build(deps): Bump @nestjs/serve-static from 5.0.5 to 12.0.0

[dependabot]

Bumps @nestjs/serve-static from 5.0.5 to 12.0.0.

Release notes

Sourced from @​nestjs/serve-static's releases.

Release 12.0.0

What's Changed

@nestjs/serve-static is now a native ES module, and the major version is aligned with the Nest 12 release line (there is no 6.x–11.x — 5.0.5 goes straight to 12.0.0).

ESM migration

The package is published as pure ESM ("type": "module", compiled with NodeNext) behind a proper exports map. The legacy root index.js / index.d.ts shims are gone, and deep imports into build internals are no longer resolvable — import from the package root.

The runtime was migrated too, not just the build output: the optional express and @fastify/static loads now go through createRequire(import.meta.url) instead of a bare require(). Under a native ESM loader the old code threw ReferenceError, which loadPackage swallowed before calling process.exit(1) — taking the host application down at startup.

If you pass rootPath: join(__dirname, '..', 'client') from an ESM app, switch to import.meta.dirname:

ServeStaticModule.forRoot({
  rootPath: join(import.meta.dirname, '..', 'client')
})

require(esm) — CommonJS still works

You do not need to convert your app to ESM. Thanks to Node's require(esm) support, CommonJS applications can keep using require('@nestjs/serve-static') unchanged.

TypeScript projects that compile to CommonJS need "module": "nodenext" in their tsconfig.json. The older "node16" setting predates require(esm) and will report TS1479.

Node.js requirement

An engines floor is now declared so npm blocks installs on versions without require(esm):

^20.19.0 || ^22.12.0 || >=23.0.0

Peer dependencies

• @nestjs/common and @nestjs/core → ^12.0.0
• @fastify/static → ^10.0.0 (the ^8 || ^9 range is dropped; v10 carries a security fix)
• express ^5.0.1 and fastify ^5.2.1 are unchanged

Features

• exclude now accepts a RegExp in addition to an array of path strings, for cases where a single pattern is clearer than enumerating routes (#1983):

  ServeStaticModule.forRoot({
    rootPath: join(import.meta.dirname, '..', 'client'),
    exclude: /^\/api(\/.*)?$/
  })

... (truncated)

Commits

• a7f33e3 chore(): release v12.0.0
• 7d973a5 test: temporary fix to express e2e
• cce882e Merge branch 'master' of https://github.com/nestjs/serve-static
• e2172a3 chore: upgrade to v12
• 623ecb3 Merge pull request #2052 from nestjs/renovate/cimg-node-24.x
• 11de2d5 Merge pull request #2049 from Fcmam5/fix/enoent-error-sanitization
• 7d35a8f chore(deps): update node.js to v24.20.0
• 3b42226 chore(deps): update nest monorepo to v11.2.3 (#2051)
• 6673038 chore(deps): update dependency oxlint to v1.80.0 (#2050)
• fda4eed fix(express): avoid leaking index.html path in spa fallback
• Additional commits viewable in compare view

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud