chore(deps): bump the production-dependencies group with 7 updates

[dependabot]

Bumps the production-dependencies group with 7 updates:

Package	From	To
@nestjs/common	11.2.3	12.0.1
@nestjs/config	4.0.4	12.0.0
@nestjs/core	11.2.3	12.0.1
@nestjs/cqrs	11.0.3	12.0.0
@nestjs/platform-express	11.2.3	12.0.1
@nestjs/swagger	11.4.7	12.0.1
uuid	11.1.1	14.0.2

Updates @nestjs/common from 11.2.3 to 12.0.1

Release notes

Sourced from @​nestjs/common's releases.

v12.0.0

NestJS v12.0.0

NestJS 12 is centered around ESM-ready packages, first-class Standard Schema support for validation and serialization, a rebuilt CLI, and native observability through the new @nestjs/observe SDK.

Existing CommonJS applications keep working — migrating your own code to ESM is entirely optional.

📖 Full migration guide

---

Upgrading

Upgrade the CLI first, since the upgrade command ships with it:

npm i -g @nestjs/cli@latest

Then, from the root of your project:

nest upgrade

nest upgrade moves every @nestjs/* package to its v12-compatible major at once and applies the mechanical parts of the migration for you — nest-cli.json webpack options, the GraphQL playground → graphiql rename and subscriptions transport swap, the NATS package replacement, @nestjs/config validation options, Jest and Joi bumps — then prints a report of everything it changed and everything you still need to review by hand. Run it with --dry-run first to see that report without touching your files.

It deliberately does not migrate your project to ESM, Vitest, or oxlint. Those are the defaults for newly generated projects; existing projects adopt them on their own schedule.

Node.js: v12 requires Node.js v20.19+ or v22.12+. Both require(esm) and the ESM packages depend on it; the upgrade command refuses to run on older releases (including the 21.x line). The latest active LTS is recommended.

---

Highlights

ESM packages

All core Nest packages now ship as ESM. Thanks to require(esm) in modern Node.js, most existing CommonJS applications continue to work without a rewrite. Review custom bootstrapping scripts, build tooling, and test runners if they assume CommonJS-only packages.

nest new now asks whether to scaffold a CommonJS or an ESM project.

Standard Schema validation

Route parameter decorators — @Body(), @Query(), @Param(), @RawBody() — accept a new schema option, designed for Standard Schema compatible libraries such as Zod, Valibot, and ArkType:

@Post()
create(@Body({ schema: createUserSchema }) body: CreateUserDto) {
  return this.usersService.create(body);
}
</tr></table> 

... (truncated)

Commits

• 4c751c5 chore(release): publish v12.0.1 release
• 6494a6c chore(release): publish v12.0.0 release
• e306724 fix(deps): update dependency file-type to v22
• edb0034 Merge branch 'master' into v12.0.0
• e255755 chore: resolve conflicts, minor fixes
• 5d1b19b Merge branch 'master' into v12.0.0
• a2c25c2 Merge pull request #17028 from OlegStrokan/feat/get-transport-server
• 5f2618a fix(common): Reject hex and non-numeric strings in parse-float pipe
• See full diff in compare view

Updates @nestjs/config from 4.0.4 to 12.0.0

Release notes

Sourced from @​nestjs/config's releases.

12.0.0

What's Changed

@nestjs/config is now a native ES module, environment validation is built on Standard Schema instead of Joi-specific code, and the major version is aligned with the Nest 12 release line (there is no 5.x — 4.0.4 goes straight to 12.0.0).

ESM migration

The package is published as pure ESM ("type": "module", compiled with NodeNext) behind a proper exports map. The legacy root index.js / index.d.ts shims are gone, and deep imports into build internals are no longer resolvable — import from the package root.

// ✅
import { ConfigModule, ConfigService } from '@nestjs/config';
// ❌ no longer resolvable
import { ConfigService } from '@​nestjs/config/dist/config.service';

require(esm) — CommonJS still works

You do not need to convert your app to ESM. Thanks to Node's require(esm) support (Node 20.19+ / 22.12+), a CommonJS app can keep using require('@nestjs/config') unchanged.

Validation is now Standard Schema based

validationSchema accepts any schema implementing the Standard Schema spec — Zod (v3, v4, v4-mini), Valibot, ArkType, Joi 18+, and anything else that adopts it. There is no longer any Joi-specific code path in the module, and Joi is no longer implied as the validation library.

ConfigModule.forRoot({
  validationSchema: z.object({
    PORT: z.coerce.number().default(3000),
    DATABASE_NAME: z.string(),
  }),
});

Joi keeps working — it implements Standard Schema as of v18 — and the historical abortEarly: false / allowUnknown: true defaults are still applied automatically for Joi schemas, so existing Joi setups behave as before.

Breaking: validationOptions shape

Options are now the Standard Schema Options object, and library-specific settings move under libraryOptions:

// Before (4.x)
validationOptions: { allowUnknown: false, abortEarly: true }
// Now (12.x)
validationOptions: { libraryOptions: { allowUnknown: false, abortEarly: true } }

The generic parameter changed accordingly: ConfigModuleOptions<ValidationOptions extends StandardSchemaV1.Options>, and validationSchema is typed as StandardSchemaV1 rather than any — a schema that does not implement the spec is now a compile-time error instead of a runtime one.

... (truncated)

Commits

• 269312f chore(): release v12.0.0
• 5748c1f chore: upgrade to v12
• d833a6a chore(deps): update dependency oxlint to v1.80.0 (#2408)
• 4555cbc chore(deps): update nest monorepo to v11.2.3 (#2407)
• 4561739 chore(deps): update dependency vite to v8.2.2 (#2406)
• 0fc13bb chore(deps): update dependency joi to v18.2.5 (#2405)
• 22642b8 chore(deps): update dependency oxlint to v1.79.0 (#2404)
• d3a7dd5 chore(deps): update dependency vitest to v4.1.11 (#2403)
• 8c87973 chore(deps): update dependency zod to v4.4.3 (#2402)
• 949dc88 Merge pull request #2356 from nestjs/renovate/cimg-node-24.x
• Additional commits viewable in compare view

Updates @nestjs/core from 11.2.3 to 12.0.1

Release notes

Sourced from @​nestjs/core's releases.

v12.0.0

NestJS v12.0.0

NestJS 12 is centered around ESM-ready packages, first-class Standard Schema support for validation and serialization, a rebuilt CLI, and native observability through the new @nestjs/observe SDK.

Existing CommonJS applications keep working — migrating your own code to ESM is entirely optional.

📖 Full migration guide

---

Upgrading

Upgrade the CLI first, since the upgrade command ships with it:

npm i -g @nestjs/cli@latest

Then, from the root of your project:

nest upgrade

nest upgrade moves every @nestjs/* package to its v12-compatible major at once and applies the mechanical parts of the migration for you — nest-cli.json webpack options, the GraphQL playground → graphiql rename and subscriptions transport swap, the NATS package replacement, @nestjs/config validation options, Jest and Joi bumps — then prints a report of everything it changed and everything you still need to review by hand. Run it with --dry-run first to see that report without touching your files.

It deliberately does not migrate your project to ESM, Vitest, or oxlint. Those are the defaults for newly generated projects; existing projects adopt them on their own schedule.

Node.js: v12 requires Node.js v20.19+ or v22.12+. Both require(esm) and the ESM packages depend on it; the upgrade command refuses to run on older releases (including the 21.x line). The latest active LTS is recommended.

---

Highlights

ESM packages

All core Nest packages now ship as ESM. Thanks to require(esm) in modern Node.js, most existing CommonJS applications continue to work without a rewrite. Review custom bootstrapping scripts, build tooling, and test runners if they assume CommonJS-only packages.

nest new now asks whether to scaffold a CommonJS or an ESM project.

Standard Schema validation

Route parameter decorators — @Body(), @Query(), @Param(), @RawBody() — accept a new schema option, designed for Standard Schema compatible libraries such as Zod, Valibot, and ArkType:

@Post()
create(@Body({ schema: createUserSchema }) body: CreateUserDto) {
  return this.usersService.create(body);
}
</tr></table> 

... (truncated)

Commits

• 4c751c5 chore(release): publish v12.0.1 release
• 3c25112 chore: update peer deps
• 6494a6c chore(release): publish v12.0.0 release
• c9d59f2 chore: expose missing internals
• 45485b5 fix(core): circular durable providers issue #17562
• f94e9eb fix(core): preserve middleware arity and harden instance decorator
• 1dcbc25 fix(core): instrument midldeware issue #17554
• f5bf4dd docs(core): update Mercure SSE header comment to current path
• edb0034 Merge branch 'master' into v12.0.0
• e255755 chore: resolve conflicts, minor fixes
• Additional commits viewable in compare view

Updates @nestjs/cqrs from 11.0.3 to 12.0.0

Release notes

Sourced from @​nestjs/cqrs's releases.

Release 12.0.0

What's Changed

@nestjs/cqrs is now a native ES module, and the major version is aligned with the Nest 12 release line (11.0.3 goes straight to 12.0.0).

ESM migration

The package is published as pure ESM ("type": "module", compiled with NodeNext) behind a proper exports map. The legacy root index.js / index.d.ts / index.ts shims are gone, and deep imports into build internals are no longer resolvable — import from the package root.

// ✅
import { CommandBus, EventBus, AggregateRoot } from '@nestjs/cqrs';
// ❌ no longer resolvable
import { CommandBus } from '@​nestjs/cqrs/dist/command-bus';

./package.json is exported as well, for tooling that reads the manifest.

require(esm) — CommonJS still works

You do not need to convert your app to ESM. Thanks to Node's require(esm) support, CommonJS consumers can keep requiring the package exactly as before:

const { CommandBus } = require('@nestjs/cqrs'); // still works

The . export declares import, require, and default conditions, all pointing at the same ESM build, so CJS resolution no longer fails with ERR_PACKAGE_PATH_NOT_EXPORTED.

Breaking changes

• Node.js ^20.19.0 || >=22.12.0 is now required (engines). These are the versions where require(esm) is unflagged — older Node cannot load ESM from CommonJS at all.
• Nest 12 is now the required peer. @nestjs/common and @nestjs/core peer ranges are ^12.0.0; support for Nest 10 and 11 has been dropped.
• Deep imports removed. Anything reaching into @nestjs/cqrs/dist/* must import from the package root instead.
• Root shims removed. index.js / index.d.ts at the package root no longer exist; resolution goes through the exports map.

There are no changes to the public API — command/query/event buses, handlers, sagas, AggregateRoot, decorators, and operators all behave exactly as they did in v11.

Commits

• 9b614ae chore(): release v12.0.0
• 7e99bda chore: upgrade to v12
• 1de147a chore(deps): update dependency oxlint to v1.80.0 (#2349)
• 77ccfd2 chore(deps): update nest monorepo to v11.2.3 (#2348)
• 1b25f34 chore(deps): update dependency vite to v8.2.2 (#2347)
• a372a0f chore(deps): update dependency oxlint to v1.79.0 (#2346)
• 4b5af3b chore(deps): update dependency vitest to v4.1.11 (#2345)
• c1238f2 Merge pull request #2323 from nestjs/renovate/typescript-7.x
• 2bb511e chore(deps): update dependency typescript to v7
• d5afbdd Merge pull request #2284 from nestjs/renovate/cimg-node-24.x
• Additional commits viewable in compare view

Updates @nestjs/platform-express from 11.2.3 to 12.0.1

Release notes

Sourced from @​nestjs/platform-express's releases.

v12.0.0

NestJS v12.0.0

NestJS 12 is centered around ESM-ready packages, first-class Standard Schema support for validation and serialization, a rebuilt CLI, and native observability through the new @nestjs/observe SDK.

Existing CommonJS applications keep working — migrating your own code to ESM is entirely optional.

📖 Full migration guide

---

Upgrading

Upgrade the CLI first, since the upgrade command ships with it:

npm i -g @nestjs/cli@latest

Then, from the root of your project:

nest upgrade

nest upgrade moves every @nestjs/* package to its v12-compatible major at once and applies the mechanical parts of the migration for you — nest-cli.json webpack options, the GraphQL playground → graphiql rename and subscriptions transport swap, the NATS package replacement, @nestjs/config validation options, Jest and Joi bumps — then prints a report of everything it changed and everything you still need to review by hand. Run it with --dry-run first to see that report without touching your files.

It deliberately does not migrate your project to ESM, Vitest, or oxlint. Those are the defaults for newly generated projects; existing projects adopt them on their own schedule.

Node.js: v12 requires Node.js v20.19+ or v22.12+. Both require(esm) and the ESM packages depend on it; the upgrade command refuses to run on older releases (including the 21.x line). The latest active LTS is recommended.

---

Highlights

ESM packages

All core Nest packages now ship as ESM. Thanks to require(esm) in modern Node.js, most existing CommonJS applications continue to work without a rewrite. Review custom bootstrapping scripts, build tooling, and test runners if they assume CommonJS-only packages.

nest new now asks whether to scaffold a CommonJS or an ESM project.

Standard Schema validation

Route parameter decorators — @Body(), @Query(), @Param(), @RawBody() — accept a new schema option, designed for Standard Schema compatible libraries such as Zod, Valibot, and ArkType:

@Post()
create(@Body({ schema: createUserSchema }) body: CreateUserDto) {
  return this.usersService.create(body);
}
</tr></table> 

... (truncated)

Commits

• 4c751c5 chore(release): publish v12.0.1 release
• 3c25112 chore: update peer deps
• 6494a6c chore(release): publish v12.0.0 release
• e03cf5c fix(express,fastify): apply falsy status codes in reply()
• edb0034 Merge branch 'master' into v12.0.0
• e255755 chore: resolve conflicts, minor fixes
• 5d1b19b Merge branch 'master' into v12.0.0
• 043e951 fix(platform-express): address body parser review comments
• 361ce5f feat: narrow body parser options to the selected parser
• 68dfc23 Merge branch 'master' into v12.0.0
• Additional commits viewable in compare view

Updates @nestjs/swagger from 11.4.7 to 12.0.1

Release notes

Sourced from @​nestjs/swagger's releases.

Release 12.0.1

12.0.1 (2026-08-28)

Bug fixes

• #4082 fix: esm hoist static imports (@​kamilmysliwiec)

Dependencies

• #4077 chore(deps): update dependency swagger-ui-dist to v5.32.14 (@​renovate[bot])

Committers: 1

• Kamil Mysliwiec (@​kamilmysliwiec)

Release 12.0.0

What's Changed

@nestjs/swagger is now a native ES module, requires Nest 12, and changes how nullable schemas are spelled in the generated document.

ESM migration

The package is published as pure ESM ("type": "module", compiled with NodeNext) behind a proper exports map. The legacy root index.ts / plugin.js / plugin.ts shims are gone, and deep imports into build internals are no longer resolvable — import from the package root (@nestjs/swagger) or from @nestjs/swagger/plugin.

require(esm) — CommonJS still works

You do not need to convert your app to ESM. Thanks to Node's require(esm) support, a CommonJS app can keep doing const { SwaggerModule } = require('@nestjs/swagger'). The CLI plugin entry (@nestjs/swagger/plugin) also keeps a require condition so nest-cli.json setups load it unchanged.

This is why the package now declares "engines": { "node": "^20.19.0 || >=22.12.0" } — those are the Node versions where require(esm) is available without a flag.

Nest 12 peer dependencies

@nestjs/common and @nestjs/core peers are now ^12.0.0. @nestjs/mapped-types moves to 12.0.0 (itself ESM, with its major aligned to the Nest 12 line), so PartialType, PickType, OmitType and IntersectionType come from an ESM build too.

Standard Schema support

Schemas passed to Nest 12's route decorators (for example @Body({ schema: z.object({ ... }) })) can now be reflected into the OpenAPI document. Supply an adapter via the new standardSchemaConverter document option:

import { SwaggerModule, DocumentBuilder } from '@nestjs/swagger';
import type { SwaggerDocumentOptions } from '@nestjs/swagger';
import { createSchema } from 'zod-openapi';
import type { ZodType } from 'zod';
// Standard Schema exposes the producing library under ~standard.vendor,
// which is how you narrow the raw value to a library-specific type.
function isZodSchema(schema: unknown): schema is ZodType {
return (
!!schema &&
typeof schema === 'object' &&
(schema as { '~standard'?: { vendor?: string } })['~standard']?.vendor ===
'zod'
);
</tr></table>

... (truncated)

Commits

• 4274e7c chore(): release v12.0.1
• 325d009 Merge pull request #4082 from nestjs/fix/esm-hoist-static-imports
• 8980a54 fix: esm hoist static imports
• 31b0bf4 chore(deps): update dependency lint-staged to v17.4.1 (#4078)
• b71a812 Merge pull request #4077 from nestjs/renovate/swagger-ui-dist-5.x-lockfile
• ec18a13 chore(deps): update dependency swagger-ui-dist to v5.32.14
• 0f85b4c Merge pull request #4072 from nestjs/renovate/js-yaml-5.x
• 7d8b38e Merge pull request #4076 from nestjs/renovate/vite-8.x-lockfile
• ebc4cb8 Merge pull request #4069 from nestjs/renovate/zod-openapi-6.x
• 71e1769 Merge pull request #4068 from nestjs/renovate/swagger-ui-dist-5.x
• Additional commits viewable in compare view

Updates uuid from 11.1.1 to 14.0.2

Release notes

Sourced from uuid's releases.

v14.0.2

14.0.2 (2026-08-18)

Bug Fixes

• v1: carry nsecs overflow into the timestamp's high bits (#972) (6adcc1d)
• v1: set the multicast bit on v1Bytes's own randomly-generated node (#973) (b1da338)
• v7: align default seq formula in v7Bytes with updateV7State (#965) (a67db57)

v14.0.1

14.0.1 (2026-06-20)

Bug Fixes

• add types condition to node export for moduleResolution bundler (#961) (27ffae5)

v14.0.0

14.0.0 (2026-04-19)

⚠ BREAKING CHANGES

• expect crypto to be global everywhere (requires node@20+) (#935)
• drop node@18 support (#934)

Features

• drop node@18 support (#934) (dc4ddb8)

Bug Fixes

• expect crypto to be global everywhere (requires node@20+) (#935) (f2c235f)
• Use GITHUB_TOKEN for release-please and enable npm provenance (#925) (ffa3138)

v13.0.2

13.0.2 (2026-05-04)

Bug Fixes

• rerelease to fix provenance. (49ccb35)

v13.0.1

13.0.1 (2026-04-27)

Bug Fixes

... (truncated)

Changelog

Sourced from uuid's changelog.

14.0.2 (2026-08-18)

Bug Fixes

• v1: carry nsecs overflow into the timestamp's high bits (#972) (6adcc1d)
• v1: set the multicast bit on v1Bytes's own randomly-generated node (#973) (b1da338)
• v7: align default seq formula in v7Bytes with updateV7State (#965) (a67db57)

14.0.1 (2026-06-20)

Bug Fixes

• add types condition to node export for moduleResolution bundler (#961) (27ffae5)

14.0.0 (2026-04-19)

Security

• Fixes GHSA-w5hq-g745-h8pq: v3(), v5(), and v6() did not validate that writes would remain within the bounds of a caller-supplied buffer, allowing out-of-bounds writes when an invalid offset was provided. A RangeError is now thrown if offset < 0 or offset + 16 > buf.length.

⚠ BREAKING CHANGES

• crypto is now expected to be globally defined (requires node@20+) (#935)
• drop node@18 support (#934)
• upgrade minimum supported TypeScript version to 5.4.3, in keeping with the project's policy of supporting TypeScript versions released within the last two years

13.0.0 (2025-09-08)

⚠ BREAKING CHANGES

• make browser exports the default (#901)

Bug Fixes

• make browser exports the default (#901) (bce9d72)

12.0.0 (2025-09-05)

⚠ BREAKING CHANGES

• update to typescript@5.2 (#887)
• remove CommonJS support (#886)
• drop node@16 support (#883)

... (truncated)

Commits

• fd59f02 chore(main): release 14.0.2 (#967)
• f3c564e docs: point the Node support permalink at the CI version matrix (#974)
• b1da338 fix(v1): set the multicast bit on v1Bytes's own randomly-generated node (#973)
• 6adcc1d fix(v1): carry nsecs overflow into the timestamp's high bits (#972)
• ea83515 docs: cleanup API summary (#968)
• ac36860 chore: pin publint version in CI (#966)
• a67db57 fix(v7): align default seq formula in v7Bytes with updateV7State (#965)
• 7017780 chore(main): release 14.0.1 (#964)
• f2c3e4b chore: fix release-please workflow (#963)
• 27ffae5 fix: add types condition to node export for moduleResolution bundler (#961)
• Additional commits viewable in compare view

Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Labels

The following labels could not be found: automated, dependencies. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.