Skip to content

build(deps): bump @nestjs/core from 11.1.12 to 11.1.18#42

Open
dependabot[bot] wants to merge 1 commit intodevelopfrom
dependabot/npm_and_yarn/nestjs/core-11.1.18
Open

build(deps): bump @nestjs/core from 11.1.12 to 11.1.18#42
dependabot[bot] wants to merge 1 commit intodevelopfrom
dependabot/npm_and_yarn/nestjs/core-11.1.18

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot bot commented on behalf of github Apr 7, 2026

Bumps @nestjs/core from 11.1.12 to 11.1.18.

Release notes

Sourced from @​nestjs/core's releases.

v11.1.18 (2026-04-03)

Bug fixes

Dependencies

Committers: 6

v11.1.17 (2026-03-16)

Enhancements

Bugs

Dependencies

Committers: 3

... (truncated)

Commits
  • 3c1cc5f chore(release): publish v11.1.18 release
  • 0f962c7 fix(core): sanitize sse message
  • 94aa424 Merge pull request #16679 from nestjs/renovate/path-to-regexp-8.x
  • 368691c fix(core): prevent injector hang when design:paramtypes is missing
  • 25d4fde fix(deps): update dependency path-to-regexp to v8.4.2
  • 5c0b11e fix(deps): update dependency path-to-regexp to v8.4.1
  • f7d4460 Merge pull request #16637 from JakobStaudinger/moduleref-create-transient-sco...
  • d0a9dc9 fix(deps): update dependency path-to-regexp to v8.4.0
  • 4677434 feat(core): export IEntryNestModule type
  • 7493b94 fix(core): dependency injection edge case with moduleref.create
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps [@nestjs/core](https://github.com/nestjs/nest/tree/HEAD/packages/core) from 11.1.12 to 11.1.18.
- [Release notes](https://github.com/nestjs/nest/releases)
- [Commits](https://github.com/nestjs/nest/commits/v11.1.18/packages/core)

---
updated-dependencies:
- dependency-name: "@nestjs/core"
  dependency-version: 11.1.18
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Apr 7, 2026
@cla-assistant
Copy link
Copy Markdown

cla-assistant bot commented Apr 7, 2026

CLA assistant check
Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
You have signed the CLA already but the status is still pending? Let us recheck it.

1 similar comment
@cla-assistant
Copy link
Copy Markdown

cla-assistant bot commented Apr 7, 2026

CLA assistant check
Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
You have signed the CLA already but the status is still pending? Let us recheck it.

@augmentcode
Copy link
Copy Markdown

augmentcode bot commented Apr 7, 2026

🤖 Augment PR Summary

Summary: Bumps @nestjs/core from ^11.1.12 to ^11.1.18 to pick up the latest NestJS core patch fixes.
Notes: This is a dependency-only update (lockfile updated), with no runtime/application code changes in this PR.

🤖 Was this summary useful? React with 👍 or 👎

Copy link
Copy Markdown

@augmentcode augmentcode bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Review completed. No suggestions at this time.

Comment augment review to trigger a new review at any time.

@greptile-apps
Copy link
Copy Markdown

greptile-apps bot commented Apr 7, 2026

Greptile Summary

This Dependabot PR bumps @nestjs/core from 11.1.12 to 11.1.18, pulling in several bug fixes (SSE message sanitization, injector hang prevention, ModuleRef.create DI edge case) and a transitive update of path-to-regexp to 8.4.2.

Confidence Score: 5/5

Safe to merge; patch-level update with low-risk companion version skew

All findings are P2. The version gap between @nestjs/core (11.1.18) and sibling packages (11.1.12) is a best-practice concern, not a breaking compatibility issue at this patch level. The package.json was correctly updated per custom rule d1ffbb9b.

package.json — companion @nestjs/* packages could be bumped to align with @nestjs/core 11.1.18

Important Files Changed

Filename Overview
package.json Bumps @nestjs/core to ^11.1.18; companion @nestjs/* packages remain at ^11.1.12
yarn.lock Lock file correctly updated: @nestjs/core 11.1.12→11.1.18 and path-to-regexp 8.3.0→8.4.2

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[Dependabot PR] --> B[package.json updated]
    B --> C[@nestjs/core ^11.1.12 → ^11.1.18]
    C --> D[yarn.lock updated]
    D --> E[path-to-regexp 8.3.0 → 8.4.2]
    B --> F[@nestjs/common stays at ^11.1.12]
    B --> G[@nestjs/microservices stays at ^11.1.12]
    B --> H[@nestjs/platform-express stays at ^11.1.12]
    B --> I[@nestjs/testing stays at ^11.1.12]
Loading

Comments Outside Diff (1)

  1. package.json, line 68-74 (link)

    P2 Companion NestJS packages not bumped alongside @nestjs/core

    @nestjs/core is now at 11.1.18, but @nestjs/common, @nestjs/microservices, @nestjs/platform-express (and @nestjs/testing in devDependencies) are still resolved to 11.1.12 in the lockfile. NestJS packages are tightly coupled and typically published at the same version; running mismatched patch versions may produce peer-dependency warnings and, in rare cases, subtle runtime differences if internal contracts changed. The recommended practice is to bump all @nestjs/* core packages together.

    Rule Used: When updating dependencies via automated PRs (like... (source)

    Learnt From
    ever-co/ever-traduora#478

Reviews (1): Last reviewed commit: "build(deps): bump @nestjs/core from 11.1..." | Re-trigger Greptile

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants