@nestjs/platform-express 12.1.1 → 12.1.3

package/adapters/express-adapter.d.ts

@@ -5,7 +5,7 @@ import * as http from 'http';
 import * as https from 'https';
 import { NestExpressBodyParserOptionsFor, NestExpressBodyParserType } from '../interfaces/nest-express-body-parser.interface.js';
 import { ServeStaticOptions } from '../interfaces/serve-static-options.interface.js';
-import { type CorsOptions, type CorsOptionsDelegate, type VersionValue } from '@nestjs/common/internal';
+import { type CorsOptions, type CorsOptionsDelegate, type RouteInfo, type VersionValue } from '@nestjs/common/internal';
 import type { NestApplicationOptions } from '@nestjs/common';
 import { AbstractHttpAdapter } from '@nestjs/core';
 type VersionedRoute = <TRequest extends Record<string, any> = any, TResponse = any>(req: TRequest, res: TResponse, next: () => void) => any;
@@ -21,7 +21,18 @@ export declare class ExpressAdapter extends AbstractHttpAdapter<http.Server | ht
     private onRequestHook?;
     private onResponseHook?;
     constructor(instance?: any);
-    setOnRequestHook(onRequestHook: (req: express.Request, res: express.Response, done: () => void) => Promise<void> | void): void;
+    private runRequestHook;
+    /**
+     * Registers a request hook. Call `done()` to continue processing the request;
+     * resolving the returned promise does not continue it. Only the first
+     * completion is forwarded to Express. Errors after `done()` are logged
+     * without advancing the request again.
+     */
+    setOnRequestHook(onRequestHook: (req: express.Request, res: express.Response, done: (err?: Error) => void) => Promise<void> | void): void;
+    /**
+     * Registers a hook to run after the response has been sent.
+     * Thrown errors and rejected promises are logged.
+     */
     setOnResponseHook(onResponseHook: (req: express.Request, res: express.Response) => Promise<void> | void): void;
     reply(response: any, body: any, statusCode?: number): any;
     status(response: any, statusCode: number): any;
@@ -29,7 +40,7 @@ export declare class ExpressAdapter extends AbstractHttpAdapter<http.Server | ht
     render(response: any, view: string, options: any): any;
     redirect(response: any, statusCode: number, url: string): any;
     setErrorHandler(handler: Function, prefix?: string): any;
-    setNotFoundHandler(handler: Function, prefix?: string): any;
+    setNotFoundHandler(handler: Function, prefix?: string, excludedRoutes?: RouteInfo[]): any;
     isHeadersSent(response: any): boolean;
     getHeader(response: any, name: string): any;
     setHeader(response: any, name: string, value: string): any;

package/adapters/express-adapter.js

@@ -4,10 +4,18 @@ import express from 'express';
 import * as http from 'http';
 import * as https from 'https';
 import { pathToRegexp } from 'path-to-regexp';
+import { finished } from 'stream';
 import { getBodyParserOptions } from './utils/get-body-parser-options.util.js';
+import { getMediaTypeVersion } from './utils/get-media-type-version.util.js';
 import { addLeadingSlash, isFunction, isNil, isObject, isString, isUndefined, stripEndSlash, } from '@nestjs/common/internal';
 import { AbstractHttpAdapter } from '@nestjs/core';
 import { RouterMethodFactory, LegacyRouteConverter, } from '@nestjs/core/internal';
+// Covers "application/json" and the "+json" structured syntax suffix (RFC 6839),
+// e.g. "application/problem+json", with or without parameters.
+function isJsonContentType(contentType) {
+    const mediaType = contentType.split(';')[0].trim().toLowerCase();
+    return (mediaType.startsWith('application/json') || mediaType.endsWith('+json'));
+}
 /**
  * @publicApi
  */
@@ -23,21 +31,59 @@ export class ExpressAdapter extends AbstractHttpAdapter {
         super(instance || express());
         this.instance.use((req, res, next) => {
             if (this.onResponseHook) {
-                res.on('finish', () => {
-                    void this.onResponseHook.apply(this, [req, res]);
+                res.on('finish', async () => {
+                    try {
+                        await this.onResponseHook.apply(this, [req, res]);
+                    }
+                    catch (err) {
+                        this.logger.error(err);
+                    }
                 });
             }
             if (this.onRequestHook) {
-                void this.onRequestHook.apply(this, [req, res, next]);
+                this.runRequestHook(req, res, next);
             }
             else {
                 next();
             }
         });
     }
+    runRequestHook(req, res, next) {
+        let completed = false;
+        const doneOnce = (err) => {
+            if (completed) {
+                if (err) {
+                    this.logger.error(err);
+                }
+                return;
+            }
+            completed = true;
+            next(err);
+        };
+        try {
+            // Not returned to Express: rejections share the once-guard with done()
+            const result = this.onRequestHook.call(this, req, res, doneOnce);
+            if (result && typeof result.then === 'function') {
+                result.then(undefined, err => doneOnce(err || new Error('Request hook failed')));
+            }
+        }
+        catch (err) {
+            doneOnce(err || new Error('Request hook failed'));
+        }
+    }
+    /**
+     * Registers a request hook. Call `done()` to continue processing the request;
+     * resolving the returned promise does not continue it. Only the first
+     * completion is forwarded to Express. Errors after `done()` are logged
+     * without advancing the request again.
+     */
     setOnRequestHook(onRequestHook) {
         this.onRequestHook = onRequestHook;
     }
+    /**
+     * Registers a hook to run after the response has been sent.
+     * Thrown errors and rejected promises are logged.
+     */
     setOnResponseHook(onResponseHook) {
         this.onResponseHook = onResponseHook;
     }
@@ -54,13 +100,20 @@ export class ExpressAdapter extends AbstractHttpAdapter {
             stream.once('error', err => {
                 body.errorHandler(err, response);
             });
+            // pipe() leaves the source open when the client disconnects early,
+            // also before reply() runs ("close" has already fired by then)
+            finished(response, () => {
+                if (!stream.readableEnded) {
+                    stream.destroy();
+                }
+            });
             return stream
                 .pipe(response)
                 .on('error', (err) => body.errorLogger(err));
         }
         const responseContentType = response.getHeader('Content-Type');
         if (typeof responseContentType === 'string' &&
-            !responseContentType.startsWith('application/json') &&
+            !isJsonContentType(responseContentType) &&
             body?.statusCode >= HttpStatus.BAD_REQUEST) {
             this.logger.warn("Content-Type doesn't match Reply body, you might need a custom ExceptionFilter for non-JSON responses");
             response.setHeader('Content-Type', 'application/json');
@@ -91,13 +144,23 @@ export class ExpressAdapter extends AbstractHttpAdapter {
         // root-mounted routes) still pass through the exception layer.
         return this.use(handler);
     }
-    setNotFoundHandler(handler, prefix) {
+    setNotFoundHandler(handler, prefix, excludedRoutes) {
         const normalizedPrefix = this.normalizePrefix(prefix);
         if (normalizedPrefix) {
             this.registeredPrefixes.add(normalizedPrefix);
             const router = express.Router();
             router.all('*path', handler);
-            return this.use(normalizedPrefix, router);
+            this.use(normalizedPrefix, router);
+            // Excluded routes live at the root, out of the prefix router's reach.
+            // Mount the handler on each exact path, for every method, so a method
+            // miss there (`POST /hello` with only `GET /hello`) still reaches the
+            // exception layer. Not `use(path, router)`: a subtree mount would claim
+            // a raw `/hello/live` added after `init()`; a wildcard exclusion covers
+            // its subtree through its own pattern.
+            for (const route of excludedRoutes ?? []) {
+                this.instance.all(addLeadingSlash(route.path), handler);
+            }
+            return;
         }
         return this.use((req, res, next) => {
             // When multiple apps share this adapter, a non-prefixed app's 404
@@ -195,10 +258,22 @@ export class ExpressAdapter extends AbstractHttpAdapter {
     createMiddlewareFactory(requestMethod) {
         return (path, callback) => {
             try {
-                const convertedPath = LegacyRouteConverter.tryConvert(path);
-                return this.routerMethodFactory
-                    .get(this.instance, requestMethod)
-                    .call(this.instance, convertedPath, callback);
+                // The core marks an exact-match path with a trailing "$" (e.g. "/api$").
+                // Express 5 reads "$" literally and "use()" matches by prefix, so strip
+                // the marker and register the path as an exact "all()" route instead.
+                const isExactPath = path.endsWith('$');
+                const convertedPath = LegacyRouteConverter.tryConvert(isExactPath ? path.slice(0, -1) : path);
+                let router = this.routerMethodFactory.get(this.instance, requestMethod);
+                if (isExactPath && router === this.instance.use) {
+                    router = this.instance.all;
+                }
+                // Express routes are not strict, so "/api" also matches "/api/". That
+                // path is left to the wildcard entry registered next to it (an optional
+                // "{*path}" matches it), so the middleware doesn't run twice.
+                const handler = isExactPath
+                    ? (req, res, next) => req.path.endsWith('/') ? next() : callback(req, res, next)
+                    : callback;
+                return router.call(this.instance, convertedPath, handler);
             }
             catch (e) {
                 if (e instanceof TypeError) {
@@ -308,11 +383,9 @@ export class ExpressAdapter extends AbstractHttpAdapter {
                 const MEDIA_TYPE_HEADER = 'Accept';
                 const acceptHeaderValue = req.headers?.[MEDIA_TYPE_HEADER] ||
                     req.headers?.[MEDIA_TYPE_HEADER.toLowerCase()];
-                const acceptHeaderVersionParameter = acceptHeaderValue
-                    ? acceptHeaderValue.split(';')[1]
-                    : undefined;
+                const headerVersion = getMediaTypeVersion(acceptHeaderValue, versioningOptions.key);
                 // No version was supplied
-                if (isUndefined(acceptHeaderVersionParameter)) {
+                if (isUndefined(headerVersion)) {
                     if (Array.isArray(version)) {
                         if (version.includes(VERSION_NEUTRAL)) {
                             return handler(req, res, next);
@@ -320,7 +393,6 @@ export class ExpressAdapter extends AbstractHttpAdapter {
                     }
                 }
                 else {
-                    const headerVersion = acceptHeaderVersionParameter.split(versioningOptions.key)[1];
                     if (Array.isArray(version)) {
                         if (version.includes(headerVersion)) {
                             return handler(req, res, next);

package/adapters/utils/get-media-type-version.util.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Returns the version carried by an `Accept` header for media type versioning,
+ * e.g. `2` for `application/json;v=2` with the `v=` key.
+ *
+ * The version parameter may follow other parameters and may belong to any
+ * media range of a list (`text/html, application/json;v=2`); the first match
+ * wins. Returns `undefined` when no parameter starts with the key.
+ *
+ * Duplicated in each platform package so that a platform package never
+ * depends on a newer `@nestjs/core` than the one installed.
+ */
+export declare function getMediaTypeVersion(acceptHeader: string | string[] | undefined, key: string): string | undefined;

package/adapters/utils/get-media-type-version.util.js

@@ -0,0 +1,26 @@
+/**
+ * Returns the version carried by an `Accept` header for media type versioning,
+ * e.g. `2` for `application/json;v=2` with the `v=` key.
+ *
+ * The version parameter may follow other parameters and may belong to any
+ * media range of a list (`text/html, application/json;v=2`); the first match
+ * wins. Returns `undefined` when no parameter starts with the key.
+ *
+ * Duplicated in each platform package so that a platform package never
+ * depends on a newer `@nestjs/core` than the one installed.
+ */
+export function getMediaTypeVersion(acceptHeader, key) {
+    const mediaRanges = []
+        .concat(acceptHeader ?? [])
+        .flatMap(value => value.split(','));
+    for (const mediaRange of mediaRanges) {
+        const [, ...parameters] = mediaRange.split(';');
+        for (const parameter of parameters) {
+            const trimmedParameter = parameter.trim();
+            if (trimmedParameter.startsWith(key)) {
+                return trimmedParameter.slice(key.length);
+            }
+        }
+    }
+    return undefined;
+}

package/multer/interfaces/multer-options.interface.d.ts

@@ -16,6 +16,10 @@ export interface MulterLimits {
     parts?: number;
     /** For multipart forms, the max number of header key=> value pairs to parse Default: 2000(same as node's http). */
     headerPairs?: number;
+    /** Max nesting depth of field names; `a[b][c]` has 2 levels (Default: Infinity) */
+    fieldNestingDepth?: number;
+    /** Max numeric array index accepted in field names; `a[3]` uses index 3 (Default: Infinity) */
+    fieldArrayIndexLimit?: number;
 }
 /**
  * @see https://github.com/expressjs/multer

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nestjs/platform-express",
-  "version": "12.1.1",
+  "version": "12.1.3",
   "description": "Nest - modern, fast, powerful node.js web framework (@platform-express)",
   "author": "Kamil Mysliwiec",
   "license": "MIT",
@@ -32,12 +32,12 @@
     "tslib": "2.8.1"
   },
   "devDependencies": {
-    "@nestjs/common": "12.1.1",
-    "@nestjs/core": "12.1.1"
+    "@nestjs/common": "12.1.3",
+    "@nestjs/core": "12.1.3"
   },
   "peerDependencies": {
     "@nestjs/common": "^12.0.0",
     "@nestjs/core": "^12.0.0"
   },
-  "gitHead": "9feedffde8ef8c86f0cd521153740575dc579d88"
+  "gitHead": "4514623279f6087808e3c8f08fbf9f37d3c17482"
 }