chore(deps): bump the prod-deps group across 1 directory with 14 updates

[dependabot]

Bumps the prod-deps group with 14 updates in the / directory:

Package	From	To
@aws-sdk/client-s3	3.1097.0	3.1125.0
@aws-sdk/s3-presigned-post	3.1097.0	3.1125.0
@aws-sdk/s3-request-presigner	3.1097.0	3.1125.0
@nestjs/cache-manager	3.1.3	12.0.0
@nestjs/common	11.1.28	12.0.1
@nestjs/core	11.1.28	12.0.1
@nestjs/platform-express	11.1.28	12.0.1
@nestjs/schedule	6.1.3	12.0.1
@nestjs/swagger	11.4.6	12.0.1
iovalkey	0.3.3	0.4.0
ipaddr.js	2.4.0	2.5.0
nanoid	6.0.0	6.0.1
p-retry	8.0.0	8.0.1
pg	8.22.0	8.23.0

Updates @aws-sdk/client-s3 from 3.1097.0 to 3.1125.0

Release notes

Sourced from @​aws-sdk/client-s3's releases.

v3.1125.0

3.1125.0(2026-09-02)

New Features

• client-ec2: This release adds support to retain interruptible Capacity Reservations in an active state when all capacity is reclaimed. (336c7896)
• client-sagemaker-featurestore-runtime: Amazon SageMaker Feature Store now supports the UpdateRecord API, enabling partial updates to individual feature values in an existing Online Store record without rewriting the entire record. This reduces write payloads and latency for high-frequency feature-level writes . (71920960)
• client-sagemaker: Amazon SageMaker Feature Store now supports the Standard V2 online store type, which enables feature-level writes to feature groups. You can select Standard V2 when creating a feature group, and update the storage type of an existing feature group via UpdateFeatureGroup. (5287db7f)
• client-odb: Adds the ListFlexComponents API for listing the flex components available for a given DB system shape. (551174bf)
• client-mgn: AWS Transform for migrations adds a second network migration option - apply your source security posture to existing VPCs. Upload a source network file with firewall rules, tag the in-scope VPCs, and AWS Transform matches source subnets to them by CIDR and generates the security groups. (822144b2)
• client-mwaa: Enabled customers to clear optional S3 paths (plugins, requirements, and startup script) for their Amazon MWAA environments by accepting empty strings for the associated fields in UpdateEnvironment requests. (9fa2e0c1)
• client-bedrock-agentcore: Batch evaluation now supports up to 10 CloudWatch log groups per CloudWatchLogsSource (cebd3179)
• client-medialive: AWS Elemental MediaLive now supports AB forensic video watermarking (d48e9e15)
• client-appintegrations: This release adds a force parameter to DeleteApplication and a ConflictException to UpdateApplication, letting customers delete applications with existing associations in one call and get a clear error when an update conflicts with the application's current state. (62b7304c)

Bug Fixes

• cloudfront-signer: preserve plus in query strings when signing URLs (#8283) (dd76a0dd)

---

For list of updated packages, view updated-packages.md in assets-3.1125.0.zip

v3.1124.0

3.1124.0(2026-09-01)

New Features

• clients: update client endpoints as of 2026-09-01 (5f5319a0)
• client-lambda: AWS Lambda now provides configurable control over S3 direct access, allowing you to explicitly enable or disable how functions stream file reads directly from S3 buckets. This gives you flexibility to tune data access behavior based on your workload requirements, independent of memory size. (b4738dbb)
• client-marketplace-discovery: GetOfferTerms now returns renewalTerm for offers with pre-authorized renewals, exposing maxRenewals, lockoutPeriod, adjustmentDeadline, priceIncrease (fixed percentage or percentage range), and termTemplates (renewal payment schedules). Enables buyers to view renewal pricing and terms. (1fbc92ca)
• client-iotsitewise: AWS IoT SiteWise Scenario Discovery now supports mounting Amazon S3 data directly into pipeline task containers via S3 Access Points, and configuring additional ephemeral storage per task. Mount configurations can be overridden at execution time. See the API guide for details. (3b3b8a5b)
• client-lightsail: This release adds support for the Amazon Lightsail GetProfile API, which returns the profile for the specified account. (a05a4bf2)
• client-kinesis: Amazon Kinesis Data Streams now supports a dry run feature for data-plane APIs to validate the permissions and request parameters. If all checks complete successfully, the API returns a 'DryRunOperationException', confirming the request would have succeeded without the 'DryRun' parameter. (b7c1241e)
• client-taxsettings: France and Monaco Additional Info changes (93faab85)
• client-mediaconvert: Adds support for AAC passthrough. Adds ManifestCues option to support HLS manifest Cue marker passthrough. Adds playback device compatibility mode for DASH H.265 outputs. Adds TTML caption styling options. Adds interlace mode support for XAVC HD Intra CBG profile. (4f9ca64d)
• client-ec2: Update UserData and UploadPolicy shapes to use SecureBlob (0369a0ea)
• client-bedrock-agentcore-control: Online evaluation configurations now support up to 25 evaluators. CloudWatch Logs data sources for online evaluation now support up to 10 log groups. (add62744)
• client-guardduty: Amazon GuardDuty now supports custom detection rules, including APIs to manage rule associations and organization-level configurations. (c4309459)
• client-sesv2: Added support for managing SMIME signing certificates for email identities, including associating, listing, and disassociating certificates. Added the UpdateConfigurationSet operation to configure message security options such as signing scheme. (5d6518c2)
• client-marketplace-agreement: This release adds renewal support for AWS Marketplace private offers. Agreements report whether they renew and, if not, why. Renewal terms add price increases, renewal limits, renewal decision deadlines, and payment schedule templates. SearchAgreements adds filters. (5cffee4c)

---

For list of updated packages, view updated-packages.md in assets-3.1124.0.zip

v3.1123.0

3.1123.0(2026-08-31)

... (truncated)

Changelog

Sourced from @​aws-sdk/client-s3's changelog.

3.1125.0 (2026-09-02)

Note: Version bump only for package @​aws-sdk/client-s3

3.1124.0 (2026-09-01)

Note: Version bump only for package @​aws-sdk/client-s3

3.1123.0 (2026-08-31)

Note: Version bump only for package @​aws-sdk/client-s3

3.1122.0 (2026-08-31)

Note: Version bump only for package @​aws-sdk/client-s3

3.1121.0 (2026-08-28)

Note: Version bump only for package @​aws-sdk/client-s3

3.1120.0 (2026-08-27)

Note: Version bump only for package @​aws-sdk/client-s3

3.1119.0 (2026-08-26)

... (truncated)

Commits

• 678282b Publish v3.1125.0
• e80cab3 Publish v3.1124.0
• 49a1557 Publish v3.1123.0
• e1cf460 Publish v3.1122.0
• e53a25a Publish v3.1121.0
• d6be6f8 Publish v3.1120.0
• ba4e449 Publish v3.1119.0
• c65dd65 Publish v3.1118.0
• 78b069a Publish v3.1117.0
• d760a00 Publish v3.1116.0
• Additional commits viewable in compare view

Updates @aws-sdk/s3-presigned-post from 3.1097.0 to 3.1125.0

Release notes

Sourced from @​aws-sdk/s3-presigned-post's releases.

v3.1125.0

3.1125.0(2026-09-02)

New Features

• client-ec2: This release adds support to retain interruptible Capacity Reservations in an active state when all capacity is reclaimed. (336c7896)
• client-sagemaker-featurestore-runtime: Amazon SageMaker Feature Store now supports the UpdateRecord API, enabling partial updates to individual feature values in an existing Online Store record without rewriting the entire record. This reduces write payloads and latency for high-frequency feature-level writes . (71920960)
• client-sagemaker: Amazon SageMaker Feature Store now supports the Standard V2 online store type, which enables feature-level writes to feature groups. You can select Standard V2 when creating a feature group, and update the storage type of an existing feature group via UpdateFeatureGroup. (5287db7f)
• client-odb: Adds the ListFlexComponents API for listing the flex components available for a given DB system shape. (551174bf)
• client-mgn: AWS Transform for migrations adds a second network migration option - apply your source security posture to existing VPCs. Upload a source network file with firewall rules, tag the in-scope VPCs, and AWS Transform matches source subnets to them by CIDR and generates the security groups. (822144b2)
• client-mwaa: Enabled customers to clear optional S3 paths (plugins, requirements, and startup script) for their Amazon MWAA environments by accepting empty strings for the associated fields in UpdateEnvironment requests. (9fa2e0c1)
• client-bedrock-agentcore: Batch evaluation now supports up to 10 CloudWatch log groups per CloudWatchLogsSource (cebd3179)
• client-medialive: AWS Elemental MediaLive now supports AB forensic video watermarking (d48e9e15)
• client-appintegrations: This release adds a force parameter to DeleteApplication and a ConflictException to UpdateApplication, letting customers delete applications with existing associations in one call and get a clear error when an update conflicts with the application's current state. (62b7304c)

Bug Fixes

• cloudfront-signer: preserve plus in query strings when signing URLs (#8283) (dd76a0dd)

---

For list of updated packages, view updated-packages.md in assets-3.1125.0.zip

v3.1124.0

3.1124.0(2026-09-01)

New Features

• clients: update client endpoints as of 2026-09-01 (5f5319a0)
• client-lambda: AWS Lambda now provides configurable control over S3 direct access, allowing you to explicitly enable or disable how functions stream file reads directly from S3 buckets. This gives you flexibility to tune data access behavior based on your workload requirements, independent of memory size. (b4738dbb)
• client-marketplace-discovery: GetOfferTerms now returns renewalTerm for offers with pre-authorized renewals, exposing maxRenewals, lockoutPeriod, adjustmentDeadline, priceIncrease (fixed percentage or percentage range), and termTemplates (renewal payment schedules). Enables buyers to view renewal pricing and terms. (1fbc92ca)
• client-iotsitewise: AWS IoT SiteWise Scenario Discovery now supports mounting Amazon S3 data directly into pipeline task containers via S3 Access Points, and configuring additional ephemeral storage per task. Mount configurations can be overridden at execution time. See the API guide for details. (3b3b8a5b)
• client-lightsail: This release adds support for the Amazon Lightsail GetProfile API, which returns the profile for the specified account. (a05a4bf2)
• client-kinesis: Amazon Kinesis Data Streams now supports a dry run feature for data-plane APIs to validate the permissions and request parameters. If all checks complete successfully, the API returns a 'DryRunOperationException', confirming the request would have succeeded without the 'DryRun' parameter. (b7c1241e)
• client-taxsettings: France and Monaco Additional Info changes (93faab85)
• client-mediaconvert: Adds support for AAC passthrough. Adds ManifestCues option to support HLS manifest Cue marker passthrough. Adds playback device compatibility mode for DASH H.265 outputs. Adds TTML caption styling options. Adds interlace mode support for XAVC HD Intra CBG profile. (4f9ca64d)
• client-ec2: Update UserData and UploadPolicy shapes to use SecureBlob (0369a0ea)
• client-bedrock-agentcore-control: Online evaluation configurations now support up to 25 evaluators. CloudWatch Logs data sources for online evaluation now support up to 10 log groups. (add62744)
• client-guardduty: Amazon GuardDuty now supports custom detection rules, including APIs to manage rule associations and organization-level configurations. (c4309459)
• client-sesv2: Added support for managing SMIME signing certificates for email identities, including associating, listing, and disassociating certificates. Added the UpdateConfigurationSet operation to configure message security options such as signing scheme. (5d6518c2)
• client-marketplace-agreement: This release adds renewal support for AWS Marketplace private offers. Agreements report whether they renew and, if not, why. Renewal terms add price increases, renewal limits, renewal decision deadlines, and payment schedule templates. SearchAgreements adds filters. (5cffee4c)

---

For list of updated packages, view updated-packages.md in assets-3.1124.0.zip

v3.1123.0

3.1123.0(2026-08-31)

... (truncated)

Changelog

Sourced from @​aws-sdk/s3-presigned-post's changelog.

3.1125.0 (2026-09-02)

Note: Version bump only for package @​aws-sdk/s3-presigned-post

3.1124.0 (2026-09-01)

Note: Version bump only for package @​aws-sdk/s3-presigned-post

3.1123.0 (2026-08-31)

Note: Version bump only for package @​aws-sdk/s3-presigned-post

3.1122.0 (2026-08-31)

Note: Version bump only for package @​aws-sdk/s3-presigned-post

3.1121.0 (2026-08-28)

Note: Version bump only for package @​aws-sdk/s3-presigned-post

3.1120.0 (2026-08-27)

Note: Version bump only for package @​aws-sdk/s3-presigned-post

3.1119.0 (2026-08-26)

... (truncated)

Commits

• 678282b Publish v3.1125.0
• e80cab3 Publish v3.1124.0
• 49a1557 Publish v3.1123.0
• e1cf460 Publish v3.1122.0
• e53a25a Publish v3.1121.0
• d6be6f8 Publish v3.1120.0
• ba4e449 Publish v3.1119.0
• c65dd65 Publish v3.1118.0
• 78b069a Publish v3.1117.0
• d760a00 Publish v3.1116.0
• Additional commits viewable in compare view

Updates @aws-sdk/s3-request-presigner from 3.1097.0 to 3.1125.0

Release notes

Sourced from @​aws-sdk/s3-request-presigner's releases.

v3.1125.0

3.1125.0(2026-09-02)

New Features

• client-ec2: This release adds support to retain interruptible Capacity Reservations in an active state when all capacity is reclaimed. (336c7896)
• client-sagemaker-featurestore-runtime: Amazon SageMaker Feature Store now supports the UpdateRecord API, enabling partial updates to individual feature values in an existing Online Store record without rewriting the entire record. This reduces write payloads and latency for high-frequency feature-level writes . (71920960)
• client-sagemaker: Amazon SageMaker Feature Store now supports the Standard V2 online store type, which enables feature-level writes to feature groups. You can select Standard V2 when creating a feature group, and update the storage type of an existing feature group via UpdateFeatureGroup. (5287db7f)
• client-odb: Adds the ListFlexComponents API for listing the flex components available for a given DB system shape. (551174bf)
• client-mgn: AWS Transform for migrations adds a second network migration option - apply your source security posture to existing VPCs. Upload a source network file with firewall rules, tag the in-scope VPCs, and AWS Transform matches source subnets to them by CIDR and generates the security groups. (822144b2)
• client-mwaa: Enabled customers to clear optional S3 paths (plugins, requirements, and startup script) for their Amazon MWAA environments by accepting empty strings for the associated fields in UpdateEnvironment requests. (9fa2e0c1)
• client-bedrock-agentcore: Batch evaluation now supports up to 10 CloudWatch log groups per CloudWatchLogsSource (cebd3179)
• client-medialive: AWS Elemental MediaLive now supports AB forensic video watermarking (d48e9e15)
• client-appintegrations: This release adds a force parameter to DeleteApplication and a ConflictException to UpdateApplication, letting customers delete applications with existing associations in one call and get a clear error when an update conflicts with the application's current state. (62b7304c)

Bug Fixes

• cloudfront-signer: preserve plus in query strings when signing URLs (#8283) (dd76a0dd)

---

For list of updated packages, view updated-packages.md in assets-3.1125.0.zip

v3.1124.0

3.1124.0(2026-09-01)

New Features

• clients: update client endpoints as of 2026-09-01 (5f5319a0)
• client-lambda: AWS Lambda now provides configurable control over S3 direct access, allowing you to explicitly enable or disable how functions stream file reads directly from S3 buckets. This gives you flexibility to tune data access behavior based on your workload requirements, independent of memory size. (b4738dbb)
• client-marketplace-discovery: GetOfferTerms now returns renewalTerm for offers with pre-authorized renewals, exposing maxRenewals, lockoutPeriod, adjustmentDeadline, priceIncrease (fixed percentage or percentage range), and termTemplates (renewal payment schedules). Enables buyers to view renewal pricing and terms. (1fbc92ca)
• client-iotsitewise: AWS IoT SiteWise Scenario Discovery now supports mounting Amazon S3 data directly into pipeline task containers via S3 Access Points, and configuring additional ephemeral storage per task. Mount configurations can be overridden at execution time. See the API guide for details. (3b3b8a5b)
• client-lightsail: This release adds support for the Amazon Lightsail GetProfile API, which returns the profile for the specified account. (a05a4bf2)
• client-kinesis: Amazon Kinesis Data Streams now supports a dry run feature for data-plane APIs to validate the permissions and request parameters. If all checks complete successfully, the API returns a 'DryRunOperationException', confirming the request would have succeeded without the 'DryRun' parameter. (b7c1241e)
• client-taxsettings: France and Monaco Additional Info changes (93faab85)
• client-mediaconvert: Adds support for AAC passthrough. Adds ManifestCues option to support HLS manifest Cue marker passthrough. Adds playback device compatibility mode for DASH H.265 outputs. Adds TTML caption styling options. Adds interlace mode support for XAVC HD Intra CBG profile. (4f9ca64d)
• client-ec2: Update UserData and UploadPolicy shapes to use SecureBlob (0369a0ea)
• client-bedrock-agentcore-control: Online evaluation configurations now support up to 25 evaluators. CloudWatch Logs data sources for online evaluation now support up to 10 log groups. (add62744)
• client-guardduty: Amazon GuardDuty now supports custom detection rules, including APIs to manage rule associations and organization-level configurations. (c4309459)
• client-sesv2: Added support for managing SMIME signing certificates for email identities, including associating, listing, and disassociating certificates. Added the UpdateConfigurationSet operation to configure message security options such as signing scheme. (5d6518c2)
• client-marketplace-agreement: This release adds renewal support for AWS Marketplace private offers. Agreements report whether they renew and, if not, why. Renewal terms add price increases, renewal limits, renewal decision deadlines, and payment schedule templates. SearchAgreements adds filters. (5cffee4c)

---

For list of updated packages, view updated-packages.md in assets-3.1124.0.zip

v3.1123.0

3.1123.0(2026-08-31)

... (truncated)

Changelog

Sourced from @​aws-sdk/s3-request-presigner's changelog.

3.1125.0 (2026-09-02)

Note: Version bump only for package @​aws-sdk/s3-request-presigner

3.1124.0 (2026-09-01)

Note: Version bump only for package @​aws-sdk/s3-request-presigner

3.1123.0 (2026-08-31)

Note: Version bump only for package @​aws-sdk/s3-request-presigner

3.1122.0 (2026-08-31)

Note: Version bump only for package @​aws-sdk/s3-request-presigner

3.1121.0 (2026-08-28)

Note: Version bump only for package @​aws-sdk/s3-request-presigner

3.1120.0 (2026-08-27)

Note: Version bump only for package @​aws-sdk/s3-request-presigner

3.1119.0 (2026-08-26)

... (truncated)

Commits

• 678282b Publish v3.1125.0
• e80cab3 Publish v3.1124.0
• 49a1557 Publish v3.1123.0
• e1cf460 Publish v3.1122.0
• e53a25a Publish v3.1121.0
• d6be6f8 Publish v3.1120.0
• ba4e449 Publish v3.1119.0
• c65dd65 Publish v3.1118.0
• 78b069a Publish v3.1117.0
• d760a00 Publish v3.1116.0
• Additional commits viewable in compare view

Updates @nestjs/cache-manager from 3.1.3 to 12.0.0

Release notes

Sourced from @​nestjs/cache-manager's releases.

Release 12.0.0

What's Changed

@nestjs/cache-manager is now a native ES module, and the major version is aligned with the Nest 12 release line (there is no 4.x — 3.1.3 goes straight to 12.0.0).

ESM migration

The package is published as pure ESM ("type": "module", compiled with NodeNext) behind a proper exports map. The legacy root index.js / index.d.ts / index.ts shims are gone, and deep imports into build internals are no longer resolvable — import from the package root:

import { CacheModule, CacheInterceptor, CacheKey, CacheTTL } from '@nestjs/cache-manager';

require(esm) — CommonJS still works

You do not need to convert your app to ESM. Thanks to Node's require(esm) support, CommonJS consumers can keep using require('@nestjs/cache-manager') unchanged — the exports map points both import and require at the same ESM build, and Node loads it natively.

This is why the supported Node range is now enforced via engines:

"engines": {
  "node": "^20.19.0 || ^22.12.0 || >=24.0.0"
}

Those are the Node versions where require(esm) is available unflagged. On older Node versions, requiring this package from CommonJS will fail with ERR_REQUIRE_ESM.

Upgrading

npm i @nestjs/cache-manager@12

Checklist:

• Ensure you're on Node ^20.19.0, ^22.12.0, or >=24.0.0.
• Replace any deep imports (e.g. @nestjs/cache-manager/dist/...) with root imports.
• No changes needed to CacheModule.register() / registerAsync(), interceptors, or decorators.

Commits

• 661bc00 chore(): release v12.0.0
• 085ae1a chore: upgrade to v12
• 3a07e0b chore(deps): update dependency oxlint to v1.80.0 (#1152)
• 5f1ad64 chore(deps): update nest monorepo to v11.2.3 (#1151)
• f34fe5a chore(deps): update dependency vite to v8.2.2 (#1150)
• 288ea83 Merge pull request #1149 from miso-kyoungminkim/cachettl-ms-comment
• 9c08ea6 chore(deps): update dependency oxlint to v1.79.0 (#1148)
• f2b60ee docs(cache-ttl): clarify that ttl is in milliseconds
• f12d697 chore(deps): update dependency vitest to v4.1.11 (#1147)
• d0030ab Merge pull request #1067 from nestjs/chore/esm-migration
• Additional commits viewable in compare view

Updates @nestjs/common from 11.1.28 to 12.0.1

Release notes

Sourced from @​nestjs/common's releases.

v12.0.0

NestJS v12.0.0

NestJS 12 is centered around ESM-ready packages, first-class Standard Schema support for validation and serialization, a rebuilt CLI, and native observability through the new @nestjs/observe SDK.

Existing CommonJS applications keep working — migrating your own code to ESM is entirely optional.

📖 Full migration guide

---

Upgrading

Upgrade the CLI first, since the upgrade command ships with it:

npm i -g @nestjs/cli@latest

Then, from the root of your project:

nest upgrade

nest upgrade moves every @nestjs/* package to its v12-compatible major at once and applies the mechanical parts of the migration for you — nest-cli.json webpack options, the GraphQL playground → graphiql rename and subscriptions transport swap, the NATS package replacement, @nestjs/config validation options, Jest and Joi bumps — then prints a report of everything it changed and everything you still need to review by hand. Run it with --dry-run first to see that report without touching your files.

It deliberately does not migrate your project to ESM, Vitest, or oxlint. Those are the defaults for newly generated projects; existing projects adopt them on their own schedule.

Node.js: v12 requires Node.js v20.19+ or v22.12+. Both require(esm) and the ESM packages depend on it; the upgrade command refuses to run on older releases (including the 21.x line). The latest active LTS is recommended.

---

Highlights

ESM packages

All core Nest packages now ship as ESM. Thanks to require(esm) in modern Node.js, most existing CommonJS applications continue to work without a rewrite. Review custom bootstrapping scripts, build tooling, and test runners if they assume CommonJS-only packages.

nest new now asks whether to scaffold a CommonJS or an ESM project.

Standard Schema validation

Route parameter decorators — @Body(), @Query(), @Param(), @RawBody() — accept a new schema option, designed for Standard Schema compatible libraries such as Zod, Valibot, and ArkType:

@Post()
create(@Body({ schema: createUserSchema }) body: CreateUserDto) {
  return this.usersService.create(body);
}
</tr></table> 

... (truncated)

Commits

• 4c751c5 chore(release): publish v12.0.1 release
• 6494a6c chore(release): publish v12.0.0 release
• e306724 fix(deps): update dependency file-type to v22
• edb0034 Merge branch 'master' into v12.0.0
• 4535f43 chore(release): publish v11.2.1 release
• e255755 chore: resolve conflicts, minor fixes
• 5d1b19b Merge branch 'master' into v12.0.0
• f2a7e4b chore(release): publish v11.2.0 release
• b2e7fb5 Merge pull request #17469 from nestjs/feat/sse-signal
• 6498f11 feat: signal should finalize in every case
• Additional commits viewable in compare view

Updates @nestjs/core from 11.1.28 to 12.0.1

Release notes

Sourced from @​nestjs/core's releases.

v12.0.0

NestJS v12.0.0

NestJS 12 is centered around ESM-ready packages, first-class Standard Schema support for validation and serialization, a rebuilt CLI, and native observability through the new @nestjs/observe SDK.

Existing CommonJS applications keep working — migrating your own code to ESM is entirely optional.

📖 Full migration guide

---

Upgrading

Upgrade the CLI first, since the upgrade command ships with it:

npm i -g @nestjs/cli@latest

Then, from the root of your project:

nest upgrade

nest upgrade moves every @nestjs/* package to its v12-compatible major at once and applies the mechanical parts of the migration for you — nest-cli.json webpack options, the GraphQL playground → graphiql rename and subscriptions transport swap, the NATS package replacement, @nestjs/config validation options, Jest and Joi bumps — then prints a report of everything it changed and everything you still need to review by hand. Run it with --dry-run first to see that report without touching your files.

It deliberately does not migrate your project to ESM, Vitest, or oxlint. Those are the defaults for newly generated projects; existing projects adopt them on their own schedule.

Node.js: v12 requires Node.js v20.19+ or v22.12+. Both require(esm) and the ESM packages depend on it; the upgrade command refuses to run on older releases (including the 21.x line). The latest active LTS is recommended.

---

Highlights

ESM packages

All core Nest packages now ship as ESM. Thanks to require(esm) in modern Node.js, most existing CommonJS applications continue to work without a rewrite. Review custom bootstrapping scripts, build tooling, and test runners if they assume CommonJS-only packages.

nest new now asks whether to scaffold a CommonJS or an ESM project.

Standard Schema validation

Route parameter decorators — @Body(), @Query(), @Param(), @RawBody() — accept a new schema option, designed for Standard Schema compatible libraries such as Zod, Valibot, and ArkType:

@Post()
create(@Body({ schema: createUserSchema }) body: CreateUserDto) {
  return this.usersService.create(body);
}
</tr></table> 

... (truncated)

Commits

• 4c751c5 chore(release): publish v12.0.1 release
• 3c25112 chore: update peer deps
• 6494a6c chore(release): publish v12.0.0 release
• c9d59f2 chore: expose missing internals
• 45485b5 fix(core): circular durable providers issue #17562
• f94e9eb fix(core): preserve middleware arity and harden instance decorator
• 1dcbc25 fix(core): instrument midldeware issue #17554
• f5bf4dd docs(core): update Mercure SSE header comment to current path
• edb0034 Merge branch 'master' into v12.0.0
• 4535f43 chore(release): publish v11.2.1 release
• Additional commits viewable in compare view

Updates @nestjs/platform-express from 11.1.28 to 12.0.1

Release notes

Sourced from @​nestjs/platform-express's releases.

v12.0.0

NestJS v12.0.0

NestJS 12 is centered around ESM-ready packages, first-class Standard Schema support for validation and serialization, a rebuilt CLI, and native observability through the new @nestjs/observe SDK.

Existing CommonJS applications keep working — migrating your own code to ESM is entirely optional.

📖 Full migration guide

---

Upgrading

Upgrade the CLI first, since the upgrade command ships with it:

npm i -g @nestjs/cli@latest

Then, from the root of your project:

nest upgrade

nest upgrade moves every @nestjs/* package to its v12-compatible major at once and applies the mechanical parts of the migration for you — nest-cli.json webpack options, the GraphQL playground → graphiql rename and subscriptions transport swap, the NATS package replacement, @nestjs/config validation options, Jest and Joi bumps — then prints a report of everything it changed and everything you still need to review by hand. Run it with --dry-run first to see that report without touching your files.

It deliberately does not migrate your project to ESM, Vitest, or oxlint. Those are the defaults for newly generated projects; existing projects adopt them on their own schedule.

Node.js: v12 requires Node.js v20.19+ or v22.12+. Both require(esm) and the ESM packages depend on it; the upgrade command refuses to run on older releases (including the 21.x line). The latest active LTS is recommended.

---

Highlights

ESM packages

All core Nest packages now ship as ESM. Thanks to require(esm) in modern Node.js, most existing CommonJS applications continue to work without a rewrite. Review custom bootstrapping scripts, build tooling, and test runners if they assume CommonJS-only packages.

nest new now asks whether to scaffold a CommonJS or an ESM project.

Standard Schema validation

Route parameter decorators — @Body(), @Query(), @Param(), @RawBody() — accept a new schema option, designed for Standard Schema compatible libraries such as Zod, Valibot, and ArkType:

@Post()
create(@Body({ schema: createUserSchema }) body: CreateUserDto) {
  return this.usersService.create(body);
}
</tr></table> 

... (truncated)

Commits

• 4c751c5 chore(release): publish v12.0.1 release
• 3c25112 chore: update peer deps
• 6494a6c chore(release): publish v12.0.0 release
• e03cf5c fix(express,fastify): apply falsy status codes in reply()
• edb0034 Merge branch 'master' into v12.0.0
• 4535f43 chore(release): publish v11.2.1 release
• e255755 chore: resolve conflicts, minor fixes
• 5d1b19b Merge branch 'master' into v12.0.0
• f2a7e4b chore(release): publish v11.2.0 release
• 03587a1 chore(release): publish v11.1.29 release
• Additional commits viewable in compare view

Updates @nestjs/schedule from 6.1.3 to 12.0.1

Release notes

Sourced from @​nestjs/schedule's releases.

Release 12.0.1

What's Changed

• feat: export ScheduleExplorer from the package entry point by @​kamilmysliwiec in nestjs/schedule#2349

Full Changelog: nestjs/schedule@12.0.0...12.0.1

Release 12.0.0

What's Changed

@nestjs/schedule is now a native ES module, and the major version is aligned with the Nest 12 release line (there is no 7.x — 6.1.3 goes straight to 12.0.0).

ESM migration

The package is published as pure ESM ("type": "module", compiled with NodeNext) behind a proper exports map. The legacy root index.js / index.d.ts / index.ts shims are gone, and deep imports into build internals are no longer resolvable — import from the package root.

// ✅
import { ScheduleModule, Cron, CronExpression } from '@nestjs/schedule';
// ❌ no longer resolvable
import { CronExpression } from '@​nestjs/schedule/dist/enums/cron-expression.enum';

Only . and ./package.json are exported.

require(esm) — CommonJS still works

You do not need to convert your app to ESM. Thanks to Node's require(esm) support, a CommonJS app can keep doing:

const { ScheduleModule } = require('@nestjs/schedule');

This is why the package now declares "engines": { "node": ">=20.19.0" } — require(esm) is unflagged from Node 20.19 / 22.12 onward. On older Node versions the require will throw ERR_REQUIRE_ESM.

Fixes

• Duplicate scheduler names are now rejected at startup. Two @Cron, @Interval, or @Timeout declarations sharing an explicit name previously slipped past decorator collection and only conflicted later; the DUPLICATE_SCHEDULER error is now thrown during initialization, where you can actually see it.

Upgrading

npm i @nestjs/schedule@12

• Node 20.19+ (or 22.12+) is required.
• Replace any deep imports with root imports.
• If you were importing from the removed root index.js shim path explicitly, drop the path — @nestjs/schedule resolves on its own.

Commits

• 1df146c chore(): release v12.0.1
• 7c241a5 Merge pull request #2349 from nestjs/feat/export-schedule-explorer
• 00d3db8 feat: export ScheduleExplorer from the package entry point
• 55e94dd Merge pull request #2347 from nestjs/renovate/cimg-node-24.x
• 7e5d551 Merge pull request #2348 from nestjs/renovate/nest-monorepo
• 5237ab0 chore(deps): update nest monorepo to v12.0.1
• 6bd6e14 chore(): release v12.0.0
• 6719285 feat: support nestjs v12
• 3bcca07 chore(deps): update node.js to v24.20.0
• 1b24bb7 chore(deps): update nest monorepo to v11.2.3 (#2346)
• Additional commits viewable in compare view

Updates @nestjs/swagger from 11.4.6 to 12.0.1

Release notes

Sourced from @​nestjs/swagger's releases.

Release 12.0.1

12.0.1 (2026-08-28)

Bug fixes

• #4082 fix: esm hoist static imports (@​kamilmysliwiec)

Dependencies

• #4077 chore(deps): update dependency swagger-ui-dist to v5.32.14 (@​renovate[bot])

Committers: 1

• Kamil Mysliwiec (@​kamilmysliwiec)

Release 12.0.0

What's Changed

@nestjs/swagger is now a native ES module, requires Nest 12, and changes how nullable schemas are spelled in the generated document.

ESM migration

The package is published as pure ESM ("type": "module", compiled with NodeNext) behind a proper exports map. The legacy root index.ts / plugin.js / plugin.ts shims are gone, and deep imports into build internals are no longer resolvable — import from the package root (@nestjs/swagger) or from @nestjs/swagger/plugin.

require(esm) — CommonJS still works

You do not need to convert your app to ESM. Thanks to Node's require(esm) support, a CommonJS app can keep doing const { SwaggerModule } = require('@nestjs/swagger'). The CLI plugin entry (@nestjs/swagger/plugin) also keeps a require condition so nest-cli.json setups load it unchanged.

This is why the package now declares "engines": { "node": "^20.19.0 || >=22.12.0" } — those are the Node versions where require(esm) is available without a flag.

Nest 12 peer dependencies

@nestjs/common and @nestjs/core peers are now ^12.0.0. @nestjs/mapped-types moves to 12.0.0 (itself ESM, with its major aligned to the Nest 12 line), so PartialType, PickType, OmitType and IntersectionType come from an ESM build too.

Standard Schema support

Schemas passed to Nest 12's route decorators (for example @Body({ schema: z.object({ ... }) })) can now be reflected into th...

Description has been truncated