nestjs/nest
A progressive Node.js framework for building efficient, scalable, and enterprise-grade server-side applications with TypeScript/JavaScript 🚀
How nest is put together
This is the NestJS monorepo — a progressive Node.js server-side application framework written in TypeScript and organized as a Lerna/npm-workspaces monorepo under packages/*. The core provides a dependency-injection container, module system, HTTP router, middleware pipeline, and lifecycle hooks, with platform adapters (Express, Fastify), transport layers (WebSockets via socket.io/ws, microservices over gRPC/Kafka/NATS/MQTT/RabbitMQ/Redis), and a testing harness. Request data flows from a platform HTTP adapter through guards, interceptors, pipes, and exception filters (all registered globally via ApplicationConfig) to controller route handlers resolved by the RoutesResolver. It is a library/framework, not a deployed service; integration/ holds sample apps used for testing.
Languages
Frameworks
Datastores
Infrastructure
Major components
@nestjs/common
Shared decorators, pipes, exceptions, interfaces, and services consumed by all other packages.
@nestjs/core
DI container/injector, module scanner, HTTP router, middleware, and application bootstrap/lifecycle.
@nestjs/microservices
Client/server transport layer for gRPC, Kafka, NATS, MQTT, RabbitMQ, and Redis message-based communication.
@nestjs/websockets
Gateway abstraction and socket module wiring for real-time WebSocket communication.
@nestjs/platform-express
Express-based HTTP adapter implementation for the core framework.
@nestjs/platform-fastify
Fastify-based HTTP adapter implementation as an Express alternative.
@nestjs/platform-socket.io / platform-ws
Concrete WebSocket adapters backed by socket.io and the ws library.
@nestjs/testing
Testing module builder and injector for constructing and overriding modules in unit/integration tests.
A light week of framework version bumps paired with several targeted bug fixes to request-scoped providers and middleware.
5 weeksWeek of 2026-08-24
Week of 2026-08-24latest
A light week of framework version bumps paired with several targeted bug fixes to request-scoped providers and middleware.
Week of 2026-08-17
A heavy maintenance week dominated by dozens of dependency updates plus a small networking-types improvement.
Week of 2026-08-10
A large week combining several security-driven dependency patches with a reply-handling fix and documentation cleanup.
Week of 2026-08-03
A productive week delivering real correctness fixes to module loading, routing, and body parsing alongside ongoing dependency upkeep.
Week of 2026-07-27
A steady week fixing edge cases in startup barriers, validation, and microservices while adding tests and reducing risky patterns.
Over the past five weeks the NestJS framework has mostly been kept healthy and up-to-date, with the bulk of activity being routine dependency upgrades and security patches rather than new capabilities. Alongside that steady maintenance, engineers fixed several real bugs in how the framework handles request-scoped ('durable') providers, middleware, routing, and message-processing. The most recent weeks delivered targeted correctness fixes and small quality improvements on top of a well-maintained, stable codebase.
Week by week
2026-08-24A light week of framework version bumps paired with several targeted bug fixes to request-scoped providers and middleware.latest5 changes
Fix
Fixed circular request-scoped provider issue
Resolved a bug where certain interdependent request-scoped ('durable') services could fail to wire up correctly.
Fix
Hardened middleware handling
Preserved middleware function signatures and made instance decoration more robust.
Fix
Corrected middleware instrumentation
Fixed a reported problem with how middleware was being instrumented internally.
Chore
Upgraded framework packages to v11.2.3
Rolled the internal Nest packages forward through versions 11.2.2 and 11.2.3.
Chore
Refreshed developer tooling and dependencies
Updated linting tools and the eventsource library to their latest versions.
2026-08-17A heavy maintenance week dominated by dozens of dependency updates plus a small networking-types improvement.5 changes
Chore
Large batch of dependency updates
Merged many routine upgrades across testing, database, and web-server libraries to stay current.
Fix
Improved socket platform types
Merged a contributor change refining type definitions for the WebSocket adapter.
Chore
Upgraded the test runner
Moved the Vitest testing toolchain to a newer major version.
Chore
Refreshed security-scanning tooling
Updated the CodeQL code-analysis action used in automated checks.
Docs
Documentation sample path fix
Merged a contributor correction to a sample's scope path in the docs.
2026-08-10A large week combining several security-driven dependency patches with a reply-handling fix and documentation cleanup.5 changes
Fix
Fixed handling of falsy HTTP status codes
Ensured status codes like 0 are applied correctly when sending responses on both Express and Fastify.
Chore
Applied multiple security patches
Updated Vite, the core package, and valibot specifically to close known security advisories.
Chore
Upgraded TypeScript and build tooling
Moved TypeScript to v6 and refreshed bundling and formatting tools.
Docs
Removed a dead documentation link
Merged a contributor fix deleting a broken developer-guide link from the contributing guide.
Chore
Broad routine dependency refresh
Merged many non-security library updates across samples and the main packages.
2026-08-03A productive week delivering real correctness fixes to module loading, routing, and body parsing alongside ongoing dependency upkeep.6 changes
Feature
More precise body-parser configuration
Body parser options are now narrowed to the specific parser selected, giving developers clearer control.
Fix
Fixed lazy-loaded module provider sharing
Corrected how existing shared services are reused when modules are loaded on demand.
Fix
Fixed wildcard route conversion
Handled adjacent wildcard segments correctly when converting legacy-style routes.
Fix
Fixed file-type matching with special characters
String file-type checks now correctly handle names containing regex special characters.
Fix
Improved microservices shutdown and errors
Ensured processing-end hooks run and mapped a missing file-upload field error correctly.
Refactor
Code cleanup across the codebase
Replaced unsafe non-null assertions with safe defaults and tidied type formatting.
2026-07-27A steady week fixing edge cases in startup barriers, validation, and microservices while adding tests and reducing risky patterns.6 changes
Fix
Fixed startup barrier with zero targets
The framework now resolves immediately instead of hanging when a barrier has a target count of zero.
Fix
Cleaned up validation pipe options
Excluded internal pipe options from being passed through as validator options.
Fix
Fixed gRPC client cleanup on shutdown
Properly cleared the gRPC client when a graceful shutdown attempt fails.
Refactor
Removed risky async patterns
Eliminated an async promise-executor anti-pattern to make the code safer and clearer.
Chore
Added tests for core module handling
Added unit tests for the module reference and coverage for a reported common-package issue.
Chore
Dependency and security updates
Applied a security update to a static-file library and refreshed build and analysis tooling.
Dependencies and code review
Dependency advisories
Security Watch
No known advisories across 1489 scanned dependencies.
No known advisories in the scanned dependencies.
Code review
No concrete code-level issues confirmed.
Get this report every week for your repos.
GitZoid learns each repo, reports what changed, and flags what needs attention. One flat price for the whole team.
$19 a month, flat · First 10 outputs free · No card required