chore(deps): update dependency @nestjs/platform-express to v11.1.28

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
@nestjs/platform-express (source)	11.1.11 → 11.1.28

---

Release Notes

nestjs/nest (@​nestjs/platform-express)

v11.1.28

Compare Source

v11.1.27

Compare Source

What's Changed

• fix(core): sse async handlers teardown issue by @​kamilmysliwiec in #​17131
• fix(platform-fastify): forRoutes middleware ending slash by @​kamilmysliwiec in #​17138

Full Changelog: nestjs/nest@v11.1.26...v11.1.27

v11.1.26

Compare Source

What's Changed

• fix(core): post sse endpoint empty response #​17098 by @​kamilmysliwiec in #​17099

Full Changelog: nestjs/nest@v11.1.25...v11.1.26

v11.1.25

Compare Source

What's Changed

• fix(microservices): reject pending Redis requests on close by @​yudin-s in #​17024
• fix(core): register SSE close listener before async setup by @​fallintoplace in #​17018
• fix(platform-fastify): remove pathname ending slash by @​kamilmysliwiec in #​17094

New Contributors

• @​fallintoplace made their first contribution in #​17018
• @​DucMinhNe made their first contribution in #​17085
• @​iambeaukim made their first contribution in #​17091

Full Changelog: nestjs/nest@v11.1.24...v11.1.25

v11.1.24

Compare Source

v11.1.24 (2026-05-25)

Bug fixes

• core
  • #​17009 fix(core): reset dependency-tree cache on metadata changes (@​puneetdixit200)

Enhancements

• core
  • #​16997 feat(core): warn on late websocket adapter registration (@​hbinhng)

Dependencies

• platform-ws
  • #​17011 chore(deps): bump ws from 8.20.1 to 8.21.0 (@​dependabot[bot])

Committers: 2

• Nguyễn Hải Bình (@​hbinhng)
• Puneet Dixit (@​puneetdixit200)

v11.1.23

Compare Source

v11.1.23 (2026-05-21)

Bug fixes

• core
  • #​16998 fix snapshot: true eagerly instantiates Terminus transient indicators since 11.1.20

Committers: 1

• Kamil Mysliwiec (@​kamilmysliwiec)

v11.1.22

Compare Source

v11.1.22 (2026-05-21)

Bug fixes

• core
  • #​16993 fix(core): inflight request injection bug #​16989 (@​kamilmysliwiec)

Enhancements

• core
  • #​16967 fix(core): identify decorator type in invalid-class-module error (@​HarrierOnChain)

Committers: 2

• Harrier (@​HarrierOnChain)
• Kamil Mysliwiec (@​kamilmysliwiec)

v11.1.21

Compare Source

v11.1.21 (2026-05-14)

Bug fixes

• core
  • #​16948 fix(core): settle skipped provider initialization (@​yudin-s)

Committers: 1

• Serge Yudin (@​yudin-s)

v11.1.20

Compare Source

v11.1.20 (2026-05-13)

Bug fixes

• core, testing
  • #​16939 fix(core): fix deeply nested transient providers resolution (@​kamilmysliwiec)
• core
  • #​16861 fix(core): fix @​Sse losing events on complete (@​MatthiasBrehmer)
  • #​16753 fix(core): defer sse writehead until after lifecycle completes (@​jkalberer)
  • #​16782 fix(core): use strict null check for SSE message id (@​burhanharoon)
• microservices
  • #​16850 fix(microservices): ServerRMQ crashes at boot when @​MessagePattern(undefined) is combined with wildcards: true (@​lavieennoir)
• common
  • #​16845 fix(common): accept zero timestamp in parse date pipe (@​Mysh3ll)
• platform-socket.io
  • #​16742 fix(socket.io): Deduplicate disconnect listener in bindMessageHandlers (@​fru1tworld)

Enhancements

• microservices
  • #​16676 feat(microservices): add return buffers option for binary data (@​Forceres)
  • #​16826 feat(microservices): handle rmq blocked/unblocked connection events (@​thisalihassan)
• common
  • #​16902 fix(common): filetype validator buffer message (@​QusaiAlbonni)
• platform-express
  • #​16844 feat(platform-express): add defParamCharset to MulterOptions (@​starnayuta)

Dependencies

• platform-ws
  • #​16941 chore(deps): bump ws from 8.20.0 to 8.20.1 (@​dependabot[bot])

Committers: 13

• Ali Hassan (@​thisalihassan)
• Burhan Haroon⚡ (@​burhanharoon)
• Dmytro Khyzhniak (@​lavieennoir)
• Harsh Rathod (@​harshrathod50)
• IlyaCredo (@​Forceres)
• Kamil Mysliwiec (@​kamilmysliwiec)
• Mysh3ll (@​Mysh3ll)
• @​MatthiasBrehmer
• @​QusaiAlbonni
• @​jkalberer
• @​pazaderey
• fru1tworld (@​fru1tworld)
• starnayuta (@​starnayuta)

v11.1.19

Compare Source

v11.1.19 (2026-04-13)

Bug fixes

• microservices
  • #​16762 fix(microservices): use backing field for consumer CRASH event listener (@​burhanharoon)
  • #​16764 fix(microservices): prevent stack overflow in jsonsocket.handledata() (@​kamilmysliwiec)

Committers: 2

• Burhan Haroon⚡ (@​burhanharoon)
• Kamil Mysliwiec (@​kamilmysliwiec)

v11.1.18

Compare Source

v11.1.18 (2026-04-03)

Bug fixes

• microservices
  • #​16675 fix(microservices): preserve packet headers in nats serializer (@​wwenrr)
• core
  • #​16683 fix(core): prevent injector hang when design:paramtypes is missing (@​Youmoo)
  • #​16637 fix(core): dependency injection edge case with moduleref.create (@​JakobStaudinger)
  • #​16686 fix(core): sanitize sse message

Dependencies

• core, platform-express, platform-fastify
  • #​16679 fix(deps): update dependency path-to-regexp to v8.4.2 (@​renovate[bot])
• platform-fastify
  • #​16623 fix(deps): update dependency fastify to v5.8.4 (@​renovate[bot])
• platform-ws
  • #​16618 chore(deps): bump ws from 8.19.0 to 8.20.0 (@​dependabot[bot])
• common
  • #​16619 chore(deps): bump file-type from 21.3.3 to 21.3.4 (@​dependabot[bot])

Committers: 6

• Ankit San (@​ankitbelal)
• Jakob Staudinger (@​JakobStaudinger)
• Kamil Mysliwiec (@​kamilmysliwiec)
• Krishna Chaitanya (@​Krishnachaitanyakc)
• MK (@​wwenrr)
• youmoo (@​Youmoo)

v11.1.17

Compare Source

v11.1.17 (2026-03-16)

Enhancements

• microservices
  • #​16218 feat(microservices): add redis driver identification (@​vchomakov)

Bugs

• platform-fastify
  • auto-run middleware for HEAD requests as fastify redirects them to GET handlers (effectively skipping middleware execution) cbdf737 (@​kamilmysliwiec)

Dependencies

• common
  • #​16567 fix(deps): update dependency file-type to v21.3.2 (@​renovate[bot])
• platform-fastify
  • #​16533 fix(deps): update dependency fastify to v5.8.2 (@​renovate[bot])

Committers: 3

• Rohan Santhosh Kumar (@​Rohan5commit)
• Vasil Chomakov (@​vchomakov)
• Kamil Mysliwiec (@​kamilmysliwiec)

v11.1.16

Compare Source

v11.1.16 (2026-03-05)

Bug fixes

• microservices
  • #​16506 fix(microservices): fix double callback when isdisposed or err is truthy (@​LhonRafaat)

Dependencies

• platform-express
  • #​16507 fix(deps): update dependency multer to v2.1.1 (@​renovate[bot])

Committers: 2

• Lhon (@​LhonRafaat)
• Shahnoor Mujawar (@​shahnoormujawar)

v11.1.15

Compare Source

What's Changed

• fix(microservices): if indexOf return 0 will if will be falsy by @​cuiweixie in #​16401
• fix(microservices): introuduce max pattern depth and object complexity by @​kamilmysliwiec in #​16402
• chore(@​nestjs/core): allow override for initializeWildcardHandlersIfE… by @​StNekroman in #​16468
• chore(deps): update dependency @​fastify/middie to v9.2.0 [security] by @​renovate[bot] in #​16472
• fix(deps): update dependency multer to v2.1.0 [security] by @​renovate[bot] in #​16474

New Contributors

• @​cuiweixie made their first contribution in #​16401
• @​StNekroman made their first contribution in #​16468

Full Changelog: nestjs/nest@v11.1.14...v11.1.15

v11.1.14

Compare Source

v11.1.14 (2026-02-17)

Bug fixes

• platform-fastify
  • #​16384 fix(fastify): fastify middleware bypass cve (@​kamilmysliwiec)
• common
  • #​16307 fix: logger print invalid context when no stack trace provided (@​JulienDuf)

Enhancements

• common
  • #​16314 fix(common): change requestOrigin type (@​SpencerKaiser)

Committers: 5

• Julien Dufresne (@​JulienDuf)
• Kamil Mysliwiec (@​kamilmysliwiec)
• Mykhailo Skrypsky (@​mixator)
• Spencer Kaiser (@​SpencerKaiser)
• 조수민 (@​suuuuuuminnnnnn)

v11.1.13

Compare Source

v11.1.13 (2026-02-03)

Bug fixes

• common
  • #​16230 fix(common): Fix skipping maxArrayLength and maxStringLength option (@​chojs23)

Enhancements

• microservices
  • #​16286 feat(microservices): support per-handler qos in mqtt (@​suuuuuuminnnnnn)
  • #​16262 Feat/microservices configurable max buffer size (@​jobnow)
• common
  • #​16202 fix(common): exclude built-in primitives from strip proto keys (@​som14062005)

Dependencies

• platform-fastify
  • #​16282 fix(deps): update dependency fastify to v5.7.4 (@​renovate[bot])
• platform-express
  • #​16241 fix(deps): update dependency cors to v2.8.6 (@​renovate[bot])

Committers: 6

• Lee Donghyun (@​devizi0)
• Mykhailo Skrypsky (@​mixator)
• Neo (@​chojs23)
• Praveen Somasundaram (@​som14062005)
• Ricardo Gomes (@​jobnow)
• 조수민 (@​suuuuuuminnnnnn)

v11.1.12

Compare Source

v11.1.12 (2026-01-15)

Bug fixes

• common
  • #​16187 fix(common): regression in loading file-type under Windows OS (@​iamkanguk97)

Dependencies

• platform-ws
  • #​16161 chore(deps): bump ws from 8.18.3 to 8.19.0 (@​dependabot[bot])
• common
  • #​16155 fix(deps): update dependency file-type to v21.3.0 (@​renovate[bot])
• platform-fastify
  • #​16154 fix(deps): update dependency find-my-way to v9.4.0 (@​renovate[bot])

Committers: 3

• Antonio Tripodi (@​Tony133)
• KANGUK LEE (@​iamkanguk97)
• @​miso-kyoungminkim

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
npm/@nestjs/platform-express	11.1.28	🟢 7.1	Details Check Score Reason Code-Review 🟢 3 Found 3/10 approved changesets -- score normalized to 3 Maintained 🟢 10 30 commit(s) and 26 issue activity found in the last 90 days -- score normalized to 10 Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege Security-Policy 🟢 9 security policy file detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Packaging ⚠️ -1 packaging workflow not detected CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 Binary-Artifacts 🟢 10 no binaries found in the repo License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md Fuzzing ⚠️ 0 project is not fuzzed SAST 🟢 9 SAST tool detected but not run on all commits
npm/cors	2.8.6	🟢 7.2	Details Check Score Reason Maintained ⚠️ 1 0 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 1 Binary-Artifacts 🟢 10 no binaries found in the repo Packaging ⚠️ -1 packaging workflow not detected Dependency-Update-Tool 🟢 10 update tool detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Code-Review 🟢 9 Found 18/19 approved changesets -- score normalized to 9 Pinned-Dependencies 🟢 6 dependency not pinned by hash detected -- score normalized to 6 Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege Vulnerabilities 🟢 10 0 existing vulnerabilities detected CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected SAST 🟢 9 SAST tool detected but not run on all commits Fuzzing ⚠️ 0 project is not fuzzed Signed-Releases ⚠️ -1 no releases found License 🟢 10 license file detected Security-Policy 🟢 10 security policy file detected Branch-Protection ⚠️ 0 branch protection not enabled on development/release branches CI-Tests 🟢 7 21 out of 30 merged PRs checked by a CI test -- score normalized to 7 Contributors 🟢 10 project has 8 contributing companies or organizations
npm/multer	2.2.0	🟢 7.4	Details Check Score Reason Code-Review 🟢 7 Found 15/21 approved changesets -- score normalized to 7 Binary-Artifacts 🟢 10 no binaries found in the repo Dependency-Update-Tool 🟢 10 update tool detected Maintained 🟢 5 7 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 5 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Packaging ⚠️ -1 packaging workflow not detected Pinned-Dependencies 🟢 6 dependency not pinned by hash detected -- score normalized to 6 Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege Vulnerabilities 🟢 10 0 existing vulnerabilities detected License 🟢 10 license file detected CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Signed-Releases ⚠️ -1 no releases found SAST 🟢 8 SAST tool detected but not run on all commits Fuzzing ⚠️ 0 project is not fuzzed Branch-Protection ⚠️ 0 branch protection not enabled on development/release branches Security-Policy 🟢 10 security policy file detected CI-Tests 🟢 9 22 out of 23 merged PRs checked by a CI test -- score normalized to 9 Contributors 🟢 10 project has 67 contributing companies or organizations
npm/path-to-regexp	8.4.2	🟢 6.9	Details Check Score Reason Binary-Artifacts 🟢 10 no binaries found in the repo Branch-Protection ⚠️ 1 branch protection is not maximal on development and all release branches CI-Tests 🟢 10 26 out of 26 merged PRs checked by a CI test -- score normalized to 10 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Code-Review 🟢 5 found 12 unreviewed changesets out of 29 -- score normalized to 5 Contributors 🟢 10 25 different organizations found -- score normalized to 10 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Dependency-Update-Tool 🟢 10 update tool detected Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Maintained ⚠️ 1 1 commit(s) out of 30 and 1 issue activity out of 30 found in the last 90 days -- score normalized to 1 Packaging ⚠️ -1 no published package detected Pinned-Dependencies 🟢 3 dependency not pinned by hash detected -- score normalized to 3 SAST 🟢 10 SAST tool is run on all commits Security-Policy 🟢 9 security policy file detected Signed-Releases ⚠️ -1 no releases found Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege Vulnerabilities 🟢 10 no vulnerabilities detected

Scanned Files

• test-content/nest-project/package-lock.json

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​nestjs/​platform-express@​11.1.11 ⏵ 11.1.28	+1			+2

View full report