validationErrors);
+                let errors = this.groupValidationErrors(validationErrors);
+                if (budget.isExceeded) {
+                    errors = { ...errors, '...': [OMITTED_ERRORS_MESSAGE] };
+                }
                 // Custom (object) bodies are returned verbatim by
                 // `HttpException.createBody`, so add the standard envelope fields
                 // explicitly to match the shape of the "list" format.
@@ -123,10 +159,43 @@ let ValidationPipe = class ValidationPipe {
                     statusCode,
                 });
             }
-            const errors = this.flattenValidationErrors(validationErrors);
+            let errors = this.flattenValidationErrors(validationErrors);
+            if (budget.isExceeded) {
+                errors = [...errors, OMITTED_ERRORS_MESSAGE];
+            }
             return new HttpErrorByCode[this.errorHttpStatusCode](errors);
         };
     }
+    /**
+     * Leaves out the errors that come after the first "maxErrorMessagesLength"
+     * characters of messages. Each message counts with the path of its
+     * property, which is what makes the response to a deeply nested payload
+     * grow faster than the payload. The errors past the limit are not visited.
+     */
+    limitValidationErrors(validationErrors, budget, parentPathLength = 0) {
+        const limited = [];
+        let isChanged = false;
+        for (const error of validationErrors) {
+            if (budget.remaining <= 0) {
+                budget.isExceeded = true;
+                return limited;
+            }
+            const pathLength = parentPathLength + String(error.property).length + 1;
+            for (const key in error.constraints) {
+                budget.remaining -= pathLength + String(error.constraints[key]).length;
+            }
+            const children = error.children &&
+                this.limitValidationErrors(error.children, budget, pathLength);
+            if (children === error.children) {
+                limited.push(error);
+            }
+            else {
+                limited.push({ ...error, children });
+                isChanged = true;
+            }
+        }
+        return isChanged ? limited : validationErrors;
+    }
     toValidate(metadata) {
         const { metatype, type } = metadata;
         if (type === 'custom' && !this.validateCustomDecorators) {
@@ -191,6 +260,11 @@ let ValidationPipe = class ValidationPipe {
     validate(object, validatorOptions) {
         return classValidator.validate(object, validatorOptions);
     }
+    async hasValidationRules(metatype) {
+        // "forbidUnknownValues" rejects a class without any rule that applies
+        const errors = await this.validate({ constructor: metatype }, { ...this.validatorOptions, forbidUnknownValues: true });
+        return !errors.some(error => error.constraints?.unknownValue);
+    }
     flattenValidationErrors(validationErrors) {
         return iterate(validationErrors)
             .map(error => this.mapChildrenToValidationErrors(error))
@@ -200,8 +274,7 @@ let ValidationPipe = class ValidationPipe {
             .flatten()
             .toArray();
     }
-    groupValidationErrors(validationErrors, parentPath) {
-        const result = {};
+    groupValidationErrors(validationErrors, parentPath, result = {}) {
         for (const error of validationErrors) {
             const path = parentPath
                 ? `${parentPath}.${error.property}`
@@ -210,24 +283,42 @@ let ValidationPipe = class ValidationPipe {
                 result[path] = Object.values(error.constraints);
             }
             if (error.children && error.children.length) {
-                Object.assign(result, this.groupValidationErrors(error.children, path));
+                // Nested errors go into the same result: copying each level's result
+                // into its parent took as many insertions as depth times leaves.
+                const nested = this.groupValidationErrors(error.children, path, result);
+                if (nested !== result) {
+                    // an override returned a result of its own
+                    Object.assign(result, nested);
+                }
             }
         }
         return result;
     }
-    mapChildrenToValidationErrors(error, parentPath) {
+    mapChildrenToValidationErrors(error, parentPath, validationErrors = []) {
+        const currentError = parentPath
+            ? this.prependConstraintsWithParentProp(parentPath, error)
+            : error;
         if (!(error.children && error.children.length)) {
-            return [error];
+            validationErrors.push(currentError);
+            return validationErrors;
+        }
+        if (error.constraints) {
+            validationErrors.push(currentError);
         }
-        const validationErrors = [];
         parentPath = parentPath
             ? `${parentPath}.${error.property}`
             : error.property;
         for (const item of error.children) {
-            if (item.children && item.children.length) {
-                validationErrors.push(...this.mapChildrenToValidationErrors(item, parentPath));
+            // Nested errors go into the same list: copying each level's list into
+            // its parent took as many copies as depth times leaves, and spreading
+            // a long one into push() threw a RangeError.
+            const nested = this.mapChildrenToValidationErrors(item, parentPath, validationErrors);
+            if (nested !== validationErrors) {
+                // an override returned a list of its own
+                for (const nestedError of nested) {
+                    validationErrors.push(nestedError);
+                }
             }
-            validationErrors.push(this.prependConstraintsWithParentProp(parentPath, item));
         }
         return validationErrors;
     }

package/serializer/class-serializer.interceptor.js

@@ -6,6 +6,11 @@ import { loadPackage } from '../utils/load-package.util.js';
 import { isObject } from '../utils/shared.utils.js';
 import { CLASS_SERIALIZER_OPTIONS } from './class-serializer.constants.js';
 let classTransformer = {};
+// The package of the interceptor created last, which may still be loading.
+// "intercept()" resolves it into "classTransformer", so that an interceptor
+// created while responses are serialized (e.g. a request-scoped one) doesn't
+// put a promise in place of the package they use.
+let pendingClassTransformer;
 // NOTE (external)
 // We need to deduplicate them here due to the circular dependency
 // between core and common packages
@@ -19,12 +24,15 @@ let ClassSerializerInterceptor = class ClassSerializerInterceptor {
     constructor(reflector, defaultOptions = {}) {
         this.reflector = reflector;
         this.defaultOptions = defaultOptions;
-        classTransformer =
+        pendingClassTransformer =
             defaultOptions?.transformerPackage ??
                 loadPackage('class-transformer', 'ClassSerializerInterceptor', () => import('class-transformer'));
+        if (!(pendingClassTransformer instanceof Promise)) {
+            classTransformer = pendingClassTransformer;
+        }
     }
     async intercept(context, next) {
-        classTransformer = (await classTransformer);
+        classTransformer = (await pendingClassTransformer);
         const contextOptions = this.getContextOptions(context);
         const options = {
             ...this.defaultOptions,

package/serializer/standard-schema-serializer.interceptor.js

@@ -60,10 +60,19 @@ let StandardSchemaSerializerInterceptor = class StandardSchemaSerializerIntercep
         return result.value;
     }
     getContextOptions(context) {
-        return this.reflector.getAllAndOverride(CLASS_SERIALIZER_OPTIONS, [
+        const [handlerOptions, classOptions] = this.reflector.getAll(CLASS_SERIALIZER_OPTIONS, [
             context.getHandler(),
             context.getClass(),
         ]);
+        if (!handlerOptions || !classOptions) {
+            return handlerOptions ?? classOptions;
+        }
+        // Key by key, so that a handler that only sets "validateOptions" (or the
+        // options of another serializer) doesn't drop the schema of its class
+        return {
+            schema: handlerOptions.schema ?? classOptions.schema,
+            validateOptions: handlerOptions.validateOptions ?? classOptions.validateOptions,
+        };
     }
 };
 StandardSchemaSerializerInterceptor = __decorate([

package/services/console-logger.service.d.ts

@@ -23,6 +23,9 @@ export interface ConsoleLoggerOptions {
     prefix?: string;
     /**
      * If enabled, will print the log message in JSON format.
+     * Unless `colors` are enabled or `compact` is not true, a record is cut short
+     * at about 1,000,000 characters: what comes past that point is replaced with
+     * "[Truncated]".
      */
     json?: boolean;
     /**
@@ -49,28 +52,28 @@ export interface ConsoleLoggerOptions {
     /**
      * Specifies the maximum number of Array, TypedArray, Map, Set, WeakMap, and WeakSet elements to include when formatting.
      * Set to null or Infinity to show all elements. Set to 0 or negative to show no elements.
-     * Ignored when `json` is enabled, colors are disabled, and `compact` is set to true as it produces a parseable JSON output.
+     * When `json` is enabled, colors are disabled, and `compact` is set to true, only applies to Map, Set and Error values, which are inspected; everything else is serialized as JSON.
      * @default 100
      */
     maxArrayLength?: number;
     /**
      * Specifies the maximum number of characters to include when formatting.
      * Set to null or Infinity to show all elements. Set to 0 or negative to show no characters.
-     * Ignored when `json` is enabled, colors are disabled, and `compact` is set to true as it produces a parseable JSON output.
+     * When `json` is enabled, colors are disabled, and `compact` is set to true, only applies to Map, Set and Error values, which are inspected; everything else is serialized as JSON.
      * @default 10000.
      */
     maxStringLength?: number;
     /**
      * If enabled, will sort keys while formatting objects.
      * Can also be a custom sorting function.
-     * Ignored when `json` is enabled, colors are disabled, and `compact` is set to true as it produces a parseable JSON output.
+     * When `json` is enabled, colors are disabled, and `compact` is set to true, only applies to Map, Set and Error values, which are inspected; everything else is serialized as JSON.
      * @default false
      */
     sorted?: boolean | ((a: string, b: string) => number);
     /**
      * Specifies the number of times to recurse while formatting object.
      * This is useful for inspecting large objects. To recurse up to the maximum call stack size pass Infinity or null.
-     * Ignored when `json` is enabled, colors are disabled, and `compact` is set to true as it produces a parseable JSON output.
+     * When `json` is enabled, colors are disabled, and `compact` is set to true, only applies to Map, Set and Error values, which are inspected; everything else is serialized as JSON.
      * @default 5
      */
     depth?: number;
@@ -83,7 +86,7 @@ export interface ConsoleLoggerOptions {
     /**
      * The length at which input values are split across multiple lines. Set to Infinity to format the input as a single line (in combination with "compact" set to true).
      * Default Infinity when "compact" is true, 80 otherwise.
-     * Ignored when `json` is enabled, colors are disabled, and `compact` is set to true as it produces a parseable JSON output.
+     * When `json` is enabled, colors are disabled, and `compact` is set to true, only applies to Map, Set and Error values, which are inspected; everything else is serialized as JSON.
      */
     breakLength?: number;
     /**
@@ -276,7 +279,8 @@ export declare class ConsoleLogger implements LoggerService {
     protected getInspectOptions(): InspectOptions;
     /**
      * Serializes a JSON log object without ever throwing: circular references
-     * are replaced with "[Circular]", and a value that cannot be serialized
+     * are replaced with "[Circular]", whatever comes past `MAX_JSON_LENGTH`
+     * characters with "[Truncated]", and a value that cannot be serialized
      * (e.g. a throwing `toJSON()`) makes the whole record fall back to `inspect`.
      */
     protected stringifyJsonLogObject(logObject: Record<string, unknown>): string;
@@ -292,19 +296,19 @@ export declare class ConsoleLogger implements LoggerService {
     };
     protected getContextAndStackAndMessagesToPrint(args: unknown[]): {
         messages: unknown[];
-        stack: string;
         context: string | undefined;
         params?: undefined;
+        stack?: undefined;
     } | {
         messages: unknown[];
         context: string | undefined;
-        params?: undefined;
+        params: any;
         stack?: undefined;
     } | {
         messages: unknown[];
+        stack: string;
         context: string | undefined;
-        params: any;
-        stack?: undefined;
+        params?: undefined;
     } | {
         stack: string | undefined;
         messages: unknown[];

package/services/console-logger.service.js

@@ -13,6 +13,13 @@ const DEFAULT_DEPTH = 5;
  * serialized in JSON mode.
  */
 const MAX_ERROR_DEPTH = 5;
+/**
+ * The approximate number of characters up to which a record is serialized in
+ * JSON mode. An object is written out once per reference to it, so a small
+ * value can expand to a huge record; past this length, objects and strings
+ * are replaced with "[Truncated]".
+ */
+const MAX_JSON_LENGTH = 1_000_000;
 const DEFAULT_LOG_LEVELS = [
     'log',
     'error',
@@ -466,16 +473,32 @@ let ConsoleLogger = class ConsoleLogger {
     }
     /**
      * Serializes a JSON log object without ever throwing: circular references
-     * are replaced with "[Circular]", and a value that cannot be serialized
+     * are replaced with "[Circular]", whatever comes past `MAX_JSON_LENGTH`
+     * characters with "[Truncated]", and a value that cannot be serialized
      * (e.g. a throwing `toJSON()`) makes the whole record fall back to `inspect`.
      */
     stringifyJsonLogObject(logObject) {
-        const replacer = this.stringifyReplacer;
+        const replacer = this.stringifyReplacer.bind(this);
         // Objects on the path from the root to the value being serialized.
         const ancestors = [];
+        // Approximate length of the output so far (array indices aren't written).
+        let length = 0;
         try {
             return JSON.stringify(logObject, function (key, value) {
-                value = replacer.call(this, key, value);
+                value = replacer(key, value);
+                length +=
+                    (Array.isArray(this) ? 0 : key.length) +
+                        (isString(value) || typeof value === 'number'
+                            ? String(value).length
+                            : 1);
+                if (length > MAX_JSON_LENGTH) {
+                    // A primitive in place of an object is not descended into, so the
+                    // walk stops here on every branch past the limit.
+                    return isString(value) ||
+                        (typeof value === 'object' && value !== null)
+                        ? '[Truncated]'
+                        : value;
+                }
                 if (typeof value !== 'object' || value === null) {
                     return value;
                 }
@@ -550,8 +573,11 @@ let ConsoleLogger = class ConsoleLogger {
         return { messages, context, params };
     }
     getContextAndStackAndMessagesToPrint(args) {
+        if (args.length === 1) {
+            return { ...this.getContextAndMessagesToPrint(args) };
+        }
         if (args.length === 2) {
-            if (this.isStackFormat(args[1])) {
+            if (this.isStackFormat(args[1]) || isUndefined(args[1])) {
                 return {
                     messages: [args[0]],
                     stack: args[1],
@@ -591,7 +617,9 @@ let ConsoleLogger = class ConsoleLogger {
         if (!isString(stack) && !isUndefined(stack)) {
             return false;
         }
-        return /^(.)+\n\s+at .+:\d+:\d+/.test(stack);
+        // `[ \t]+` rather than `\s+`, which also matches "\n" and would make this
+        // unanchored search backtrack quadratically on long runs of newlines.
+        return /\n[ \t]+at .+:\d+:\d+/.test(stack);
     }
     getColorByLogLevel(level) {
         switch (level) {

package/services/utils/redact.util.d.ts

@@ -18,9 +18,11 @@ export type Redactor = (value: unknown) => unknown;
  * `AggregateError#errors`), `Map`s (string keys) and `Set`s are traversed.
  * Only the objects on the way to a redacted property are copied; the rest is
  * returned as is, and the input is never mutated. A circular reference is
- * replaced with `"[Circular]"` (so the objects on the cycle are copied too). If
- * the value can't be traversed (for example, a getter throws), the whole value
- * is replaced with the censor.
+ * replaced with `"[Circular]"` (so the objects on the cycle are copied too). An
+ * object that is referenced several times is traversed (and copied) once for
+ * all the references a dotted path can't tell apart. If the value can't be
+ * traversed (for example, a getter throws), the whole value is replaced with
+ * the censor.
  *
  * @returns `undefined` when there is nothing to redact.
  */

package/services/utils/redact.util.js

@@ -14,9 +14,11 @@ const CIRCULAR = '[Circular]';
  * `AggregateError#errors`), `Map`s (string keys) and `Set`s are traversed.
  * Only the objects on the way to a redacted property are copied; the rest is
  * returned as is, and the input is never mutated. A circular reference is
- * replaced with `"[Circular]"` (so the objects on the cycle are copied too). If
- * the value can't be traversed (for example, a getter throws), the whole value
- * is replaced with the censor.
+ * replaced with `"[Circular]"` (so the objects on the cycle are copied too). An
+ * object that is referenced several times is traversed (and copied) once for
+ * all the references a dotted path can't tell apart. If the value can't be
+ * traversed (for example, a getter throws), the whole value is replaced with
+ * the censor.
  *
  * @returns `undefined` when there is nothing to redact.
  */
@@ -38,11 +40,18 @@ export function createRedactor(paths, censor = DEFAULT_REDACT_CENSOR) {
     if (keys.size === 0 && dottedPaths.length === 0) {
         return undefined;
     }
+    // How many of the keys leading to an object the dotted paths can look at.
+    const contextLength = Math.max(0, ...dottedPaths.map(segments => segments.length - 1));
     return (value) => {
         // Lower-cased keys from the root to the value being visited.
         const path = [];
         // Objects on that path, to detect circular references.
         const ancestors = [];
+        // What each visited object was replaced with, by the last keys leading to
+        // it (a dotted path can match under some keys and not under others).
+        // Otherwise, an object referenced many times would be traversed, and
+        // copied, once per reference.
+        const visited = new Map();
         const isRedacted = (key) => {
             if (keys.has(key)) {
                 return true;
@@ -82,6 +91,15 @@ export function createRedactor(paths, censor = DEFAULT_REDACT_CENSOR) {
             if (ancestors.includes(current)) {
                 return CIRCULAR;
             }
+            const context = contextLength > 0 ? JSON.stringify(path.slice(-contextLength)) : '';
+            let results = visited.get(context);
+            if (!results) {
+                results = new Map();
+                visited.set(context, results);
+            }
+            if (results.has(current)) {
+                return results.get(current);
+            }
             let redacted;
             ancestors.push(current);
             if (Array.isArray(current)) {
@@ -103,6 +121,7 @@ export function createRedactor(paths, censor = DEFAULT_REDACT_CENSOR) {
                 redacted = redactObject(current);
             }
             ancestors.pop();
+            results.set(current, redacted);
             return redacted;
         };
         const redactArray = (array) => {

package/utils/parameter-decorator-options.util.d.ts

@@ -8,6 +8,9 @@ import type { ParameterDecoratorOptions } from '../decorators/http/route-params.
  * arguments identically: a pipe instance that happens to expose a `schema` or
  * `pipes` property must never be mistaken for an options object.
  *
+ * `createParamDecorator` applies a stricter check to its first argument, since
+ * that argument may also be arbitrary custom data.
+ *
  * @internal
  */
 export declare function isParameterDecoratorOptions(value: unknown): value is ParameterDecoratorOptions;

package/utils/parameter-decorator-options.util.js

@@ -12,6 +12,9 @@ const isPipeLike = (value) => isFunction(value?.transform) ||
  * arguments identically: a pipe instance that happens to expose a `schema` or
  * `pipes` property must never be mistaken for an options object.
  *
+ * `createParamDecorator` applies a stricter check to its first argument, since
+ * that argument may also be arbitrary custom data.
+ *
  * @internal
  */
 export function isParameterDecoratorOptions(value) {

package/utils/strip-proto-keys.util.js

@@ -17,7 +17,11 @@ export function stripProtoKeys(value) {
         return;
     }
     if (Array.isArray(value)) {
-        for (const v of value) {
+        // Only the items that are present: the length of a sparse array (e.g.
+        // one built from a multipart field named `tags[4294967294]`) can be far
+        // beyond its number of items, and a loop over every index would block
+        // the event loop for as long. `Object.values()` skips the holes.
+        for (const v of Object.values(value)) {
             stripProtoKeys(v);
         }
         return;
@@ -25,9 +29,9 @@ export function stripProtoKeys(value) {
     // Delete dangerous prototype pollution keys
     delete value.__proto__;
     delete value.prototype;
-    // Only delete constructor if it's NOT a built-in type
-    const constructorType = value?.constructor;
-    if (constructorType && !BUILT_IN_TYPES.includes(constructorType)) {
+    // Only delete constructor if it's NOT a built-in type, whatever its value:
+    // a falsy one (null, 0, false, "") shadows the prototype's all the same
+    if (!BUILT_IN_TYPES.includes(value.constructor)) {
         delete value.constructor;
     }
     for (const key in value) {