[dependabot]

Bumps @nestjs/platform-express from 12.1.3 to 12.2.0.

Release notes

Sourced from @​nestjs/platform-express's releases.

v12.2.0 (2026-10-19)

Notable changes

New options

• @Sse({ maxPendingDataLength }) sets how many characters of event data may wait for a client that is not reading its events (4M by default; 0 or Infinity lifts the limit) – 2f05ad954e
• IoAdapter and WsAdapter take maxConcurrentMessages, the number of a client's messages handled at once (1000 by default; Infinity lifts it) – 0bd0810ed7
• ValidationPipe takes maxErrorMessagesLength (1,000,000 characters by default); messages past it are replaced by a "Further validation errors were omitted" entry – 086c1c514f
• Kafka: parser.maxMessageSize (16 MiB after decompression by default); larger messages are logged and skipped – 9bdf844fca
• TCP server: drainTimeout (30 s by default, 0 disables) disconnects a peer that leaves its responses unread – 583d6077ad
• MQTT server: reconnectOnConnackError is now enabled by default, so a refused connection attempt is retried; set it to false for the previous behaviour – a63cea600a
• HttpServer.getRouteMatchingOptions(), an optional adapter hook that tells core how the router matches paths (see "Middleware exclusions" below) – 08d8677c8d

New defaults and behaviour changes

• @nestjs/platform-express, @nestjs/platform-fastify: fieldNestingDepth and fieldArrayIndexLimit (#18074) now default to 32 and 1000; set them to Infinity to lift the limits – 94fcc93770
• ValidationPipe validates with validationError.target: false unless the options set it, so an exceptionFactory that reads error.target gets undefined; set validationError.target to true for the old errors – 8c5a59bf63
• ValidationPipe answers an array or a primitive sent for a validated class with a 400 – 197371c1f3
• FileTypeValidator matches a string fileType up to the end of a name (e.g. font/woff no longer accepts font/woff2; use a RegExp for that) – 770c6f1a19
• @SerializeOptions({}) on a handler no longer turns off the class schema – d27cb7017f
• BaseExceptionFilter answers http-errors errors created with expose: false (the default from 500) with the standard reason phrase instead of their message – 9ed572f853
• A StreamableFile error still gets a 400, but the body no longer carries the error message – 2f28d91afb
• Files uploaded with a request that a pipe rejected are removed from storage – acb98de89e
• @nestjs/platform-fastify: a route with fileSize: undefined (or null) falls back to the plugin's limit; set it to Infinity to keep uploads unlimited – dd549e1a74
• @nestjs/platform-express: object error bodies are sent as application/json on routes with a non-JSON Content-Type – 7dc6e349d5
• ConsoleLogger in JSON mode cuts a record short past about a million characters – ad4915eaa3
• A global enhancer that the injector failed to instantiate now fails the application at startup – ae78524ced
• A request- or transient-scoped APP_FILTER now logs a startup warning, as it only applies to exceptions thrown from controllers – df5275c5e1
• Microservices: a pattern key longer than 256 characters matches no handler – accd27e66c
• Kafka: a message may carry up to 10,000 header values (e419ff540b); headers given as a string or array are not sent (312777743f); reply headers are decoded as text (ee94f6aaae)
• gRPC: request streams are paused while their replies wait to be written – 37e5cf7706
• Deprecation: on TCP, Redis, NATS, MQTT and RabbitMQ, an @EventPattern() handler that replies to ClientProxy#send() now logs a deprecation warning. The reply is unchanged; in the next major version event handlers will not reply to send(), as on Kafka already – ba3668d36b

Middleware exclusions

• MiddlewareConsumer.exclude() now compiles excluded routes with the router's case and trailing-slash matching (08d8677c8d). Update @nestjs/core together with @nestjs/platform-express / @nestjs/platform-fastify: with an adapter that does not implement getRouteMatchingOptions(), excluded routes are matched exactly (f5aa875e40), so on a lenient router other spellings of an excluded path run the middleware.
• With header, media type or custom versioning, exclude({ path, method, version }) and enableCsrfProtection({ exclude }) apply only to requests that ask for one of the excluded versions – 1a7a31fa46
• @nestjs/platform-fastify: the request hook used by enableCsrfProtection() and useSecurityHeaders() now runs before Nest and app.use() middleware with NestFactory.create() too, including middleware registered before either call, as it already did with Test.createNestApplication() – 8351806290

Bug fixes

• platform-fastify
  • 614d1ac7ea fix(fastify): send the status of an exception whose body is an error (@​kamilmysliwiec)
  • 8b420f788f fix(fastify): apply middleware to plugins registered before init (@​kamilmysliwiec)
  • #18175 fix(fastify): keep raw-response cookies in the header helpers (@​johnnyhuirilef)
  • c215fd9b4f fix(fastify): match middleware paths like a case-insensitive router (@​kamilmysliwiec)
  • 43d4420205 fix(fastify): pass version extractor errors to the error handler (@​kamilmysliwiec)
  • 1435ed22f4 fix(fastify): pass middleware rejections to the error handler (@​kamilmysliwiec)
  • 84c947faf9 fix(fastify): stop reading a streamable file for a head request (@​kamilmysliwiec)
  • dd549e1a74 fix(fastify): let undefined upload limits fall back to the defaults (@​kamilmysliwiec)
  • 4735f8d050 fix(fastify): free memory storage chunks once a file is buffered (@​kamilmysliwiec)
  • 3e3e6eea6f fix(fastify): remove uploads cut off after their last chunk (@​kamilmysliwiec)
  • c04a9182b9 fix(fastify): set the security headers on router error responses (@​kamilmysliwiec)

... (truncated)

Commits

• af37111 chore(release): publish v12.2.0 release
• c8923bd fix(express,fastify): parse quoted media type version parameters (#18178)
• fb8c2ca fix(core): mount wildcard middleware on every path when "/" is excluded
• b75244f fix(express): run wildcard middleware on "/api/" for a named wildcard
• 8b8e839 fix(express): stop reading a streamable file for a head request
• acb98de fix(core,express,fastify): remove uploads of requests a pipe rejected
• 1933cc9 fix(express,fastify): handle a StreamableFile that cannot be streamed
• 7dc6e34 fix(express): send object error bodies with a json content type
• e075cda fix(express,fastify): let a route's dest replace the module's storage
• 84a16fe fix(deps): update dependency express to v5.3.0 (#18150)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)