# What changed in @nestjs/core

> 308 changes in @nestjs/core 10 to 12 from its official release notes, upgrade guides and advisories: 26 breaking, 3 deprecations, 17 security, 58 new APIs and options. Each one cited. Sources checked 2026-10-17. HTML: https://unstale.sh/npm/@nestjs/core/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## @nestjs/core 12

### Breaking changes

- Every event handler runs when a sibling completes empty. (12.1.3) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.1.3)
- ParseArrayPipe rejects arrays nested in item values. (12.1.3) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.1.3)
- Request-scoped global enhancers now fail explicitly at startup instead of being silently dropped. (12.1.3) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.1.3)
- Every pending request now fails when a callback throws. (12.1.0) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.1.0)
- Pending RMQ requests now fail when the client closes. (12.0.4) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.0.4)
- Pending requests now fail when the client closes. (12.0.3) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.0.3), [release notes](https://github.com/nestjs/nest/releases/tag/v12.0.4)
- Plain handler results are no longer flattened when pre-request hooks are used. (12.0.2) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.0.2)
- Requests now fail when their reply subscription is rejected. (12.0.2) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.0.2)
- The angular schematic has been removed. (12.0.0) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.0.0), [upgrade guide](https://github.com/nestjs/docs.nestjs.com/blob/72f77737e2c6f2c305229e87c4f7846bb629c6cc/content/migration.md), [upgrade guide](https://docs.nestjs.com/migration-guide)
- ArgumentMetadata is now generic, requiring adjustments to some hand-written custom pipe signatures. (12.0.0) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.0.0), [upgrade guide](https://github.com/nestjs/docs.nestjs.com/blob/72f77737e2c6f2c305229e87c4f7846bb629c6cc/content/migration.md), [upgrade guide](https://docs.nestjs.com/migration-guide)
- Plain objects after log messages are now attached as structured parameters by default; structuredParams false restores prior behavior. (12.0.0) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.0.0), [upgrade guide](https://github.com/nestjs/docs.nestjs.com/blob/72f77737e2c6f2c305229e87c4f7846bb629c6cc/content/migration.md), [upgrade guide](https://docs.nestjs.com/migration-guide)
- Core Nest packages are now ESM-only, while CommonJS applications can continue using them through require(esm). (12.0.0) — [upgrade guide](https://github.com/nestjs/docs.nestjs.com/blob/72f77737e2c6f2c305229e87c4f7846bb629c6cc/content/migration.md)
- GraphiQL is now the default GraphQL IDE, and customization uses an options object. (12.0.0) — [upgrade guide](https://github.com/nestjs/docs.nestjs.com/blob/72f77737e2c6f2c305229e87c4f7846bb629c6cc/content/migration.md)
- Throwing HealthCheckError no longer reports unhealthy health checks. (12.0.0) — [upgrade guide](https://github.com/nestjs/docs.nestjs.com/blob/72f77737e2c6f2c305229e87c4f7846bb629c6cc/content/migration.md)
- The legacy health indicator base class has been removed; custom indicators must use HealthIndicatorService. (12.0.0) — [upgrade guide](https://github.com/nestjs/docs.nestjs.com/blob/72f77737e2c6f2c305229e87c4f7846bb629c6cc/content/migration.md), [upgrade guide](https://docs.nestjs.com/migration-guide)
- Lifecycle hooks are now invoked by component hierarchy level, which may change ordering assumptions. (12.0.0) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.0.0), [upgrade guide](https://github.com/nestjs/docs.nestjs.com/blob/72f77737e2c6f2c305229e87c4f7846bb629c6cc/content/migration.md), [upgrade guide](https://docs.nestjs.com/migration-guide)
- The NATS transport package replaces nats; direct imports and message handling must be updated. (12.0.0) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.0.0), [upgrade guide](https://github.com/nestjs/docs.nestjs.com/blob/72f77737e2c6f2c305229e87c4f7846bb629c6cc/content/migration.md), [upgrade guide](https://docs.nestjs.com/migration-guide)
- NATS packets are serialized as JSON strings, and custom deserializers receive the full message object. (12.0.0) — [upgrade guide](https://github.com/nestjs/docs.nestjs.com/blob/72f77737e2c6f2c305229e87c4f7846bb629c6cc/content/migration.md), [upgrade guide](https://docs.nestjs.com/migration-guide)
- CLI generation and upgrade commands require Node.js v22.22.3+, v24.15+, or v26+. (12.0.0) — [upgrade guide](https://docs.nestjs.com/migration-guide)
- NestJS 12 requires Node.js 20.19+ or 22.12+; the 21.x line is unsupported. (12.0.0) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.0.0), [upgrade guide](https://github.com/nestjs/docs.nestjs.com/blob/72f77737e2c6f2c305229e87c4f7846bb629c6cc/content/migration.md), [upgrade guide](https://docs.nestjs.com/migration-guide)
- Optional constructor parameter markers are no longer inherited by subclasses. (12.0.0) — [upgrade guide](https://github.com/nestjs/docs.nestjs.com/blob/72f77737e2c6f2c305229e87c4f7846bb629c6cc/content/migration.md), [upgrade guide](https://docs.nestjs.com/migration-guide)
- GraphQL subscriptions transport support was removed; clients must switch to graphql-ws. (12.0.0) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.0.0), [upgrade guide](https://github.com/nestjs/docs.nestjs.com/blob/72f77737e2c6f2c305229e87c4f7846bb629c6cc/content/migration.md), [upgrade guide](https://docs.nestjs.com/migration-guide)
- Joi-specific validation settings must be moved under validationOptions.libraryOptions. (12.0.0) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.0.0), [upgrade guide](https://github.com/nestjs/docs.nestjs.com/blob/72f77737e2c6f2c305229e87c4f7846bb629c6cc/content/migration.md), [upgrade guide](https://docs.nestjs.com/migration-guide)

### Security

- useSecurityHeaders() turns off Express x-powered-by. (12.1.3) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.1.3)
- NestJS adds built-in CSRF protection. (12.1.0) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.1.0)
- NestJS adds built-in security headers. (12.1.0) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.1.0)
- Memory held for a TCP peer is now bounded. (11.2.5, 12.0.3) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.0.3), [security advisory](https://github.com/advisories/GHSA-96H4-VGXJ-GVM2)
- Platform Fastify fixes middleware bypass for absolute-form request targets. (11.2.4, 12.0.2) — [release notes](https://github.com/nestjs/nest/releases/tag/v11.2.4), [security advisory](https://github.com/advisories/GHSA-9C5C-9QCX-Q35Q)
- Nest: Remote process termination via a deeply nested microservice message pattern (11.2.4, 12.0.2) — [security advisory](https://github.com/advisories/GHSA-M8VH-JMQ9-5RJG)

### Deprecations

- Terminus built-in indicator timeout options are deprecated in favor of chaining withTimeout on the returned attempt. (12.0.0) — [upgrade guide](https://github.com/nestjs/docs.nestjs.com/blob/72f77737e2c6f2c305229e87c4f7846bb629c6cc/content/migration.md), [upgrade guide](https://docs.nestjs.com/migration-guide)
- The webpack CLI workflow is deprecated in favor of --builder rspack. (12.0.0) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.0.0), [upgrade guide](https://github.com/nestjs/docs.nestjs.com/blob/72f77737e2c6f2c305229e87c4f7846bb629c6cc/content/migration.md), [upgrade guide](https://docs.nestjs.com/migration-guide)
- The webpack path flag is deprecated in favor of selecting the Rspack builder. (12.0.0) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.0.0)

### New APIs and options

- Express and Fastify file uploads support array index limits. (12.1.3) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.1.3)
- Express and Fastify file uploads support field nesting limits. (12.1.3) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.1.3)
- Upload limits now support field nesting and array indexes. (12.1.3) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.1.3)
- Fastify can listen on a socket path. (12.1.3) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.1.3)
- Exports deserializers from the microservices package root. (12.1.1) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.1.1)
- NestJS adds built-in, adapter-agnostic cookie support. (12.1.0) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.1.0)
- Fastify gains file upload interceptors backed by @fastify/multipart. (12.1.0) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.1.0)
- Global prefixes now support being provided as an array. (12.1.0) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.1.0)
- ServerMqtt adds maxConnectionAttempts to configure the maximum connection attempts. (12.0.2) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.0.2)
- CLI builds should select Rspack with the builder option as webpack workflows are deprecated. (12.0.0) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.0.0)
- Kafka event patterns now accept RegExp values. (12.0.0) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.0.0)
- JSON logging can spread structured parameters into the root instead of nesting them under params. (12.0.0) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.0.0), [upgrade guide](https://github.com/nestjs/docs.nestjs.com/blob/72f77737e2c6f2c305229e87c4f7846bb629c6cc/content/migration.md)
- graphql-ws is the supported GraphQL subscriptions transport. (12.0.0) — [upgrade guide](https://github.com/nestjs/docs.nestjs.com/blob/72f77737e2c6f2c305229e87c4f7846bb629c6cc/content/migration.md)
- WebSocket disconnect handlers can receive the disconnection reason. (12.0.0) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.0.0), [upgrade guide](https://github.com/nestjs/docs.nestjs.com/blob/72f77737e2c6f2c305229e87c4f7846bb629c6cc/content/migration.md), [upgrade guide](https://docs.nestjs.com/migration-guide)
- Exceptions can serialize a stable error code so clients avoid parsing message strings. (12.0.0) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.0.0), [upgrade guide](https://github.com/nestjs/docs.nestjs.com/blob/72f77737e2c6f2c305229e87c4f7846bb629c6cc/content/migration.md), [upgrade guide](https://docs.nestjs.com/migration-guide)
- Kafka message patterns now accept RegExp values. (12.0.0) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.0.0), [upgrade guide](https://docs.nestjs.com/migration-guide)
- A new hook runs before a microservice message handler is invoked. (12.0.0) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.0.0), [upgrade guide](https://github.com/nestjs/docs.nestjs.com/blob/72f77737e2c6f2c305229e87c4f7846bb629c6cc/content/migration.md), [upgrade guide](https://docs.nestjs.com/migration-guide)
- The SWC builder can emit declaration files through a new CLI flag or nest-cli.json option. (12.0.0) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.0.0), [upgrade guide](https://github.com/nestjs/docs.nestjs.com/blob/72f77737e2c6f2c305229e87c4f7846bb629c6cc/content/migration.md), [upgrade guide](https://docs.nestjs.com/migration-guide)
- Builds can disable type checking. (12.0.0) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.0.0), [upgrade guide](https://github.com/nestjs/docs.nestjs.com/blob/72f77737e2c6f2c305229e87c4f7846bb629c6cc/content/migration.md), [upgrade guide](https://docs.nestjs.com/migration-guide)
- Monorepo projects can be built in parallel with configurable concurrency. (12.0.0) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.0.0), [upgrade guide](https://github.com/nestjs/docs.nestjs.com/blob/72f77737e2c6f2c305229e87c4f7846bb629c6cc/content/migration.md)
- Monorepo projects can build in parallel when --parallel is combined with --all. (12.0.0) — [upgrade guide](https://docs.nestjs.com/migration-guide)
- nest build supports specifying the Rspack path. (12.0.0) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.0.0)
- Adds a nest-cli.json property for copying library assets into an application build. (12.0.0) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.0.0), [upgrade guide](https://github.com/nestjs/docs.nestjs.com/blob/72f77737e2c6f2c305229e87c4f7846bb629c6cc/content/migration.md), [upgrade guide](https://docs.nestjs.com/migration-guide)
- A new command deploys applications to the cloud through Mau and installs @nestjs/mau on first use. (12.0.0) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.0.0), [upgrade guide](https://github.com/nestjs/docs.nestjs.com/blob/72f77737e2c6f2c305229e87c4f7846bb629c6cc/content/migration.md), [upgrade guide](https://docs.nestjs.com/migration-guide)
- The upgrade command can report planned changes without modifying project files. (12.0.0) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.0.0), [upgrade guide](https://docs.nestjs.com/migration-guide)
- The application accepts an instrument option for integrating the official observability SDK with Nest's lifecycle. (12.0.0) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.0.0), [upgrade guide](https://github.com/nestjs/docs.nestjs.com/blob/72f77737e2c6f2c305229e87c4f7846bb629c6cc/content/migration.md)
- The new SDK provides native observability for requests, jobs, errors, traces, and supported transports. (12.0.0) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.0.0), [upgrade guide](https://github.com/nestjs/docs.nestjs.com/blob/72f77737e2c6f2c305229e87c4f7846bb629c6cc/content/migration.md), [upgrade guide](https://docs.nestjs.com/migration-guide)
- Projects switching to ESM set package.json type to module. (12.0.0) — [upgrade guide](https://github.com/nestjs/docs.nestjs.com/blob/72f77737e2c6f2c305229e87c4f7846bb629c6cc/content/migration.md)
- Kafka message and event patterns can now use regular expressions. (12.0.0) — [upgrade guide](https://github.com/nestjs/docs.nestjs.com/blob/72f77737e2c6f2c305229e87c4f7846bb629c6cc/content/migration.md)
- Request-scoped WebSocket gateways can inject the socket through the REQUEST token. (12.0.0) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.0.0), [upgrade guide](https://github.com/nestjs/docs.nestjs.com/blob/72f77737e2c6f2c305229e87c4f7846bb629c6cc/content/migration.md), [upgrade guide](https://docs.nestjs.com/migration-guide)
- Route parameter decorators accept Standard Schema-compatible schemas for validation and OpenAPI generation. (12.0.0) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.0.0), [upgrade guide](https://github.com/nestjs/docs.nestjs.com/blob/72f77737e2c6f2c305229e87c4f7846bb629c6cc/content/migration.md), [upgrade guide](https://docs.nestjs.com/migration-guide)
- Applications can opt into errors for duplicate route conflicts. (12.0.0) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.0.0)
- NestApplicationOptions can configure duplicate and shadowed route diagnostics. (12.0.0) — [upgrade guide](https://github.com/nestjs/docs.nestjs.com/blob/72f77737e2c6f2c305229e87c4f7846bb629c6cc/content/migration.md), [upgrade guide](https://docs.nestjs.com/migration-guide)
- Applications can opt into warnings when declaration order causes one route to shadow another. (12.0.0) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.0.0)
- Applications can opt into specificity-based route resolution. (12.0.0) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.0.0), [upgrade guide](https://github.com/nestjs/docs.nestjs.com/blob/72f77737e2c6f2c305229e87c4f7846bb629c6cc/content/migration.md), [upgrade guide](https://docs.nestjs.com/migration-guide)
- nest build and nest start accept a Rspack configuration path. (12.0.0) — [upgrade guide](https://github.com/nestjs/docs.nestjs.com/blob/72f77737e2c6f2c305229e87c4f7846bb629c6cc/content/migration.md)
- Compiler informational logs can be suppressed. (12.0.0) — [upgrade guide](https://github.com/nestjs/docs.nestjs.com/blob/72f77737e2c6f2c305229e87c4f7846bb629c6cc/content/migration.md), [upgrade guide](https://docs.nestjs.com/migration-guide)
- A new interceptor validates and transforms outgoing responses using Standard Schema. (12.0.0) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.0.0), [upgrade guide](https://github.com/nestjs/docs.nestjs.com/blob/72f77737e2c6f2c305229e87c4f7846bb629c6cc/content/migration.md), [upgrade guide](https://docs.nestjs.com/migration-guide)
- A new pipe validates route data against Standard Schema metadata. (12.0.0) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.0.0), [upgrade guide](https://github.com/nestjs/docs.nestjs.com/blob/72f77737e2c6f2c305229e87c4f7846bb629c6cc/content/migration.md), [upgrade guide](https://docs.nestjs.com/migration-guide)
- Adds errorFormat to control validation error response shape as list or grouped. (12.0.0) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.0.0), [upgrade guide](https://github.com/nestjs/docs.nestjs.com/blob/72f77737e2c6f2c305229e87c4f7846bb629c6cc/content/migration.md), [upgrade guide](https://docs.nestjs.com/migration-guide)

### Behavior and default changes

- Omitted WebSocket adapter creation options receive defaults. (12.1.3) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.1.3)
- Omitted WebSocket adapter creation options receive defaults. (12.1.3) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.1.3)
- SSE responses now send the expires header. (12.1.3) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.1.3)
- Transient global enhancers now run on controllers. (12.1.3) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.1.3)
- Global scoped enhancers are resolved per connection. (12.1.3) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.1.3)
- A redeclared @Inject() property replaces the inherited property. (12.1.3) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.1.3)
- Request-scoped hooks use the hook name as their pattern. (12.1.3) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.1.3)
- Server options now receive defaults like the client factory does. (12.1.3) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.1.3)
- TCP connections wait for the TLS handshake. (12.1.3) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.1.3)
- useClass() overrides now take the scope of the class. (12.1.3) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.1.3)
- validationSchema now accepts any compatible Standard Schema instead of being Joi-specific. (12.0.0) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.0.0), [upgrade guide](https://github.com/nestjs/docs.nestjs.com/blob/72f77737e2c6f2c305229e87c4f7846bb629c6cc/content/migration.md), [upgrade guide](https://docs.nestjs.com/migration-guide)
- All core Nest packages now ship as ESM while existing CommonJS applications generally continue working. (12.0.0) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.0.0), [upgrade guide](https://docs.nestjs.com/migration-guide)
- The Express adapter now drains in-flight requests during shutdown. (12.0.0) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.0.0), [upgrade guide](https://github.com/nestjs/docs.nestjs.com/blob/72f77737e2c6f2c305229e87c4f7846bb629c6cc/content/migration.md)
- The Express adapter drains in-flight requests during shutdown. (12.0.0) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.0.0), [upgrade guide](https://docs.nestjs.com/migration-guide)
- GraphiQL is now the default GraphQL IDE, replacing playground configuration. (12.0.0) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.0.0), [upgrade guide](https://docs.nestjs.com/migration-guide)
- Error mapping was reworked across core, Express, and Fastify adapters. (12.0.0) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.0.0)
- Rspack is now the default bundler for monorepos. (12.0.0) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.0.0), [upgrade guide](https://github.com/nestjs/docs.nestjs.com/blob/72f77737e2c6f2c305229e87c4f7846bb629c6cc/content/migration.md), [upgrade guide](https://docs.nestjs.com/migration-guide)

### Tooling

- bun is now supported as a package manager alongside npm, yarn, and pnpm. (12.0.0) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.0.0), [upgrade guide](https://github.com/nestjs/docs.nestjs.com/blob/72f77737e2c6f2c305229e87c4f7846bb629c6cc/content/migration.md), [upgrade guide](https://docs.nestjs.com/migration-guide)
- The project generator now asks whether to scaffold a CommonJS or ESM project. (12.0.0) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.0.0), [upgrade guide](https://github.com/nestjs/docs.nestjs.com/blob/72f77737e2c6f2c305229e87c4f7846bb629c6cc/content/migration.md), [upgrade guide](https://docs.nestjs.com/migration-guide)
- A new command upgrades v11 projects to v12 and applies supported migration steps. (12.0.0) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.0.0), [upgrade guide](https://docs.nestjs.com/migration-guide)
- Generated projects now use oxlint instead of ESLint. (12.0.0) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.0.0), [upgrade guide](https://github.com/nestjs/docs.nestjs.com/blob/72f77737e2c6f2c305229e87c4f7846bb629c6cc/content/migration.md), [upgrade guide](https://docs.nestjs.com/migration-guide)
- The decorator schematic now generates decorators using Reflector.createDecorator(). (12.0.0) — [upgrade guide](https://github.com/nestjs/docs.nestjs.com/blob/72f77737e2c6f2c305229e87c4f7846bb629c6cc/content/migration.md)
- Vitest is the default test runner for generated ESM projects, while CommonJS projects retain Jest. (12.0.0) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.0.0), [upgrade guide](https://github.com/nestjs/docs.nestjs.com/blob/72f77737e2c6f2c305229e87c4f7846bb629c6cc/content/migration.md), [upgrade guide](https://docs.nestjs.com/migration-guide)

### Fixes and other changes

- Fastify async lifecycle hooks settle only once. (12.1.3) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.1.3)
- Async request hook completion is guarded. (12.1.3) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.1.3)
- Buffered logs are flushed when application initialization fails. (12.1.3) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.1.3)
- Client-streaming calls receive an answer when handlers return nothing. (12.1.3) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.1.3)
- Dependencies of configurable module aliases are collected. (12.1.3) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.1.3)
- Custom decorator data is retained when it has schema or pipes keys. (12.1.3) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.1.3)
- Client operations survive custom deserializer errors. (12.1.3) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.1.3)
- Import error messages now name dynamic host modules. (12.1.3) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.1.3)
- Minified exception class names fall back to Error. (12.1.3) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.1.3)
- Method misses are answered on excluded routes. (12.1.3) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.1.3)
- Method misses are answered on excluded routes. (12.1.3) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.1.3)
- File type regular-expression state is isolated. (12.1.3) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.1.3)
- Gateway lifecycle hook errors are passed to exception filters. (12.1.3) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.1.3)
- A GET middleware exclusion also covers HEAD requests. (12.1.3) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.1.3)
- Global prefix exclusions are honored for overlapping versions. (12.1.3) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.1.3)
- Global scoped enhancers are resolved separately for each connection. (12.1.3) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.1.3)
- gRPC response errors no longer enter the request stream. (12.1.3) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.1.3)
- Empty-completing gRPC stream calls now resolve. (12.1.3) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.1.3)
- isHeadersSent counts headers flushed through reply.raw. (12.1.3) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.1.3)
- Both Kafka client connections close when one fails. (12.1.3) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.1.3)
- Kafka records are cloned before serialization. (12.1.3) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.1.3)
- Pending Kafka requests fail when deserialization errors occur. (12.1.3) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.1.3)
- Null payloads are preserved in Kafka tombstone records. (12.1.3) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.1.3)
- Fastify listen() rejects invalid ports. (12.1.3) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.1.3)
- Records returned by message handlers are unwrapped. (12.1.3) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.1.3)
- Controller paths are normalized when middleware is mapped. (12.1.3) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.1.3)
- MQTT payload options are preserved. (12.1.3) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.1.3)
- MQTT requests fail when publishing fails. (12.1.3) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.1.3)
- NATS requests fail on undecodable replies. (12.1.3) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.1.3)
- Stale NATS status events are ignored. (12.1.3) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.1.3)
- NATS status updates continue when a listener throws. (12.1.3) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.1.3)
- Inherited @Optional() properties remain optional. (12.1.3) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.1.3)
- Redis operations wait for both clients to be ready. (12.1.3) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.1.3)
- Redis connections no longer crash the process when they drop. (12.1.3) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.1.3)
- Redis listen operations fail when subscriptions are rejected. (12.1.3) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.1.3)
- Explicit null values are preserved in reflectable decorators. (12.1.3) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.1.3)
- Fastify shutdown hooks honor return503OnClosing. (12.1.3) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.1.3)
- The RabbitMQ client no longer opens two channels on connect. (12.1.3) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.1.3)
- RabbitMQ connect and listen operations fail on channel setup errors. (12.1.3) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.1.3)
- RabbitMQ # wildcards match in any position. (12.1.3) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.1.3)
- Custom Fastify router constraints are preserved. (12.1.3) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.1.3)
- The pattern is included when a scoped handler fails to resolve. (12.1.3) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.1.3)
- Shared contexts are retained during disconnect hooks. (12.1.3) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.1.3)
- Shared contexts are retained during disconnect hooks. (12.1.3) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.1.3)
- The shutdown sequence runs after initialization fails. (12.1.3) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.1.3)
- A shutdown signal received while close() is running is honored. (12.1.3) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.1.3)
- Assigning an SSE event id no longer mutates the message. (12.1.3) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.1.3)
- Headers are committed for empty SSE streams. (12.1.3) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.1.3)
- SSE lifecycle state settles correctly after an early disconnect. (12.1.3) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.1.3)
- Handler-set status and headers are sent on SSE responses. (12.1.3) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.1.3)
- SSE streams end when event data cannot be serialized. (12.1.3) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.1.3)
- The StreamableFile source is destroyed when a client disconnects. (12.1.3) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.1.3)
- Pending TCP retries are canceled when the connection closes. (12.1.3) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.1.3)
- Nested transient providers injected into properties are isolated. (12.1.3) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.1.3)
- Default Fastify body parsers remain available after useBodyParser(). (12.1.3) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.1.3)
- Overrides take the scope of the class. (12.1.3) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.1.3)
- Parent validation constraints are preserved. (12.1.3) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.1.3)
- VERSION_NEUTRAL middleware routes are treated as having no version. (12.1.3) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.1.3)
- URI versioned exclusions are resolved correctly for the not-found handler. (12.1.3) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.1.3)
- The base WebSocket exception filter copies the options object. (12.1.3) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.1.3)
- Wildcard middleware runs on the bare global prefix path. (12.1.3) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.1.3)
- Detects circular dependencies across more than two providers. (12.1.1) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.1.1)
- Keeps a newer Kafka connection when a stale connection fails. (12.1.1) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.1.1)
- Fixes JSON output, log level changes, fatal logs, and buffered logs. (12.1.1) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.1.1)
- Allows the MQTT client to retry after a failed connection. (12.1.1) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.1.1)
- Recovers the NATS client after it gives up reconnecting. (12.1.1) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.1.1)
- Keeps a newer NATS connection when a stale connection fails. (12.1.1) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.1.1)
- Rejects non-numeric items when ParseArrayPipe uses Number items. (12.1.1) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.1.1)
- Replies on the request channel when Redis wildcards are enabled. (12.1.1) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.1.1)
- Treats JSON content types with parameters as JSON in reply(). (12.1.1) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.1.1)
- Allows the RMQ client to retry after a failed connection. (12.1.1) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.1.1)
- Preserves string enum values that match numeric member names. (12.1.1) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.1.1)
- Ignores events emitted by a replaced TCP client socket. (12.1.1) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.1.1)
- Preserves TCP event listeners across reconnects. (12.1.1) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.1.1)
- Honors class and factory overrides of value providers. (12.1.1) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.1.1)
- Fastify initialization now honors Nest's forceCloseConnections setting. (12.1.0) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.1.0)
- Invalid metadata entries now include the module name in the resulting diagnostic. (12.1.0) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.1.0)
- Optional constructor parameters are inherited when the constructor is not redeclared. (12.1.0) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.1.0)
- The ParseDatePipe default now applies to every missing value. (12.1.0) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.1.0)
- The Redis client retries after a failed connection. (12.1.0) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.1.0)
- Route handler names are preserved. (12.1.0) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.1.0)
- Subsequent middleware is no longer skipped after a transient middleware. (12.1.0) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.1.0)
- Sparse factory inject arrays no longer cause the application to hang. (12.0.4) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.0.4)
- Missing gRPC package namespaces are handled gracefully. (12.0.4) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.0.4)
- The Kafka client retries after a failed connection. (12.0.4) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.0.4)
- Message handler rejections are routed to handleError. (12.0.4) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.0.4)
- Multer limits are merged key-by-key instead of being overridden wholesale. (12.0.4) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.0.4)
- Parse date pipe options are optional. (12.0.4) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.0.4)
- The processing hook envelope is shared across transports. (12.0.4) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.0.4)
- Kafka request-response spans are closed exactly once. (12.0.4) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.0.4)
- Request-response spans are closed exactly once. (12.0.4) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.0.4)
- The Kafka processing end hook now always runs. (12.0.3) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.0.3)
- Open TCP sockets are now destroyed during shutdown. (12.0.3) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.0.3)
- The proto-key stripping hook is now invoked via this during transformation. (12.0.3) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.0.3)
- UUID version and variant are now validated when no version is set. (12.0.3) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.0.3)
- Fastify derives a neutral version when the accept header is absent. (12.0.2) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.0.2)
- Factory providers using discovery decorators are now discovered. (12.0.2) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.0.2)
- Message streams now remain alive when a handler throws. (12.0.2) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.0.2)
- Responses are now sent for exceptions thrown from middleware. (12.0.2) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.0.2)
- The MQTT listen callback now runs only once. (12.0.2) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.0.2)
- normalizePath now collapses duplicate internal slashes. (12.0.2) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.0.2)
- An empty string is now treated as array input by ParseArrayPipe. (12.0.2) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.0.2)
- Foreign JSON is no longer treated as an RPC envelope. (12.0.2) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.0.2)
- Repeated shutdown signal listeners are cleaned up. (12.0.2) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.0.2)
- Connected microservices now detach signal listeners correctly. (12.0.2) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.0.2)
- Error instances with statusCode are no longer incorrectly treated as HTTP errors. (12.0.2) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.0.2)
- UUID v3 variant validation is corrected. (12.0.2) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.0.2)
- gRPC exception handling now maps errors to proper gRPC status codes instead of UNKNOWN. (12.0.0) — [release notes](https://github.com/nestjs/nest/releases/tag/v12.0.0), [upgrade guide](https://github.com/nestjs/docs.nestjs.com/blob/72f77737e2c6f2c305229e87c4f7846bb629c6cc/content/migration.md), [upgrade guide](https://docs.nestjs.com/migration-guide)

## @nestjs/core 11

### Breaking changes

- Numeric enum validation no longer includes reverse-mapped keys. (11.2.0) — [release notes](https://github.com/nestjs/nest/releases/tag/v11.2.0)
- get() now throws for implicitly request-scoped dependency trees. (11.1.9) — [release notes](https://github.com/nestjs/nest/releases/tag/v11.1.9)
- Fastify top-level options are migrated to routerOptions. (11.1.8) — [release notes](https://github.com/nestjs/nest/releases/tag/v11.1.8)

### Security

- Updated multer to address CVE-2026-88932 in @nestjs/platform-express. (11.2.6) — [release notes](https://github.com/nestjs/nest/releases/tag/v11.2.6)
- Hardened the TCP transport against a hostile peer. (11.2.5) — [release notes](https://github.com/nestjs/nest/releases/tag/v11.2.5)
- Nest: Middleware Bypass on Fastify via Trailing Slash (11.1.24) — [security advisory](https://github.com/advisories/GHSA-6V32-FJC9-9QF6)
- jsonsocket.handledata no longer causes a stack overflow. (11.1.19) — [release notes](https://github.com/nestjs/nest/releases/tag/v11.1.19), [security advisory](https://github.com/advisories/GHSA-HPWF-8G29-85QM)
- @nestjs/core Improperly Neutralizes Special Elements in Output Used by a Downstream Component ('Injection') (11.1.18) — [security advisory](https://github.com/advisories/GHSA-36XV-JGW5-4Q75)
- SSE message handling now sanitizes messages. (11.1.18) — [release notes](https://github.com/nestjs/nest/releases/tag/v11.1.18)
- Nest Fastify HEAD Request Middleware Bypass (11.1.16) — [security advisory](https://github.com/advisories/GHSA-WF42-42FG-FG84)
- Fixes a Fastify middleware bypass vulnerability. (11.1.14) — [release notes](https://github.com/nestjs/nest/releases/tag/v11.1.14), [security advisory](https://github.com/advisories/GHSA-R4WM-X892-VJMX)
- Fixes middie bypassing through decoded characters in platform-fastify. (11.1.11) — [release notes](https://github.com/nestjs/nest/releases/tag/v11.1.11), [security advisory](https://github.com/advisories/GHSA-8WPR-639P-CCRJ)

### New APIs and options

- NestJS now supports the HTTP QUERY method across core, common, and Fastify. (11.2.0) — [release notes](https://github.com/nestjs/nest/releases/tag/v11.2.0)
- Server-sent events now support an SSE signal. (11.2.0) — [release notes](https://github.com/nestjs/nest/releases/tag/v11.2.0)
- File type validation adds an override mimetype option. (11.1.29) — [release notes](https://github.com/nestjs/nest/releases/tag/v11.1.29)
- Server-sent events support comments. (11.1.29) — [release notes](https://github.com/nestjs/nest/releases/tag/v11.1.29)
- MulterOptions gains defParamCharset for configuring parameter character encoding. (11.1.20) — [release notes](https://github.com/nestjs/nest/releases/tag/v11.1.20)
- Microservices add an option to return buffers for binary data. (11.1.20) — [release notes](https://github.com/nestjs/nest/releases/tag/v11.1.20)
- Microservices handle RMQ blocked and unblocked connection events. (11.1.20) — [release notes](https://github.com/nestjs/nest/releases/tag/v11.1.20)
- Microservices adds Redis driver identification for applications using Redis transport. (11.1.17) — [release notes](https://github.com/nestjs/nest/releases/tag/v11.1.17)
- Microservices support a configurable maximum buffer size. (11.1.13) — [release notes](https://github.com/nestjs/nest/releases/tag/v11.1.13)
- MQTT supports configuring QoS per handler. (11.1.13) — [release notes](https://github.com/nestjs/nest/releases/tag/v11.1.13)
- An option for async logger compatibility was added. (11.1.10) — [release notes](https://github.com/nestjs/nest/releases/tag/v11.1.10)
- FileTypeValidator gains a message property for customizing validation messages. (11.1.10) — [release notes](https://github.com/nestjs/nest/releases/tag/v11.1.10)
- Server-side keepalive support was added for microservices. (11.1.10) — [release notes](https://github.com/nestjs/nest/releases/tag/v11.1.10)
- SSE handlers now support Promise<Observable> return values. (11.1.10) — [release notes](https://github.com/nestjs/nest/releases/tag/v11.1.10)
- The @sse decorator now accepts method options. (11.1.9) — [release notes](https://github.com/nestjs/nest/releases/tag/v11.1.9)
- WebSockets supports manual acknowledgement handling through the @Ack decorator. (11.1.7) — [release notes](https://github.com/nestjs/nest/releases/tag/v11.1.7)
- The console logger gains a force-console option. (11.1.7) — [release notes](https://github.com/nestjs/nest/releases/tag/v11.1.7)
- A TCP exception was added for handling TCP receive errors. (11.1.7) — [release notes](https://github.com/nestjs/nest/releases/tag/v11.1.7)

### Behavior and default changes

- The legacy route path warning now includes the auto-converted route. (11.1.28) — [release notes](https://github.com/nestjs/nest/releases/tag/v11.1.28)
- NestJS now warns when a WebSocket adapter is registered late. (11.1.24) — [release notes](https://github.com/nestjs/nest/releases/tag/v11.1.24)

### Fixes and other changes

- Multer errors are mapped by code instead of message, restoring 400 responses for unexpected file field names. (11.2.6) — [release notes](https://github.com/nestjs/nest/releases/tag/v11.2.6)
- Microservices now handle unserializable patterns without crashing. (11.2.4) — [release notes](https://github.com/nestjs/nest/releases/tag/v11.2.4)
- Fixes an issue involving circular durable providers. (11.2.3) — [release notes](https://github.com/nestjs/nest/releases/tag/v11.2.3)
- Fixed bootstrap crashes with nestjs-cls proxy providers caused by ProxyProviderNotResolvedException on CLS_REQ. (11.2.2) — [release notes](https://github.com/nestjs/nest/releases/tag/v11.2.2)
- Fixed ObserveInstrument breaking application startup in @nestjs/core 11.2.x. (11.2.2) — [release notes](https://github.com/nestjs/nest/releases/tag/v11.2.2)
- Fixed an early-return issue affecting SSE abort behavior. (11.2.1) — [release notes](https://github.com/nestjs/nest/releases/tag/v11.2.1)
- Pre-registered dynamic imports of lazy modules are now scanned. (11.2.0) — [release notes](https://github.com/nestjs/nest/releases/tag/v11.2.0)
- Inherited middleware no longer receives a duplicated route prefix. (11.2.0) — [release notes](https://github.com/nestjs/nest/releases/tag/v11.2.0)
- Adjacent wildcard segments are now converted correctly in legacy routes. (11.2.0) — [release notes](https://github.com/nestjs/nest/releases/tag/v11.2.0)
- Middleware now runs on routes excluded from the global prefix. (11.2.0) — [release notes](https://github.com/nestjs/nest/releases/tag/v11.2.0)
- Existing singleton providers are now shared with lazily loaded modules. (11.2.0) — [release notes](https://github.com/nestjs/nest/releases/tag/v11.2.0)
- String file types containing regex metacharacters are now matched correctly. (11.2.0) — [release notes](https://github.com/nestjs/nest/releases/tag/v11.2.0)
- A barrier resolves immediately when its target count is zero. (11.1.29) — [release notes](https://github.com/nestjs/nest/releases/tag/v11.1.29)
- Middleware overlap regexes no longer use the global flag. (11.1.29) — [release notes](https://github.com/nestjs/nest/releases/tag/v11.1.29)
- The gRPC client is nullified on close when tryshutdown fails. (11.1.29) — [release notes](https://github.com/nestjs/nest/releases/tag/v11.1.29)
- Import lookup stops after the first direct export match. (11.1.29) — [release notes](https://github.com/nestjs/nest/releases/tag/v11.1.29)
- Express maps missing Multer field nesting errors correctly. (11.1.29) — [release notes](https://github.com/nestjs/nest/releases/tag/v11.1.29)
- Express now maps missing Multer field-nesting errors correctly. (11.1.29) — [release notes](https://github.com/nestjs/nest/releases/tag/v11.1.29)
- The pub/sub client type used in Redis listeners is corrected. (11.1.29) — [release notes](https://github.com/nestjs/nest/releases/tag/v11.1.29)
- The SSE retry field is serialized when its value is zero. (11.1.29) — [release notes](https://github.com/nestjs/nest/releases/tag/v11.1.29)
- Missing exception classes are now included in HttpErrorByCode. (11.1.28) — [release notes](https://github.com/nestjs/nest/releases/tag/v11.1.28)
- Teardown now triggers for the SSE producer Observable when a client disconnects with an interceptor. (11.1.28) — [release notes](https://github.com/nestjs/nest/releases/tag/v11.1.28)
- The type guard now checks the value rather than the key. (11.1.28) — [release notes](https://github.com/nestjs/nest/releases/tag/v11.1.28)
- Fixed middleware handling for routes with an ending slash. (11.1.27) — [release notes](https://github.com/nestjs/nest/releases/tag/v11.1.27)
- Fixed teardown issues affecting SSE async handlers. (11.1.27) — [release notes](https://github.com/nestjs/nest/releases/tag/v11.1.27)
- Fixed empty responses from POST SSE endpoints. (11.1.26) — [release notes](https://github.com/nestjs/nest/releases/tag/v11.1.26)
- The ending slash is removed from pathnames in the Fastify platform. (11.1.25) — [release notes](https://github.com/nestjs/nest/releases/tag/v11.1.25)
- Pending Redis requests are rejected when microservices close. (11.1.25) — [release notes](https://github.com/nestjs/nest/releases/tag/v11.1.25)
- The SSE close listener is registered before asynchronous setup. (11.1.25) — [release notes](https://github.com/nestjs/nest/releases/tag/v11.1.25)
- The dependency-tree cache now resets when metadata changes, preventing stale dependency information. (11.1.24) — [release notes](https://github.com/nestjs/nest/releases/tag/v11.1.24)
- Fixes snapshot: true eagerly instantiating Terminus transient indicators since 11.1.20. (11.1.23) — [release notes](https://github.com/nestjs/nest/releases/tag/v11.1.23)
- Fixed an inflight request injection bug in core. (11.1.22) — [release notes](https://github.com/nestjs/nest/releases/tag/v11.1.22)
- Invalid-class-module errors now identify the decorator type. (11.1.22) — [release notes](https://github.com/nestjs/nest/releases/tag/v11.1.22)
- Skipped provider initialization is now settled correctly. (11.1.21) — [release notes](https://github.com/nestjs/nest/releases/tag/v11.1.21)
- bindMessageHandlers no longer duplicates the disconnect listener. (11.1.20) — [release notes](https://github.com/nestjs/nest/releases/tag/v11.1.20)
- Deeply nested transient providers now resolve correctly. (11.1.20) — [release notes](https://github.com/nestjs/nest/releases/tag/v11.1.20)
- The filetype validator buffer message is corrected. (11.1.20) — [release notes](https://github.com/nestjs/nest/releases/tag/v11.1.20)
- The parse date pipe now accepts a zero timestamp. (11.1.20) — [release notes](https://github.com/nestjs/nest/releases/tag/v11.1.20)
- ServerRMQ no longer crashes at boot when @MessagePattern(undefined) is combined with wildcards: true. (11.1.20) — [release notes](https://github.com/nestjs/nest/releases/tag/v11.1.20)
- @Sse no longer loses events when the stream completes. (11.1.20) — [release notes](https://github.com/nestjs/nest/releases/tag/v11.1.20)
- SSE message IDs now use strict null checking. (11.1.20) — [release notes](https://github.com/nestjs/nest/releases/tag/v11.1.20)
- SSE writehead output is deferred until after the lifecycle completes. (11.1.20) — [release notes](https://github.com/nestjs/nest/releases/tag/v11.1.20)
- The consumer CRASH event listener now uses its backing field. (11.1.19) — [release notes](https://github.com/nestjs/nest/releases/tag/v11.1.19)
- Prevents the injector from hanging when design:paramtypes metadata is missing. (11.1.18) — [release notes](https://github.com/nestjs/nest/releases/tag/v11.1.18)
- Fixes a dependency injection edge case involving ModuleRef.create. (11.1.18) — [release notes](https://github.com/nestjs/nest/releases/tag/v11.1.18)
- NATS serializer behavior now preserves packet headers. (11.1.18) — [release notes](https://github.com/nestjs/nest/releases/tag/v11.1.18)
- Middleware now auto-runs for HEAD requests because Fastify redirects them to GET handlers and otherwise skips middleware execution. (11.1.17) — [release notes](https://github.com/nestjs/nest/releases/tag/v11.1.17)
- Fixed a double callback when isdisposed or err is truthy in microservices. (11.1.16) — [release notes](https://github.com/nestjs/nest/releases/tag/v11.1.16)
- Introduces limits for pattern depth and object complexity in microservices handling. (11.1.15) — [release notes](https://github.com/nestjs/nest/releases/tag/v11.1.15)
- Fixes pattern matching when indexOf returns 0, preventing a valid result from being treated as falsy. (11.1.15) — [release notes](https://github.com/nestjs/nest/releases/tag/v11.1.15)
- Introduces object complexity limits for microservices processing. (11.1.15) — [release notes](https://github.com/nestjs/nest/releases/tag/v11.1.15)
- Prevents the logger from printing an invalid context when no stack trace is provided. (11.1.14) — [release notes](https://github.com/nestjs/nest/releases/tag/v11.1.14)
- Changes the requestOrigin type. (11.1.14) — [release notes](https://github.com/nestjs/nest/releases/tag/v11.1.14)
- The maxArrayLength option is no longer skipped. (11.1.13) — [release notes](https://github.com/nestjs/nest/releases/tag/v11.1.13)
- The maxStringLength option is no longer skipped. (11.1.13) — [release notes](https://github.com/nestjs/nest/releases/tag/v11.1.13)
- Built-in primitives are excluded when stripping prototype keys. (11.1.13) — [release notes](https://github.com/nestjs/nest/releases/tag/v11.1.13)
- Fixed a regression in loading file-type under Windows OS. (11.1.12) — [release notes](https://github.com/nestjs/nest/releases/tag/v11.1.12)
- Adds a missing catch handler for forward-ref provider resolution. (11.1.11) — [release notes](https://github.com/nestjs/nest/releases/tag/v11.1.11)
- fallbackToMimetype now works without a buffer. (11.1.10) — [release notes](https://github.com/nestjs/nest/releases/tag/v11.1.10)
- Error handling in FileTypeValidator was improved. (11.1.10) — [release notes](https://github.com/nestjs/nest/releases/tag/v11.1.10)
- The gRPC stream method return type was corrected. (11.1.10) — [release notes](https://github.com/nestjs/nest/releases/tag/v11.1.10)
- Nested transient providers are now instantiated correctly in static context. (11.1.10) — [release notes](https://github.com/nestjs/nest/releases/tag/v11.1.10)
- resolve() now resolves all providers when used with the each option. (11.1.10) — [release notes](https://github.com/nestjs/nest/releases/tag/v11.1.10)
- ValidationPipe behavior was enhanced. (11.1.10) — [release notes](https://github.com/nestjs/nest/releases/tag/v11.1.10)
- Nested transient providers are now isolated correctly. (11.1.8) — [release notes](https://github.com/nestjs/nest/releases/tag/v11.1.8)
- Console logger options now check whether color output is allowed. (11.1.7) — [release notes](https://github.com/nestjs/nest/releases/tag/v11.1.7)
- Dependency resolution errors now provide improved error messages. (11.1.7) — [release notes](https://github.com/nestjs/nest/releases/tag/v11.1.7)
- Extras are resolved in configurable module builder asynchronous methods. (11.1.7) — [release notes](https://github.com/nestjs/nest/releases/tag/v11.1.7)
- Lifecycle hooks are skipped for transient services that are not instantiated. (11.1.7) — [release notes](https://github.com/nestjs/nest/releases/tag/v11.1.7)
- RabbitMQ microservice fanout binding was fixed. (11.1.7) — [release notes](https://github.com/nestjs/nest/releases/tag/v11.1.7)
- The parameter type in the RouteConstraints decorator was corrected. (11.1.7) — [release notes](https://github.com/nestjs/nest/releases/tag/v11.1.7)

## @nestjs/core 10

### Security

- Updated to 1.20.4 to address CVE-2025-15284. (10.4.22) — [release notes](https://github.com/nestjs/nest/releases/tag/v10.4.22)
- Updated Express to address CVE-2025-15284. (10.4.21) — [release notes](https://github.com/nestjs/nest/releases/tag/v10.4.21)