v12.1.0 (2026-09-23)

Bug fixes

• core
  • #17838 fix(core): inherit optional ctor params when the ctor is not redeclared (@kamilmysliwiec)
  • #17819 fix(core): name the module when metadata entries are invalid (@thekhegay)
• microservices
  • #17828 fix(microservices): let the redis client retry after a failed connect (@hktitof)
  • #17810 fix(microservices): fail every pending request when a callback throws (@hktitof)

Enhancements

• core
  • #17846 fix(core): do not skip subsequent middleware after a transient one (@lehafari)
  • #17840 fix(core): preserve route handler names (@Grmiade)
• common, core
  • #17713 feat(core): add support for array of global prefixes (@micalevisk)
  • #17834 feat(common,core): add built-in, adapter-agnostic cookies (@kamilmysliwiec)
• platform-fastify
  • #17824 fix(fastify): honor Nest forceCloseConnections in initHttpServer (@xia-chao)
• common
  • #17827 fix(common): apply the ParseDatePipe default to every missing value (@xia-chao)
• platform-fastify, testing
  • #17835 feat(fastify): add file upload interceptors backed by @fastify/multipart (@kamilmysliwiec)
• common, core, platform-fastify
  • #17836 feat(common,core,fastify): built-in CSRF protection and security headers (@kamilmysliwiec)

Committers: 9

• Abdellatif Anaflous (@hktitof)
• Alejandro (@lehafari)
• Chris Z (@haimingZZ)
• Johnny J. Huirilef Millán (@johnnyhuirilef)
• Jérémy Fauvel (@Grmiade)
• Kamil Mysliwiec (@kamilmysliwiec)
• Micael Levi L. Cavalcante (@micalevisk)
• Roman Khegay (@thekhegay)
• Xia Chao (@xia-chao)

v12.0.4 (2026-09-21)

Bug fixes

• microservices
  • #17816 fix(microservices): let the kafka client retry after a failed connect (@Xch4rt)
  • #17786 fix(microservices): fail pending rmq requests on client close (@johnnyhuirilef)
  • #17802 fix(microservices): fail pending nats requests on client close (@hktitof)
  • #17803 fix(microservices): handle missing grpc package namespace gracefully (@Se3do)
  • #17799 fix(microservices): share the processing hook envelope across transports (@kamilmysliwiec)
  • #17797 fix(microservices): close the kafka request-response span exactly once (@MingLin1995)
  • #17794 fix(microservices): close the request-response span exactly once (@kamilmysliwiec)
  • #17785 fix(microservices): route message handler rejections to handleError (@hktitof)
• core
  • #17821 fix(core): hang on sparse factory inject array (@xia-chao)

Enhancements

• platform-express
  • #17818 Fix: merge multer limits key-by-key instead of overriding it wholesale (@mdrezuanislamridoy)
• common
  • #17780 fix(common): mark parse date pipe options as optional (@Chy-Zaber-Bin-Zahid)

Dependencies

• common
  • #17793 fix(deps): update dependency file-type to v22.1.1 (@renovate[bot])
• platform-fastify
  • #17791 fix(deps): update dependency fastify to v5.12.5 (@renovate[bot])

Committers: 10

• Abdellatif Anaflous (@hktitof)
• Chowdhury Zaber Bin Zahid (@Chy-Zaber-Bin-Zahid)
• Imad - Prakticode (@prakticode)
• Johnny J. Huirilef Millán (@johnnyhuirilef)
• Kamil Mysliwiec (@kamilmysliwiec)
• MD. Ridoy Babu (@mdrezuanislamridoy)
• Ming (@MingLin1995)
• Mohammed Said (@Se3do)
• Pablo Gutiérrez (@Xch4rt)
• Xia Chao (@xia-chao)

v12.0.3 (2026-09-15)

Bug fixes

• microservices
  • #17766 fix(microservices): always run the kafka processing end hook (@kamilmysliwiec)
  • #17757 fix(microservices): fail pending requests on client close (@hktitof)
  • #17746 fix(microservices): bound memory held for a TCP peer (@kamilmysliwiec)
  • #17745 fix(microservices): destroy open TCP sockets on shutdown (@kamilmysliwiec)
• common
  • #17738 fix(common): validate uuid version and variant when no version is set (@otnc)
  • #17761 fix(common): invoke proto-key stripping hook via this in transform (@koreahghg)

Dependencies

• platform-express
  • #17762 fix(deps): update dependency multer to v2.4.0 (@renovate[bot])
• common
  • #17753 fix(deps): update dependency file-type to v22.1.0 (@renovate[bot])

Committers: 4

• Abdellatif Anaflous (@hktitof)
• Kamil Mysliwiec (@kamilmysliwiec)
• otoneko. (@otnc)
• 한국 (@koreahghg)

v12.0.2 (2026-09-14)

Bug fixes

• platform-socket.io, platform-ws
  • #17666 fix(socket.io): keep the message stream alive when a handler throws (@hktitof)
• microservices
  • #17728 fix(microservices): detach signal listeners of connected microservices (@kamilmysliwiec)
  • #17671 fix(microservices): fail requests whose reply subscription is rejected (@samuelmbabhazi)
  • #17670 fix(microservices): do not treat foreign JSON as an RPC envelope (@xia-chao)
  • #17644 fix(microservices): don't flatten plain handler results with pre-request hooks (@iamolegga)
  • #17641 fix(microservices): run the mqtt listen callback once (@johnnyhuirilef)
• common
  • #17710 fix(common): collapse duplicate internal slashes in normalizePath (@Asadshah7950)
  • #17655 fix(common): validate UUID v3 variant (@gwagjiug)
  • #17702 fix(common): treat empty string as array input in ParseArrayPipe (@xia-chao)
• core
  • #17667 fix(core): discover factory providers with discovery decorators (@hktitof)
  • #17709 fix(core): avoid treating error instances with statusCode as http errors (@Asadshah7950)
  • #17625 fix(core): clean up repeated shutdown signal listeners (@Raj4478)
• platform-fastify
  • #17705 fix(fastify): derive neutral version when accept header is absent (@Gaurav1112)
  • #17699 fix(fastify): send responses for exceptions thrown from middleware (@micalevisk)

Enhancements

• microservices
  • #17734 feat(microservices): add maxConnectionAttempts to ServerMqtt (@kamilmysliwiec)

Dependencies

• platform-fastify
  • #17729 fix(deps): update dependency fastify to v5.12.4 (@renovate[bot])

Committers: 16

• Abdellatif Anaflous (@hktitof)
• Alexey Solovyov (@lyohaplotinka)
• Asad Ali Shah (@Asadshah7950)
• Gyeonghun Park (@Gyeonghun-Park)
• Johnny J. Huirilef Millán (@johnnyhuirilef)
• Kamil Mysliwiec (@kamilmysliwiec)
• Kumar Gaurav (@Gaurav1112)
• Micael Levi L. Cavalcante (@micalevisk)
• Ming (@MingLin1995)
• Mohammed Said (@Se3do)
• Rajeshwar Singh (@Raj4478)
• Xia Chao (@xia-chao)
• @iamolegga
• cui fliter (@cuishuang)
• samuel mbabhazi (@samuelmbabhazi)
• 곽지욱 (@gwagjiug)

NestJS v12.0.0

NestJS 12 is centered around ESM-ready packages, first-class Standard Schema support for validation and serialization, a rebuilt CLI, and native observability through the new @nestjs/observe SDK.

Existing CommonJS applications keep working — migrating your own code to ESM is entirely optional.

📖 Full migration guide

Upgrading

Upgrade the CLI first, since the upgrade command ships with it:

npm i -g @nestjs/cli@latest

Then, from the root of your project:

nest upgrade

nest upgrade moves every @nestjs/* package to its v12-compatible major at once and applies the mechanical parts of the migration for you — nest-cli.json webpack options, the GraphQL playground → graphiql rename and subscriptions transport swap, the NATS package replacement, @nestjs/config validation options, Jest and Joi bumps — then prints a report of everything it changed and everything you still need to review by hand. Run it with --dry-run first to see that report without touching your files.

It deliberately does not migrate your project to ESM, Vitest, or oxlint. Those are the defaults for newly generated projects; existing projects adopt them on their own schedule.

Node.js: v12 requires Node.js v20.19+ or v22.12+. Both require(esm) and the ESM packages depend on it; the upgrade command refuses to run on older releases (including the 21.x line). The latest active LTS is recommended.

Highlights

ESM packages

All core Nest packages now ship as ESM. Thanks to require(esm) in modern Node.js, most existing CommonJS applications continue to work without a rewrite. Review custom bootstrapping scripts, build tooling, and test runners if they assume CommonJS-only packages.

nest new now asks whether to scaffold a CommonJS or an ESM project.

Standard Schema validation

Route parameter decorators — @Body(), @Query(), @Param(), @RawBody() — accept a new schema option, designed for Standard Schema compatible libraries such as Zod, Valibot, and ArkType:

@Post()
create(@Body({ schema: createUserSchema }) body: CreateUserDto) {
  return this.usersService.create(body);
}

@Get(':id')
findOne(@Param('id', { schema: z.coerce.number().int().positive() }) id: number) {
  return this.usersService.findOne(id);
}

The decorator only attaches metadata; register the new StandardSchemaValidationPipe to validate against it:

app.useGlobalPipes(new StandardSchemaValidationPipe());

The same schemas feed OpenAPI generation. The decorator-based class-validator workflow remains fully supported, with no plan to remove it.

Standard Schema serialization

StandardSchemaSerializerInterceptor validates and transforms outgoing responses with the same ecosystem:

@UseInterceptors(StandardSchemaSerializerInterceptor)
@SerializeOptions({ schema: userResponseSchema })
@Get(':id')
findOne(@Param('id') id: string) {
  return this.usersService.findOne(id);
}

Pick per use case: ValidationPipe / ClassSerializerInterceptor for class-based DTOs, the Standard Schema variants when your schemas already exist.

Native observability — @nestjs/observe

The official NestJS Observe SDK plugs into Nest's own request lifecycle through the instrument application option, rather than patching the HTTP server like a generic APM agent. Requests, jobs, errors, and traces are reported in terms of your controllers, providers, resolvers, and queue consumers:

export const { ObserveModule, ObserveInstrument } = createObserveModule();

const app = await NestFactory.create(AppModule, {
  instrument: ObserveInstrument,
});

Auto-instrumentation covers HTTP, GraphQL, gRPC, and microservice transports, plus queue consumers and cron runs — no manual span wiring and no collector to run. Opt-in and new; nothing to migrate. nest new and nest upgrade can wire it up for you (--observe). See the Observability chapter.

Config module on Standard Schema

@nestjs/config moves from Joi-specific validation to Standard Schema. validationSchema now accepts any compatible schema:

ConfigModule.forRoot({
  validationSchema: z.object({
    NODE_ENV: z.enum(['development', 'production', 'test']).default('development'),
    PORT: z.coerce.number().default(3000),
  }),
});

Existing Joi schemas still work with two caveats: upgrade to Joi v18+ (the first release implementing Standard Schema), and move library-specific settings under validationOptions.libraryOptions.

Route conflict diagnostics

Routes are registered in declaration order, so on order-sensitive adapters @Get(':id') can silently shadow a @Get('me') declared after it. Two opt-in options surface this:

const app = await NestFactory.create(AppModule, {
  routeConflictPolicy: { duplicate: 'error', shadow: 'warn' },
  routeResolutionStrategy: 'specificity',
});

Both default to the previous behavior, so nothing changes unless you set them.

Machine-readable error codes

HttpExceptionOptions accepts an errorCode that is serialized into the response body, so clients branch on a stable identifier instead of parsing message strings:

throw new BadRequestException('Password is too weak', { errorCode: 'WEAK_PASSWORD' });

Structured logging params

ConsoleLogger now treats plain objects passed after the message as structured params of the same log entry instead of separate records:

logger.log('User created', { userId: 1, email: 'foo@bar.com' });

In JSON mode they nest under params, or spread into the root with flattenParams. On by default; set structuredParams: false to restore the old behavior.

CLI (@nestjs/cli v12)

The CLI was rebuilt in nestjs/nest-cli#3280: the entire source migrated to ESM, tests moved from Jest to Vitest, e2e tests were added for every command, and command classes were refactored to take typed context objects instead of untyped inputs and option arrays.

New commands

• nest upgrade (alias update) — upgrades a v11 project to v12 and applies the migration steps described above.
• nest deploy — deploys your application to the cloud via Mau, installing @nestjs/mau on first use and forwarding every argument straight through.

Defaults and tooling

• Rspack is the new default bundler for monorepos. The --webpack / --webpackPath flags (and their webpack / webpackConfigPath counterparts in nest-cli.json) are deprecated in favor of --builder rspack.
• oxlint replaces ESLint in generated projects.
• Vitest is the default test runner for ESM projects; CommonJS projects continue with Jest.
• bun is now a supported package manager, alongside npm, yarn, and pnpm.
• The decorator schematic generates decorators using the preferred Reflector.createDecorator() form. The angular schematic has been removed.

New options

• nest build / nest start: --rspackPath [path], --emit-declarations (SWC), --no-type-check, --silent
• nest build: --parallel [concurrency], for building monorepo projects in parallel with --all
• nest-cli.json: includeLibraryAssets, for copying library assets into an application build

Breaking changes

Most of these are handled automatically by nest upgrade.

Also in this release

• ValidationPipe error format — a new option controls the shape of validation error responses.
• gRPC exception filter — GrpcExceptionFilter and status-specific exceptions map errors to proper gRPC status codes instead of UNKNOWN.
• Regex Kafka patterns — @MessagePattern() and @EventPattern() accept a RegExp on the Kafka transport.
• Request-scoped WebSocket gateways — gateways support request-scoped providers, with the socket injectable via the REQUEST token.
• WebSocket disconnect reason — handleDisconnect can receive the reason for the disconnection.
• Microservices pre-request hook — a new hook runs before a message handler is invoked.
• Express graceful shutdown — the Express adapter drains in-flight requests on shutdown.
• HTTP adapter error mapping — reworked across core, Express, and Fastify adapters.

Thanks

Thank you to everyone who contributed code, issues, reproductions, and reviews to this release. 💛

If NestJS helps you build your products, consider supporting the project.

What's changed

• @nestjs/platform-express
  • fix(deps): update dependency multer to v2.4.0 [security] — fixes CVE-2026-88932 (GHSA-3pph-fpjx-jg34)
  • fix(express): map multer errors by code instead of message — backport of #17769; a file sent under an unexpected field name now returns 400 again instead of 500 with multer 2.4.0

Full Changelog: v11.2.5...v11.2.6

What's changed

• @nestjs/microservices
  • fix(microservices): harden the tcp transport against a hostile peer

Full Changelog: v11.2.4...v11.2.5

What's changed

• fix(microservices): handle unserializable patterns without crashing
• fix(platform-fastify): absolute-form request target middleware bypass

What's Changed

• fix(core): circular durable providers issue by @kamilmysliwiec in #17563

Full Changelog: v11.2.2...v11.2.3

What's changed

• fix(core): ObserveInstrument breaks app startup with @nestjs/core@11.2.x #17554 by @kamilmysliwiec
• fix(core): Bootstrap crashes with nestjs-cls proxy providers (ProxyProviderNotResolvedException on CLS_REQ) #17553 by @kamilmysliwiec

What's Changed

• fix(core): early-return SSE abort issue by @kamilmysliwiec

Full Changelog: v11.2.0...v11.2.1

What's Changed

• fix(core): share existing singleton providers with lazily loaded modules by @shariyerShazan in #17430
• fix(common): match string file types containing regex metacharacters by @Jaybhade in #17435
• fix(core): convert adjacent wildcard segments in legacy route converter by @eeshsaxena in #17416
• fix(fastify): run middleware on routes excluded from global prefix by @Arun445 in #17377
• fix(fastify): avoid double prefixing inherited middleware by @GiHoon1123 in #17350
• fix(core): scan pre-registered dynamic imports of lazy modules by @johnnyhuirilef in #17464
• feat(core,common,platform-fastify): add query http method support by @gacardinal in #17162
• fix(common): exclude reverse-mapped keys from numeric enum validation in ParseEnumPipe by @LeSingh1 in #17086
• test(testing): Add e2e integration tests for HTTP QUERY method (RFC 10008) by @brayanjeshua in #17310
• feat(core): sse signal by @kamilmysliwiec in #17469
• chore(deps): update dependency fastify to v5.12.0 by @renovate[bot] in #17473

New Contributors

• @shariyerShazan made their first contribution in #17430
• @Jaybhade made their first contribution in #17435
• @eeshsaxena made their first contribution in #17416
• @Arun445 made their first contribution in #17377
• @GiHoon1123 made their first contribution in #17350
• @johnnyhuirilef made their first contribution in #17464
• @gacardinal made their first contribution in #17162
• @LeSingh1 made their first contribution in #17086
• @brayanjeshua made their first contribution in #17310

Full Changelog: v11.1.29...v11.2.0

What's Changed

• fix(core): stop import lookup after first direct export match by @malekelkssas in #17141
• chore: update multerExceptions constant by @bo0tzz in #17328
• fix(microservices): correct pub/sub client type in redis listeners by @zaewc in #17331
• feat(common): add override mimetype option to file type validator by @Ativ3k in #17333
• fix(core): drop the g flag from middleware overlap regexes by @dchaudhari7177 in #17335
• feat(core): support sse comments by @kyu4583 in #17327
• fix(core): resolve barrier immediately when target count is zero by @ikrbasak in #17393
• fix(common): exclude pipe options from validator options by @coxxny in #17399
• fix(core): serialize SSE retry field when value is zero by @kyu4583 in #17360
• fix(microservices): nullify grpcclient on close when tryshutdown fails by @Se3do in #17394
• fix(express): map missing multer field nesting error by @Se3do in #17421

New Contributors

• @malekelkssas made their first contribution in #17141
• @hjc0930 made their first contribution in #17311
• @bo0tzz made their first contribution in #17328
• @Ativ3k made their first contribution in #17333
• @dchaudhari7177 made their first contribution in #17335
• @kyu4583 made their first contribution in #17327
• @anupamme made their first contribution in #17378
• @ikrbasak made their first contribution in #17393
• @beiifeng made their first contribution in #17404
• @coxxny made their first contribution in #17399

Full Changelog: v11.1.28...v11.1.29

v11.1.28 (2026-07-08)

Bug fixes

• core
  • #17239 fix(core): trigger teardown of SSE producer Observable on client disconnect with interceptor (@jyx-07)
• common
  • #17257 fix(common): Add missing exception classes to HttpErrorByCode (@Se3do)
• websockets
  • #17188 fix(websockets): correct type guard to check value not key (@Se3do)

Enhancements

• core
  • #17241 feat(core): include auto-converted route in legacy route path warning (@ronielli)

Dependencies

• platform-fastify
  • #17262 chore(deps): bump fastify from 5.8.5 to 5.10.0 (@dependabot[bot])
• platform-express
  • #17164 fix(deps): update dependency multer to v2.2.0 [security] (@renovate[bot])

Committers: 4

• Mohammed Said (@Se3do)
• Ronielli (@ronielli)
• greymoth (@greymoth-jp)
• 종윤 (@jyx-07)

What's Changed

• fix(core): sse async handlers teardown issue by @kamilmysliwiec in #17131
• fix(platform-fastify): forRoutes middleware ending slash by @kamilmysliwiec in #17138

Full Changelog: v11.1.26...v11.1.27

What's Changed

• fix(core): post sse endpoint empty response #17098 by @kamilmysliwiec in #17099

Full Changelog: v11.1.25...v11.1.26

What's Changed

• fix(microservices): reject pending Redis requests on close by @yudin-s in #17024
• fix(core): register SSE close listener before async setup by @fallintoplace in #17018
• fix(platform-fastify): remove pathname ending slash by @kamilmysliwiec in #17094

New Contributors

• @fallintoplace made their first contribution in #17018
• @DucMinhNe made their first contribution in #17085
• @iambeaukim made their first contribution in #17091

Full Changelog: v11.1.24...v11.1.25

v11.1.24 (2026-05-25)

Bug fixes

• core
  • #17009 fix(core): reset dependency-tree cache on metadata changes (@puneetdixit200)

Enhancements

• core
  • #16997 feat(core): warn on late websocket adapter registration (@hbinhng)

Dependencies

• platform-ws
  • #17011 chore(deps): bump ws from 8.20.1 to 8.21.0 (@dependabot[bot])

Committers: 2

• Nguyễn Hải Bình (@hbinhng)
• Puneet Dixit (@puneetdixit200)

v11.1.23 (2026-05-21)

Bug fixes

• core
  • https://github.com/nestjs/nest/issues/16998 fix snapshot: true eagerly instantiates Terminus transient indicators since 11.1.20

Committers: 1

• Kamil Mysliwiec (@kamilmysliwiec)

v11.1.22 (2026-05-21)

Bug fixes

• core
  • #16993 fix(core): inflight request injection bug #16989 (@kamilmysliwiec)

Enhancements

• core
  • #16967 fix(core): identify decorator type in invalid-class-module error (@HarrierOnChain)

Committers: 2

• Harrier (@HarrierOnChain)
• Kamil Mysliwiec (@kamilmysliwiec)

v11.1.21 (2026-05-14)

Bug fixes

• core
  • #16948 fix(core): settle skipped provider initialization (@yudin-s)

Committers: 1

• Serge Yudin (@yudin-s)

v11.1.20 (2026-05-13)

Bug fixes

• core, testing
  • #16939 fix(core): fix deeply nested transient providers resolution (@kamilmysliwiec)
• core
  • #16861 fix(core): fix @Sse losing events on complete (@MatthiasBrehmer)
  • #16753 fix(core): defer sse writehead until after lifecycle completes (@jkalberer)
  • #16782 fix(core): use strict null check for SSE message id (@burhanharoon)
• microservices
  • #16850 fix(microservices): ServerRMQ crashes at boot when @MessagePattern(undefined) is combined with wildcards: true (@lavieennoir)
• common
  • #16845 fix(common): accept zero timestamp in parse date pipe (@Mysh3ll)
• platform-socket.io
  • #16742 fix(socket.io): Deduplicate disconnect listener in bindMessageHandlers (@fru1tworld)

Enhancements

• microservices
  • #16676 feat(microservices): add return buffers option for binary data (@Forceres)
  • #16826 feat(microservices): handle rmq blocked/unblocked connection events (@thisalihassan)
• common
  • #16902 fix(common): filetype validator buffer message (@QusaiAlbonni)
• platform-express
  • #16844 feat(platform-express): add defParamCharset to MulterOptions (@starnayuta)

Dependencies

• platform-ws
  • #16941 chore(deps): bump ws from 8.20.0 to 8.20.1 (@dependabot[bot])

Committers: 13

• Ali Hassan (@thisalihassan)
• Burhan Haroon⚡ (@burhanharoon)
• Dmytro Khyzhniak (@lavieennoir)
• Harsh Rathod (@harshrathod50)
• IlyaCredo (@Forceres)
• Kamil Mysliwiec (@kamilmysliwiec)
• Mysh3ll (@Mysh3ll)
• @MatthiasBrehmer
• @QusaiAlbonni
• @jkalberer
• @pazaderey
• fru1tworld (@fru1tworld)
• starnayuta (@starnayuta)

v11.1.19 (2026-04-13)

Bug fixes

• microservices
  • #16762 fix(microservices): use backing field for consumer CRASH event listener (@burhanharoon)
  • #16764 fix(microservices): prevent stack overflow in jsonsocket.handledata() (@kamilmysliwiec)

Committers: 2

• Burhan Haroon⚡ (@burhanharoon)
• Kamil Mysliwiec (@kamilmysliwiec)

v11.1.18 (2026-04-03)

Bug fixes

• microservices
  • #16675 fix(microservices): preserve packet headers in nats serializer (@wwenrr)
• core
  • #16683 fix(core): prevent injector hang when design:paramtypes is missing (@Youmoo)
  • #16637 fix(core): dependency injection edge case with moduleref.create (@JakobStaudinger)
  • https://github.com/nestjs/nest/pull/16686 fix(core): sanitize sse message

Dependencies

• core, platform-express, platform-fastify
  • #16679 fix(deps): update dependency path-to-regexp to v8.4.2 (@renovate[bot])
• platform-fastify
  • #16623 fix(deps): update dependency fastify to v5.8.4 (@renovate[bot])
• platform-ws
  • #16618 chore(deps): bump ws from 8.19.0 to 8.20.0 (@dependabot[bot])
• common
  • #16619 chore(deps): bump file-type from 21.3.3 to 21.3.4 (@dependabot[bot])

Committers: 6

• Ankit San (@ankitbelal)
• Jakob Staudinger (@JakobStaudinger)
• Kamil Mysliwiec (@kamilmysliwiec)
• Krishna Chaitanya (@Krishnachaitanyakc)
• MK (@wwenrr)
• youmoo (@Youmoo)

v11.1.17 (2026-03-16)

Enhancements

• microservices
  • #16218 feat(microservices): add redis driver identification (@vchomakov)

Bugs

• platform-fastify
  • auto-run middleware for HEAD requests as fastify redirects them to GET handlers (effectively skipping middleware execution) https://github.com/nestjs/nest/commit/cbdf737cd6e7cefa52d05ecea2ae4af95c464614 (@kamilmysliwiec)

Dependencies

• common
  • #16567 fix(deps): update dependency file-type to v21.3.2 (@renovate[bot])
• platform-fastify
  • #16533 fix(deps): update dependency fastify to v5.8.2 (@renovate[bot])

Committers: 3

• Rohan Santhosh Kumar (@Rohan5commit)
• Vasil Chomakov (@vchomakov)
• Kamil Mysliwiec (@kamilmysliwiec)

v11.1.16 (2026-03-05)

Bug fixes

• microservices
  • #16506 fix(microservices): fix double callback when isdisposed or err is truthy (@LhonRafaat)

Dependencies

• platform-express
  • #16507 fix(deps): update dependency multer to v2.1.1 (@renovate[bot])

Committers: 2

• Lhon (@LhonRafaat)
• Shahnoor Mujawar (@shahnoormujawar)

What's Changed

• fix(microservices): if indexOf return 0 will if will be falsy by @cuiweixie in https://github.com/nestjs/nest/pull/16401
• fix(microservices): introuduce max pattern depth and object complexity by @kamilmysliwiec in https://github.com/nestjs/nest/pull/16402
• chore(@nestjs/core): allow override for initializeWildcardHandlersIfE… by @StNekroman in https://github.com/nestjs/nest/pull/16468
• chore(deps): update dependency @fastify/middie to v9.2.0 [security] by @renovate[bot] in https://github.com/nestjs/nest/pull/16472
• fix(deps): update dependency multer to v2.1.0 [security] by @renovate[bot] in https://github.com/nestjs/nest/pull/16474

New Contributors

• @cuiweixie made their first contribution in https://github.com/nestjs/nest/pull/16401
• @StNekroman made their first contribution in https://github.com/nestjs/nest/pull/16468

Full Changelog: https://github.com/nestjs/nest/compare/v11.1.14...v11.1.15

v11.1.14 (2026-02-17)

Bug fixes

• platform-fastify
  • #16384 fix(fastify): fastify middleware bypass cve (@kamilmysliwiec)
• common
  • #16307 fix: logger print invalid context when no stack trace provided (@JulienDuf)

Enhancements

• common
  • #16314 fix(common): change requestOrigin type (@SpencerKaiser)

Committers: 5

• Julien Dufresne (@JulienDuf)
• Kamil Mysliwiec (@kamilmysliwiec)
• Mykhailo Skrypsky (@mixator)
• Spencer Kaiser (@SpencerKaiser)
• 조수민 (@suuuuuuminnnnnn)

v11.1.13 (2026-02-03)

Bug fixes

• common
  • #16230 fix(common): Fix skipping maxArrayLength and maxStringLength option (@chojs23)

Enhancements

• microservices
  • #16286 feat(microservices): support per-handler qos in mqtt (@suuuuuuminnnnnn)
  • #16262 Feat/microservices configurable max buffer size (@jobnow)
• common
  • #16202 fix(common): exclude built-in primitives from strip proto keys (@som14062005)

Dependencies

• platform-fastify
  • #16282 fix(deps): update dependency fastify to v5.7.4 (@renovate[bot])
• platform-express
  • #16241 fix(deps): update dependency cors to v2.8.6 (@renovate[bot])

Committers: 6

• Lee Donghyun (@devizi0)
• Mykhailo Skrypsky (@mixator)
• Neo (@chojs23)
• Praveen Somasundaram (@som14062005)
• Ricardo Gomes (@jobnow)
• 조수민 (@suuuuuuminnnnnn)

v11.1.12 (2026-01-15)

Bug fixes

• common
  • #16187 fix(common): regression in loading file-type under Windows OS (@iamkanguk97)

Dependencies

• platform-ws
  • #16161 chore(deps): bump ws from 8.18.3 to 8.19.0 (@dependabot[bot])
• common
  • #16155 fix(deps): update dependency file-type to v21.3.0 (@renovate[bot])
• platform-fastify
  • #16154 fix(deps): update dependency find-my-way to v9.4.0 (@renovate[bot])

Committers: 3

• Antonio Tripodi (@Tony133)
• KANGUK LEE (@iamkanguk97)
• @miso-kyoungminkim

v11.1.11 (2025-12-29)

Bug fixes

• platform-fastify
  • #16135 fix(platform-fastify): middie bypassing through decoded chars (@kamilmysliwiec)
• core
  • #16133 fix(core): add missing catch handler for forward-ref provider resolution (@coti-z)

Dependencies

• platform-socket.io
  • #16125 fix(deps): update dependency socket.io to v4.8.3 (@renovate[bot])
  • #16114 chore(deps): bump socket.io from 4.8.1 to 4.8.2 (@dependabot[bot])
• platform-fastify
  • #16130 fix(deps): update dependency @fastify/static to v9 (@renovate[bot])
• common
  • #16127 chore(deps): bump file-type from 21.1.1 to 21.2.0 (@dependabot[bot])

Committers: 3

• Himanshu Gupta (@manureja64)
• Kamil Mysliwiec (@kamilmysliwiec)
• coti (@coti-z)

v11.1.10 (2025-12-22)

Bug fixes

• core
  • #16098 fix(core): instantiate nested transient providers in static context (@mag123c)
  • #16005 fix(core): resolve all providers when using resolve() with each option (@malkovitc)
• microservices
  • #16072 fix(microservices): fix grpc stream method return type (@shash-hq)
• common
  • #16077 fix(common): resolve file-type path explicitly (@shash-hq)
  • #16013 fix(common): Support fallbackToMimetype without buffer (@chenjieya)

Enhancements

• common
  • #16100 fix(common): improve error handling in FileTypeValidator (@malkovitc)
  • #16060 feat(common): add message property to file type validator (@Jo-Minseok)
  • #16079 fix: enhance ValidationPipe (@liu-jin-yi)
• core
  • #15721 feat(core): add Promise<Observable> support for SSE handlers (@pythonjsgo)
• microservices
  • #15975 feat(microservices): add keepalive support for server side (@OlegStrokan)
• common, core
  • #15986 feat(core): add option for async logger compatibility (@mag123c)

Dependencies

• platform-fastify
  • #16041 fix(deps): update dependency @fastify/cors to v11.2.0 (@renovate[bot])
• platform-express
  • #16002 fix(deps): update dependency express to v5.2.1 (@renovate[bot])
• common
  • #15948 chore(deps): bump file-type from 21.1.0 to 21.1.1 (@dependabot[bot])

Committers: 11

• Alexander (@pythonjsgo)
• J_Coder (@Jo-Minseok)
• Luke Son (@KAPUIST)
• Oleh Strokan (@OlegStrokan)
• Praveen Somasundaram (@som14062005)
• Shashank (@shash-hq)
• @chenjieya
• @giorgikakauridze
• @mag123c
• chernomortsev evgeny (@malkovitc)
• liu-jin-yi (@liu-jin-yi)

v11.1.9 (2025-11-14)

Bug fixes

• core
  • #15865 fix(core): make get() throw for implicitly request-scoped trees (@JoeNutt)

Enhancements

• common
  • #15863 feat(common): add method options to @sse decorator (@TomerSteinberg)

Dependencies

• platform-fastify
  • #15899 chore(deps): bump fastify from 5.6.1 to 5.6.2 (@dependabot[bot])

Committers: 4

• Rami (@JoeNutt)
• Rhynel Algopera (@dev-rhynel)
• Tomer Steinberg (@TomerSteinberg)
• WuMingDao (@WuMingDao)

v11.1.8 (2025-10-27)

Bug fixes

• core
  • #15815 fix(core): ensure nested transient provider isolation (@mag123c)
• platform-fastify
  • #15831 fix(fastify): Migrate fastify top-level options to routerOptions (@kim-sung-jee)

Committers: 2

• JaeHo Jang (@mag123c)
• Seongjee Kim (@kim-sung-jee)

v11.1.7 (2025-10-21)

Bug fixes

• microservices
  • #15747 Fix/rmq microservice fanout bind (@slon2015)
• platform-fastify
  • #15732 fix: correct parameter type in RouteConstraints decorator (@thedv91)
• core
  • #15571 fix(core): skip lifecycle hooks for non-instantiated transient services (@mag123c)
• common
  • #15577 Add color allowance check to console logger options (@kerryChen95)

Enhancements

• common, platform-socket.io, websockets
  • #15543 feat(websockets): allow manual acknowledgement handling with @Ack() decorator (@kim-sung-jee)
• common
  • #15705 fix(core): resolve extras in configurable module builder async methods (@mag123c)
• common, core
  • #15503 feat(common): add force-console option to console logger (@mag123c)
• core
  • #15588 fix(core): improve dependency resolution error messages (@at7211)
• microservices
  • #15598 feat(errors): add InvalidTcpDataReceptionException for handling TCP receive errors​ (@ghyghoo8)

Dependencies

• platform-fastify
  • #15664 chore(deps): bump fastify to 5.6.1 (@dependabot[bot])
• core, platform-express, platform-fastify
  • #15622 fix(deps): update dependency path-to-regexp to v8.3.0 (@renovate[bot])
• common
  • #15566 chore(deps): bump load-esm from 1.0.2 to 1.0.3 (@dependabot[bot])

Committers: 9

• Harry (@thedv91)
• JaeHo Jang (@mag123c)
• Jay-Chou (@at7211)
• Kerry (@kerryChen95)
• Micael Levi L. Cavalcante (@micalevisk)
• Seongjee Kim (@kim-sung-jee)
• SerafimGerasimov (@slon2015)
• @Olexandr88
• ghy (@ghyghoo8)

v11.1.6 (2025-08-07)

Bug fixes

• core
  • #15504 fix(core): fix race condition in class dependency resolution from imported modules (@hajekjiri)
  • #15469 fix(core): attach root inquirer for nested transient providers (@kamilmysliwiec)
• microservices
  • #15508 fix(microservices): report correct buffer length in exception (@kim-sung-jee)
  • #15492 fix(microservices): fix kafka serilization of class instances (@LeonBiersch)

Dependencies

• platform-fastify
  • #15493 chore(deps): bump @fastify/cors from 11.0.1 to 11.1.0 (@dependabot[bot])

Committers: 6

• Jiri Hajek (@hajekjiri)
• Kamil Mysliwiec (@kamilmysliwiec)
• Leon Biersch (@LeonBiersch)
• Seongjee Kim (@kim-sung-jee)
• @premierbell
• pTr (@ptrgits)

v11.1.5 (2025-07-18)

Dependencies

• platform-express
  • #15425 chore(deps): bump multer from 2.0.1 to 2.0.2 in /packages/platform-express (@dependabot[bot])

v11.1.4 (2025-07-16)

Bug fixes

• platform-fastify
  • #15385 fix(testing): auto-init fastify adapter for middleware registration (@mag123c)
• core, testing
  • #15405 fix(core): fix race condition in class dependency resolution (@hajekjiri)
• core
  • #15333 fix(core): Make flattenRoutePath return a valid module (@gentunian)
• microservices
  • #15305 fix(microservices): Revisit RMQ pattern matching with wildcards (@getlarge)
  • #15250 fix(constants): update RMQ_DEFAULT_QUEUE to an empty string (@EeeasyCode)

Enhancements

• platform-fastify
  • #14789 feat(fastify): add decorator for custom schema (@piotrfrankowski)
• common, core, microservices, platform-express, platform-fastify, websockets
  • #15386 feat: enhance introspection capabilities (@kamilmysliwiec)
• core
  • #15374 feat: supporting fine async storage control (@Farenheith)

Dependencies

• platform-ws
  • #15350 chore(deps): bump ws from 8.18.2 to 8.18.3 (@dependabot[bot])
• platform-fastify
  • #15278 chore(deps): bump fastify from 5.3.3 to 5.4.0 (@dependabot[bot])

Committers: 11

• Alexey Filippov (@SocketSomeone)
• EFIcats (@ext4cats)
• Edouard Maleix (@getlarge)
• JaeHo Jang (@mag123c)
• Jiri Hajek (@hajekjiri)
• Kamil Mysliwiec (@kamilmysliwiec)
• Khan / 이창민 (@EeeasyCode)
• Peter F. (@piotrfrankowski)
• Sebastian (@gentunian)
• Thiago Oliveira Santos (@Farenheith)
• jochong (@jochongs)

v11.1.3 (2025-06-06)

Bug fixes

• core
  • #15201 fix(core): gracefully shutdown the app when repl exits (@dzhlobo)

Enhancements

• common
  • #15209 feat: add string array type to disposition (@fjodor-rybakov)
• common, core
  • #15203 feat(core): defer initialization connected microservice (@isaryy)

Dependencies

• platform-express
  • #15232 chore(deps): bump multer from 2.0.0 to 2.0.1 (@dependabot[bot])

Committers: 3

• Dmitry Zhlobo (@dzhlobo)
• @fjodor-rybakov
• @isaryy

v11.1.2 (2025-05-26)

Bug fixes

• microservices
  • #15172 fix(microservices): support custom strategy in async usefactory config (@mag123c)
  • #15166 fix(microservice): prevent error logs during redis client shutdown (@janroker)

Dependencies

• common
  • #15185 chore(deps): bump file-type from 20.5.0 to 21.0.0 (@dependabot[bot])
• platform-express
  • #15159 chore(deps): bump multer from 1.4.5-lts.2 to 2.0.0 (@dependabot[bot])

Committers: 2

• JaeHo Jang (@mag123c)
• Jan Roček (@janroker)

v11.1.1 (2025-05-14)

Bug fixes

• core
  • #15056 fix(core): HTTP adapter error mapping (@maxbronnikov10)
• microservices
  • #15062 fix(microservices): ensure all redis and amqp client closes properly (@yatin166)
  • #15032 fix(microservices): ensure all the amqp connections are closed properly (@yatin166)
  • #15020 fix(microservices): ensure all redis connections are closed (@yatin166)
• core, platform-fastify
  • #15061 fix(core): bring back getHeader and appendHeader methods from AbstractHttpAdapter (@micalevisk)
• platform-express
  • #15010 feat: remove use of pipeline (@jmcdo29)

Enhancements

• microservices
  • #14606 feat(microservices): add specific transport id to microservices (@maxbronnikov10)
  • #15057 feat(microservices): Allow custom exchangeType as string for plugin compatibility (@ChangmoKang)
  • #15072 feat(microservices): Add exchange arguments to RabbitMQ (@gapon2401)

Dependencies

• platform-fastify
  • #15129 chore(deps): bump fastify from 5.3.2 to 5.3.3 (@dependabot[bot])
• platform-ws
  • #15068 chore(deps): bump ws from 8.18.1 to 8.18.2 (@dependabot[bot])
• common
  • #15029 chore(deps): bump file-type from 20.4.1 to 20.5.0 (@dependabot[bot])

Committers: 7

• Antonio Tripodi (@Tony133)
• Changmo Kang (Ryan) (@ChangmoKang)
• Igor Gaponov (@gapon2401)
• Jackie McDoniel (@jmcdo29)
• Maxim Bronnikov (@maxbronnikov10)
• Micael Levi L. Cavalcante (@micalevisk)
• Yatin Gaikwad (@yatin166)

v11.1.0 (2025-04-23)

Enhancements

• microservices
  • #14540 feat(microservices): add support for topic exchange (rabbitmq) (@kamilmysliwiec)

Committers: 1

• Kamil Mysliwiec (@kamilmysliwiec)

v11.0.21 (2025-04-23)

Enhancements

• common
  • #14995 feat(common): Add fallbackToMimetype support in FileTypeValidator (@mag123c)

Dependencies

• platform-fastify
  • #14989 fix(deps): update dependency fastify to v5.3.2 [security] (@renovate[bot])

Committers: 1

• JaeHo Jang (@mag123c)

What's Changed

• refactor(common): Prevent JavaScript being wrapped in eval by @Borewit in https://github.com/nestjs/nest/pull/14974

New Contributors

• @Borewit made their first contribution in https://github.com/nestjs/nest/pull/14974

Full Changelog: https://github.com/nestjs/nest/compare/v11.0.19...v11.0.20

What's Changed

• chore(common): temporarily move file-type to regular deps https://github.com/nestjs/nest/commit/d9a69a32a4d560f82112e63a28c26445d4277c44

Full Changelog: https://github.com/nestjs/nest/compare/v11.0.17...v11.0.18

v11.0.16 (2025-04-11)

• fix(common): use file-type to validate file mimetypes by @Chathula in https://github.com/nestjs/nest/pull/14881