@nestjs/platform-express 12.1.2 → 12.2.0

package/adapters/express-adapter.d.ts

@@ -5,7 +5,7 @@ import * as http from 'http';
 import * as https from 'https';
 import { NestExpressBodyParserOptionsFor, NestExpressBodyParserType } from '../interfaces/nest-express-body-parser.interface.js';
 import { ServeStaticOptions } from '../interfaces/serve-static-options.interface.js';
-import { type CorsOptions, type CorsOptionsDelegate, type VersionValue } from '@nestjs/common/internal';
+import { type CorsOptions, type CorsOptionsDelegate, type RouteInfo, type VersionValue } from '@nestjs/common/internal';
 import type { NestApplicationOptions } from '@nestjs/common';
 import { AbstractHttpAdapter } from '@nestjs/core';
 type VersionedRoute = <TRequest extends Record<string, any> = any, TResponse = any>(req: TRequest, res: TResponse, next: () => void) => any;
@@ -21,7 +21,18 @@ export declare class ExpressAdapter extends AbstractHttpAdapter<http.Server | ht
     private onRequestHook?;
     private onResponseHook?;
     constructor(instance?: any);
-    setOnRequestHook(onRequestHook: (req: express.Request, res: express.Response, done: () => void) => Promise<void> | void): void;
+    private runRequestHook;
+    /**
+     * Registers a request hook. Call `done()` to continue processing the request;
+     * resolving the returned promise does not continue it. Only the first
+     * completion is forwarded to Express. Errors after `done()` are logged
+     * without advancing the request again.
+     */
+    setOnRequestHook(onRequestHook: (req: express.Request, res: express.Response, done: (err?: Error) => void) => Promise<void> | void): void;
+    /**
+     * Registers a hook to run after the response has been sent.
+     * Thrown errors and rejected promises are logged.
+     */
     setOnResponseHook(onResponseHook: (req: express.Request, res: express.Response) => Promise<void> | void): void;
     reply(response: any, body: any, statusCode?: number): any;
     status(response: any, statusCode: number): any;
@@ -29,7 +40,7 @@ export declare class ExpressAdapter extends AbstractHttpAdapter<http.Server | ht
     render(response: any, view: string, options: any): any;
     redirect(response: any, statusCode: number, url: string): any;
     setErrorHandler(handler: Function, prefix?: string): any;
-    setNotFoundHandler(handler: Function, prefix?: string): any;
+    setNotFoundHandler(handler: Function, prefix?: string, excludedRoutes?: RouteInfo[]): any;
     isHeadersSent(response: any): boolean;
     getHeader(response: any, name: string): any;
     setHeader(response: any, name: string, value: string): any;
@@ -57,6 +68,10 @@ export declare class ExpressAdapter extends AbstractHttpAdapter<http.Server | ht
     setLocal(key: string, value: any): this;
     getType(): string;
     isRouteOrderSensitive(): boolean;
+    getRouteMatchingOptions(): {
+        caseSensitive: boolean;
+        ignoreTrailingSlash: boolean;
+    };
     applyVersionFilter(handler: Function, version: VersionValue, versioningOptions: VersioningOptions): VersionedRoute;
     mapException(error: unknown): unknown;
     private normalizePrefix;

package/adapters/express-adapter.js

@@ -4,6 +4,7 @@ import express from 'express';
 import * as http from 'http';
 import * as https from 'https';
 import { pathToRegexp } from 'path-to-regexp';
+import { finished } from 'stream';
 import { getBodyParserOptions } from './utils/get-body-parser-options.util.js';
 import { getMediaTypeVersion } from './utils/get-media-type-version.util.js';
 import { addLeadingSlash, isFunction, isNil, isObject, isString, isUndefined, stripEndSlash, } from '@nestjs/common/internal';
@@ -30,21 +31,59 @@ export class ExpressAdapter extends AbstractHttpAdapter {
         super(instance || express());
         this.instance.use((req, res, next) => {
             if (this.onResponseHook) {
-                res.on('finish', () => {
-                    void this.onResponseHook.apply(this, [req, res]);
+                res.on('finish', async () => {
+                    try {
+                        await this.onResponseHook.apply(this, [req, res]);
+                    }
+                    catch (err) {
+                        this.logger.error(err);
+                    }
                 });
             }
             if (this.onRequestHook) {
-                void this.onRequestHook.apply(this, [req, res, next]);
+                this.runRequestHook(req, res, next);
             }
             else {
                 next();
             }
         });
     }
+    runRequestHook(req, res, next) {
+        let completed = false;
+        const doneOnce = (err) => {
+            if (completed) {
+                if (err) {
+                    this.logger.error(err);
+                }
+                return;
+            }
+            completed = true;
+            next(err);
+        };
+        try {
+            // Not returned to Express: rejections share the once-guard with done()
+            const result = this.onRequestHook.call(this, req, res, doneOnce);
+            if (result && typeof result.then === 'function') {
+                result.then(undefined, err => doneOnce(err || new Error('Request hook failed')));
+            }
+        }
+        catch (err) {
+            doneOnce(err || new Error('Request hook failed'));
+        }
+    }
+    /**
+     * Registers a request hook. Call `done()` to continue processing the request;
+     * resolving the returned promise does not continue it. Only the first
+     * completion is forwarded to Express. Errors after `done()` are logged
+     * without advancing the request again.
+     */
     setOnRequestHook(onRequestHook) {
         this.onRequestHook = onRequestHook;
     }
+    /**
+     * Registers a hook to run after the response has been sent.
+     * Thrown errors and rejected promises are logged.
+     */
     setOnResponseHook(onResponseHook) {
         this.onResponseHook = onResponseHook;
     }
@@ -56,11 +95,32 @@ export class ExpressAdapter extends AbstractHttpAdapter {
             return response.send();
         }
         if (body instanceof StreamableFile) {
+            // A stream that failed before the reply (e.g. while an interceptor
+            // awaited) has already emitted its 'error' event.
+            const { errored } = body.getStream();
+            if (errored) {
+                return body.errorHandler(errored, response);
+            }
             this.applyStreamHeaders(response, body);
             const stream = body.getStream();
             stream.once('error', err => {
                 body.errorHandler(err, response);
             });
+            // pipe() leaves the source open when the client disconnects early,
+            // also before reply() runs ("close" has already fired by then)
+            finished(response, () => {
+                if (!stream.readableEnded) {
+                    stream.destroy();
+                }
+            });
+            // Node discards the body of a HEAD response without ever applying
+            // backpressure, so piping would read the whole source. The response
+            // ends once the source is readable instead, which still leaves an
+            // error opening it (e.g. a missing file) to the error handler.
+            if (response.req?.method === 'HEAD') {
+                stream.once('readable', () => response.end());
+                return response.on('error', (err) => body.errorLogger(err));
+            }
             return stream
                 .pipe(response)
                 .on('error', (err) => body.errorLogger(err));
@@ -68,7 +128,12 @@ export class ExpressAdapter extends AbstractHttpAdapter {
         const responseContentType = response.getHeader('Content-Type');
         if (typeof responseContentType === 'string' &&
             !isJsonContentType(responseContentType) &&
-            body?.statusCode >= HttpStatus.BAD_REQUEST) {
+            (body?.statusCode >= HttpStatus.BAD_REQUEST ||
+                // A custom error body (e.g. "new HttpException({ ... }, 404)") need
+                // not have a "statusCode" of its own
+                (isObject(body) &&
+                    !isNil(statusCode) &&
+                    statusCode >= HttpStatus.BAD_REQUEST))) {
             this.logger.warn("Content-Type doesn't match Reply body, you might need a custom ExceptionFilter for non-JSON responses");
             response.setHeader('Content-Type', 'application/json');
         }
@@ -98,13 +163,23 @@ export class ExpressAdapter extends AbstractHttpAdapter {
         // root-mounted routes) still pass through the exception layer.
         return this.use(handler);
     }
-    setNotFoundHandler(handler, prefix) {
+    setNotFoundHandler(handler, prefix, excludedRoutes) {
         const normalizedPrefix = this.normalizePrefix(prefix);
         if (normalizedPrefix) {
             this.registeredPrefixes.add(normalizedPrefix);
             const router = express.Router();
             router.all('*path', handler);
-            return this.use(normalizedPrefix, router);
+            this.use(normalizedPrefix, router);
+            // Excluded routes live at the root, out of the prefix router's reach.
+            // Mount the handler on each exact path, for every method, so a method
+            // miss there (`POST /hello` with only `GET /hello`) still reaches the
+            // exception layer. Not `use(path, router)`: a subtree mount would claim
+            // a raw `/hello/live` added after `init()`; a wildcard exclusion covers
+            // its subtree through its own pattern.
+            for (const route of excludedRoutes ?? []) {
+                this.instance.all(addLeadingSlash(route.path), handler);
+            }
+            return;
         }
         return this.use((req, res, next) => {
             // When multiple apps share this adapter, a non-prefixed app's 404
@@ -202,10 +277,20 @@ export class ExpressAdapter extends AbstractHttpAdapter {
     createMiddlewareFactory(requestMethod) {
         return (path, callback) => {
             try {
-                const convertedPath = LegacyRouteConverter.tryConvert(path);
-                return this.routerMethodFactory
-                    .get(this.instance, requestMethod)
-                    .call(this.instance, convertedPath, callback);
+                // The core marks an exact-match path with a trailing "$" (e.g. "/api$").
+                // Express 5 reads "$" literally and "use()" matches by prefix, so strip
+                // the marker and register the path as an exact "all()" route instead.
+                const isExactPath = path.endsWith('$');
+                const convertedPath = LegacyRouteConverter.tryConvert(isExactPath ? path.slice(0, -1) : path);
+                let router = this.routerMethodFactory.get(this.instance, requestMethod);
+                if (isExactPath && router === this.instance.use) {
+                    router = this.instance.all;
+                }
+                // Express routes are not strict, so "/api" also matches "/api/", which
+                // the wildcard path registered next to it may match too ("/api/{*path}"
+                // does, "/api/*path" does not). The core runs the middleware for the
+                // first of its paths that matches a request only.
+                return router.call(this.instance, convertedPath, callback);
             }
             catch (e) {
                 if (e instanceof TypeError) {
@@ -265,6 +350,18 @@ export class ExpressAdapter extends AbstractHttpAdapter {
     isRouteOrderSensitive() {
         return true;
     }
+    // The return type is spelled out (rather than "RouteMatchingOptions") so
+    // that the declarations still compile against an older "@nestjs/common"
+    getRouteMatchingOptions() {
+        // Routes are registered on the application router, which takes the
+        // "case sensitive routing" and "strict routing" settings in effect when
+        // it is created and ignores later changes
+        const router = this.getInstance().router;
+        return {
+            caseSensitive: !!router?.caseSensitive,
+            ignoreTrailingSlash: !router?.strict,
+        };
+    }
     applyVersionFilter(handler, version, versioningOptions) {
         const callNextHandler = (req, res, next) => {
             if (!next) {

package/adapters/utils/get-media-type-version.util.d.ts

@@ -6,6 +6,10 @@
  * media range of a list (`text/html, application/json;v=2`); the first match
  * wins. Returns `undefined` when no parameter starts with the key.
  *
+ * Quoted parameter values are unescaped, and separators inside them are ignored.
+ * An unterminated quoted string runs to the end of the header value, so a
+ * version that follows its opening quote is not read.
+ *
  * Duplicated in each platform package so that a platform package never
  * depends on a newer `@nestjs/core` than the one installed.
  */

package/adapters/utils/get-media-type-version.util.js

@@ -1,3 +1,29 @@
+/**
+ * Splits a header value at separators outside quoted strings in linear time.
+ * Backslash-escaped characters inside quoted strings are treated as literals.
+ */
+const splitOutsideQuotes = (value, separator) => {
+    const parts = [];
+    let start = 0;
+    let isQuoted = false;
+    const len = value.length;
+    for (let index = 0; index < len; index++) {
+        const character = value[index];
+        if (isQuoted && character === '\\') {
+            // A quoted-pair consumes the next character, including an escaped quote.
+            index++;
+        }
+        else if (character === '"') {
+            isQuoted = !isQuoted;
+        }
+        else if (character === separator && !isQuoted) {
+            parts.push(value.slice(start, index));
+            start = index + 1;
+        }
+    }
+    parts.push(value.slice(start));
+    return parts;
+};
 /**
  * Returns the version carried by an `Accept` header for media type versioning,
  * e.g. `2` for `application/json;v=2` with the `v=` key.
@@ -6,19 +32,27 @@
  * media range of a list (`text/html, application/json;v=2`); the first match
  * wins. Returns `undefined` when no parameter starts with the key.
  *
+ * Quoted parameter values are unescaped, and separators inside them are ignored.
+ * An unterminated quoted string runs to the end of the header value, so a
+ * version that follows its opening quote is not read.
+ *
  * Duplicated in each platform package so that a platform package never
  * depends on a newer `@nestjs/core` than the one installed.
  */
 export function getMediaTypeVersion(acceptHeader, key) {
     const mediaRanges = []
         .concat(acceptHeader ?? [])
-        .flatMap(value => value.split(','));
+        .flatMap(value => splitOutsideQuotes(value, ','));
     for (const mediaRange of mediaRanges) {
-        const [, ...parameters] = mediaRange.split(';');
+        const [, ...parameters] = splitOutsideQuotes(mediaRange, ';');
         for (const parameter of parameters) {
             const trimmedParameter = parameter.trim();
             if (trimmedParameter.startsWith(key)) {
-                return trimmedParameter.slice(key.length);
+                const version = trimmedParameter.slice(key.length);
+                if (version.startsWith('"') && version.endsWith('"')) {
+                    return version.slice(1, -1).replace(/\\([\s\S])/g, '$1');
+                }
+                return version;
             }
         }
     }

package/multer/interceptors/any-files.interceptor.js

@@ -2,7 +2,7 @@ import { __decorate, __metadata, __param } from "tslib";
 import { Inject, mixin, Optional, } from '@nestjs/common';
 import multer from 'multer';
 import { MULTER_MODULE_OPTIONS } from '../files.constants.js';
-import { mergeMulterOptions, transformException, } from '../multer/multer.utils.js';
+import { applyDefaultLimits, mergeMulterOptions, removeFilesOnPipeRejection, transformException, } from '../multer/multer.utils.js';
 /**
  * @param localOptions
  *
@@ -12,7 +12,7 @@ export function AnyFilesInterceptor(localOptions) {
     let MixinInterceptor = class MixinInterceptor {
         multer;
         constructor(options = {}) {
-            this.multer = multer(mergeMulterOptions(options, localOptions));
+            this.multer = multer(applyDefaultLimits(mergeMulterOptions(options, localOptions)));
         }
         async intercept(context, next) {
             const ctx = context.switchToHttp();
@@ -23,7 +23,9 @@ export function AnyFilesInterceptor(localOptions) {
                 }
                 resolve();
             }));
-            return next.handle();
+            return next
+                .handle()
+                .pipe(removeFilesOnPipeRejection(this.multer.storage, ctx.getRequest(), ctx.getResponse()));
         }
     };
     MixinInterceptor = __decorate([

package/multer/interceptors/file-fields.interceptor.js

@@ -2,7 +2,7 @@ import { __decorate, __metadata, __param } from "tslib";
 import { Inject, mixin, Optional, } from '@nestjs/common';
 import multer from 'multer';
 import { MULTER_MODULE_OPTIONS } from '../files.constants.js';
-import { mergeMulterOptions, transformException, } from '../multer/multer.utils.js';
+import { applyDefaultLimits, mergeMulterOptions, removeFilesOnPipeRejection, transformException, } from '../multer/multer.utils.js';
 /**
  * @param uploadFields
  * @param localOptions
@@ -12,7 +12,7 @@ export function FileFieldsInterceptor(uploadFields, localOptions) {
     let MixinInterceptor = class MixinInterceptor {
         multer;
         constructor(options = {}) {
-            this.multer = multer(mergeMulterOptions(options, localOptions));
+            this.multer = multer(applyDefaultLimits(mergeMulterOptions(options, localOptions)));
         }
         async intercept(context, next) {
             const ctx = context.switchToHttp();
@@ -23,7 +23,9 @@ export function FileFieldsInterceptor(uploadFields, localOptions) {
                 }
                 resolve();
             }));
-            return next.handle();
+            return next
+                .handle()
+                .pipe(removeFilesOnPipeRejection(this.multer.storage, ctx.getRequest(), ctx.getResponse()));
         }
     };
     MixinInterceptor = __decorate([

package/multer/interceptors/file.interceptor.js

@@ -2,7 +2,7 @@ import { __decorate, __metadata, __param } from "tslib";
 import { Inject, mixin, Optional, } from '@nestjs/common';
 import multer from 'multer';
 import { MULTER_MODULE_OPTIONS } from '../files.constants.js';
-import { mergeMulterOptions, transformException, } from '../multer/multer.utils.js';
+import { applyDefaultLimits, mergeMulterOptions, removeFilesOnPipeRejection, transformException, } from '../multer/multer.utils.js';
 /**
  * @param fieldName
  * @param localOptions
@@ -13,7 +13,7 @@ export function FileInterceptor(fieldName, localOptions) {
     let MixinInterceptor = class MixinInterceptor {
         multer;
         constructor(options = {}) {
-            this.multer = multer(mergeMulterOptions(options, localOptions));
+            this.multer = multer(applyDefaultLimits(mergeMulterOptions(options, localOptions)));
         }
         async intercept(context, next) {
             const ctx = context.switchToHttp();
@@ -24,7 +24,9 @@ export function FileInterceptor(fieldName, localOptions) {
                 }
                 resolve();
             }));
-            return next.handle();
+            return next
+                .handle()
+                .pipe(removeFilesOnPipeRejection(this.multer.storage, ctx.getRequest(), ctx.getResponse()));
         }
     };
     MixinInterceptor = __decorate([

package/multer/interceptors/files.interceptor.js

@@ -2,7 +2,7 @@ import { __decorate, __metadata, __param } from "tslib";
 import { Inject, mixin, Optional, } from '@nestjs/common';
 import multer from 'multer';
 import { MULTER_MODULE_OPTIONS } from '../files.constants.js';
-import { mergeMulterOptions, transformException, } from '../multer/multer.utils.js';
+import { applyDefaultLimits, mergeMulterOptions, removeFilesOnPipeRejection, transformException, } from '../multer/multer.utils.js';
 /**
  *
  * @param fieldName
@@ -15,7 +15,7 @@ export function FilesInterceptor(fieldName, maxCount, localOptions) {
     let MixinInterceptor = class MixinInterceptor {
         multer;
         constructor(options = {}) {
-            this.multer = multer(mergeMulterOptions(options, localOptions));
+            this.multer = multer(applyDefaultLimits(mergeMulterOptions(options, localOptions)));
         }
         async intercept(context, next) {
             const ctx = context.switchToHttp();
@@ -26,7 +26,9 @@ export function FilesInterceptor(fieldName, maxCount, localOptions) {
                 }
                 resolve();
             }));
-            return next.handle();
+            return next
+                .handle()
+                .pipe(removeFilesOnPipeRejection(this.multer.storage, ctx.getRequest(), ctx.getResponse()));
         }
     };
     MixinInterceptor = __decorate([

package/multer/interceptors/no-files.interceptor.js

@@ -2,7 +2,7 @@ import { __decorate, __metadata, __param } from "tslib";
 import { Inject, mixin, Optional, } from '@nestjs/common';
 import multer from 'multer';
 import { MULTER_MODULE_OPTIONS } from '../files.constants.js';
-import { mergeMulterOptions, transformException, } from '../multer/multer.utils.js';
+import { applyDefaultLimits, mergeMulterOptions, transformException, } from '../multer/multer.utils.js';
 /**
  *
  * @param localOptions
@@ -12,7 +12,7 @@ export function NoFilesInterceptor(localOptions) {
     let MixinInterceptor = class MixinInterceptor {
         multer;
         constructor(options = {}) {
-            this.multer = multer(mergeMulterOptions(options, localOptions));
+            this.multer = multer(applyDefaultLimits(mergeMulterOptions(options, localOptions)));
         }
         async intercept(context, next) {
             const ctx = context.switchToHttp();

package/multer/interfaces/multer-options.interface.d.ts

@@ -16,6 +16,18 @@ export interface MulterLimits {
     parts?: number;
     /** For multipart forms, the max number of header key=> value pairs to parse Default: 2000(same as node's http). */
     headerPairs?: number;
+    /**
+     * Max nesting depth of field names; `a[b][c]` has 2 levels (Default: 32,
+     * where multer's own default is Infinity). Set it to `Infinity` to lift
+     * the limit.
+     */
+    fieldNestingDepth?: number;
+    /**
+     * Max numeric array index accepted in field names; `a[3]` uses index 3
+     * (Default: 1000, where multer's own default is Infinity). Set it to
+     * `Infinity` to lift the limit.
+     */
+    fieldArrayIndexLimit?: number;
 }
 /**
  * @see https://github.com/expressjs/multer
@@ -27,8 +39,9 @@ export interface MulterOptions {
     /** The storage engine to use for uploaded files. */
     storage?: any;
     /**
-     * An object specifying the size limits of the following optional properties. This object is passed to busboy
-     * directly, and the details of properties can be found on https://github.com/mscdex/busboy#busboy-methods
+     * An object specifying the size limits of the following optional properties. This object is passed to multer
+     * and on to busboy, with `fieldNestingDepth` and `fieldArrayIndexLimit` set to their defaults when absent.
+     * The details of the busboy properties can be found on https://github.com/mscdex/busboy#busboy-methods
      *
      * Since multer 2.4.0, this can also be a function of the request that returns such an object.
      */

package/multer/multer/multer.constants.d.ts

@@ -11,6 +11,17 @@ export declare const multerExceptions: {
     LIMIT_FIELD_ARRAY_INDEX: string;
     INVALID_FIELD_NAME: string;
 };
+/**
+ * Defaults of the field name limits that multer leaves at `Infinity`, which
+ * let a single small request build an arbitrarily deep `req.body`
+ * (`fieldNestingDepth`) or arrays of arbitrary length (`fieldArrayIndexLimit`).
+ * `32` is the nesting depth `body-parser` allows in the urlencoded bodies the
+ * ExpressAdapter parses; `1000` is the number of parameters it parses.
+ */
+export declare const DEFAULT_FIELD_NAME_LIMITS: {
+    readonly fieldNestingDepth: 32;
+    readonly fieldArrayIndexLimit: 1000;
+};
 export declare const busboyExceptions: {
     MULTIPART_BOUNDARY_NOT_FOUND: string;
     MULTIPART_MALFORMED_PART_HEADER: string;

package/multer/multer/multer.constants.js

@@ -15,6 +15,17 @@ export const multerExceptions = {
     // engine after the file stream was destroyed, not by the request, so it
     // stays a 500.
 };
+/**
+ * Defaults of the field name limits that multer leaves at `Infinity`, which
+ * let a single small request build an arbitrarily deep `req.body`
+ * (`fieldNestingDepth`) or arrays of arbitrary length (`fieldArrayIndexLimit`).
+ * `32` is the nesting depth `body-parser` allows in the urlencoded bodies the
+ * ExpressAdapter parses; `1000` is the number of parameters it parses.
+ */
+export const DEFAULT_FIELD_NAME_LIMITS = {
+    fieldNestingDepth: 32,
+    fieldArrayIndexLimit: 1000,
+};
 export const busboyExceptions = {
     // from https://github.com/mscdex/busboy/blob/master/lib/types/multipart.js
     MULTIPART_BOUNDARY_NOT_FOUND: 'Multipart: Boundary not found',

package/multer/multer/multer.utils.d.ts

@@ -1,4 +1,5 @@
 import { HttpException } from '@nestjs/common';
+import { type MonoTypeOperatorFunction } from 'rxjs';
 import { MulterModuleOptions } from '../interfaces/index.js';
 import { MulterOptions } from '../interfaces/multer-options.interface.js';
 /**
@@ -12,6 +13,20 @@ import { MulterOptions } from '../interfaces/multer-options.interface.js';
  * `limits`) the local value wins outright, matching the pre-merge behaviour.
  */
 export declare function mergeMulterOptions(options?: MulterModuleOptions, localOptions?: MulterOptions): MulterModuleOptions;
+/**
+ * Sets the field name limits multer leaves at `Infinity` to
+ * `DEFAULT_FIELD_NAME_LIMITS` wherever they are not set. multer only checks
+ * a limit that is present in `limits`, so the defaults are added to the
+ * object, or to the object a function-valued `limits` returns.
+ */
+export declare function applyDefaultLimits<T extends MulterOptions>(options: T): T;
+/**
+ * Removes the files multer stored for `req` when the route's pipes reject
+ * the request (e.g. `ParseFilePipe`): the route handler never sees them, and
+ * nothing else would remove them. They are removed once the response has
+ * been sent, as an exception filter may still use (or remove) them.
+ */
+export declare function removeFilesOnPipeRejection<T>(storage: any, req: any, res: any): MonoTypeOperatorFunction<T>;
 export declare function transformException(error: (Error & {
     field?: string;
     code?: string;

package/multer/multer/multer.utils.js

@@ -1,6 +1,9 @@
 import { BadRequestException, HttpException, PayloadTooLargeException, } from '@nestjs/common';
 import { isPlainObject } from '@nestjs/common/internal';
-import { multerExceptions, busboyExceptions } from './multer.constants.js';
+import { isRejectedByPipes } from '@nestjs/core/internal';
+import { catchError, throwError } from 'rxjs';
+import { finished } from 'stream';
+import { DEFAULT_FIELD_NAME_LIMITS, multerExceptions, busboyExceptions, } from './multer.constants.js';
 /**
  * Merges module-level (global) multer options with interceptor-level (local)
  * options. `limits` is merged key-by-key rather than replaced outright, so
@@ -16,8 +19,66 @@ export function mergeMulterOptions(options = {}, localOptions = {}) {
     if (isPlainObject(options.limits) && isPlainObject(localOptions.limits)) {
         merged.limits = { ...options.limits, ...localOptions.limits };
     }
+    // `dest` and `storage` both say where files go, and multer prefers
+    // `storage`, so a global storage engine would shadow a local `dest`.
+    if (localOptions.dest && !localOptions.storage) {
+        delete merged.storage;
+    }
     return merged;
 }
+/**
+ * Sets the field name limits multer leaves at `Infinity` to
+ * `DEFAULT_FIELD_NAME_LIMITS` wherever they are not set. multer only checks
+ * a limit that is present in `limits`, so the defaults are added to the
+ * object, or to the object a function-valued `limits` returns.
+ */
+export function applyDefaultLimits(options) {
+    const { limits } = options;
+    return {
+        ...options,
+        limits: typeof limits === 'function'
+            ? (req) => withDefaultLimits(limits(req))
+            : withDefaultLimits(limits),
+    };
+}
+function withDefaultLimits(limits) {
+    return {
+        ...limits,
+        fieldNestingDepth: limits?.fieldNestingDepth ?? DEFAULT_FIELD_NAME_LIMITS.fieldNestingDepth,
+        fieldArrayIndexLimit: limits?.fieldArrayIndexLimit ??
+            DEFAULT_FIELD_NAME_LIMITS.fieldArrayIndexLimit,
+    };
+}
+/**
+ * Removes the files multer stored for `req` when the route's pipes reject
+ * the request (e.g. `ParseFilePipe`): the route handler never sees them, and
+ * nothing else would remove them. They are removed once the response has
+ * been sent, as an exception filter may still use (or remove) them.
+ */
+export function removeFilesOnPipeRejection(storage, req, res) {
+    return catchError(err => {
+        if (isRejectedByPipes(req)) {
+            finished(res, () => {
+                for (const file of storedFiles(req)) {
+                    try {
+                        storage._removeFile(req, file, () => undefined);
+                    }
+                    catch {
+                        // The request has failed already.
+                    }
+                }
+            });
+        }
+        return throwError(() => err);
+    });
+}
+function storedFiles(req) {
+    const { file, files } = req;
+    if (file) {
+        return [file];
+    }
+    return Array.isArray(files) ? files : Object.values(files ?? {}).flat();
+}
 // Multer may add in a 'field' property to the error
 // https://github.com/expressjs/multer/blob/aa42bea6ac7d0cb8fcb279b15a7278cda805dc63/lib/multer-error.js#L19
 export function transformException(error) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nestjs/platform-express",
-  "version": "12.1.2",
+  "version": "12.2.0",
   "description": "Nest - modern, fast, powerful node.js web framework (@platform-express)",
   "author": "Kamil Mysliwiec",
   "license": "MIT",
@@ -8,6 +8,7 @@
   "main": "./index.js",
   "exports": {
     ".": "./index.js",
+    "./package.json": "./package.json",
     "./*.js": "./*.js",
     "./*": "./*.js"
   },
@@ -26,18 +27,18 @@
   },
   "dependencies": {
     "cors": "2.8.6",
-    "express": "5.2.1",
+    "express": "5.3.0",
     "multer": "2.4.0",
     "path-to-regexp": "8.4.2",
     "tslib": "2.8.1"
   },
   "devDependencies": {
-    "@nestjs/common": "12.1.2",
-    "@nestjs/core": "12.1.2"
+    "@nestjs/common": "12.2.0",
+    "@nestjs/core": "12.2.0"
   },
   "peerDependencies": {
     "@nestjs/common": "^12.0.0",
     "@nestjs/core": "^12.0.0"
   },
-  "gitHead": "8ab60aa1b2927fbe0e23135ffc65d610c623236a"
+  "gitHead": "af37111368de7fd2dfab0bdec2f530c7845510c2"
 }