Skip to content

Update dependency @nestjs/common [SECURITY]#521

Closed
renovate[bot] wants to merge 634 commits into
masterfrom
renovate/npm-nestjs-common-vulnerability
Closed

Update dependency @nestjs/common [SECURITY]#521
renovate[bot] wants to merge 634 commits into
masterfrom
renovate/npm-nestjs-common-vulnerability

Conversation

@renovate

@renovate renovate Bot commented Apr 11, 2025 •
edited
Loading

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
@nestjs/common (source) 9.4.3 → 10.4.16 age confidence
@nestjs/common (source) ^9.0.0 → ^9.0.0 || ^11.0.0 age confidence

nest allows a remote attacker to execute arbitrary code via the Content-Type header

CVE-2024-29409 / GHSA-cj7v-w2c7-cp7c

More information

Details

File Upload vulnerability in nestjs nest prior to v.11.0.16 allows a remote attacker to execute arbitrary code via the Content-Type header.

Severity

  • CVSS Score: 5.5 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

nestjs/nest (@​nestjs/common)

v10.4.16

Compare Source

What's Changed

Full Changelog: nestjs/nest@v10.4.15...v10.4.16

v10.4.15

Compare Source

v10.4.15 (2024-12-09)

Dependencies

v10.4.14

Compare Source

v10.4.13

Compare Source

v10.4.13 (2024-12-03)

Bug fixes
Dependencies
Committers: 3

v10.4.12

Compare Source

v10.4.12 (2024-11-29)

Bug fixes
Dependencies
Committers: 1

v10.4.11

Compare Source

v10.4.10

Compare Source

v10.4.10 (2024-11-27)

Bug fixes
  • platform-socket.io, websockets
Dependencies
Committers: 1

v10.4.9

Compare Source

v10.4.9 (2024-11-25)

Bug fixes
Enhancements
Dependencies
Committers: 7

v10.4.8

Compare Source

v10.4.8 (2024-11-15)

Bug fixes
Enhancements
Committers: 3

v10.4.7

Compare Source

v10.4.6

Compare Source

v10.4.5

Compare Source

v10.4.5 (2024-10-16)

Dependencies
Committers: 5

v10.4.4

Compare Source

v10.4.3

Compare Source

v10.4.2

Compare Source

v10.4.2 (2024-09-16)

Dependencies
Committers: 3

v10.4.1

Compare Source

v10.4.0

Compare Source

v10.3.10

Compare Source

v10.3.10 (2024-07-01)

Bug fixes
Enhancements
  • platform-fastify
Dependencies
Committers: 4

v10.3.9

Compare Source

v10.3.9 (2024-06-03)

Bug fixes
Enhancements
Docs
Dependencies

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

Neo Technology Build Agent and others added 30 commits October 22, 2020 09:38
Merge branch 'release'
a9fd803
Publish
a27d760 
 - @relate/electron@1.0.2-alpha.16
 - @relate/web@1.0.2-alpha.16
Merge branch 'release'
2d5fd6b
@huboneo
Feature public extensions (#218)
c0c5f6a 
* now using public NPM registry

* added extension verification with code-signer

* additional output to ext:list

* refactored extension discovery to use cascading defaults from package.json if not in manifest

* Allow installing tarballs from URL
- bugfix broken code signature for static packages
- remove cache entry when installing from file or URL

* fix broken TestExtensions

* changes from review

* address case where version as path is passed but no name

* fix flaky windows tests
@nglgzz
Fix package locks on publish (#222)
8e816a1 
* Sync package locks on publish

* Fix package locks

* Fix npm audit issues
@huboneo
Feature remote STATIC extensions (#223)
a5b6ae7 
* Updated relate client parameters and added support for remote STATIC apps

* fix broken test

* disable concurrent tests again

* changes from review
@nglgzz
Add xvfb script for Docker tests (#224)
6931218 
* Fix setup script hanging on errors

* Add xvfb script for Docker tests
@akollegger
db:exec query handling (#217)
612d4c8 
* fix(cli): db:exec allow nameOrId, append missing semicolon, reduce extra output
* fix(cli): removed extra, conflicting @oclif/errors dependency
* fix(common): input stream to cypher-shell may be a string or a raw buffer
* fix(cli): create test project, populate with test cypher for db:exec testing
* fix(common): all dbs.local operations accept nameOrId
@huboneo
Rfc relate client (#225)
fdb0c7f 
* created relate client RFC

* added link to PR

* update RFC
@nglgzz
Add server status to infoDbmss, make all CLI flags camel case (#227)
2228921 
* Web: add online check and server status to infoDbmss

* CLI: make flag casing consistent across commands

And add onlineCheck flag to dbms:info

* CLI: remove duplicate calls to dbmss.info

* CLI: fix docs links
common/extensions install and web/extensions.e2e tests (#219)
f32d9df
@huboneo
Chore separate access token files (#226)
f5d6442 
* now saving access tokens in separate files

* changes from review

* added dump logs for better debugging

* banned TS type assertions and updated linter
add force flag for overwriting project files (#228)
33b4fda
@huboneo
Update @relate/types readme links
32c513d
@huboneo
Cleaned up backup.local implementation (#230)
88979d3
@huboneo
create separate env dirs when creating new envs (#229)
c24602e 
* create separate env dirs when creating new envs

* fix failing tests

* fix rebase conflict

* fix access token storage path, improved teardown cleanup

* removed yargs from common

* remove yargs and revert to backward compatible dataPath

* refactored modules to be dynamic, removing the need for environment variables to accurately load extensions

* Return of the global config, much better

* systemProvider createEnv and getEnv tests

* pass config to load property in system provider test

Co-authored-by: Hugo Bove <hugo.bove@neotechnology.com>
@nglgzz
Add manifest entity to abstract common logic (#231)
f4912f9 
* Update table fields on environment:list

* Add manifest entity

* Add manifest entity to DBMSs

* Add manifest entity to projects

* Rename model files, make manifest readonly

* Add manifest tests

* Add util to get manifest name

* Fix broken import
@huboneo
Update relate-client.rfc.md
bc21173
@huboneo
Update relate-extensions.rfc.md
5c61537
@nglgzz
Add metadata field to entity manifests (#232)
529df71 
* Types: add Dict.assign

* Add metadata to entity manifest

* CLI: update output to include metadata

* Allow passing multiple keys to Dict.omit

* Update signature of metadata methods
@nglgzz
Update docs and bump code-signer (#233)
a2bb033 
* Update docs

* Bump code signer
add is-symlink check and update project and dbms link logic (#234)
5b9f477
ensure global Relate data path exists before write file (#235)
f9146b3
@nglgzz
Start running tests in separate environments (#237)
870763a 
* Create test util to create environments

* Start running tests in separate environments

* Disallow new expression with TestEnvironment
@nglgzz
Refactor dbmss.link and projects.link (#236)
0b0a2e9 
* Add method to unlink projects

* Make nameOrId argument consistent across project operations

* Fix broken links showing as existing projects

* Refactor dbmss.link and projects.link

* Add more link tests

* Update CLI commands

* Update docs

* Fix broken tests

* Always set encoding when reading or writing JSON
@nglgzz
Add resolvers for getting/setting/removing metadata and tags (#238)
a87e180 
* Copy import folder on DBMS upgrades

* Allow getting, setting, and removing metadata from WebModule

* Add tests
Publish
621ccac 
 - @relate/cli@1.0.2-alpha.16
 - @relate/client@1.0.2-alpha.11
 - @relate/common@1.0.2-alpha.16
 - @relate/electron@1.0.2-alpha.17
 - @relate/types@1.0.2-alpha.11
 - @relate/web@1.0.2-alpha.17
@nglgzz
Add flag for merging fields on manifest update (#241)
c593414
Publish
a50238c 
 - @relate/cli@1.0.2-alpha.17
 - @relate/common@1.0.2-alpha.17
 - @relate/electron@1.0.2-alpha.18
 - @relate/web@1.0.2-alpha.18
@linuslundahl
Install sample projects (#245)
33f4595
@renovate renovate Bot changed the title fix(deps): update dependency @nestjs/common [security] fix(deps): update dependency @nestjs/common to v10 [security] Jul 28, 2025
@renovate renovate Bot force-pushed the renovate/npm-nestjs-common-vulnerability branch from d69c8c7 to ba15370 Compare August 10, 2025 13:49
@renovate renovate Bot changed the title fix(deps): update dependency @nestjs/common to v10 [security] fix(deps): update dependency @nestjs/common [security] Aug 10, 2025
@renovate renovate Bot force-pushed the renovate/npm-nestjs-common-vulnerability branch from ba15370 to 7337d3a Compare August 10, 2025 16:39
@renovate renovate Bot changed the title fix(deps): update dependency @nestjs/common [security] fix(deps): update dependency @nestjs/common to v10 [security] Aug 10, 2025
@renovate renovate Bot force-pushed the renovate/npm-nestjs-common-vulnerability branch from 7337d3a to 028b7bb Compare August 13, 2025 17:30
@renovate renovate Bot changed the title fix(deps): update dependency @nestjs/common to v10 [security] fix(deps): update dependency @nestjs/common [security] Aug 13, 2025
@renovate renovate Bot force-pushed the renovate/npm-nestjs-common-vulnerability branch from 028b7bb to 3474232 Compare August 13, 2025 22:30
@renovate renovate Bot changed the title fix(deps): update dependency @nestjs/common [security] fix(deps): update dependency @nestjs/common to v10 [security] Aug 13, 2025
@renovate renovate Bot force-pushed the renovate/npm-nestjs-common-vulnerability branch from 3474232 to 22485ec Compare August 19, 2025 13:03
@renovate renovate Bot changed the title fix(deps): update dependency @nestjs/common to v10 [security] fix(deps): update dependency @nestjs/common [security] Aug 19, 2025
@renovate renovate Bot force-pushed the renovate/npm-nestjs-common-vulnerability branch from 22485ec to d5df4a2 Compare August 19, 2025 21:35
@renovate renovate Bot changed the title fix(deps): update dependency @nestjs/common [security] fix(deps): update dependency @nestjs/common to v10 [security] Aug 19, 2025
@renovate renovate Bot force-pushed the renovate/npm-nestjs-common-vulnerability branch from d5df4a2 to 209b04b Compare August 31, 2025 10:25
@renovate renovate Bot changed the title fix(deps): update dependency @nestjs/common to v10 [security] fix(deps): update dependency @nestjs/common [security] Aug 31, 2025
@renovate renovate Bot force-pushed the renovate/npm-nestjs-common-vulnerability branch from 209b04b to 34a1601 Compare August 31, 2025 14:43
@renovate renovate Bot changed the title fix(deps): update dependency @nestjs/common [security] fix(deps): update dependency @nestjs/common to v10 [security] Aug 31, 2025
@renovate renovate Bot force-pushed the renovate/npm-nestjs-common-vulnerability branch from 34a1601 to 650df97 Compare September 25, 2025 16:31
@renovate renovate Bot changed the title fix(deps): update dependency @nestjs/common to v10 [security] fix(deps): update dependency @nestjs/common [security] Sep 25, 2025
@renovate renovate Bot force-pushed the renovate/npm-nestjs-common-vulnerability branch from 650df97 to a88624b Compare September 25, 2025 22:57
@renovate renovate Bot changed the title fix(deps): update dependency @nestjs/common [security] fix(deps): update dependency @nestjs/common to v10 [security] Sep 25, 2025
@renovate renovate Bot force-pushed the renovate/npm-nestjs-common-vulnerability branch from a88624b to 20eb45f Compare October 9, 2025 10:55
@renovate renovate Bot changed the title fix(deps): update dependency @nestjs/common to v10 [security] fix(deps): update dependency @nestjs/common [security] Oct 9, 2025
@renovate renovate Bot changed the title fix(deps): update dependency @nestjs/common [security] fix(deps): update dependency @nestjs/common to v10 [security] Oct 9, 2025
@renovate renovate Bot force-pushed the renovate/npm-nestjs-common-vulnerability branch from 20eb45f to 9b16fa1 Compare October 9, 2025 15:30
@renovate renovate Bot force-pushed the renovate/npm-nestjs-common-vulnerability branch from 9b16fa1 to 2ebdc35 Compare October 21, 2025 15:44
@renovate renovate Bot changed the title fix(deps): update dependency @nestjs/common to v10 [security] fix(deps): update dependency @nestjs/common [security] Oct 21, 2025
@renovate renovate Bot force-pushed the renovate/npm-nestjs-common-vulnerability branch from 2ebdc35 to bdcd59d Compare October 22, 2025 02:40
@renovate renovate Bot changed the title fix(deps): update dependency @nestjs/common [security] fix(deps): update dependency @nestjs/common to v10 [security] Oct 22, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

6 participants

@linuslundahl @huboneo @nglgzz @akollegger @emmaagh @team-devtools-bot