ttipo
750cd6362a
@nestjs/platform-express@11 이 multer 를 2.2.0 으로 정확 고정하는데, 이 버전에는 깊게 중첩된 필드명으로 자원을 소모시키는 DoS 취약점(high)이 있다. 상위 패키지가 버전을 박아두어 npm audit fix 로는 해결되지 않았다. platform-express@12 가 쓰는 multer 버전을 확인하니 2.4.0 이었다. 즉 v12 로 올려서 얻는 결과가 multer 상향이므로, overrides 로 하위 패키지만 올려 Nest 생태계(v11) 업그레이드 없이 동일한 결과를 얻는다. - npm audit: 10건 → 0건 - 같은 메이저(2.x) 안에서의 상향이라 API 호환 위험이 낮고, lint·단위 31개·e2e 7개·빌드·런타임 기동·Docker 빌드까지 확인했다. - 이 패턴(전이 의존성 취약점을 overrides 로 끊기)과 주의사항을 security.md 에 규칙으로 정리. platform-express 를 v12 로 올릴 때 override 를 제거해야 한다는 조건도 함께 기록. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
A progressive Node.js framework for building efficient and scalable server-side applications.
Description
Nest framework TypeScript starter repository.
Project setup
$ npm install
Compile and run the project
# development
$ npm run start
# watch mode
$ npm run start:dev
# production mode
$ npm run start:prod
Run tests
# unit tests
$ npm run test
# e2e tests
$ npm run test:e2e
# test coverage
$ npm run test:cov
Deployment
When you're ready to deploy your NestJS application to production, there are some key steps you can take to ensure it runs as efficiently as possible. Check out the deployment documentation for more information.
If you are looking for a cloud-based platform to deploy your NestJS application, check out Mau, our official platform for deploying NestJS applications on AWS. Mau makes deployment straightforward and fast, requiring just a few simple steps:
$ npm install -g @nestjs/mau
$ mau deploy
With Mau, you can deploy your application in just a few clicks, allowing you to focus on building features rather than managing infrastructure.
Resources
Check out a few resources that may come in handy when working with NestJS:
- Visit the NestJS Documentation to learn more about the framework.
- For questions and support, please visit our Discord channel.
- To dive deeper and get more hands-on experience, check out our official video courses.
- Deploy your application to AWS with the help of NestJS Mau in just a few clicks.
- Visualize your application graph and interact with the NestJS application in real-time using NestJS Devtools.
- Need help with your project (part-time to full-time)? Check out our official enterprise support.
- To stay in the loop and get updates, follow us on X and LinkedIn.
- Looking for a job, or have a job to offer? Check out our official Jobs board.
Support
Nest is an MIT-licensed open source project. It can grow thanks to the sponsors and support by the amazing backers. If you'd like to join them, please read more here.
Stay in touch
- Author - Kamil Myśliwiec
- Website - https://nestjs.com
- Twitter - @nestframework
License
Nest is MIT licensed.