[dependabot]

Bumps the nestjs group with 4 updates in the /backend directory: @nestjs/config, @nestjs/jwt, @nestjs/mapped-types and @nestjs/schedule.

Updates @nestjs/config from 12.0.0 to 12.1.0

Release notes

Sourced from @​nestjs/config's releases.

Release 12.1.0

Security

This release fixes several security issues in how ConfigService resolves property paths and how ConfigModule.forRoot() loads and validates environment variables. See GHSA-q989-84g5-qg72 for details. Upgrading is recommended.

Behavior changes

Some fixes change what ConfigService returns. Please review them before upgrading:

• Property paths only resolve members a configuration object defines (own properties and members of your own classes). Members inherited from built-ins resolve to undefined, e.g. get('database.toString'), get('constructor.prototype') or get('cert.length') for a Buffer. set() never writes through them, and paths through __proto__, constructor or prototype are ignored.
• Validated variables take precedence:
  • A variable that the validator maps to undefined is no longer served from process.env. get(key, defaultValue) returns the default.
  • A variable that a validationSchema declares and removes (e.g. Joi .strip()) is no longer merged back. Undeclared variables are still kept.
  • With skipProcessEnv: true and a validationSchema, undeclared variables from process.env are no longer served. Declared ones still are. A validate function's output is served as it is.
  • With validatePredefined: false, a predefined variable now takes precedence over a different value from the env file, and get() returns it as it is.
  • A second validated forRoot() no longer replaces the converted values of another one.
• expandVariables:
  • Expanded values are assigned to process.env after validation, not before.
  • Several env files are expanded once, so $ and \$ in earlier files are no longer expanded again.
  • With override: true, a variable's reference to itself (e.g. PATH=/opt/bin:$PATH) expands to its previous value.
• Env files: a value containing a NUL character now fails startup instead of being truncated in process.env. __proto__ keys returned by a custom parser are ignored.
• ConfigService.set():
  • Dependent variables are re-expanded from the definitions loaded at startup. The env files are not read again.
  • Values passed to earlier set() calls and variables set in the environment are kept.
  • The expandVariables.processEnv target is honored.
  • A re-expanded value longer than 128 KiB throws.
• Load order:
  • ConfigService from a plain imports: [ConfigModule] or ConfigModule.forFeature() is provided once forRoot() has merged its load factories.
  • ConfigModule.envVariablesLoaded (used by ConditionalModule.registerWhen()) waits until every forRoot() in progress has loaded its environment variables.
• Validation errors no longer include the rejected value: Joi pattern() messages leave it out, and a quoted value is replaced with [redacted].

Features

• validate may be an async function. A rejected promise stops startup.
• ConfigService.set() re-interpolates variables that depend on the changed key, including chains of references (#2463).

Bug fixes

• override: true takes precedence when expanding variables (#2465).
• get('_PROCESS_ENV_VALIDATED') no longer returns the internal snapshot of validated variables.

Deprecations

• ConfigService.setEnvFilePaths() and ConfigService.setParser(). ConfigModule.forRoot() no longer uses them.

Full Changelog: nestjs/config@12.0.1...12.1.0

Release 12.0.1

What's Changed

• fix(config): prevent prefix corruption and escape propertyPath in updateInterpolatedEnv by @​Asadshah7950 in nestjs/config#2427

... (truncated)

Commits

• f615c54 chore(): release v12.1.0
• 136dd28 fix(config): keep validator output intact and address review feedback
• 7ea859b fix(config): harden property paths, validated env and variable expansion
• 4c22faa chore(deps): update dependency rimraf to v6.1.4 (#2475)
• 6556f91 chore(deps): update dependency vitest to v5.1.0 (#2474)
• c627116 chore(deps): update dependency release-it to v21.1.2 (#2473)
• e5eaba1 chore(deps): update nest monorepo to v12.3.2 (#2452)
• 2b9b84c chore(deps): update dependency oxlint to v1.90.0 (#2453)
• 26690d5 chore(deps): update dependency joi to v18.3.1 (#2468)
• 59e1691 chore(deps): update dependency zod to v4.6.7 (#2460)
• Additional commits viewable in compare view

Updates @nestjs/jwt from 12.0.1 to 12.0.3

Release notes

Sourced from @​nestjs/jwt's releases.

Release 12.0.3

What's Changed

• fix(jwt): reject async sign when the secret provider rejects by @​thekhegay in nestjs/jwt#2294
• fix(jwt): suppress async provider rejection on string payload error by @​thekhegay in nestjs/jwt#2295

New Contributors

• @​thekhegay made their first contribution in nestjs/jwt#2294

Full Changelog: nestjs/jwt@12.0.2...12.0.3

Release 12.0.2

What's Changed

• fix(jwt): add type overloads for decode with complete option and nullable return by @​Asadshah7950 in nestjs/jwt#2269

New Contributors

• @​Asadshah7950 made their first contribution in nestjs/jwt#2269

Full Changelog: nestjs/jwt@12.0.1...12.0.2

Commits

• 1b8f652 chore(): release v12.0.3
• 99ac1f9 fix(jwt): suppress async provider rejection on string payload error (#2295)
• 96bfd75 chore(deps): update nest monorepo to v12.1.2 (#2289)
• b74a723 chore(deps): update dependency @​types/node to v24.19.2 (#2290)
• 41ac94b chore(deps): update dependency oxlint to v1.87.0 (#2291)
• 19b1466 chore(deps): update dependency release-it to v21.1.1 (#2292)
• d399c15 chore(deps): update dependency prettier to v3.9.10 (#2293)
• 61c5e94 ci(): upgrade circleci config to version 2.1 (#2296)
• 1801d4d Merge pull request #2294 from thekhegay/fix/sign-async-secret-provider-reject
• d995c2f fix(jwt): reject async sign when the secret provider rejects
• Additional commits viewable in compare view

Updates @nestjs/mapped-types from 12.0.0 to 12.0.1

Release notes

Sourced from @​nestjs/mapped-types's releases.

Release 12.0.1

• fix(type-helpers): match numeric keys in omit and pick types (3613e20)

Commits

• 511fafd chore(): release v12.0.1
• 3613e20 fix(type-helpers): match numeric keys in omit and pick types
• fbabfbb chore(deps): update dependency release-it to v21.1.2 (#2070)
• e091d3e chore(deps): update dependency @​types/node to v26 (#2068)
• 7ba9a73 chore(deps): update dependency oxlint to v1.90.0 (#2058)
• b483e38 chore(deps): update dependency @​nestjs/common to v12.3.2 (#2057)
• 685af8d chore(deps): update dependency vitest to v5.0.5 (#2059)
• d806692 chore(deps): update dependency vite to v8.3.5 (#2060)
• d81be1d chore(deps): update dependency release-it to v21.1.1 (#2062)
• 8fb0c9d chore(deps): update dependency prettier to v3.9.10 (#2063)
• Additional commits viewable in compare view

Updates @nestjs/schedule from 12.0.1 to 12.0.2

Release notes

Sourced from @​nestjs/schedule's releases.

Release 12.0.2

• feat(scheduler): add generic return type parameter to getInterval and getTimeout (a178f1b)
• fix(cron): do not resurrect a deleted job after its initialDelay elapses (4473390)

Commits

• 1de04b0 chore(): release v12.0.2
• 4090c9e Merge pull request #2356 from nestjs/renovate/cimg-node-24.x
• 680c949 Merge pull request #2359 from Asadshah7950/feat/scheduler-generic-interval-ti...
• cdbaa32 Merge pull request #2344 from chuanghiduoc/fix/cron-initial-delay-resurrection
• a178f1b feat(scheduler): add generic return type parameter to getInterval and getTimeout
• 7a7ecdd chore(deps): update dependency vite to v8.3.0 (#2358)
• 77fc72b chore(deps): update dependency lint-staged to v17.5.1 (#2357)
• 80eec9d chore(deps): update dependency @​types/node to v24.13.4 (#2355)
• 63ed7b8 chore(deps): update node.js to v24.21.0
• 0ea711b chore(deps): update dependency oxlint to v1.82.0 (#2354)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Labels

The following labels could not be found: backend, dependencies. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.