chore(deps): bump the nestjs group with 8 updates

[dependabot]

Bumps the nestjs group with 8 updates:

Package	From	To
@nestjs/axios	4.0.1	12.0.0
@nestjs/cache-manager	3.1.3	12.0.0
@nestjs/config	4.0.4	12.0.0
@nestjs/jwt	11.0.2	12.0.1
@nestjs/passport	11.0.5	12.0.0
@nestjs/schedule	6.1.3	12.0.1
@nestjs/swagger	11.4.7	12.0.1
@nestjs/typeorm	11.0.3	12.0.1

Updates @nestjs/axios from 4.0.1 to 12.0.0

Release notes

Sourced from @​nestjs/axios's releases.

Release 12.0.0

What's Changed

@nestjs/axios is now a native ES module, and the major version is aligned with the Nest 12 release line (there is no 5.x — 4.0.1 goes straight to 12.0.0).

ESM migration

The package is published as pure ESM ("type": "module", compiled with NodeNext) behind a proper exports map. The legacy root index.js / index.d.ts / index.ts shims are gone, and deep imports into build internals are no longer resolvable — import from the package root:

import { HttpModule, HttpService } from '@nestjs/axios';

require(esm) — CommonJS still works

You do not need to convert your app to ESM. Thanks to Node's require(esm) support, a CommonJS app can keep doing:

const { HttpModule, HttpService } = require('@nestjs/axios');

This is why the supported Node range is now declared explicitly:

"engines": {
  "node": "^20.19.0 || ^22.12.0 || >=24.0.0"
}

Those are the versions where require(esm) is available and unflagged. On older Node releases, requiring this package will fail with ERR_REQUIRE_ESM.

Upgrading

For most applications, the upgrade is:

npm i @nestjs/axios@12

Then check that:

1. You are on Node 20.19+ / 22.12+ / 24+.
2. You do not import from internal paths such as @nestjs/axios/dist/... — import from the package root instead.
3. If you were importing from the removed root index.js shim path explicitly, drop the path and import the package by name.

Commits

• 10cefb3 chore(): release v12.0.0
• a988df5 chore: upgrade to v12
• c4b9df9 chore(deps): update dependency axios to v1.20.0 (#1781)
• 210caf2 chore(deps): update nest monorepo to v11.2.3 (#1780)
• 3266444 chore(deps): update dependency oxlint to v1.80.0 (#1779)
• 5fe2ad4 chore(deps): update dependency vite to v8.2.2 (#1778)
• a909611 chore(deps): update dependency oxlint to v1.79.0 (#1777)
• 405c7e2 chore(deps): update dependency vitest to v4.1.11 (#1776)
• df9a2ca test: enable legacy decorators for spec files
• 60154c8 Merge remote-tracking branch 'origin/master'
• Additional commits viewable in compare view

Updates @nestjs/cache-manager from 3.1.3 to 12.0.0

Release notes

Sourced from @​nestjs/cache-manager's releases.

Release 12.0.0

What's Changed

@nestjs/cache-manager is now a native ES module, and the major version is aligned with the Nest 12 release line (there is no 4.x — 3.1.3 goes straight to 12.0.0).

ESM migration

The package is published as pure ESM ("type": "module", compiled with NodeNext) behind a proper exports map. The legacy root index.js / index.d.ts / index.ts shims are gone, and deep imports into build internals are no longer resolvable — import from the package root:

import { CacheModule, CacheInterceptor, CacheKey, CacheTTL } from '@nestjs/cache-manager';

require(esm) — CommonJS still works

You do not need to convert your app to ESM. Thanks to Node's require(esm) support, CommonJS consumers can keep using require('@nestjs/cache-manager') unchanged — the exports map points both import and require at the same ESM build, and Node loads it natively.

This is why the supported Node range is now enforced via engines:

"engines": {
  "node": "^20.19.0 || ^22.12.0 || >=24.0.0"
}

Those are the Node versions where require(esm) is available unflagged. On older Node versions, requiring this package from CommonJS will fail with ERR_REQUIRE_ESM.

Upgrading

npm i @nestjs/cache-manager@12

Checklist:

• Ensure you're on Node ^20.19.0, ^22.12.0, or >=24.0.0.
• Replace any deep imports (e.g. @nestjs/cache-manager/dist/...) with root imports.
• No changes needed to CacheModule.register() / registerAsync(), interceptors, or decorators.

Commits

• 661bc00 chore(): release v12.0.0
• 085ae1a chore: upgrade to v12
• 3a07e0b chore(deps): update dependency oxlint to v1.80.0 (#1152)
• 5f1ad64 chore(deps): update nest monorepo to v11.2.3 (#1151)
• f34fe5a chore(deps): update dependency vite to v8.2.2 (#1150)
• 288ea83 Merge pull request #1149 from miso-kyoungminkim/cachettl-ms-comment
• 9c08ea6 chore(deps): update dependency oxlint to v1.79.0 (#1148)
• f2b60ee docs(cache-ttl): clarify that ttl is in milliseconds
• f12d697 chore(deps): update dependency vitest to v4.1.11 (#1147)
• d0030ab Merge pull request #1067 from nestjs/chore/esm-migration
• Additional commits viewable in compare view

Updates @nestjs/config from 4.0.4 to 12.0.0

Release notes

Sourced from @​nestjs/config's releases.

12.0.0

What's Changed

@nestjs/config is now a native ES module, environment validation is built on Standard Schema instead of Joi-specific code, and the major version is aligned with the Nest 12 release line (there is no 5.x — 4.0.4 goes straight to 12.0.0).

ESM migration

The package is published as pure ESM ("type": "module", compiled with NodeNext) behind a proper exports map. The legacy root index.js / index.d.ts shims are gone, and deep imports into build internals are no longer resolvable — import from the package root.

// ✅
import { ConfigModule, ConfigService } from '@nestjs/config';
// ❌ no longer resolvable
import { ConfigService } from '@​nestjs/config/dist/config.service';

require(esm) — CommonJS still works

You do not need to convert your app to ESM. Thanks to Node's require(esm) support (Node 20.19+ / 22.12+), a CommonJS app can keep using require('@nestjs/config') unchanged.

Validation is now Standard Schema based

validationSchema accepts any schema implementing the Standard Schema spec — Zod (v3, v4, v4-mini), Valibot, ArkType, Joi 18+, and anything else that adopts it. There is no longer any Joi-specific code path in the module, and Joi is no longer implied as the validation library.

ConfigModule.forRoot({
  validationSchema: z.object({
    PORT: z.coerce.number().default(3000),
    DATABASE_NAME: z.string(),
  }),
});

Joi keeps working — it implements Standard Schema as of v18 — and the historical abortEarly: false / allowUnknown: true defaults are still applied automatically for Joi schemas, so existing Joi setups behave as before.

Breaking: validationOptions shape

Options are now the Standard Schema Options object, and library-specific settings move under libraryOptions:

// Before (4.x)
validationOptions: { allowUnknown: false, abortEarly: true }
// Now (12.x)
validationOptions: { libraryOptions: { allowUnknown: false, abortEarly: true } }

The generic parameter changed accordingly: ConfigModuleOptions<ValidationOptions extends StandardSchemaV1.Options>, and validationSchema is typed as StandardSchemaV1 rather than any — a schema that does not implement the spec is now a compile-time error instead of a runtime one.

... (truncated)

Commits

• 269312f chore(): release v12.0.0
• 5748c1f chore: upgrade to v12
• d833a6a chore(deps): update dependency oxlint to v1.80.0 (#2408)
• 4555cbc chore(deps): update nest monorepo to v11.2.3 (#2407)
• 4561739 chore(deps): update dependency vite to v8.2.2 (#2406)
• 0fc13bb chore(deps): update dependency joi to v18.2.5 (#2405)
• 22642b8 chore(deps): update dependency oxlint to v1.79.0 (#2404)
• d3a7dd5 chore(deps): update dependency vitest to v4.1.11 (#2403)
• 8c87973 chore(deps): update dependency zod to v4.4.3 (#2402)
• 949dc88 Merge pull request #2356 from nestjs/renovate/cimg-node-24.x
• Additional commits viewable in compare view

Updates @nestjs/jwt from 11.0.2 to 12.0.1

Release notes

Sourced from @​nestjs/jwt's releases.

Release 12.0.1

• fix: jsonwebtoken esm imports (05d0075)

Release 12.0.0

What's Changed

@nestjs/jwt is now a native ES module, and the major version is aligned with the Nest 12 release line

ESM migration

The package is published as pure ESM ("type": "module", compiled with NodeNext) behind a proper exports map. The legacy root index.js / index.d.ts / index.ts shims are gone, and deep imports into build internals are no longer resolvable — import from the package root.

// ✅
import { JwtModule, JwtService } from '@nestjs/jwt';
// ❌ no longer resolvable
import { JwtService } from '@​nestjs/jwt/dist/jwt.service';

require(esm) — CommonJS still works

You do not need to convert your app to ESM. Thanks to Node's require(esm) support (Node 20.19+, 22.12+, and all of 24.x), a CommonJS Nest application can keep requiring the package exactly as before:

const { JwtModule, JwtService } = require('@nestjs/jwt');

TypeScript users compiling to CommonJS are unaffected as long as their runtime is on a supported Node version. On older Node releases, require() of this package will throw ERR_REQUIRE_ESM — upgrade Node, or switch the consuming code to import.

jsonwebtoken re-exports

The error classes re-exported from jsonwebtoken (TokenExpiredError, NotBeforeError, JsonWebTokenError) are now re-exported explicitly by name instead of via a star export, so they resolve correctly under ESM interop with the CJS jsonwebtoken package. No import changes are needed on your side:

import { TokenExpiredError } from '@nestjs/jwt';

Upgrading

npm install @nestjs/jwt@12

For most applications this is a drop-in upgrade. Action is only required if you were relying on deep imports into dist/, or are running a Node version older than 20.19 with a CommonJS app.

Commits

• 6c75fa6 chore(): release v12.0.1
• 05d0075 fix: jsonwebtoken esm imports
• 8853ee8 chore(): release v12.0.0
• b8455f2 chore: upgrade to v12
• 542e29e chore(deps): update dependency oxlint to v1.80.0 (#2260)
• ae0d0d7 chore(deps): update nest monorepo to v11.2.3 (#2259)
• af3ad43 chore(deps): update dependency oxlint to v1.79.0 (#2258)
• 53c8fee chore(deps): update dependency vitest to v4.1.11 (#2257)
• 7014c3a Merge pull request #2205 from nestjs/renovate/cimg-node-24.x
• 54a4c5c Merge pull request #2186 from nestjs/chore/esm-migration
• Additional commits viewable in compare view

Updates @nestjs/passport from 11.0.5 to 12.0.0

Release notes

Sourced from @​nestjs/passport's releases.

Release 12.0.0

What's Changed

@nestjs/passport is now a native ES module, and the major version is aligned with the Nest 12 release line.

ESM migration

The package is published as pure ESM ("type": "module", compiled with NodeNext) behind a proper exports map. The legacy root index.js / index.d.ts / index.ts shims are gone, and deep imports into build internals (e.g. @nestjs/passport/dist/auth.guard) are no longer resolvable — import from the package root:

import { AuthGuard, PassportModule, PassportStrategy } from '@nestjs/passport';

require(esm) — CommonJS still works

You do not need to convert your app to ESM. Thanks to Node's require(esm) support, a CommonJS app can keep doing:

const { AuthGuard, PassportModule } = require('@nestjs/passport');

This requires Node.js 20.19+ or 22.12+ (where require(esm) is enabled by default). On older Node versions you must either upgrade Node or move your app to ESM.

AuthGuard no longer forwards module options to passport.authenticate()

defaultStrategy and property — options that belong to PassportModule.register(), not to Passport itself — were being passed straight through to passport.authenticate(), where they could collide with strategy-level options. They are now stripped before the call, so a strategy only ever receives real AuthenticateOptions.

The signature of getAuthenticateOptions() changed accordingly:

// before
getAuthenticateOptions(
  context: ExecutionContext,
): Promise<IAuthModuleOptions> | IAuthModuleOptions | undefined;
// after
getAuthenticateOptions(
context: ExecutionContext,
):
| Promise<AuthGuardAuthenticateOptions>
| AuthGuardAuthenticateOptions
| undefined;

AuthGuardAuthenticateOptions is exported from the package root and is passport.AuthenticateOptions with defaultStrategy explicitly disallowed. If you override getAuthenticateOptions() and return defaultStrategy, TypeScript will now flag it — remove it and set it via PassportModule.register({ defaultStrategy: '...' }) instead.

Peer dependencies

"peerDependencies": {
</tr></table> 

... (truncated)

Commits

• 0f15350 chore(): release v12.0.0
• c6af6f6 chore: upgrade to v12
• d05c93e chore(deps): update dependency oxlint to v1.80.0 (#2309)
• 8d06e0c chore(deps): update nest monorepo to v11.2.3 (#2308)
• 875fddc chore(deps): update dependency oxlint to v1.79.0 (#2307)
• dd63061 chore(deps): update vitest monorepo to v4.1.11 (#2306)
• 28e6701 Merge pull request #2300 from GiHoon1123/fix-947-authenticate-options
• 849d11c Merge master into fix-947-authenticate-options, resolve conflicts
• de02b20 Merge pull request #2250 from nestjs/renovate/cimg-node-24.x
• e27a9c8 Merge pull request #2230 from nestjs/chore/esm-migration
• Additional commits viewable in compare view

Updates @nestjs/schedule from 6.1.3 to 12.0.1

Release notes

Sourced from @​nestjs/schedule's releases.

Release 12.0.1

What's Changed

• feat: export ScheduleExplorer from the package entry point by @​kamilmysliwiec in nestjs/schedule#2349

Full Changelog: nestjs/schedule@12.0.0...12.0.1

Release 12.0.0

What's Changed

@nestjs/schedule is now a native ES module, and the major version is aligned with the Nest 12 release line (there is no 7.x — 6.1.3 goes straight to 12.0.0).

ESM migration

The package is published as pure ESM ("type": "module", compiled with NodeNext) behind a proper exports map. The legacy root index.js / index.d.ts / index.ts shims are gone, and deep imports into build internals are no longer resolvable — import from the package root.

// ✅
import { ScheduleModule, Cron, CronExpression } from '@nestjs/schedule';
// ❌ no longer resolvable
import { CronExpression } from '@​nestjs/schedule/dist/enums/cron-expression.enum';

Only . and ./package.json are exported.

require(esm) — CommonJS still works

You do not need to convert your app to ESM. Thanks to Node's require(esm) support, a CommonJS app can keep doing:

const { ScheduleModule } = require('@nestjs/schedule');

This is why the package now declares "engines": { "node": ">=20.19.0" } — require(esm) is unflagged from Node 20.19 / 22.12 onward. On older Node versions the require will throw ERR_REQUIRE_ESM.

Fixes

• Duplicate scheduler names are now rejected at startup. Two @Cron, @Interval, or @Timeout declarations sharing an explicit name previously slipped past decorator collection and only conflicted later; the DUPLICATE_SCHEDULER error is now thrown during initialization, where you can actually see it.

Upgrading

npm i @nestjs/schedule@12

• Node 20.19+ (or 22.12+) is required.
• Replace any deep imports with root imports.
• If you were importing from the removed root index.js shim path explicitly, drop the path — @nestjs/schedule resolves on its own.

Commits

• 1df146c chore(): release v12.0.1
• 7c241a5 Merge pull request #2349 from nestjs/feat/export-schedule-explorer
• 00d3db8 feat: export ScheduleExplorer from the package entry point
• 55e94dd Merge pull request #2347 from nestjs/renovate/cimg-node-24.x
• 7e5d551 Merge pull request #2348 from nestjs/renovate/nest-monorepo
• 5237ab0 chore(deps): update nest monorepo to v12.0.1
• 6bd6e14 chore(): release v12.0.0
• 6719285 feat: support nestjs v12
• 3bcca07 chore(deps): update node.js to v24.20.0
• 1b24bb7 chore(deps): update nest monorepo to v11.2.3 (#2346)
• Additional commits viewable in compare view

Updates @nestjs/swagger from 11.4.7 to 12.0.1

Release notes

Sourced from @​nestjs/swagger's releases.

Release 12.0.1

12.0.1 (2026-08-28)

Bug fixes

• #4082 fix: esm hoist static imports (@​kamilmysliwiec)

Dependencies

• #4077 chore(deps): update dependency swagger-ui-dist to v5.32.14 (@​renovate[bot])

Committers: 1

• Kamil Mysliwiec (@​kamilmysliwiec)

Release 12.0.0

What's Changed

@nestjs/swagger is now a native ES module, requires Nest 12, and changes how nullable schemas are spelled in the generated document.

ESM migration

The package is published as pure ESM ("type": "module", compiled with NodeNext) behind a proper exports map. The legacy root index.ts / plugin.js / plugin.ts shims are gone, and deep imports into build internals are no longer resolvable — import from the package root (@nestjs/swagger) or from @nestjs/swagger/plugin.

require(esm) — CommonJS still works

You do not need to convert your app to ESM. Thanks to Node's require(esm) support, a CommonJS app can keep doing const { SwaggerModule } = require('@nestjs/swagger'). The CLI plugin entry (@nestjs/swagger/plugin) also keeps a require condition so nest-cli.json setups load it unchanged.

This is why the package now declares "engines": { "node": "^20.19.0 || >=22.12.0" } — those are the Node versions where require(esm) is available without a flag.

Nest 12 peer dependencies

@nestjs/common and @nestjs/core peers are now ^12.0.0. @nestjs/mapped-types moves to 12.0.0 (itself ESM, with its major aligned to the Nest 12 line), so PartialType, PickType, OmitType and IntersectionType come from an ESM build too.

Standard Schema support

Schemas passed to Nest 12's route decorators (for example @Body({ schema: z.object({ ... }) })) can now be reflected into the OpenAPI document. Supply an adapter via the new standardSchemaConverter document option:

import { SwaggerModule, DocumentBuilder } from '@nestjs/swagger';
import type { SwaggerDocumentOptions } from '@nestjs/swagger';
import { createSchema } from 'zod-openapi';
import type { ZodType } from 'zod';
// Standard Schema exposes the producing library under ~standard.vendor,
// which is how you narrow the raw value to a library-specific type.
function isZodSchema(schema: unknown): schema is ZodType {
return (
!!schema &&
typeof schema === 'object' &&
(schema as { '~standard'?: { vendor?: string } })['~standard']?.vendor ===
'zod'
);
</tr></table>

... (truncated)

Commits

• 4274e7c chore(): release v12.0.1
• 325d009 Merge pull request #4082 from nestjs/fix/esm-hoist-static-imports
• 8980a54 fix: esm hoist static imports
• 31b0bf4 chore(deps): update dependency lint-staged to v17.4.1 (#4078)
• b71a812 Merge pull request #4077 from nestjs/renovate/swagger-ui-dist-5.x-lockfile
• ec18a13 chore(deps): update dependency swagger-ui-dist to v5.32.14
• 0f85b4c Merge pull request #4072 from nestjs/renovate/js-yaml-5.x
• 7d8b38e Merge pull request #4076 from nestjs/renovate/vite-8.x-lockfile
• ebc4cb8 Merge pull request #4069 from nestjs/renovate/zod-openapi-6.x
• 71e1769 Merge pull request #4068 from nestjs/renovate/swagger-ui-dist-5.x
• Additional commits viewable in compare view

Updates @nestjs/typeorm from 11.0.3 to 12.0.1

Release notes

Sourced from @​nestjs/typeorm's releases.

Release 12.0.1

• fix: add default condition to exports so CJS can resolve the package (01874dc)

Release 12.0.0

What's Changed

@nestjs/typeorm is now a native ES module, and the major version is aligned with the Nest 12 release line (11.0.3 → 12.0.0).

ESM migration

The package is published as pure ESM ("type": "module", compiled with NodeNext) behind a proper exports map. The legacy root index.js / index.d.ts shims are gone, and deep imports into build internals are no longer resolvable — import from the package root.

The minimum supported Node version is now >=20.19.0.

require(esm) — CommonJS still works

You do not need to convert your app to ESM. Thanks to Node's require(esm) support, CJS apps still work.

Commits

• 3513624 chore(): release v12.0.1
• b36b36c Merge pull request #2685 from iflov/fix/cjs-exports-condition
• 01874dc fix: add default condition to exports so CJS can resolve the package
• 5ccaea4 chore(deps): update dependency lint-staged to v17.4.1 (#2683)
• de68dfe Merge branch 'master' of https://github.com/nestjs/typeorm
• afe5dc3 chore: bump deps to v12.0.1
• 2d2c86a Merge pull request #2682 from nestjs/renovate/cimg-node-24.x
• d40e0a5 chore(): release v12.0.0
• 36a765c chore: resolve conflicts
• d80cf31 chore: upgrade to v12 deps
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[swirlds-automation]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.