[dependabot]

Bumps the backend group with 9 updates in the /redisinsight/api directory:

Package	From	To
@nestjs/common	11.2.5	11.2.8
@nestjs/core	11.2.5	11.2.8
@nestjs/platform-express	11.2.5	11.2.8
@nestjs/platform-socket.io	11.2.5	11.2.8
@nestjs/swagger	11.4.7	11.4.8
@nestjs/websockets	11.2.5	11.2.8
socket.io	4.8.3	4.8.4
socket.io-client	4.8.3	4.8.4
@nestjs/testing	11.2.5	11.2.8

Updates @nestjs/common from 11.2.5 to 11.2.8

Release notes

Sourced from @​nestjs/common's releases.

v11.2.8

What's changed

• @nestjs/common
  • fix(common): reject non-numeric items in ParseArrayPipe with items Number — backport of #17876
  • fix(common): reject arrays nested in ParseArrayPipe items — backport of #18073
  • fix(common): skip array holes when stripping prototype keys
  • fix(common): copy array and object defaults in DefaultValuePipe
  • fix(common): cut json log records short past a million characters
  • fix(common): strip a falsy constructor key from request data
  • fix(common): validate parsed array items one at a time
  • fix(common): stop copying nested validation errors for each level
  • fix(common): reject arrays and primitives for validated classes
  • fix(common): limit the length of validation error messages by default
  • fix(common): stop exposing the validated object on validation errors
  • fix(common): match a file type string up to the end of a name
  • fix(common): handle StreamableFile errors raised before the reply
  • fix(common): keep StreamableFile error messages out of responses
  • fix(common): abort the response when a streamable file fails midway — backport of #18220
• @nestjs/core
  • fix(core,express,fastify): match excluded routes like the router does
  • fix(core): match excluded routes exactly when the router is unknown
  • fix(core): answer host mismatches on fastify with 404
  • fix(core): never exclude request targets with "#" or in absolute form
  • fix(core): mount unversioned middleware paths under the default version
  • fix(core): map controller middleware under every module declaring it
  • fix(core): mount transient-scoped middleware instead of skipping it — on v11 this also mounts the middleware listed after a transient one, which was skipped as well
  • fix(core): drop an overlapped middleware route only when it is covered
  • fix(core): mount wildcard middleware on every path when "/" is excluded
  • fix(core): mount middleware paths on routes excluded from the prefix
  • fix(core): stop wildcard exclusions from covering their parent route
  • fix(core): run middleware on a controller root excluded by a wildcard
  • fix(core,common): exclude a version only for requests that ask for it
  • fix(core,microservices,websockets): ignore inherited keys of non-objects
  • fix(core): stop the Observable producer when the client disconnects — backport of #17826
  • fix(core): end sse responses to head requests once headers are sent
  • fix(core): do not send the message of an unexposed http error
  • fix(core): destroy a StreamableFile dropped by a timed-out handler
  • fix(core): destroy a StreamableFile that is not sent
  • fix(core,express,fastify): remove uploads of requests a pipe rejected
  • fix(core): hand sse header errors to the exception filters
  • fix(core): drop sse clients that stop reading their events
  • fix(core): hide internal error messages from sse error events
  • fix(core): make the sse pending data limit configurable
  • fix(core): apply the expose flag of http errors to sse error events
  • fix(core,microservices): run transient global enhancers on controllers — backport of #17993
  • fix(core): stop silently dropping request-scoped global enhancers — backport of #18066; a global enhancer whose dependency tree is request-scoped is no longer silently skipped
  • fix(core): fail at startup for request-scoped class global enhancers — backport of #18104; such an enhancer (e.g. APP_GUARD with useClass) now fails at startup instead of running without its dependencies
  • fix(core): read class-level enhancers from the registered class
  • fix(core): apply the enhancers of class providers under any token

... (truncated)

Commits

• 8e3a557 chore(release): publish v11.2.8 release
• 2246181 fix(common): abort the response when a streamable file fails midway (#18220)
• b9cc362 fix(core): make the sse pending data limit configurable
• da962a3 fix(common): keep StreamableFile error messages out of responses
• 988ab06 fix(common): handle StreamableFile errors raised before the reply
• f9a02e4 fix(common): match a file type string up to the end of a name
• a0ee2e4 fix(common): stop exposing the validated object on validation errors
• ba1ae3d fix(common): limit the length of validation error messages by default
• b3afc3e fix(common): reject arrays and primitives for validated classes
• 90db510 fix(common): stop copying nested validation errors for each level
• Additional commits viewable in compare view

Updates @nestjs/core from 11.2.5 to 11.2.8

Release notes

Sourced from @​nestjs/core's releases.

v11.2.8

What's changed

• @nestjs/common
  • fix(common): reject non-numeric items in ParseArrayPipe with items Number — backport of #17876
  • fix(common): reject arrays nested in ParseArrayPipe items — backport of #18073
  • fix(common): skip array holes when stripping prototype keys
  • fix(common): copy array and object defaults in DefaultValuePipe
  • fix(common): cut json log records short past a million characters
  • fix(common): strip a falsy constructor key from request data
  • fix(common): validate parsed array items one at a time
  • fix(common): stop copying nested validation errors for each level
  • fix(common): reject arrays and primitives for validated classes
  • fix(common): limit the length of validation error messages by default
  • fix(common): stop exposing the validated object on validation errors
  • fix(common): match a file type string up to the end of a name
  • fix(common): handle StreamableFile errors raised before the reply
  • fix(common): keep StreamableFile error messages out of responses
  • fix(common): abort the response when a streamable file fails midway — backport of #18220
• @nestjs/core
  • fix(core,express,fastify): match excluded routes like the router does
  • fix(core): match excluded routes exactly when the router is unknown
  • fix(core): answer host mismatches on fastify with 404
  • fix(core): never exclude request targets with "#" or in absolute form
  • fix(core): mount unversioned middleware paths under the default version
  • fix(core): map controller middleware under every module declaring it
  • fix(core): mount transient-scoped middleware instead of skipping it — on v11 this also mounts the middleware listed after a transient one, which was skipped as well
  • fix(core): drop an overlapped middleware route only when it is covered
  • fix(core): mount wildcard middleware on every path when "/" is excluded
  • fix(core): mount middleware paths on routes excluded from the prefix
  • fix(core): stop wildcard exclusions from covering their parent route
  • fix(core): run middleware on a controller root excluded by a wildcard
  • fix(core,common): exclude a version only for requests that ask for it
  • fix(core,microservices,websockets): ignore inherited keys of non-objects
  • fix(core): stop the Observable producer when the client disconnects — backport of #17826
  • fix(core): end sse responses to head requests once headers are sent
  • fix(core): do not send the message of an unexposed http error
  • fix(core): destroy a StreamableFile dropped by a timed-out handler
  • fix(core): destroy a StreamableFile that is not sent
  • fix(core,express,fastify): remove uploads of requests a pipe rejected
  • fix(core): hand sse header errors to the exception filters
  • fix(core): drop sse clients that stop reading their events
  • fix(core): hide internal error messages from sse error events
  • fix(core): make the sse pending data limit configurable
  • fix(core): apply the expose flag of http errors to sse error events
  • fix(core,microservices): run transient global enhancers on controllers — backport of #17993
  • fix(core): stop silently dropping request-scoped global enhancers — backport of #18066; a global enhancer whose dependency tree is request-scoped is no longer silently skipped
  • fix(core): fail at startup for request-scoped class global enhancers — backport of #18104; such an enhancer (e.g. APP_GUARD with useClass) now fails at startup instead of running without its dependencies
  • fix(core): read class-level enhancers from the registered class
  • fix(core): apply the enhancers of class providers under any token

... (truncated)

Commits

• 8e3a557 chore(release): publish v11.2.8 release
• f53b8f2 fix(core): run interceptor, pipe and filter classes without a name
• 502874d fix(core): subscribe to guard observables from other copies of rxjs
• 2e8f8c6 fix(core): run guards bound as classes without a name
• 12ffbad fix(core,websockets): run transient enhancers bound to static gateways
• 5466771 fix(core): run transient global enhancers on static entry providers
• 47ec4ab fix(core): fail at startup when a global enhancer is not instantiated
• 3aef3a3 fix(core): run enhancers that are request-scoped through dependencies
• 9bf44a0 fix(core): apply the enhancers of class providers under any token
• 30d6629 fix(core): read class-level enhancers from the registered class
• Additional commits viewable in compare view

Updates @nestjs/platform-express from 11.2.5 to 11.2.8

Release notes

Sourced from @​nestjs/platform-express's releases.

v11.2.8

What's changed

• @nestjs/common
  • fix(common): reject non-numeric items in ParseArrayPipe with items Number — backport of #17876
  • fix(common): reject arrays nested in ParseArrayPipe items — backport of #18073
  • fix(common): skip array holes when stripping prototype keys
  • fix(common): copy array and object defaults in DefaultValuePipe
  • fix(common): cut json log records short past a million characters
  • fix(common): strip a falsy constructor key from request data
  • fix(common): validate parsed array items one at a time
  • fix(common): stop copying nested validation errors for each level
  • fix(common): reject arrays and primitives for validated classes
  • fix(common): limit the length of validation error messages by default
  • fix(common): stop exposing the validated object on validation errors
  • fix(common): match a file type string up to the end of a name
  • fix(common): handle StreamableFile errors raised before the reply
  • fix(common): keep StreamableFile error messages out of responses
  • fix(common): abort the response when a streamable file fails midway — backport of #18220
• @nestjs/core
  • fix(core,express,fastify): match excluded routes like the router does
  • fix(core): match excluded routes exactly when the router is unknown
  • fix(core): answer host mismatches on fastify with 404
  • fix(core): never exclude request targets with "#" or in absolute form
  • fix(core): mount unversioned middleware paths under the default version
  • fix(core): map controller middleware under every module declaring it
  • fix(core): mount transient-scoped middleware instead of skipping it — on v11 this also mounts the middleware listed after a transient one, which was skipped as well
  • fix(core): drop an overlapped middleware route only when it is covered
  • fix(core): mount wildcard middleware on every path when "/" is excluded
  • fix(core): mount middleware paths on routes excluded from the prefix
  • fix(core): stop wildcard exclusions from covering their parent route
  • fix(core): run middleware on a controller root excluded by a wildcard
  • fix(core,common): exclude a version only for requests that ask for it
  • fix(core,microservices,websockets): ignore inherited keys of non-objects
  • fix(core): stop the Observable producer when the client disconnects — backport of #17826
  • fix(core): end sse responses to head requests once headers are sent
  • fix(core): do not send the message of an unexposed http error
  • fix(core): destroy a StreamableFile dropped by a timed-out handler
  • fix(core): destroy a StreamableFile that is not sent
  • fix(core,express,fastify): remove uploads of requests a pipe rejected
  • fix(core): hand sse header errors to the exception filters
  • fix(core): drop sse clients that stop reading their events
  • fix(core): hide internal error messages from sse error events
  • fix(core): make the sse pending data limit configurable
  • fix(core): apply the expose flag of http errors to sse error events
  • fix(core,microservices): run transient global enhancers on controllers — backport of #17993
  • fix(core): stop silently dropping request-scoped global enhancers — backport of #18066; a global enhancer whose dependency tree is request-scoped is no longer silently skipped
  • fix(core): fail at startup for request-scoped class global enhancers — backport of #18104; such an enhancer (e.g. APP_GUARD with useClass) now fails at startup instead of running without its dependencies
  • fix(core): read class-level enhancers from the registered class
  • fix(core): apply the enhancers of class providers under any token

... (truncated)

Commits

• 8e3a557 chore(release): publish v11.2.8 release
• e1944e1 fix(express): stop reading a streamable file for a head request
• a69d986 fix(core,express,fastify): remove uploads of requests a pipe rejected
• 8edd9ed fix(express,fastify): handle a StreamableFile that cannot be streamed
• 26003c6 fix(express): send object error bodies with a json content type
• 2a2af0f fix(express): destroy the StreamableFile source on client disconnect (#17973)
• 20ee552 fix(express): map multer array index and invalid field name codes to 400 (#17...
• 6a4e49a fix(express): apply middleware to controller root routes in strict mode
• 9e79a27 fix(core): mount wildcard middleware on every path when "/" is excluded
• 5557ceb fix(express): run wildcard middleware on "/api/" for a named wildcard
• Additional commits viewable in compare view

Updates @nestjs/platform-socket.io from 11.2.5 to 11.2.8

Release notes

Sourced from @​nestjs/platform-socket.io's releases.

v11.2.8

What's changed

• @nestjs/common
  • fix(common): reject non-numeric items in ParseArrayPipe with items Number — backport of #17876
  • fix(common): reject arrays nested in ParseArrayPipe items — backport of #18073
  • fix(common): skip array holes when stripping prototype keys
  • fix(common): copy array and object defaults in DefaultValuePipe
  • fix(common): cut json log records short past a million characters
  • fix(common): strip a falsy constructor key from request data
  • fix(common): validate parsed array items one at a time
  • fix(common): stop copying nested validation errors for each level
  • fix(common): reject arrays and primitives for validated classes
  • fix(common): limit the length of validation error messages by default
  • fix(common): stop exposing the validated object on validation errors
  • fix(common): match a file type string up to the end of a name
  • fix(common): handle StreamableFile errors raised before the reply
  • fix(common): keep StreamableFile error messages out of responses
  • fix(common): abort the response when a streamable file fails midway — backport of #18220
• @nestjs/core
  • fix(core,express,fastify): match excluded routes like the router does
  • fix(core): match excluded routes exactly when the router is unknown
  • fix(core): answer host mismatches on fastify with 404
  • fix(core): never exclude request targets with "#" or in absolute form
  • fix(core): mount unversioned middleware paths under the default version
  • fix(core): map controller middleware under every module declaring it
  • fix(core): mount transient-scoped middleware instead of skipping it — on v11 this also mounts the middleware listed after a transient one, which was skipped as well
  • fix(core): drop an overlapped middleware route only when it is covered
  • fix(core): mount wildcard middleware on every path when "/" is excluded
  • fix(core): mount middleware paths on routes excluded from the prefix
  • fix(core): stop wildcard exclusions from covering their parent route
  • fix(core): run middleware on a controller root excluded by a wildcard
  • fix(core,common): exclude a version only for requests that ask for it
  • fix(core,microservices,websockets): ignore inherited keys of non-objects
  • fix(core): stop the Observable producer when the client disconnects — backport of #17826
  • fix(core): end sse responses to head requests once headers are sent
  • fix(core): do not send the message of an unexposed http error
  • fix(core): destroy a StreamableFile dropped by a timed-out handler
  • fix(core): destroy a StreamableFile that is not sent
  • fix(core,express,fastify): remove uploads of requests a pipe rejected
  • fix(core): hand sse header errors to the exception filters
  • fix(core): drop sse clients that stop reading their events
  • fix(core): hide internal error messages from sse error events
  • fix(core): make the sse pending data limit configurable
  • fix(core): apply the expose flag of http errors to sse error events
  • fix(core,microservices): run transient global enhancers on controllers — backport of #17993
  • fix(core): stop silently dropping request-scoped global enhancers — backport of #18066; a global enhancer whose dependency tree is request-scoped is no longer silently skipped
  • fix(core): fail at startup for request-scoped class global enhancers — backport of #18104; such an enhancer (e.g. APP_GUARD with useClass) now fails at startup instead of running without its dependencies
  • fix(core): read class-level enhancers from the registered class
  • fix(core): apply the enhancers of class providers under any token

... (truncated)

Commits

• 8e3a557 chore(release): publish v11.2.8 release
• da9d7c4 fix(ws): stop reading from a client that does not read its replies
• 6177c9a fix(websockets): bound how many messages of a client are handled at once
• c666d7f v11.2.7
• 8bd644e fix(websockets): keep the message stream alive when a handler throws
• 2618406 fix(websockets): stop unserializable replies from crashing the process
• c07cfb0 v11.2.6
• See full diff in compare view

Updates @nestjs/swagger from 11.4.7 to 11.4.8

Release notes

Sourced from @​nestjs/swagger's releases.

11.4.8

Full Changelog: nestjs/swagger@11.4.7...11.4.8

Commits

• f0922a0 chore(): release v11.4.8
• f767451 fix(deps): update js-yaml to v5.5.0, swagger-ui-dist to v5.34.1 and @​microsof...
• See full diff in compare view

Updates @nestjs/websockets from 11.2.5 to 11.2.8

Release notes

Sourced from @​nestjs/websockets's releases.

v11.2.8

What's changed

• @nestjs/common
  • fix(common): reject non-numeric items in ParseArrayPipe with items Number — backport of #17876
  • fix(common): reject arrays nested in ParseArrayPipe items — backport of #18073
  • fix(common): skip array holes when stripping prototype keys
  • fix(common): copy array and object defaults in DefaultValuePipe
  • fix(common): cut json log records short past a million characters
  • fix(common): strip a falsy constructor key from request data
  • fix(common): validate parsed array items one at a time
  • fix(common): stop copying nested validation errors for each level
  • fix(common): reject arrays and primitives for validated classes
  • fix(common): limit the length of validation error messages by default
  • fix(common): stop exposing the validated object on validation errors
  • fix(common): match a file type string up to the end of a name
  • fix(common): handle StreamableFile errors raised before the reply
  • fix(common): keep StreamableFile error messages out of responses
  • fix(common): abort the response when a streamable file fails midway — backport of #18220
• @nestjs/core
  • fix(core,express,fastify): match excluded routes like the router does
  • fix(core): match excluded routes exactly when the router is unknown
  • fix(core): answer host mismatches on fastify with 404
  • fix(core): never exclude request targets with "#" or in absolute form
  • fix(core): mount unversioned middleware paths under the default version
  • fix(core): map controller middleware under every module declaring it
  • fix(core): mount transient-scoped middleware instead of skipping it — on v11 this also mounts the middleware listed after a transient one, which was skipped as well
  • fix(core): drop an overlapped middleware route only when it is covered
  • fix(core): mount wildcard middleware on every path when "/" is excluded
  • fix(core): mount middleware paths on routes excluded from the prefix
  • fix(core): stop wildcard exclusions from covering their parent route
  • fix(core): run middleware on a controller root excluded by a wildcard
  • fix(core,common): exclude a version only for requests that ask for it
  • fix(core,microservices,websockets): ignore inherited keys of non-objects
  • fix(core): stop the Observable producer when the client disconnects — backport of #17826
  • fix(core): end sse responses to head requests once headers are sent
  • fix(core): do not send the message of an unexposed http error
  • fix(core): destroy a StreamableFile dropped by a timed-out handler
  • fix(core): destroy a StreamableFile that is not sent
  • fix(core,express,fastify): remove uploads of requests a pipe rejected
  • fix(core): hand sse header errors to the exception filters
  • fix(core): drop sse clients that stop reading their events
  • fix(core): hide internal error messages from sse error events
  • fix(core): make the sse pending data limit configurable
  • fix(core): apply the expose flag of http errors to sse error events
  • fix(core,microservices): run transient global enhancers on controllers — backport of #17993
  • fix(core): stop silently dropping request-scoped global enhancers — backport of #18066; a global enhancer whose dependency tree is request-scoped is no longer silently skipped
  • fix(core): fail at startup for request-scoped class global enhancers — backport of #18104; such an enhancer (e.g. APP_GUARD with useClass) now fails at startup instead of running without its dependencies
  • fix(core): read class-level enhancers from the registered class
  • fix(core): apply the enhancers of class providers under any token

... (truncated)

Commits

• 8e3a557 chore(release): publish v11.2.8 release
• 12ffbad fix(core,websockets): run transient enhancers bound to static gateways
• 30d6629 fix(core): read class-level enhancers from the registered class
• 7761f0c fix(websockets): treat an error in a ws exception as unknown
• c9c2c42 fix(ws): drop messages from a client the server is closing
• 334090f fix(websockets): log and reply when the error cause cannot be sent
• 76ca5c6 fix(core,microservices,websockets): ignore inherited keys of non-objects
• c666d7f v11.2.7
• c07cfb0 v11.2.6
• See full diff in compare view

Updates socket.io from 4.8.3 to 4.8.4

Release notes

Sourced from socket.io's releases.

socket.io@4.8.4

Bug Fixes

• cleanup pending acks on timeout to prevent memory leak (37aad11)
• prevent uWebSockets.js from serving missing client files (dfb5ab3)
• reject stateful regexps for dynamic namespaces (59f4f24)
• types: allow emitWithAck() for events with void callbacks (#5453) (8b93a18)
• types: properly import http module (74599a6)

Dependencies

• engine.io@~6.6.0 (no change)
• ws@~8.21.0 (diff)

socket.io-client@4.8.4

Bug Fixes

• types: export ExtendedError for connect_error event (#5548) (c0d5450)
• types: export reserved event interfaces (#5533) (03945df)

Dependencies

• engine.io-client@~6.6.1 (no change)
• ws@~8.21.0 (diff)

Commits

• c239eb5 chore(release): socket.io@4.8.4
• 11a6f56 chore(release): socket.io-client@4.8.4
• 00e4e73 chore(release): engine.io-client@6.6.7
• e387ab1 chore: use @​rollup/plugin-terser instead of rollup-plugin-terser
• 9738333 chore(release): engine.io@6.6.11
• fc9dd90 docs(eio): rework README
• da008a5 fix(eio): refresh ping timeout on incoming packets
• 3df3fed fix(eio-client): restore default transport resolution
• aaf2af3 test: upgrade WebdriverIO to v9
• b5da079 refactor(sio): simplify packet handling switch
• Additional commits viewable in compare view

Updates socket.io-client from 4.8.3 to 4.8.4

Release notes

Sourced from socket.io-client's releases.

socket.io-client@4.8.4

Bug Fixes

• types: export ExtendedError for connect_error event (#5548) (c0d5450)
• types: export reserved event interfaces (#5533) (03945df)

Dependencies

• engine.io-client@~6.6.1 (no change)
• ws@~8.21.0 (diff)

Commits

• 11a6f56 chore(release): socket.io-client@4.8.4
• 00e4e73 chore(release): engine.io-client@6.6.7
• e387ab1 chore: use @​rollup/plugin-terser instead of rollup-plugin-terser
• 9738333 chore(release): engine.io@6.6.11
• fc9dd90 docs(eio): rework README
• da008a5 fix(eio): refresh ping timeout on incoming packets
• 3df3fed fix(eio-client): restore default transport resolution
• aaf2af3 test: upgrade WebdriverIO to v9
• b5da079 refactor(sio): simplify packet handling switch
• 45873ca docs(protocol): clarify namespace comma restriction for built-in parser (#5545)
• Additional commits viewable in compare view

Updates @nestjs/testing from 11.2.5 to 11.2.8

Release notes

Sourced from ...

Description has been truncated

---

[!NOTE]
Medium Risk
Patch upgrades touch the HTTP stack, validation, file uploads (multer), Swagger UI, and realtime WebSocket paths without code changes—worth regression on API routes, uploads, and live features.

Overview
Bumps NestJS backend dependencies in redisinsight/api from 11.2.5 → 11.2.8 (@nestjs/common, core, platform-express, platform-socket.io, websockets, and dev @nestjs/testing), 11.4.7 → 11.4.8 for @nestjs/swagger, and socket.io / socket.io-client to 4.8.4, with matching package-lock.json resolution.

There are no application source changes—only manifest/lockfile updates. The lockfile also picks up related transitive bumps (e.g. multer 2.4.0 under @nestjs/platform-express, @microsoft/tsdoc, swagger-ui-dist, and js-yaml via @nestjs/swagger).

These Nest patch releases are mostly bugfix/security hardening around validation pipes, middleware routing, global enhancers, StreamableFile/SSE behavior, and websocket message handling; Socket.IO 4.8.4 includes ack cleanup, namespace regex fixes, and ws updates.

^{Reviewed by Cursor Bugbot for commit 5f67601. Bugbot is set up for automated code reviews on this repo. Configure here.}

[chatgpt-codex-connector]

Codex Review Summary: ✅ Completed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-09T00:09:50.809161Z	5f67601	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.