Skip to content

build(deps): bump the production group with 4 updates - #179

Merged
rennf93 merged 2 commits into
masterfrom
dependabot/npm_and_yarn/production-7371530c72
Oct 23, 2026
Merged

build(deps): bump the production group with 4 updates#179
rennf93 merged 2 commits into
masterfrom
dependabot/npm_and_yarn/production-7371530c72

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 23, 2026

Copy link
Copy Markdown
Contributor

Bumps the production group with 4 updates: guardagent, @nestjs/common, @nestjs/core and @nestjs/platform-express.

Updates guardagent from 3.2.3 to 3.2.4

Release notes

Sourced from guardagent's releases.

v3.2.4 (2026-10-15)

Redis persistence off the request path and Python agent parity (v3.2.4)

Fixed

  • addEvent and addMetric no longer await Redis, so a slow or failing Redis no longer delays requests that emit events. A Redis failure that reported through sendEvent used to re-enter persistence through unbounded async recursion; persists are now tracked background promises scoped by AsyncLocalStorage and drained on stop. In-flight persists are capped at bufferSize (shared by events and metrics): past the cap the item stays in memory only, counts toward redisPersistFailures, and one warning is logged per degradation episode. The startup encryption error now includes the cause. Lockstep release with the agent family at 3.2.4.
  • The rules loop starts only when projectId is set, like the Python agent. Without a project id there is nothing to fetch rules for.
  • Redis keys use a wall-clock epoch nanosecond stamp at microsecond resolution (performance.timeOrigin + performance.now()), like time.time_ns() in the Python agent. Reload keeps the reference semantics: keys are walked in the order Redis returns them.
  • SecurityEvent keeps unknown fields as extra and eventToWire sends them, like the reference extra="allow". They survive metadata redaction and a Redis round trip and never override a known field.
  • getStats() keeps the reference key set (pinned by a test). The code comment on signing.ts now states that the signature covers the uncompressed body.
Changelog

Sourced from guardagent's changelog.

v3.2.4 (2026-10-15)

Redis persistence off the request path and Python agent parity (v3.2.4)

Fixed

  • addEvent and addMetric no longer await Redis, so a slow or failing Redis no longer delays requests that emit events. A Redis failure that reported through sendEvent used to re-enter persistence through unbounded async recursion; persists are now tracked background promises scoped by AsyncLocalStorage and drained on stop. In-flight persists are capped at bufferSize (shared by events and metrics): past the cap the item stays in memory only, counts toward redisPersistFailures, and one warning is logged per degradation episode. The startup encryption error now includes the cause. Lockstep release with the agent family at 3.2.4.
  • The rules loop starts only when projectId is set, like the Python agent. Without a project id there is nothing to fetch rules for.
  • Redis keys use a wall-clock epoch nanosecond stamp at microsecond resolution (performance.timeOrigin + performance.now()), like time.time_ns() in the Python agent. Reload keeps the reference semantics: keys are walked in the order Redis returns them.
  • SecurityEvent keeps unknown fields as extra and eventToWire sends them, like the reference extra="allow". They survive metadata redaction and a Redis round trip and never override a known field.
  • getStats() keeps the reference key set (pinned by a test). The code comment on signing.ts now states that the signature covers the uncompressed body.
Commits
  • 73b4f59 docs(changelog): add the Python agent parity fixes to 3.2.4 (#47) (#48)
  • 993f7cb fix(agent): match the Python agent in rules loop, key stamp and event extras ...
  • fd7f6c1 release(3.2.4): Redis persistence off the request path, lockstep with the age...
  • 55d9e83 fix(buffer): persist to Redis off the request path and never recurse into per...
  • a16f60d chore(deps): bump the actions group with 4 updates (#40)
  • a50c8a7 chore(deps-dev): bump @​types/node from 26.6.4 to 26.6.5 in the npm group (#39)
  • 2984334 chore(github): point the sponsor button at the maintainer's Sponsors page (#38)
  • 6d75f43 docs(mkdocs): set site_url so the sitemap and canonical links are generated (...
  • b864943 docs(readme): point the docs links at the live site root (#35)
  • See full diff in compare view

Updates @nestjs/common from 12.1.3 to 12.2.0

Release notes

Sourced from @​nestjs/common's releases.

v12.2.0 (2026-10-19)

Notable changes

New options

  • @Sse({ maxPendingDataLength }) sets how many characters of event data may wait for a client that is not reading its events (4M by default; 0 or Infinity lifts the limit) – 2f05ad954e
  • IoAdapter and WsAdapter take maxConcurrentMessages, the number of a client's messages handled at once (1000 by default; Infinity lifts it) – 0bd0810ed7
  • ValidationPipe takes maxErrorMessagesLength (1,000,000 characters by default); messages past it are replaced by a "Further validation errors were omitted" entry – 086c1c514f
  • Kafka: parser.maxMessageSize (16 MiB after decompression by default); larger messages are logged and skipped – 9bdf844fca
  • TCP server: drainTimeout (30 s by default, 0 disables) disconnects a peer that leaves its responses unread – 583d6077ad
  • MQTT server: reconnectOnConnackError is now enabled by default, so a refused connection attempt is retried; set it to false for the previous behaviour – a63cea600a
  • HttpServer.getRouteMatchingOptions(), an optional adapter hook that tells core how the router matches paths (see "Middleware exclusions" below) – 08d8677c8d

New defaults and behaviour changes

  • @nestjs/platform-express, @nestjs/platform-fastify: fieldNestingDepth and fieldArrayIndexLimit (#18074) now default to 32 and 1000; set them to Infinity to lift the limits – 94fcc93770
  • ValidationPipe validates with validationError.target: false unless the options set it, so an exceptionFactory that reads error.target gets undefined; set validationError.target to true for the old errors – 8c5a59bf63
  • ValidationPipe answers an array or a primitive sent for a validated class with a 400 – 197371c1f3
  • FileTypeValidator matches a string fileType up to the end of a name (e.g. font/woff no longer accepts font/woff2; use a RegExp for that) – 770c6f1a19
  • @SerializeOptions({}) on a handler no longer turns off the class schema – d27cb7017f
  • BaseExceptionFilter answers http-errors errors created with expose: false (the default from 500) with the standard reason phrase instead of their message – 9ed572f853
  • A StreamableFile error still gets a 400, but the body no longer carries the error message – 2f28d91afb
  • Files uploaded with a request that a pipe rejected are removed from storage – acb98de89e
  • @nestjs/platform-fastify: a route with fileSize: undefined (or null) falls back to the plugin's limit; set it to Infinity to keep uploads unlimited – dd549e1a74
  • @nestjs/platform-express: object error bodies are sent as application/json on routes with a non-JSON Content-Type – 7dc6e349d5
  • ConsoleLogger in JSON mode cuts a record short past about a million characters – ad4915eaa3
  • A global enhancer that the injector failed to instantiate now fails the application at startup – ae78524ced
  • A request- or transient-scoped APP_FILTER now logs a startup warning, as it only applies to exceptions thrown from controllers – df5275c5e1
  • Microservices: a pattern key longer than 256 characters matches no handler – accd27e66c
  • Kafka: a message may carry up to 10,000 header values (e419ff540b); headers given as a string or array are not sent (312777743f); reply headers are decoded as text (ee94f6aaae)
  • gRPC: request streams are paused while their replies wait to be written – 37e5cf7706
  • Deprecation: on TCP, Redis, NATS, MQTT and RabbitMQ, an @EventPattern() handler that replies to ClientProxy#send() now logs a deprecation warning. The reply is unchanged; in the next major version event handlers will not reply to send(), as on Kafka already – ba3668d36b

Middleware exclusions

  • MiddlewareConsumer.exclude() now compiles excluded routes with the router's case and trailing-slash matching (08d8677c8d). Update @nestjs/core together with @nestjs/platform-express / @nestjs/platform-fastify: with an adapter that does not implement getRouteMatchingOptions(), excluded routes are matched exactly (f5aa875e40), so on a lenient router other spellings of an excluded path run the middleware.
  • With header, media type or custom versioning, exclude({ path, method, version }) and enableCsrfProtection({ exclude }) apply only to requests that ask for one of the excluded versions – 1a7a31fa46
  • @nestjs/platform-fastify: the request hook used by enableCsrfProtection() and useSecurityHeaders() now runs before Nest and app.use() middleware with NestFactory.create() too, including middleware registered before either call, as it already did with Test.createNestApplication() – 8351806290

Bug fixes

... (truncated)

Commits
  • af37111 chore(release): publish v12.2.0 release
  • 770c6f1 fix(common): match a file type string up to the end of a name
  • 8c5a59b fix(common): stop exposing the validated object on validation errors
  • 086c1c5 fix(common): limit the length of validation error messages by default
  • e77ceba fix(common): stop copying nested validation errors for each level
  • 197371c fix(common): reject arrays and primitives for validated classes
  • b34a359 fix(common): validate parsed array items one at a time
  • 1a7a31f fix(core,common): exclude a version only for requests that ask for it
  • 2f05ad9 fix(core): make the sse pending data limit configurable
  • 2f28d91 fix(common): keep StreamableFile error messages out of responses
  • Additional commits viewable in compare view

Updates @nestjs/core from 12.1.3 to 12.2.0

Release notes

Sourced from @​nestjs/core's releases.

v12.2.0 (2026-10-19)

Notable changes

New options

  • @Sse({ maxPendingDataLength }) sets how many characters of event data may wait for a client that is not reading its events (4M by default; 0 or Infinity lifts the limit) – 2f05ad954e
  • IoAdapter and WsAdapter take maxConcurrentMessages, the number of a client's messages handled at once (1000 by default; Infinity lifts it) – 0bd0810ed7
  • ValidationPipe takes maxErrorMessagesLength (1,000,000 characters by default); messages past it are replaced by a "Further validation errors were omitted" entry – 086c1c514f
  • Kafka: parser.maxMessageSize (16 MiB after decompression by default); larger messages are logged and skipped – 9bdf844fca
  • TCP server: drainTimeout (30 s by default, 0 disables) disconnects a peer that leaves its responses unread – 583d6077ad
  • MQTT server: reconnectOnConnackError is now enabled by default, so a refused connection attempt is retried; set it to false for the previous behaviour – a63cea600a
  • HttpServer.getRouteMatchingOptions(), an optional adapter hook that tells core how the router matches paths (see "Middleware exclusions" below) – 08d8677c8d

New defaults and behaviour changes

  • @nestjs/platform-express, @nestjs/platform-fastify: fieldNestingDepth and fieldArrayIndexLimit (#18074) now default to 32 and 1000; set them to Infinity to lift the limits – 94fcc93770
  • ValidationPipe validates with validationError.target: false unless the options set it, so an exceptionFactory that reads error.target gets undefined; set validationError.target to true for the old errors – 8c5a59bf63
  • ValidationPipe answers an array or a primitive sent for a validated class with a 400 – 197371c1f3
  • FileTypeValidator matches a string fileType up to the end of a name (e.g. font/woff no longer accepts font/woff2; use a RegExp for that) – 770c6f1a19
  • @SerializeOptions({}) on a handler no longer turns off the class schema – d27cb7017f
  • BaseExceptionFilter answers http-errors errors created with expose: false (the default from 500) with the standard reason phrase instead of their message – 9ed572f853
  • A StreamableFile error still gets a 400, but the body no longer carries the error message – 2f28d91afb
  • Files uploaded with a request that a pipe rejected are removed from storage – acb98de89e
  • @nestjs/platform-fastify: a route with fileSize: undefined (or null) falls back to the plugin's limit; set it to Infinity to keep uploads unlimited – dd549e1a74
  • @nestjs/platform-express: object error bodies are sent as application/json on routes with a non-JSON Content-Type – 7dc6e349d5
  • ConsoleLogger in JSON mode cuts a record short past about a million characters – ad4915eaa3
  • A global enhancer that the injector failed to instantiate now fails the application at startup – ae78524ced
  • A request- or transient-scoped APP_FILTER now logs a startup warning, as it only applies to exceptions thrown from controllers – df5275c5e1
  • Microservices: a pattern key longer than 256 characters matches no handler – accd27e66c
  • Kafka: a message may carry up to 10,000 header values (e419ff540b); headers given as a string or array are not sent (312777743f); reply headers are decoded as text (ee94f6aaae)
  • gRPC: request streams are paused while their replies wait to be written – 37e5cf7706
  • Deprecation: on TCP, Redis, NATS, MQTT and RabbitMQ, an @EventPattern() handler that replies to ClientProxy#send() now logs a deprecation warning. The reply is unchanged; in the next major version event handlers will not reply to send(), as on Kafka already – ba3668d36b

Middleware exclusions

  • MiddlewareConsumer.exclude() now compiles excluded routes with the router's case and trailing-slash matching (08d8677c8d). Update @nestjs/core together with @nestjs/platform-express / @nestjs/platform-fastify: with an adapter that does not implement getRouteMatchingOptions(), excluded routes are matched exactly (f5aa875e40), so on a lenient router other spellings of an excluded path run the middleware.
  • With header, media type or custom versioning, exclude({ path, method, version }) and enableCsrfProtection({ exclude }) apply only to requests that ask for one of the excluded versions – 1a7a31fa46
  • @nestjs/platform-fastify: the request hook used by enableCsrfProtection() and useSecurityHeaders() now runs before Nest and app.use() middleware with NestFactory.create() too, including middleware registered before either call, as it already did with Test.createNestApplication() – 8351806290

Bug fixes

... (truncated)

Commits
  • af37111 chore(release): publish v12.2.0 release
  • 85d0a0b fix(core): run interceptor, pipe and filter classes without a name
  • 8a53d08 fix(core): detect cycles in request-scoped forward references (#18186)
  • 92136a6 fix(core): give a module that extends another module its own id (#18180)
  • bafce3b fix(core): answer http requests an rpc exception filter leaves
  • 8f9fbfd fix(core): settle async param decorator values before pipes run
  • 9b77f56 fix(core,microservices): let only the hybrid application bind gateways
  • fec478e fix(core): subscribe to guard observables from other copies of rxjs
  • 034ef09 fix(core): run guards bound as classes without a name
  • a190887 fix(core,websockets): run transient enhancers bound to static gateways
  • Additional commits viewable in compare view

Updates @nestjs/platform-express from 12.1.3 to 12.2.0

Release notes

Sourced from @​nestjs/platform-express's releases.

v12.2.0 (2026-10-19)

Notable changes

New options

  • @Sse({ maxPendingDataLength }) sets how many characters of event data may wait for a client that is not reading its events (4M by default; 0 or Infinity lifts the limit) – 2f05ad954e
  • IoAdapter and WsAdapter take maxConcurrentMessages, the number of a client's messages handled at once (1000 by default; Infinity lifts it) – 0bd0810ed7
  • ValidationPipe takes maxErrorMessagesLength (1,000,000 characters by default); messages past it are replaced by a "Further validation errors were omitted" entry – 086c1c514f
  • Kafka: parser.maxMessageSize (16 MiB after decompression by default); larger messages are logged and skipped – 9bdf844fca
  • TCP server: drainTimeout (30 s by default, 0 disables) disconnects a peer that leaves its responses unread – 583d6077ad
  • MQTT server: reconnectOnConnackError is now enabled by default, so a refused connection attempt is retried; set it to false for the previous behaviour – a63cea600a
  • HttpServer.getRouteMatchingOptions(), an optional adapter hook that tells core how the router matches paths (see "Middleware exclusions" below) – 08d8677c8d

New defaults and behaviour changes

  • @nestjs/platform-express, @nestjs/platform-fastify: fieldNestingDepth and fieldArrayIndexLimit (#18074) now default to 32 and 1000; set them to Infinity to lift the limits – 94fcc93770
  • ValidationPipe validates with validationError.target: false unless the options set it, so an exceptionFactory that reads error.target gets undefined; set validationError.target to true for the old errors – 8c5a59bf63
  • ValidationPipe answers an array or a primitive sent for a validated class with a 400 – 197371c1f3
  • FileTypeValidator matches a string fileType up to the end of a name (e.g. font/woff no longer accepts font/woff2; use a RegExp for that) – 770c6f1a19
  • @SerializeOptions({}) on a handler no longer turns off the class schema – d27cb7017f
  • BaseExceptionFilter answers http-errors errors created with expose: false (the default from 500) with the standard reason phrase instead of their message – 9ed572f853
  • A StreamableFile error still gets a 400, but the body no longer carries the error message – 2f28d91afb
  • Files uploaded with a request that a pipe rejected are removed from storage – acb98de89e
  • @nestjs/platform-fastify: a route with fileSize: undefined (or null) falls back to the plugin's limit; set it to Infinity to keep uploads unlimited – dd549e1a74
  • @nestjs/platform-express: object error bodies are sent as application/json on routes with a non-JSON Content-Type – 7dc6e349d5
  • ConsoleLogger in JSON mode cuts a record short past about a million characters – ad4915eaa3
  • A global enhancer that the injector failed to instantiate now fails the application at startup – ae78524ced
  • A request- or transient-scoped APP_FILTER now logs a startup warning, as it only applies to exceptions thrown from controllers – df5275c5e1
  • Microservices: a pattern key longer than 256 characters matches no handler – accd27e66c
  • Kafka: a message may carry up to 10,000 header values (e419ff540b); headers given as a string or array are not sent (312777743f); reply headers are decoded as text (ee94f6aaae)
  • gRPC: request streams are paused while their replies wait to be written – 37e5cf7706
  • Deprecation: on TCP, Redis, NATS, MQTT and RabbitMQ, an @EventPattern() handler that replies to ClientProxy#send() now logs a deprecation warning. The reply is unchanged; in the next major version event handlers will not reply to send(), as on Kafka already – ba3668d36b

Middleware exclusions

  • MiddlewareConsumer.exclude() now compiles excluded routes with the router's case and trailing-slash matching (08d8677c8d). Update @nestjs/core together with @nestjs/platform-express / @nestjs/platform-fastify: with an adapter that does not implement getRouteMatchingOptions(), excluded routes are matched exactly (f5aa875e40), so on a lenient router other spellings of an excluded path run the middleware.
  • With header, media type or custom versioning, exclude({ path, method, version }) and enableCsrfProtection({ exclude }) apply only to requests that ask for one of the excluded versions – 1a7a31fa46
  • @nestjs/platform-fastify: the request hook used by enableCsrfProtection() and useSecurityHeaders() now runs before Nest and app.use() middleware with NestFactory.create() too, including middleware registered before either call, as it already did with Test.createNestApplication() – 8351806290

Bug fixes

... (truncated)

Commits
  • af37111 chore(release): publish v12.2.0 release
  • c8923bd fix(express,fastify): parse quoted media type version parameters (#18178)
  • fb8c2ca fix(core): mount wildcard middleware on every path when "/" is excluded
  • b75244f fix(express): run wildcard middleware on "/api/" for a named wildcard
  • 8b8e839 fix(express): stop reading a streamable file for a head request
  • acb98de fix(core,express,fastify): remove uploads of requests a pipe rejected
  • 1933cc9 fix(express,fastify): handle a StreamableFile that cannot be streamed
  • 7dc6e34 fix(express): send object error bodies with a json content type
  • e075cda fix(express,fastify): let a route's dest replace the module's storage
  • 84a16fe fix(deps): update dependency express to v5.3.0 (#18150)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
build(deps): bump the production group with 4 updates
6a1cf5d 
Bumps the production group with 4 updates: [guardagent](https://github.com/Guard-Core/guard-agent-ts), [@nestjs/common](https://github.com/nestjs/nest/tree/HEAD/packages/common), [@nestjs/core](https://github.com/nestjs/nest/tree/HEAD/packages/core) and [@nestjs/platform-express](https://github.com/nestjs/nest/tree/HEAD/packages/platform-express).


Updates `guardagent` from 3.2.3 to 3.2.4
- [Release notes](https://github.com/Guard-Core/guard-agent-ts/releases)
- [Changelog](https://github.com/Guard-Core/guard-agent-ts/blob/master/CHANGELOG.md)
- [Commits](Guard-Core/guard-agent-ts@v3.2.3...v3.2.4)

Updates `@nestjs/common` from 12.1.3 to 12.2.0
- [Release notes](https://github.com/nestjs/nest/releases)
- [Commits](https://github.com/nestjs/nest/commits/v12.2.0/packages/common)

Updates `@nestjs/core` from 12.1.3 to 12.2.0
- [Release notes](https://github.com/nestjs/nest/releases)
- [Commits](https://github.com/nestjs/nest/commits/v12.2.0/packages/core)

Updates `@nestjs/platform-express` from 12.1.3 to 12.2.0
- [Release notes](https://github.com/nestjs/nest/releases)
- [Commits](https://github.com/nestjs/nest/commits/v12.2.0/packages/platform-express)

---
updated-dependencies:
- dependency-name: guardagent
  dependency-version: 3.2.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production
- dependency-name: "@nestjs/common"
  dependency-version: 12.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production
- dependency-name: "@nestjs/core"
  dependency-version: 12.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production
- dependency-name: "@nestjs/platform-express"
  dependency-version: 12.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies package.json or pnpm-lock.yaml javascript labels Oct 23, 2026
@dependabot
dependabot Bot requested a review from rennf93 as a code owner October 23, 2026 06:24
@github-actions

github-actions Bot commented Oct 23, 2026

Copy link
Copy Markdown

Thanks for opening your first pull request on guard-core-ts!

Quick checklist before review (most of these are enforced by CI, but worth a glance):

  • pnpm install — workspace resolves cleanly
  • pnpm lint (or make lint) — turbo lint pipeline passes for every package you touched
  • pnpm test (or make test-all) — vitest suites pass across all packages
  • pnpm build — every package builds via tsup without warnings
  • Coverage didn't regress — make test-coverage
  • No // @ts-ignore / // @ts-expect-error / any shortcuts; pre-existing violations in touched files are fixed
  • Added an entry under ## Unreleased in CHANGELOG.md
  • If you touched a public API, updated the relevant page under docs/

See CONTRIBUTING.md for the full workflow and the Code of Conduct for the community standards we follow.

Welcome aboard — a maintainer will review shortly.

@github-actions github-actions Bot added package: express Changes inside @guardcore/express package: fastify Changes inside @guardcore/fastify package: hono Changes inside @guardcore/hono package: nestjs Changes inside @guardcore/nestjs examples examples/ apps labels Oct 23, 2026
@rennf93 rennf93 self-assigned this Oct 23, 2026
@rennf93
rennf93 merged commit 3f080da into master Oct 23, 2026
15 checks passed
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/production-7371530c72 branch October 23, 2026 10:56
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@rennf93 rennf93 Awaiting requested review from rennf93 rennf93 is a code owner

Assignees

@rennf93 rennf93

Labels

dependencies package.json or pnpm-lock.yaml examples examples/ apps package: express Changes inside @guardcore/express package: fastify Changes inside @guardcore/fastify package: hono Changes inside @guardcore/hono package: nestjs Changes inside @guardcore/nestjs

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@rennf93