fix(api): migrate NestJS 10 → 11 to clear critical @fastify/middie auth-bypass - #1950
Merged
Conversation
ivanslabbert
approved these changes
Aug 31, 2026
ivanslabbert
left a comment
ivanslabbert
left a comment
Contributor
There was a problem hiding this comment.
Check why rxjs dependencies are added? We removed code dependent on rxjs (shared library), but it could be a downstream dependency in the api.
Collaborator
Author
Unlike shared/, rxjs can't be dropped from api/ — it's a required peer dep of @nestjs/core and @nestjs/common (^7.1.0), since Nest is built on Observables. But none of our own api/src code imports it directly, so it's purely a framework requirement. |
…ypass CVE @nestjs/platform-fastify@10 pins @fastify/middie@8.3.3, which carries a critical middleware authentication-bypass in child plugin scopes (GHSA-72c6-fx6q-fr5w). The fix ships only in middie 9.x, which requires Fastify 5, which requires NestJS 11 — so the major bump is the only way to close it. platform-fastify@11 no longer depends on middie at all, and the API registers no Express-style middleware, so the package leaves the dependency tree entirely rather than being patched in place. Fastify 5 forces the plugin majors (@fastify/multipart 8→10, @fastify/compress 7→9); @nestjs/jwt and nest-winston are bumped because their peer ranges cap at NestJS 10. No source changes were required: the API exposes only GET/POST (both CORS- safelisted, unaffected by the Fastify 5 CORS default), the exception filter only reads reply.sent rather than assigning it, and the FastifyRequest module augmentation still resolves. npm audit: 22 vulnerabilities (1 critical, 8 high, 13 moderate) → 1 (sharp, tracked separately). Full suite unchanged at 817/817 against real CouchDB/MinIO. Refs #1866, #1800 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
ChrisTouo
force-pushed
the
1866-api-migrate-nestjs-10-11
branch
from
September 1, 2026 16:06
11e62f0 to
1c63d19
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changed
Dependencies only — no source changes. All
@nestjs/*→ 11.2.3, plus the majors Fastify 5forces (
@fastify/multipart8→10,@fastify/compress7→9) and two packages whose peer rangescap at Nest 10 (
@nestjs/jwt,nest-winston). Fastify 4→5 transitively.Nothing in the code needed touching: only
@Get/@Postare exposed (both CORS-safelisted), theexception filter only reads
reply.sentrather than assigning it, and theFastifyRequestaugmentation still resolves. Express 5 arrives only via a devDependency used by two specs —
production is Fastify-only.