[dependabot]

Bumps @nestjs/core from 11.1.17 to 12.3.2.

Release notes

Sourced from @​nestjs/core's releases.

v12.2.0 (2026-10-19)

Notable changes

New options

• @Sse({ maxPendingDataLength }) sets how many characters of event data may wait for a client that is not reading its events (4M by default; 0 or Infinity lifts the limit) – 2f05ad954e
• IoAdapter and WsAdapter take maxConcurrentMessages, the number of a client's messages handled at once (1000 by default; Infinity lifts it) – 0bd0810ed7
• ValidationPipe takes maxErrorMessagesLength (1,000,000 characters by default); messages past it are replaced by a "Further validation errors were omitted" entry – 086c1c514f
• Kafka: parser.maxMessageSize (16 MiB after decompression by default); larger messages are logged and skipped – 9bdf844fca
• TCP server: drainTimeout (30 s by default, 0 disables) disconnects a peer that leaves its responses unread – 583d6077ad
• MQTT server: reconnectOnConnackError is now enabled by default, so a refused connection attempt is retried; set it to false for the previous behaviour – a63cea600a
• HttpServer.getRouteMatchingOptions(), an optional adapter hook that tells core how the router matches paths (see "Middleware exclusions" below) – 08d8677c8d

New defaults and behaviour changes

• @nestjs/platform-express, @nestjs/platform-fastify: fieldNestingDepth and fieldArrayIndexLimit (#18074) now default to 32 and 1000; set them to Infinity to lift the limits – 94fcc93770
• ValidationPipe validates with validationError.target: false unless the options set it, so an exceptionFactory that reads error.target gets undefined; set validationError.target to true for the old errors – 8c5a59bf63
• ValidationPipe answers an array or a primitive sent for a validated class with a 400 – 197371c1f3
• FileTypeValidator matches a string fileType up to the end of a name (e.g. font/woff no longer accepts font/woff2; use a RegExp for that) – 770c6f1a19
• @SerializeOptions({}) on a handler no longer turns off the class schema – d27cb7017f
• BaseExceptionFilter answers http-errors errors created with expose: false (the default from 500) with the standard reason phrase instead of their message – 9ed572f853
• A StreamableFile error still gets a 400, but the body no longer carries the error message – 2f28d91afb
• Files uploaded with a request that a pipe rejected are removed from storage – acb98de89e
• @nestjs/platform-fastify: a route with fileSize: undefined (or null) falls back to the plugin's limit; set it to Infinity to keep uploads unlimited – dd549e1a74
• @nestjs/platform-express: object error bodies are sent as application/json on routes with a non-JSON Content-Type – 7dc6e349d5
• ConsoleLogger in JSON mode cuts a record short past about a million characters – ad4915eaa3
• A global enhancer that the injector failed to instantiate now fails the application at startup – ae78524ced
• A request- or transient-scoped APP_FILTER now logs a startup warning, as it only applies to exceptions thrown from controllers – df5275c5e1
• Microservices: a pattern key longer than 256 characters matches no handler – accd27e66c
• Kafka: a message may carry up to 10,000 header values (e419ff540b); headers given as a string or array are not sent (312777743f); reply headers are decoded as text (ee94f6aaae)
• gRPC: request streams are paused while their replies wait to be written – 37e5cf7706
• Deprecation: on TCP, Redis, NATS, MQTT and RabbitMQ, an @EventPattern() handler that replies to ClientProxy#send() now logs a deprecation warning. The reply is unchanged; in the next major version event handlers will not reply to send(), as on Kafka already – ba3668d36b

Middleware exclusions

• MiddlewareConsumer.exclude() now compiles excluded routes with the router's case and trailing-slash matching (08d8677c8d). Update @nestjs/core together with @nestjs/platform-express / @nestjs/platform-fastify: with an adapter that does not implement getRouteMatchingOptions(), excluded routes are matched exactly (f5aa875e40), so on a lenient router other spellings of an excluded path run the middleware.
• With header, media type or custom versioning, exclude({ path, method, version }) and enableCsrfProtection({ exclude }) apply only to requests that ask for one of the excluded versions – 1a7a31fa46
• @nestjs/platform-fastify: the request hook used by enableCsrfProtection() and useSecurityHeaders() now runs before Nest and app.use() middleware with NestFactory.create() too, including middleware registered before either call, as it already did with Test.createNestApplication() – 8351806290

Bug fixes

• platform-fastify
  • 614d1ac7ea fix(fastify): send the status of an exception whose body is an error (@​kamilmysliwiec)
  • 8b420f788f fix(fastify): apply middleware to plugins registered before init (@​kamilmysliwiec)
  • #18175 fix(fastify): keep raw-response cookies in the header helpers (@​johnnyhuirilef)
  • c215fd9b4f fix(fastify): match middleware paths like a case-insensitive router (@​kamilmysliwiec)
  • 43d4420205 fix(fastify): pass version extractor errors to the error handler (@​kamilmysliwiec)
  • 1435ed22f4 fix(fastify): pass middleware rejections to the error handler (@​kamilmysliwiec)
  • 84c947faf9 fix(fastify): stop reading a streamable file for a head request (@​kamilmysliwiec)
  • dd549e1a74 fix(fastify): let undefined upload limits fall back to the defaults (@​kamilmysliwiec)
  • 4735f8d050 fix(fastify): free memory storage chunks once a file is buffered (@​kamilmysliwiec)
  • 3e3e6eea6f fix(fastify): remove uploads cut off after their last chunk (@​kamilmysliwiec)
  • c04a9182b9 fix(fastify): set the security headers on router error responses (@​kamilmysliwiec)

... (truncated)

Commits

• a415cff chore(release): publish v12.3.2 release
• 9576609 chore(release): publish v12.3.1 release
• 3acb8e5 chore(release): publish v12.3.0 release
• 10adb73 fix(core): check the sse pending data limit after each write
• f640806 fix(core): run middleware once for routes that differ only in version (#18276)
• 3e2309e fix(core): tolerate sse request sockets without tuning methods (#18262)
• 0fb57c8 fix(core,express,fastify,ws,socket.io): load adapters with an older core (#18...
• 135f999 fix(core): read the url protocol from the server (#18252)
• 79b57f9 fix(core): name the array and index of undefined module entries (#18254)
• e065e23 fix(core): discover classes by each of their discovery decorators (#18235)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[github-actions]

Thanks for your first pull request. CI will run shortly. If the change touches package source, please add a changeset with pnpm changeset.

[github-actions]

This update crosses a boundary that needs human review (major bump, or minor bump on a production dependency). Not auto-merging.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud