fix(microservices): introuduce max pattern depth and object complexity

fix(fastify): fastify middleware bypass cve

.circleci/config.yml

@@ -169,8 +169,12 @@ jobs:
     working_directory: ~/nest
     docker:
       - image: cimg/node:<< pipeline.parameters.maintenance-node-version >>
+      - image: redis:8-alpine
+        name: redis
     environment:
       DISABLE_OPENCOLLECTIVE: 'true'
+      REDIS_HOST: redis
+      REDIS_PORT: 6379
     steps:
       - checkout
       - *restore-cache
@@ -179,6 +183,7 @@ jobs:
           name: Build all samples
           command: npm run build:samples
 
+
 workflows:
   build-and-test:
     jobs:
@@ -204,3 +209,4 @@ workflows:
       - samples:
           requires:
             - build
+

.circleci/install-wrk.sh

@@ -1,13 +0,0 @@
-#!/usr/bin/env bash
-set -e
-cd "$(dirname "$0")"
-
-# based on https://medium.com/@felipedutratine/intelligent-benchmark-with-wrk-163986c1587f
-
-cd /tmp/
-sudo apt-get install build-essential libssl-dev git -y
-git clone --depth=1 https://github.com/wg/wrk.git wrk
-cd wrk
-sudo make
-# move the executable to somewhere in your PATH, ex:
-sudo cp wrk /usr/local/bin

.commitlintrc.json

@@ -37,7 +37,8 @@
         "socket.io",
         "ws",
         "testing",
-        "websockets"
+        "websockets",
+        "release"
       ]
     ]
   }

.github/workflows/codeql-analysis.yml

@@ -21,7 +21,7 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v5
+      uses: actions/checkout@v6
       with:
         # We must fetch at least the immediate parents so that if this is
         # a pull request then we can checkout the head.

.gitignore

@@ -34,6 +34,7 @@ yarn-error.log
 /packages/**/.npmignore
 /packages/**/LICENSE
 *.tsbuildinfo
+/.nx/workspace-data
 
 # example
 /quick-start

.prettierignore

@@ -1,3 +1,5 @@
 packages/**/*.d.ts
 packages/**/*.js
 .nyc_output
+
+/.nx/workspace-data

LICENSE

@@ -1,6 +1,6 @@
 (The MIT License)
 
-Copyright (c) 2017-2025 Kamil Mysliwiec <https://kamilmysliwiec.com>
+Copyright (c) 2017-present Kamil Mysliwiec <https://kamilmysliwiec.com>
 
 Permission is hereby granted, free of charge, to any person obtaining
 a copy of this software and associated documentation files (the

Readme.md

@@ -1,5 +1,5 @@
 <p align="center">
-  <a href="https://nestjs.com/" target="blank"><img src="https://nestjs.com/img/logo-small.svg" width="120" alt="Nest Logo" /></a>
+  <a href="https://nestjs.com/" target="_blank"><img src="https://nestjs.com/img/logo-small.svg" width="120" alt="Nest Logo" /></a>
 </p>
 
 [circleci-image]: https://img.shields.io/circleci/build/github/nestjs/nest/master?token=abc123def456
@@ -49,7 +49,7 @@ Please make sure to read the [Issue Reporting Checklist](https://github.com/nest
 
 ## Consulting
 
-With official support, you can get expert help straight from Nest core team. We provide dedicated technical support, migration strategies, advice on best practices (and design decisions), PR reviews, and team augmentation. Read more about [support here](https://enterprise.nestjs.com).
+With official support, you can get expert help straight from the Nest core team. We provide dedicated technical support, migration strategies, advice on best practices (and design decisions), PR reviews, and team augmentation. Read more about [support here](https://enterprise.nestjs.com).
 
 ## Support
 
@@ -63,6 +63,7 @@ Nest is an MIT-licensed open source project. It can grow thanks to the sponsors
 <td><a href="https://microsoft.com/" target="_blank"><img src="https://nestjs.com/img/logos/microsoft-logo.png" width="180" valign="middle" /></a></td>
 <td><a href="https://mojam.co" target="_blank"><img src="https://nestjs.com/img/logos/mojam-logo.png" width="80" valign="middle" /></a></td>
 <td><a href="https://valor-software.com/" target="_blank"><img src="https://docs.nestjs.com/assets/sponsors/valor-software.png" width="170" valign="middle" /></a></td>
+<td><a href="https://serpapi.com/" target="_blank"><img src="https://nestjs.com/img/logos/serpapi-logo.png" width="150" valign="middle" /></a></td>
 </tr>
 </table>
 
@@ -92,6 +93,8 @@ Nest is an MIT-licensed open source project. It can grow thanks to the sponsors
 <td align="center" valign="middle"><a href="https://www.itflashcards.com/" target="_blank"><img src="https://nestjs.com/img/logos/it_flashcards-logo.png" width="170" valign="middle" /></a></td>
 <td align="center" valign="middle"><a href="https://arcjet.com/?ref=nestjs" target="_blank"><img src="https://nestjs.com/img/logos/arcjet-logo.svg" width="170" valign="middle" /></a></td>
 <td align="center" valign="middle"><a href="https://crawljobs.com" target="_blank"><img src="https://nestjs.com/img/logos/crawljobs-logo.svg" width="130" valign="middle" /></a></td>
+</tr><tr>
+<td align="center" valign="middle"><a href="https://pandektes.com" target="_blank"><img src="https://nestjs.com/img/logos/pandektes-logo.png" width="65" valign="middle" /></a></td>
 </tr>
 </table>
 

benchmarks/all_output.txt

@@ -1,88 +0,0 @@
------------------------
-express
------------------------
-Running 10s test @ http://localhost:3000
-1024 connections
-
-┌─────────┬───────┬───────┬───────┬────────┬──────────┬──────────┬────────┐
-│ Stat    │ 2.5%  │ 50%   │ 97.5% │ 99%    │ Avg      │ Stdev    │ Max    │
-├─────────┼───────┼───────┼───────┼────────┼──────────┼──────────┼────────┤
-│ Latency │ 55 ms │ 58 ms │ 91 ms │ 138 ms │ 61.88 ms │ 23.95 ms │ 747 ms │
-└─────────┴───────┴───────┴───────┴────────┴──────────┴──────────┴────────┘
-┌───────────┬─────────┬─────────┬─────────┬─────────┬──────────┬─────────┬─────────┐
-│ Stat      │ 1%      │ 2.5%    │ 50%     │ 97.5%   │ Avg      │ Stdev   │ Min     │
-├───────────┼─────────┼─────────┼─────────┼─────────┼──────────┼─────────┼─────────┤
-│ Req/Sec   │ 8407    │ 8407    │ 17407   │ 17743   │ 16454.41 │ 2716.94 │ 8402    │
-├───────────┼─────────┼─────────┼─────────┼─────────┼──────────┼─────────┼─────────┤
-│ Bytes/Sec │ 1.81 MB │ 1.81 MB │ 3.74 MB │ 3.81 MB │ 3.54 MB  │ 584 kB  │ 1.81 MB │
-└───────────┴─────────┴─────────┴─────────┴─────────┴──────────┴─────────┴─────────┘
-
-Req/Bytes counts sampled once per second.
-
-165k requests in 10.17s, 35.4 MB read
------------------------
-nest (with "@nestjs/platform-express")
------------------------
-Running 10s test @ http://localhost:3000
-1024 connections
-
-┌─────────┬───────┬───────┬───────┬───────┬──────────┬──────────┬────────┐
-│ Stat    │ 2.5%  │ 50%   │ 97.5% │ 99%   │ Avg      │ Stdev    │ Max    │
-├─────────┼───────┼───────┼───────┼───────┼──────────┼──────────┼────────┤
-│ Latency │ 61 ms │ 64 ms │ 71 ms │ 94 ms │ 65.44 ms │ 17.35 ms │ 325 ms │
-└─────────┴───────┴───────┴───────┴───────┴──────────┴──────────┴────────┘
-┌───────────┬─────────┬─────────┬─────────┬─────────┬─────────┬────────┬─────────┐
-│ Stat      │ 1%      │ 2.5%    │ 50%     │ 97.5%   │ Avg     │ Stdev  │ Min     │
-├───────────┼─────────┼─────────┼─────────┼─────────┼─────────┼────────┼─────────┤
-│ Req/Sec   │ 14183   │ 14183   │ 15767   │ 15991   │ 15640   │ 501.13 │ 14182   │
-├───────────┼─────────┼─────────┼─────────┼─────────┼─────────┼────────┼─────────┤
-│ Bytes/Sec │ 3.06 MB │ 3.06 MB │ 3.41 MB │ 3.45 MB │ 3.38 MB │ 108 kB │ 3.06 MB │
-└───────────┴─────────┴─────────┴─────────┴─────────┴─────────┴────────┴─────────┘
-
-Req/Bytes counts sampled once per second.
-
-156k requests in 10.24s, 33.8 MB read
------------------------
-fastify
------------------------
-Running 10s test @ http://localhost:3000
-1024 connections
-
-┌─────────┬───────┬───────┬───────┬───────┬──────────┬──────────┬─────────┐
-│ Stat    │ 2.5%  │ 50%   │ 97.5% │ 99%   │ Avg      │ Stdev    │ Max     │
-├─────────┼───────┼───────┼───────┼───────┼──────────┼──────────┼─────────┤
-│ Latency │ 27 ms │ 30 ms │ 39 ms │ 78 ms │ 31.62 ms │ 26.59 ms │ 1232 ms │
-└─────────┴───────┴───────┴───────┴───────┴──────────┴──────────┴─────────┘
-┌───────────┬─────────┬─────────┬─────────┬─────────┬─────────┬─────────┬─────────┐
-│ Stat      │ 1%      │ 2.5%    │ 50%     │ 97.5%   │ Avg     │ Stdev   │ Min     │
-├───────────┼─────────┼─────────┼─────────┼─────────┼─────────┼─────────┼─────────┤
-│ Req/Sec   │ 19935   │ 19935   │ 33247   │ 34111   │ 32030.4 │ 4103.84 │ 19931   │
-├───────────┼─────────┼─────────┼─────────┼─────────┼─────────┼─────────┼─────────┤
-│ Bytes/Sec │ 3.03 MB │ 3.03 MB │ 5.05 MB │ 5.19 MB │ 4.87 MB │ 624 kB  │ 3.03 MB │
-└───────────┴─────────┴─────────┴─────────┴─────────┴─────────┴─────────┴─────────┘
-
-Req/Bytes counts sampled once per second.
-
-320k requests in 10.18s, 48.7 MB read
------------------------
-nest (with "@nestjs/platform-fastify")
------------------------
-Running 10s test @ http://localhost:3000
-1024 connections
-
-┌─────────┬───────┬───────┬───────┬───────┬──────────┬──────────┬────────┐
-│ Stat    │ 2.5%  │ 50%   │ 97.5% │ 99%   │ Avg      │ Stdev    │ Max    │
-├─────────┼───────┼───────┼───────┼───────┼──────────┼──────────┼────────┤
-│ Latency │ 31 ms │ 33 ms │ 38 ms │ 52 ms │ 34.41 ms │ 11.73 ms │ 245 ms │
-└─────────┴───────┴───────┴───────┴───────┴──────────┴──────────┴────────┘
-┌───────────┬─────────┬─────────┬────────┬─────────┬─────────┬─────────┬─────────┐
-│ Stat      │ 1%      │ 2.5%    │ 50%    │ 97.5%   │ Avg     │ Stdev   │ Min     │
-├───────────┼─────────┼─────────┼────────┼─────────┼─────────┼─────────┼─────────┤
-│ Req/Sec   │ 24911   │ 24911   │ 30031  │ 30335   │ 29470.4 │ 1564.48 │ 24907   │
-├───────────┼─────────┼─────────┼────────┼─────────┼─────────┼─────────┼─────────┤
-│ Bytes/Sec │ 3.81 MB │ 3.81 MB │ 4.6 MB │ 4.64 MB │ 4.51 MB │ 239 kB  │ 3.81 MB │
-└───────────┴─────────┴─────────┴────────┴─────────┴─────────┴─────────┴─────────┘
-
-Req/Bytes counts sampled once per second.
-
-295k requests in 10.17s, 45.1 MB read

benchmarks/express.js

@@ -1,7 +0,0 @@
-'use strict';
-
-const express = require('express');
-const app = express();
-
-app.get('/', async (req, res) => res.send('Hello world'));
-app.listen(3000);

benchmarks/fastify.js

@@ -1,7 +0,0 @@
-'use strict';
-
-const fastify = require('fastify')();
-fastify.get('/', async (req, reply) => reply.send('Hello world'));
-fastify.listen({
-  port: 3000
-});

benchmarks/nest-fastify.js

@@ -1,14 +0,0 @@
-'use strict';
-Object.defineProperty(exports, '__esModule', { value: true });
-const core_1 = require('@nestjs/core');
-const fastify_platform_1 = require('@nestjs/platform-fastify');
-const app_module_1 = require('./nest/app.module');
-core_1.NestFactory.create(
-  app_module_1.AppModule,
-  new fastify_platform_1.FastifyAdapter(),
-  {
-    logger: false,
-    bodyParser: false,
-  },
-).then(app => app.listen(3000));
-//# sourceMappingURL=main.js.map

benchmarks/nest.js

@@ -1,9 +0,0 @@
-'use strict';
-Object.defineProperty(exports, '__esModule', { value: true });
-const core_1 = require('@nestjs/core');
-const app_module_1 = require('./nest/app.module');
-core_1.NestFactory.create(app_module_1.AppModule, {
-  logger: false,
-  bodyParser: false,
-}).then(app => app.listen(3000));
-//# sourceMappingURL=main.js.map

benchmarks/nest/app.controller.d.ts

@@ -1,3 +0,0 @@
-export declare class AppController {
-  root(): string;
-}

benchmarks/nest/app.controller.js

@@ -1,47 +0,0 @@
-'use strict';
-var __decorate =
-  (this && this.__decorate) ||
-  function(decorators, target, key, desc) {
-    var c = arguments.length,
-      r =
-        c < 3
-          ? target
-          : desc === null
-          ? (desc = Object.getOwnPropertyDescriptor(target, key))
-          : desc,
-      d;
-    if (typeof Reflect === 'object' && typeof Reflect.decorate === 'function')
-      r = Reflect.decorate(decorators, target, key, desc);
-    else
-      for (var i = decorators.length - 1; i >= 0; i--)
-        if ((d = decorators[i]))
-          r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-  };
-var __metadata =
-  (this && this.__metadata) ||
-  function(k, v) {
-    if (typeof Reflect === 'object' && typeof Reflect.metadata === 'function')
-      return Reflect.metadata(k, v);
-  };
-Object.defineProperty(exports, '__esModule', { value: true });
-const common_1 = require('@nestjs/common');
-let AppController = class AppController {
-  root() {
-    return 'Hello world!';
-  }
-};
-__decorate(
-  [
-    common_1.Get(),
-    __metadata('design:type', Function),
-    __metadata('design:paramtypes', []),
-    __metadata('design:returntype', String),
-  ],
-  AppController.prototype,
-  'root',
-  null,
-);
-AppController = __decorate([common_1.Controller()], AppController);
-exports.AppController = AppController;
-//# sourceMappingURL=app.controller.js.map

benchmarks/nest/app.controller.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"app.controller.js","sourceRoot":"","sources":["../src/app.controller.ts"],"names":[],"mappings":";;;;;;;;;;;AAAA,2CAAiD;AAGjD,IAAa,aAAa,GAA1B,MAAa,aAAa;IAExB,IAAI;QACF,OAAO,cAAc,CAAA;IACvB,CAAC;CACF,CAAA;AAHC;IADC,YAAG,EAAE;;;;yCAGL;AAJU,aAAa;IADzB,mBAAU,EAAE;GACA,aAAa,CAKzB;AALY,sCAAa"}

benchmarks/nest/app.module.d.ts

@@ -1 +0,0 @@
-export declare class AppModule {}

benchmarks/nest/app.module.js

@@ -1,20 +0,0 @@
-"use strict";
-var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-const common_1 = require("@nestjs/common");
-const app_controller_1 = require("./app.controller");
-let AppModule = class AppModule {
-};
-AppModule = __decorate([
-    common_1.Module({
-        imports: [],
-        controllers: [app_controller_1.AppController],
-    })
-], AppModule);
-exports.AppModule = AppModule;
-//# sourceMappingURL=app.module.js.map

benchmarks/nest/app.module.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"app.module.js","sourceRoot":"","sources":["../src/app.module.ts"],"names":[],"mappings":";;;;;;;;AAAA,2CAAwC;AACxC,qDAAiD;AAMjD,IAAa,SAAS,GAAtB,MAAa,SAAS;CAAG,CAAA;AAAZ,SAAS;IAJrB,eAAM,CAAC;QACN,OAAO,EAAE,EAAE;QACX,WAAW,EAAE,CAAC,8BAAa,CAAC;KAC7B,CAAC;GACW,SAAS,CAAG;AAAZ,8BAAS"}

benchmarks/nest/main.d.ts

@@ -1 +0,0 @@
-export {};

benchmarks/nest/main.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"main.js","sourceRoot":"","sources":["../src/main.ts"],"names":[],"mappings":";;AAAA,uCAA2C;AAC3C,6CAAyC;AAEzC,KAAK,UAAU,SAAS;IACtB,MAAM,GAAG,GAAG,MAAM,kBAAW,CAAC,MAAM,CAAC,sBAAS,CAAC,CAAC;IAChD,MAAM,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;AACzB,CAAC;AACD,SAAS,EAAE,CAAC"}

eslint.config.mjs

@@ -20,7 +20,6 @@ export default tseslint.config(
       ecmaVersion: 5,
       sourceType: 'module',
       parserOptions: {
-        project: ['tsconfig.json', 'tsconfig.spec.json'],
         projectService: true,
         tsconfigRootDir: import.meta.dirname,
       },
@@ -39,18 +38,18 @@ export default tseslint.config(
       '@typescript-eslint/no-require-imports': 'off',
       '@typescript-eslint/no-unused-vars': 'off',
       '@typescript-eslint/no-non-null-asserted-optional-chain': 'warn',
-      "@typescript-eslint/no-misused-promises": [
-        "error",
+      '@typescript-eslint/no-misused-promises': [
+        'error',
         {
-          "checksVoidReturn": false,
-          "checksConditionals": false
-        }
+          checksVoidReturn: false,
+          checksConditionals: false,
+        },
       ],
-      "@typescript-eslint/require-await": "off",
+      '@typescript-eslint/require-await': 'off',
       '@typescript-eslint/prefer-promise-reject-errors': 'off',
       '@typescript-eslint/no-base-to-string': 'off',
       '@typescript-eslint/unbound-method': 'off',
       '@typescript-eslint/only-throw-error': 'off',
     },
   },
-);
+);

integration/docker-compose.yml

@@ -25,7 +25,7 @@ services:
       - "9001:9001"
     restart: always
   mysql:
-    image: mysql:9.5.0
+    image: mysql:9.6.0
     environment:
       MYSQL_ROOT_HOST: '%'
       MYSQL_ROOT_PASSWORD: root
@@ -51,7 +51,7 @@ services:
   zookeeper:
     container_name: test-zookeeper
     hostname: zookeeper
-    image: confluentinc/cp-zookeeper:7.9.4
+    image: confluentinc/cp-zookeeper:7.9.5
     ports:
       - "2181:2181"
     environment:
@@ -60,7 +60,7 @@ services:
   kafka:
     container_name: test-kafka
     hostname: kafka
-    image: confluentinc/cp-kafka:8.1.0
+    image: confluentinc/cp-kafka:8.1.1
     depends_on:
       - zookeeper
     ports:

integration/hello-world/e2e/middleware-fastify.spec.ts

@@ -208,6 +208,15 @@ describe('Middleware (FastifyAdapter)', () => {
         .then(({ payload }) => expect(payload).to.be.eql(INCLUDED_VALUE));
     });
 
+    it(`GET forRoutes(POST /tests/%69ncluded) - ensure middleware is executed correctly with encoded characters`, () => {
+      return app
+        .inject({
+          method: 'POST',
+          url: '/tests/%69ncluded', // 'i' character is encoded
+        })
+        .then(({ payload }) => expect(payload).to.be.eql(INCLUDED_VALUE));
+    });
+
     afterEach(async () => {
       await app.close();
     });
@@ -603,4 +612,158 @@ describe('Middleware (FastifyAdapter)', () => {
       await app.close();
     });
   });
+
+  describe('should respect fastify routing options', () => {
+    const MIDDLEWARE_RETURN_VALUE = 'middleware_return';
+
+    @Controller()
+    class TestController {
+      @Get('abc/def')
+      included() {
+        return 'whatnot';
+      }
+    }
+    @Module({
+      imports: [AppModule],
+      controllers: [TestController],
+    })
+    class TestModule {
+      configure(consumer: MiddlewareConsumer) {
+        consumer
+          .apply((req, res, next) => res.end(MIDDLEWARE_RETURN_VALUE))
+          .forRoutes({ path: 'abc/def', method: RequestMethod.GET });
+      }
+    }
+
+    describe('[ignoreTrailingSlash] attribute', () => {
+      beforeEach(async () => {
+        app = (
+          await Test.createTestingModule({
+            imports: [TestModule],
+          }).compile()
+        ).createNestApplication<NestFastifyApplication>(
+          new FastifyAdapter({
+            ignoreTrailingSlash: true,
+            // routerOptions: {
+            //   ignoreTrailingSlash: true,
+            // },
+          }),
+        );
+
+        await app.init();
+      });
+
+      it(`GET forRoutes(GET /abc/def/)`, () => {
+        return app
+          .inject({
+            method: 'GET',
+            url: '/abc/def/', // trailing slash
+          })
+          .then(({ payload }) =>
+            expect(payload).to.be.eql(MIDDLEWARE_RETURN_VALUE),
+          );
+      });
+
+      afterEach(async () => {
+        await app.close();
+      });
+    });
+
+    describe('[ignoreDuplicateSlashes] attribute', () => {
+      beforeEach(async () => {
+        app = (
+          await Test.createTestingModule({
+            imports: [TestModule],
+          }).compile()
+        ).createNestApplication<NestFastifyApplication>(
+          new FastifyAdapter({
+            routerOptions: {
+              ignoreDuplicateSlashes: true,
+            },
+          }),
+        );
+
+        await app.init();
+      });
+
+      it(`GET forRoutes(GET /abc//def)`, () => {
+        return app
+          .inject({
+            method: 'GET',
+            url: '/abc//def', // duplicate slashes
+          })
+          .then(({ payload }) =>
+            expect(payload).to.be.eql(MIDDLEWARE_RETURN_VALUE),
+          );
+      });
+
+      afterEach(async () => {
+        await app.close();
+      });
+    });
+
+    describe('[caseSensitive] attribute', () => {
+      beforeEach(async () => {
+        app = (
+          await Test.createTestingModule({
+            imports: [TestModule],
+          }).compile()
+        ).createNestApplication<NestFastifyApplication>(
+          new FastifyAdapter({
+            routerOptions: {
+              caseSensitive: true,
+            },
+          }),
+        );
+
+        await app.init();
+      });
+
+      it(`GET forRoutes(GET /ABC/DEF)`, () => {
+        return app
+          .inject({
+            method: 'GET',
+            url: '/ABC/DEF', // different case
+          })
+          .then(({ payload }) =>
+            expect(payload).to.be.eql(MIDDLEWARE_RETURN_VALUE),
+          );
+      });
+
+      afterEach(async () => {
+        await app.close();
+      });
+    });
+
+    describe('[useSemicolonDelimiter] attribute', () => {
+      beforeEach(async () => {
+        app = (
+          await Test.createTestingModule({
+            imports: [TestModule],
+          }).compile()
+        ).createNestApplication<NestFastifyApplication>(
+          new FastifyAdapter({
+            routerOptions: { useSemicolonDelimiter: true } as any,
+          }),
+        );
+
+        await app.init();
+      });
+
+      it(`GET forRoutes(GET /abc/def;foo=bar)`, () => {
+        return app
+          .inject({
+            method: 'GET',
+            url: '/abc/def;foo=bar', // semicolon delimiter
+          })
+          .then(({ payload }) =>
+            expect(payload).to.be.eql(MIDDLEWARE_RETURN_VALUE),
+          );
+      });
+
+      afterEach(async () => {
+        await app.close();
+      });
+    });
+  });
 });

integration/hooks/e2e/enable-shutdown-hook.spec.ts

@@ -51,4 +51,21 @@ describe('enableShutdownHooks', () => {
     expect(result.stdout.toString().trim()).to.be.eq('');
     done();
   }).timeout(10000);
+
+  it('should call the correct hooks with useProcessExit option', done => {
+    const result = spawnSync('ts-node', [
+      join(__dirname, '../src/enable-shutdown-hooks-main.ts'),
+      'SIGHUP',
+      'SIGHUP',
+      'graceful',
+    ]);
+    const calls = result.stdout
+      .toString()
+      .split('\n')
+      .map((call: string) => call.trim());
+    expect(calls[0]).to.equal('beforeApplicationShutdown SIGHUP');
+    expect(calls[1]).to.equal('onApplicationShutdown SIGHUP');
+    expect(result.status).to.equal(0);
+    done();
+  }).timeout(10000);
 });

integration/hooks/src/enable-shutdown-hooks-main.ts

@@ -7,6 +7,7 @@ import {
 import { NestFactory } from '@nestjs/core';
 const SIGNAL = process.argv[2];
 const SIGNAL_TO_LISTEN = process.argv[3];
+const USE_GRACEFUL_EXIT = process.argv[4] === 'graceful';
 
 @Injectable()
 class TestInjectable
@@ -29,10 +30,12 @@ class AppModule {}
 async function bootstrap() {
   const app = await NestFactory.create(AppModule, { logger: false });
 
+  const shutdownOptions = USE_GRACEFUL_EXIT ? { useProcessExit: true } : {};
+
   if (SIGNAL_TO_LISTEN && SIGNAL_TO_LISTEN !== 'NONE') {
-    app.enableShutdownHooks([SIGNAL_TO_LISTEN]);
+    app.enableShutdownHooks([SIGNAL_TO_LISTEN], shutdownOptions);
   } else if (SIGNAL_TO_LISTEN !== 'NONE') {
-    app.enableShutdownHooks();
+    app.enableShutdownHooks([], shutdownOptions);
   }
 
   await app.listen(1800);

integration/injector/e2e/multiple-providers.spec.ts

@@ -24,7 +24,7 @@ describe('Multiple providers under the same token ("each" feature)', () => {
     });
   });
   describe('resolve()', () => {
-    it('should return an array of providers', async () => {
+    it('should return an array of request-scoped providers', async () => {
       const builder = Test.createTestingModule({
         imports: [MultipleProvidersModule],
       });
@@ -43,5 +43,25 @@ describe('Multiple providers under the same token ("each" feature)', () => {
 
       expect(multiProviderInstances).to.be.eql(['A', 'B', 'C']);
     });
+
+    it('should return an array of default-scoped providers', async () => {
+      const builder = Test.createTestingModule({
+        imports: [MultipleProvidersModule],
+      });
+      const testingModule = await builder.compile();
+
+      const multiProviderInstances = await testingModule.resolve<string>(
+        'MULTI_PROVIDER',
+        undefined,
+        {
+          each: true,
+        },
+      );
+
+      // @ts-expect-error: make sure "multiProviderInstances" is string[] not string
+      multiProviderInstances.charAt;
+
+      expect(multiProviderInstances).to.be.eql(['A', 'B', 'C']);
+    });
   });
 });

integration/injector/e2e/request-scope-bubbling.spec.ts

@@ -0,0 +1,48 @@
+import { Injectable, Scope, Module } from '@nestjs/common';
+import { Test, TestingModule } from '@nestjs/testing';
+import { ContextIdFactory, REQUEST } from '@nestjs/core';
+import { expect } from 'chai';
+
+describe('Request Scope Bubbling', () => {
+  // 1. Define the "Poison" (Request Scoped Service)
+  @Injectable({ scope: Scope.REQUEST })
+  class ChildService {
+    // A random ID to verify uniqueness
+    public readonly id = Math.random();
+  }
+
+  // 2. Define the "Victim" (Singleton that depends on Request Scoped)
+  @Injectable()
+  class ParentService {
+    constructor(public readonly child: ChildService) {}
+  }
+
+  @Module({
+    providers: [ChildService, ParentService],
+  })
+  class TestModule {}
+
+  it('should downgrade a Singleton to Request-Scoped if it depends on a Request-Scoped provider', async () => {
+    // 3. Bootstrap the Module (using Test.createTestingModule instead of NestFactory)
+    const moduleRef: TestingModule = await Test.createTestingModule({
+      imports: [TestModule],
+    }).compile();
+
+    // 4. Simulate Request 1
+    const contextId1 = ContextIdFactory.create();
+    const parent1 = await moduleRef.resolve(ParentService, contextId1);
+
+    // 5. Simulate Request 2
+    const contextId2 = ContextIdFactory.create();
+    const parent2 = await moduleRef.resolve(ParentService, contextId2);
+
+    // 6. Assertions (The "Moment of Truth")
+
+    // The Child IDs should be different (Proof of Request Scope)
+    expect(parent1.child.id).to.not.equal(parent2.child.id);
+
+    // The Parent instances should ALSO be different (Proof of Bubbling)
+    // If Parent was a true Singleton, these would be equal.
+    expect(parent1).to.not.equal(parent2);
+  });
+});

integration/inspector/src/core/interceptors/transform.interceptor.ts

@@ -12,9 +12,10 @@ export interface Response<T> {
 }
 
 @Injectable()
-export class TransformInterceptor<T>
-  implements NestInterceptor<T, Response<T>>
-{
+export class TransformInterceptor<T> implements NestInterceptor<
+  T,
+  Response<T>
+> {
   intercept(
     context: ExecutionContext,
     next: CallHandler<T>,

integration/scopes/e2e/transient-scope.spec.ts

@@ -141,6 +141,51 @@ describe('Transient scope', () => {
     });
   });
 
+  describe('when DEFAULT scoped provider has deeply nested TRANSIENT chain', () => {
+    let app: INestApplication;
+
+    @Injectable({ scope: Scope.TRANSIENT })
+    class DeepNestedTransient {
+      public static constructorCalled = false;
+
+      constructor() {
+        DeepNestedTransient.constructorCalled = true;
+      }
+    }
+
+    @Injectable({ scope: Scope.TRANSIENT })
+    class MiddleTransient {
+      constructor(public readonly nested: DeepNestedTransient) {}
+    }
+
+    @Injectable()
+    class RootService {
+      constructor(public readonly middle: MiddleTransient) {}
+    }
+
+    before(async () => {
+      DeepNestedTransient.constructorCalled = false;
+
+      const module = await Test.createTestingModule({
+        providers: [RootService, MiddleTransient, DeepNestedTransient],
+      }).compile();
+
+      app = module.createNestApplication();
+      await app.init();
+    });
+
+    it('should call constructor of deeply nested TRANSIENT provider', () => {
+      const rootService = app.get(RootService);
+
+      expect(DeepNestedTransient.constructorCalled).to.be.true;
+      expect(rootService.middle.nested).to.be.instanceOf(DeepNestedTransient);
+    });
+
+    after(async () => {
+      await app.close();
+    });
+  });
+
   describe('when nested transient providers are used in request scope', () => {
     let server: any;
     let app: INestApplication;

lerna.json

@@ -1,7 +1,5 @@
 {
-  "lerna": "2.4.0",
-  "packages": [
-    "packages/*"
-  ],
-  "version": "11.1.8"
+  "packages": ["packages/*"],
+  "version": "11.1.14",
+  "$schema": "node_modules/lerna/schemas/lerna-schema.json"
 }

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nestjs/core",
-  "version": "11.1.6",
+  "version": "11.1.10",
   "description": "Modern, fast, powerful node.js web framework",
   "homepage": "https://nestjs.com",
   "repository": {
@@ -42,12 +42,12 @@
     "lint:spec": "node --max-old-space-size=4096 ./node_modules/.bin/eslint 'packages/**/**.spec.ts'",
     "lint:ci": "concurrently 'npm run lint:packages' 'npm run lint:spec'",
     "prerelease": "gulp copy-misc",
-    "publish": "npm run prerelease && npm run build:prod && ./node_modules/.bin/lerna publish --force-publish --access public --exact -m \"chore(@nestjs) publish %s release\"",
+    "publish": "npm run prerelease && npm run build:prod && ./node_modules/.bin/lerna publish --force-publish --exact -m \"chore(release): publish %s release\"",
     "prepublishOnly": "npm run changelog | pbcopy",
-    "publish:beta": "npm run prerelease && npm run build:prod && ./node_modules/.bin/lerna publish --npm-tag=beta --access public -m \"chore(@nestjs) publish %s release\"",
-    "publish:next": "npm run prerelease && npm run build:prod && ./node_modules/.bin/lerna publish --npm-tag=next --access public --skip-git -m \"chore(@nestjs) publish %s release\"",
-    "publish:rc": "npm run prerelease && npm run build:prod && ./node_modules/.bin/lerna publish --npm-tag=rc --access public -m \"chore(@nestjs) publish %s release\"",
-    "publish:test": "npm run prerelease && npm run build:prod && ./node_modules/.bin/lerna publish --force-publish --access public --npm-tag=test --skip-git -m \"chore(@nestjs) publish %s release\"",
+    "publish:beta": "npm run prerelease && npm run build:prod && ./node_modules/.bin/lerna publish --npm-tag=beta -m \"chore(release): publish %s release\"",
+    "publish:next": "npm run prerelease && npm run build:prod && ./node_modules/.bin/lerna publish --npm-tag=next --skip-git -m \"chore(release): publish %s release\"",
+    "publish:rc": "npm run prerelease && npm run build:prod && ./node_modules/.bin/lerna publish --npm-tag=rc -m \"chore(release): publish %s release\"",
+    "publish:test": "npm run prerelease && npm run build:prod && ./node_modules/.bin/lerna publish --force-publish --npm-tag=test --skip-git -m \"chore(release): publish %s release\"",
     "prepare": "husky"
   },
   "lint-staged": {
@@ -62,124 +62,114 @@
     "@nuxt/opencollective": "0.4.1",
     "ansis": "4.2.0",
     "class-transformer": "0.5.1",
-    "class-validator": "0.14.2",
-    "cors": "2.8.5",
-    "express": "5.1.0",
-    "fast-json-stringify": "6.1.1",
+    "class-validator": "0.14.3",
+    "cors": "2.8.6",
+    "express": "5.2.1",
+    "fast-json-stringify": "6.3.0",
     "fast-safe-stringify": "2.1.1",
-    "file-type": "21.0.0",
+    "file-type": "21.3.0",
     "iterare": "1.2.1",
     "load-esm": "1.0.3",
     "object-hash": "3.0.0",
     "path-to-regexp": "8.3.0",
     "reflect-metadata": "0.2.2",
     "rxjs": "7.8.2",
-    "socket.io": "4.8.1",
+    "socket.io": "4.8.3",
     "tslib": "2.8.1",
     "uid": "2.0.2",
     "uuid": "13.0.0"
   },
   "devDependencies": {
-    "@apollo/server": "5.0.0",
+    "@apollo/server": "5.4.0",
     "@as-integrations/express5": "1.1.2",
-    "@codechecks/client": "0.1.12",
-    "@commitlint/cli": "20.1.0",
-    "@commitlint/config-angular": "20.0.0",
-    "@eslint/eslintrc": "3.3.1",
-    "@eslint/js": "9.38.0",
-    "@fastify/cors": "11.1.0",
+    "@commitlint/cli": "20.4.1",
+    "@commitlint/config-angular": "20.4.1",
+    "@eslint/eslintrc": "3.3.3",
+    "@eslint/js": "9.39.2",
+    "@fastify/cors": "11.2.0",
     "@fastify/formbody": "8.0.2",
-    "@fastify/middie": "9.0.3",
-    "@fastify/multipart": "9.3.0",
-    "@fastify/static": "8.3.0",
+    "@fastify/middie": "9.1.0",
+    "@fastify/multipart": "9.4.0",
+    "@fastify/static": "9.0.0",
     "@fastify/view": "11.1.1",
-    "@grpc/grpc-js": "1.14.0",
+    "@grpc/grpc-js": "1.14.3",
     "@grpc/proto-loader": "0.8.0",
-    "@nestjs/apollo": "13.2.1",
-    "@nestjs/graphql": "13.2.0",
-    "@nestjs/mongoose": "11.0.3",
+    "@nestjs/apollo": "13.2.4",
+    "@nestjs/graphql": "13.2.4",
+    "@nestjs/mongoose": "11.0.4",
     "@nestjs/typeorm": "11.0.0",
     "@types/amqplib": "0.10.8",
-    "@types/bytes": "3.1.5",
     "@types/chai": "4.3.20",
     "@types/chai-as-promised": "7.1.8",
     "@types/cors": "2.8.19",
     "@types/eslint__js": "8.42.3",
-    "@types/express": "5.0.4",
+    "@types/express": "5.0.6",
     "@types/gulp": "4.0.18",
     "@types/http-errors": "2.0.5",
     "@types/mocha": "10.0.10",
-    "@types/node": "24.9.1",
-    "@types/sinon": "17.0.4",
+    "@types/node": "25.2.3",
+    "@types/sinon": "21.0.0",
     "@types/supertest": "6.0.3",
     "@types/ws": "8.18.1",
+    "@typescript-eslint/eslint-plugin": "8.56.0",
+    "@typescript-eslint/parser": "8.56.0",
     "amqp-connection-manager": "5.0.0",
     "amqplib": "0.10.9",
-    "artillery": "2.0.26",
-    "body-parser": "2.2.0",
-    "bytes": "3.1.2",
-    "cache-manager": "7.2.4",
-    "cache-manager-redis-store": "3.0.1",
+    "body-parser": "2.2.2",
+    "cache-manager": "7.2.8",
     "chai": "4.5.0",
     "chai-as-promised": "7.1.2",
-    "clang-format": "1.8.0",
     "concurrently": "9.2.1",
     "conventional-changelog": "7.1.1",
-    "core-js": "3.46.0",
     "coveralls": "3.1.1",
     "delete-empty": "3.0.0",
-    "engine.io-client": "6.6.3",
-    "eslint": "9.38.0",
+    "eslint": "9.39.2",
     "eslint-config-prettier": "10.1.8",
-    "eslint-plugin-import": "2.32.0",
-    "eslint-plugin-prettier": "5.5.4",
-    "eventsource": "4.0.0",
+    "eslint-plugin-prettier": "5.5.5",
+    "eventsource": "4.1.0",
     "fancy-log": "2.0.0",
-    "fastify": "5.6.1",
-    "globals": "16.4.0",
-    "graphql": "16.11.0",
+    "fastify": "5.7.4",
+    "fastify-plugin": "5.1.0",
+    "find-my-way": "9.4.0",
+    "globals": "17.3.0",
+    "graphql": "16.12.0",
     "graphql-subscriptions": "3.0.0",
-    "graphql-tools": "9.0.20",
     "gulp": "5.0.1",
     "gulp-clang-format": "1.0.27",
     "gulp-clean": "0.4.0",
     "gulp-sourcemaps": "3.0.0",
     "gulp-typescript": "5.0.1",
     "gulp-watch": "5.0.1",
-    "http-errors": "2.0.0",
+    "http-errors": "2.0.1",
     "husky": "9.1.7",
-    "imports-loader": "5.0.0",
-    "ioredis": "5.8.2",
-    "json-loader": "0.5.7",
+    "ioredis": "5.9.3",
     "kafkajs": "2.2.4",
-    "lerna": "2.11.0",
+    "lerna": "9.0.4",
     "lerna-changelog": "2.2.0",
     "light-my-request": "6.6.0",
-    "lint-staged": "16.2.6",
+    "lint-staged": "16.2.7",
     "markdown-table": "2.0.0",
-    "mocha": "11.7.4",
-    "mongoose": "8.19.2",
-    "mqtt": "5.14.1",
+    "mocha": "11.7.5",
+    "mongoose": "9.2.1",
+    "mqtt": "5.15.0",
     "multer": "2.0.2",
-    "mysql2": "3.15.3",
+    "mysql2": "3.17.2",
     "nats": "2.29.3",
-    "nodemon": "3.1.10",
     "nyc": "14.1.1",
-    "prettier": "3.6.2",
-    "redis": "5.9.0",
+    "prettier": "^3.7.4",
+    "redis": "5.11.0",
+    "reusify": "1.1.0",
     "rxjs-compat": "6.6.7",
-    "sinon": "21.0.0",
-    "sinon-chai": "4.0.1",
-    "socket.io-client": "4.8.1",
-    "subscriptions-transport-ws": "0.11.0",
-    "supertest": "7.1.4",
+    "sinon": "21.0.1",
+    "sinon-chai": "3.7.0",
+    "socket.io-client": "4.8.3",
+    "supertest": "7.2.2",
     "ts-morph": "27.0.2",
     "ts-node": "10.9.2",
-    "typeorm": "0.3.27",
+    "typeorm": "0.3.28",
     "typescript": "5.9.3",
-    "typescript-eslint": "8.46.2",
-    "wrk": "1.2.1",
-    "ws": "8.18.3"
+    "typescript-eslint": "8.56.0",
+    "ws": "8.19.0"
   },
   "engines": {
     "node": ">= 20"

packages/common/Readme.md

@@ -1,5 +1,5 @@
 <p align="center">
-  <a href="https://nestjs.com/" target="blank"><img src="https://nestjs.com/img/logo-small.svg" width="120" alt="Nest Logo" /></a>
+  <a href="https://nestjs.com/" target="_blank"><img src="https://nestjs.com/img/logo-small.svg" width="120" alt="Nest Logo" /></a>
 </p>
 
 [circleci-image]: https://img.shields.io/circleci/build/github/nestjs/nest/master?token=abc123def456
@@ -49,7 +49,7 @@ Please make sure to read the [Issue Reporting Checklist](https://github.com/nest
 
 ## Consulting
 
-With official support, you can get expert help straight from Nest core team. We provide dedicated technical support, migration strategies, advice on best practices (and design decisions), PR reviews, and team augmentation. Read more about [support here](https://enterprise.nestjs.com).
+With official support, you can get expert help straight from the Nest core team. We provide dedicated technical support, migration strategies, advice on best practices (and design decisions), PR reviews, and team augmentation. Read more about [support here](https://enterprise.nestjs.com).
 
 ## Support
 
@@ -63,6 +63,7 @@ Nest is an MIT-licensed open source project. It can grow thanks to the sponsors
 <td><a href="https://microsoft.com/" target="_blank"><img src="https://nestjs.com/img/logos/microsoft-logo.png" width="180" valign="middle" /></a></td>
 <td><a href="https://mojam.co" target="_blank"><img src="https://nestjs.com/img/logos/mojam-logo.png" width="80" valign="middle" /></a></td>
 <td><a href="https://valor-software.com/" target="_blank"><img src="https://docs.nestjs.com/assets/sponsors/valor-software.png" width="170" valign="middle" /></a></td>
+<td><a href="https://serpapi.com/" target="_blank"><img src="https://nestjs.com/img/logos/serpapi-logo.png" width="150" valign="middle" /></a></td>
 </tr>
 </table>
 
@@ -92,6 +93,8 @@ Nest is an MIT-licensed open source project. It can grow thanks to the sponsors
 <td align="center" valign="middle"><a href="https://www.itflashcards.com/" target="_blank"><img src="https://nestjs.com/img/logos/it_flashcards-logo.png" width="170" valign="middle" /></a></td>
 <td align="center" valign="middle"><a href="https://arcjet.com/?ref=nestjs" target="_blank"><img src="https://nestjs.com/img/logos/arcjet-logo.svg" width="170" valign="middle" /></a></td>
 <td align="center" valign="middle"><a href="https://crawljobs.com" target="_blank"><img src="https://nestjs.com/img/logos/crawljobs-logo.svg" width="130" valign="middle" /></a></td>
+</tr><tr>
+<td align="center" valign="middle"><a href="https://pandektes.com" target="_blank"><img src="https://nestjs.com/img/logos/pandektes-logo.png" width="65" valign="middle" /></a></td>
 </tr>
 </table>
 

packages/common/decorators/http/sse.decorator.ts

@@ -6,7 +6,12 @@ import { RequestMethod } from '../../enums/request-method.enum';
  *
  * @publicApi
  */
-export function Sse(path?: string): MethodDecorator {
+export function Sse(
+  path?: string,
+  options: { [METHOD_METADATA]?: RequestMethod } = {
+    [METHOD_METADATA]: RequestMethod.GET,
+  },
+): MethodDecorator {
   return (
     target: object,
     key: string | symbol,
@@ -17,7 +22,7 @@ export function Sse(path?: string): MethodDecorator {
     Reflect.defineMetadata(PATH_METADATA, path, descriptor.value);
     Reflect.defineMetadata(
       METHOD_METADATA,
-      RequestMethod.GET,
+      options[METHOD_METADATA],
       descriptor.value,
     );
     Reflect.defineMetadata(SSE_METADATA, true, descriptor.value);

packages/common/interfaces/external/cors-options.interface.ts

@@ -10,7 +10,7 @@ type StaticOrigin = boolean | string | RegExp | (string | RegExp)[];
  * @publicApi
  */
 export type CustomOrigin = (
-  requestOrigin: string,
+  requestOrigin: string | undefined,
   callback: (err: Error | null, origin?: StaticOrigin) => void,
 ) => void;
 

packages/common/interfaces/index.ts

@@ -24,6 +24,7 @@ export * from './nest-application-options.interface';
 export * from './nest-application.interface';
 export * from './nest-microservice.interface';
 export * from './scope-options.interface';
+export * from './shutdown-hooks-options.interface';
 export * from './type.interface';
 export * from './version-options.interface';
 export * from './websockets/web-socket-adapter.interface';

packages/common/interfaces/nest-application-context.interface.ts

@@ -2,6 +2,7 @@ import { ShutdownSignal } from '../enums/shutdown-signal.enum';
 import { LoggerService, LogLevel } from '../services/logger.service';
 import { DynamicModule } from './modules';
 import { NestApplicationContextOptions } from './nest-application-context-options.interface';
+import { ShutdownHooksOptions } from './shutdown-hooks-options.interface';
 import { Type } from './type.interface';
 
 export type SelectOptions = Pick<NestApplicationContextOptions, 'abortOnError'>;
@@ -143,9 +144,15 @@ export interface INestApplicationContext {
    * `onApplicationShutdown` function of a provider if the
    * process receives a shutdown signal.
    *
+   * @param {ShutdownSignal[] | string[]} [signals] The system signals to listen to
+   * @param {ShutdownHooksOptions} [options] Options for configuring shutdown hooks behavior
+   *
    * @returns {this} The Nest application context instance
    */
-  enableShutdownHooks(signals?: ShutdownSignal[] | string[]): this;
+  enableShutdownHooks(
+    signals?: ShutdownSignal[] | string[],
+    options?: ShutdownHooksOptions,
+  ): this;
 
   /**
    * Initializes the Nest application.

packages/common/interfaces/nest-application.interface.ts

@@ -17,8 +17,9 @@ import { WebSocketAdapter } from './websockets/web-socket-adapter.interface';
  *
  * @publicApi
  */
-export interface INestApplication<TServer = any>
-  extends INestApplicationContext {
+export interface INestApplication<
+  TServer = any,
+> extends INestApplicationContext {
   /**
    * A wrapper function around HTTP adapter method: `adapter.use()`.
    * Example `app.use(cors())`

packages/common/interfaces/shutdown-hooks-options.interface.ts

@@ -0,0 +1,21 @@
+/**
+ * Options for configuring shutdown hooks behavior.
+ *
+ * @publicApi
+ */
+export interface ShutdownHooksOptions {
+  /**
+   * If true, uses `process.exit()` instead of `process.kill(process.pid, signal)`
+   * after shutdown hooks complete. This ensures the 'exit' event is properly
+   * triggered, which is required for async loggers (like Pino with transports)
+   * to flush their buffers before the process terminates.
+   *
+   * Note: Using `process.exit()` will:
+   * - Change the exit code (e.g., SIGTERM: 143 → 0)
+   * - May not trigger other signal handlers from third-party libraries
+   * - May affect orchestrator (Kubernetes, Docker) behavior
+   *
+   * @default false
+   */
+  useProcessExit?: boolean;
+}

packages/common/module-utils/configurable-module.builder.ts

@@ -53,8 +53,8 @@ export interface ConfigurableModuleBuilderOptions {
 export class ConfigurableModuleBuilder<
   ModuleOptions,
   StaticMethodKey extends string = typeof DEFAULT_METHOD_KEY,
-  FactoryClassMethodKey extends
-    string = typeof DEFAULT_FACTORY_CLASS_METHOD_KEY,
+  FactoryClassMethodKey extends string =
+    typeof DEFAULT_FACTORY_CLASS_METHOD_KEY,
   ExtraModuleDefinitionOptions = {},
 > {
   protected staticMethodKey: StaticMethodKey;

packages/common/module-utils/interfaces/configurable-module-async-options.interface.ts

@@ -28,8 +28,8 @@ export type ConfigurableModuleOptionsFactory<
  */
 export interface ConfigurableModuleAsyncOptions<
   ModuleOptions,
-  FactoryClassMethodKey extends
-    string = typeof DEFAULT_FACTORY_CLASS_METHOD_KEY,
+  FactoryClassMethodKey extends string =
+    typeof DEFAULT_FACTORY_CLASS_METHOD_KEY,
 > extends Pick<ModuleMetadata, 'imports'> {
   /**
    * Injection token resolving to an existing provider. The provider must implement

packages/common/module-utils/interfaces/configurable-module-cls.interface.ts

@@ -16,8 +16,8 @@ import { ConfigurableModuleAsyncOptions } from './configurable-module-async-opti
 export type ConfigurableModuleCls<
   ModuleOptions,
   MethodKey extends string = typeof DEFAULT_METHOD_KEY,
-  FactoryClassMethodKey extends
-    string = typeof DEFAULT_FACTORY_CLASS_METHOD_KEY,
+  FactoryClassMethodKey extends string =
+    typeof DEFAULT_FACTORY_CLASS_METHOD_KEY,
   ExtraModuleDefinitionOptions = {},
 > = {
   new (): any;

packages/common/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nestjs/common",
-  "version": "11.1.8",
+  "version": "11.1.14",
   "description": "Nest - modern, fast, powerful node.js web framework (@common)",
   "author": "Kamil Mysliwiec",
   "homepage": "https://nestjs.com",
@@ -18,7 +18,7 @@
   },
   "license": "MIT",
   "dependencies": {
-    "file-type": "21.0.0",
+    "file-type": "21.3.0",
     "iterare": "1.2.1",
     "load-esm": "1.0.3",
     "tslib": "2.8.1",
@@ -37,5 +37,6 @@
     "class-transformer": {
       "optional": true
     }
-  }
+  },
+  "gitHead": "bcb4747f7598a9d2655c8184a6d729ebefa07fbd"
 }

packages/common/pipes/default-value.pipe.ts

@@ -13,9 +13,10 @@ import { isNil, isNumber } from '../utils/shared.utils';
  * @publicApi
  */
 @Injectable()
-export class DefaultValuePipe<T = any, R = any>
-  implements PipeTransform<T, T | R>
-{
+export class DefaultValuePipe<T = any, R = any> implements PipeTransform<
+  T,
+  T | R
+> {
   constructor(protected readonly defaultValue: R) {}
 
   transform(value?: T, _metadata?: ArgumentMetadata): T | R {

packages/common/pipes/file/file-type.validator.ts

@@ -1,10 +1,49 @@
+import { pathToFileURL } from 'url';
+import { Logger } from '../../services/logger.service';
+import { FileValidatorContext } from './file-validator-context.interface';
 import { FileValidator } from './file-validator.interface';
 import { IFile } from './interfaces';
 import { loadEsm } from 'load-esm';
 
+const logger = new Logger('FileTypeValidator');
+type FileTypeValidatorContext = FileValidatorContext<
+  Omit<FileTypeValidatorOptions, 'errorMessage'>
+>;
+
 export type FileTypeValidatorOptions = {
+  /**
+   * Expected file type(s) for validation. Can be a string (MIME type)
+   * or a regular expression to match multiple types.
+   *
+   * @example
+   * // Match a single MIME type
+   * fileType: 'image/png'
+   *
+   * @example
+   * // Match multiple types using RegExp
+   * fileType: /^image\/(png|jpeg)$/
+   */
   fileType: string | RegExp;
 
+  /**
+   * Custom error message displayed when file type validation fails
+   * Can be provided as a static string, or as a factory function
+   * that receives the validation context (file and validator configuration)
+   * and returns a dynamic error message.
+   *
+   * @example
+   * // Static message
+   * new FileTypeValidator({ fileType: 'image/png', errorMessage: 'Only PNG allowed' })
+   *
+   * @example
+   * // Dynamic message based on file object and validator configuration
+   * new FileTypeValidator({
+   *   fileType: 'image/png',
+   *   errorMessage: ctx => `Received file type '${ctx.file?.mimetype}', but expected '${ctx.config.fileType}'`
+   * })
+   */
+  errorMessage?: string | ((ctx: FileTypeValidatorContext) => string);
+
   /**
    * If `true`, the validator will skip the magic numbers validation.
    * This can be useful when you can't identify some files as there are no common magic numbers available for some file types.
@@ -33,10 +72,16 @@ export class FileTypeValidator extends FileValidator<
   IFile
 > {
   buildErrorMessage(file?: IFile): string {
-    const expected = this.validationOptions.fileType;
+    const { errorMessage, ...config } = this.validationOptions;
+
+    if (errorMessage) {
+      return typeof errorMessage === 'function'
+        ? errorMessage({ file, config })
+        : errorMessage;
+    }
 
     if (file?.mimetype) {
-      const baseMessage = `Validation failed (current file type is ${file.mimetype}, expected type is ${expected})`;
+      const baseMessage = `Validation failed (current file type is ${file.mimetype}, expected type is ${this.validationOptions.fileType})`;
 
       /**
        * If fallbackToMimetype is enabled, this means the validator failed to detect the file type
@@ -52,7 +97,7 @@ export class FileTypeValidator extends FileValidator<
       return baseMessage;
     }
 
-    return `Validation failed (expected type is ${expected})`;
+    return `Validation failed (expected type is ${this.validationOptions.fileType})`;
   }
 
   async isValid(file?: IFile): Promise<boolean> {
@@ -69,11 +114,25 @@ export class FileTypeValidator extends FileValidator<
       );
     }
 
-    if (!isFileValid || !file.buffer) return false;
+    if (!isFileValid) return false;
+
+    if (!file.buffer) {
+      if (this.validationOptions.fallbackToMimetype) {
+        return !!file.mimetype.match(this.validationOptions.fileType);
+      }
+      return false;
+    }
 
     try {
+      let fileTypeModule: string;
+      try {
+        const resolvedPath = require.resolve('file-type');
+        fileTypeModule = pathToFileURL(resolvedPath).href;
+      } catch {
+        fileTypeModule = 'file-type';
+      }
       const { fileTypeFromBuffer } =
-        await loadEsm<typeof import('file-type')>('file-type');
+        await loadEsm<typeof import('file-type')>(fileTypeModule);
       const fileType = await fileTypeFromBuffer(file.buffer);
 
       if (fileType) {
@@ -90,7 +149,27 @@ export class FileTypeValidator extends FileValidator<
         return !!file.mimetype.match(this.validationOptions.fileType);
       }
       return false;
-    } catch {
+    } catch (error) {
+      const errorMessage =
+        error instanceof Error ? error.message : String(error);
+
+      // Check for common ESM loading issues
+      if (
+        errorMessage.includes('ERR_VM_DYNAMIC_IMPORT_CALLBACK_MISSING') ||
+        errorMessage.includes('Cannot find module') ||
+        errorMessage.includes('ERR_MODULE_NOT_FOUND')
+      ) {
+        logger.warn(
+          `Failed to load the "file-type" package for magic number validation. ` +
+            `If you are using Jest, run it with NODE_OPTIONS="--experimental-vm-modules". ` +
+            `Error: ${errorMessage}`,
+        );
+      }
+
+      // Fallback to mimetype if enabled
+      if (this.validationOptions.fallbackToMimetype) {
+        return !!file.mimetype.match(this.validationOptions.fileType);
+      }
       return false;
     }
   }

packages/common/pipes/file/file-validator-context.interface.ts

@@ -0,0 +1,6 @@
+import { IFile } from './interfaces';
+
+export type FileValidatorContext<TConfig> = {
+  file?: IFile;
+  config: TConfig;
+};

packages/common/pipes/file/max-file-size.validator.ts

@@ -1,9 +1,40 @@
+import { FileValidatorContext } from './file-validator-context.interface';
 import { FileValidator } from './file-validator.interface';
 import { IFile } from './interfaces';
 
+type MaxFileSizeValidatorContext = FileValidatorContext<
+  Omit<MaxFileSizeValidatorOptions, 'errorMessage' | 'message'>
+>;
+
 export type MaxFileSizeValidatorOptions = {
+  /**
+   * Maximum allowed file size in bytes.
+   */
   maxSize: number;
+
+  /**
+   * @deprecated Use `errorMessage` instead.
+   */
   message?: string | ((maxSize: number) => string);
+
+  /**
+   * Custom error message returned when file size validation fails.
+   * Can be provided as a static string, or as a factory function
+   * that receives the validation context (file and validator configuration)
+   * and returns a dynamic error message.
+   *
+   * @example
+   * // Static message
+   * new MaxFileSizeValidator({ maxSize: 1000, errorMessage: 'File size exceeds the limit' })
+   *
+   * @example
+   * // Dynamic message based on file object and validator configuration
+   * new MaxFileSizeValidator({
+   *   maxSize: 1000,
+   *   errorMessage: ctx => `Received file size is ${ctx.file?.size}, but it must be smaller than ${ctx.config.maxSize}.`
+   * })
+   */
+  errorMessage?: string | ((ctx: MaxFileSizeValidatorContext) => string);
 };
 
 /**
@@ -18,12 +49,18 @@ export class MaxFileSizeValidator extends FileValidator<
   IFile
 > {
   buildErrorMessage(file?: IFile): string {
-    if ('message' in this.validationOptions) {
-      if (typeof this.validationOptions.message === 'function') {
-        return this.validationOptions.message(this.validationOptions.maxSize);
-      }
+    const { errorMessage, message, ...config } = this.validationOptions;
 
-      return this.validationOptions.message!;
+    if (errorMessage) {
+      return typeof errorMessage === 'function'
+        ? errorMessage({ file, config })
+        : errorMessage;
+    }
+
+    if (message) {
+      return typeof message === 'function'
+        ? message(this.validationOptions.maxSize)
+        : message;
     }
 
     if (file?.size) {

packages/common/pipes/parse-array.pipe.ts

@@ -16,11 +16,10 @@ const DEFAULT_ARRAY_SEPARATOR = ',';
 /**
  * @publicApi
  */
-export interface ParseArrayOptions
-  extends Omit<
-    ValidationPipeOptions,
-    'transform' | 'validateCustomDecorators' | 'exceptionFactory'
-  > {
+export interface ParseArrayOptions extends Omit<
+  ValidationPipeOptions,
+  'transform' | 'validateCustomDecorators' | 'exceptionFactory'
+> {
   /**
    * Type for items to be converted into
    */

packages/common/pipes/parse-bool.pipe.ts

@@ -41,9 +41,10 @@ export interface ParseBoolPipeOptions {
  * @publicApi
  */
 @Injectable()
-export class ParseBoolPipe
-  implements PipeTransform<string | boolean, Promise<boolean>>
-{
+export class ParseBoolPipe implements PipeTransform<
+  string | boolean,
+  Promise<boolean>
+> {
   protected exceptionFactory: (error: string) => any;
 
   constructor(@Optional() protected readonly options?: ParseBoolPipeOptions) {

packages/common/pipes/parse-date.pipe.ts

@@ -31,9 +31,9 @@ export interface ParseDatePipeOptions {
 }
 
 @Injectable()
-export class ParseDatePipe
-  implements PipeTransform<string | number | undefined | null>
-{
+export class ParseDatePipe implements PipeTransform<
+  string | number | undefined | null
+> {
   protected exceptionFactory: (error: string) => any;
 
   constructor(private readonly options: ParseDatePipeOptions = {}) {

packages/common/pipes/validation.pipe.ts

@@ -38,6 +38,12 @@ export interface ValidationPipeOptions extends ValidatorOptions {
 let classValidator: ValidatorPackage = {} as any;
 let classTransformer: TransformerPackage = {} as any;
 
+/**
+ * Built-in JavaScript types that should be excluded from prototype stripping
+ * to avoid conflicts with test frameworks like Jest's useFakeTimers
+ */
+const BUILT_IN_TYPES = [Date, RegExp, Error, Map, Set, WeakMap, WeakSet];
+
 /**
  * @see [Validation](https://docs.nestjs.com/techniques/validation)
  *
@@ -66,7 +72,7 @@ export class ValidationPipe implements PipeTransform<any> {
       ...validatorOptions
     } = options;
 
-    // @see https://github.com/nestjs/nest/issues/10683#issuecomment-1413690508
+    // @see [https://github.com/nestjs/nest/issues/10683#issuecomment-1413690508](https://github.com/nestjs/nest/issues/10683#issuecomment-1413690508)
     this.validatorOptions = { forbidUnknownValues: false, ...validatorOptions };
 
     this.isTransformEnabled = !!transform;
@@ -147,7 +153,7 @@ export class ValidationPipe implements PipeTransform<any> {
     if (originalValue === undefined && originalEntity === '') {
       // Since SWC requires empty string for validation (to avoid an error),
       // a fallback is needed to revert to the original value (when undefined).
-      // @see https://github.com/nestjs/nest/issues/14430
+      // @see [https://github.com/nestjs/nest/issues/14430](https://github.com/nestjs/nest/issues/14430)
       return originalValue;
     }
     if (isPrimitive) {
@@ -241,7 +247,7 @@ export class ValidationPipe implements PipeTransform<any> {
     // SWC requires empty string to be returned instead of an empty object
     // when the value is nil and the metatype is not a class instance, but a plain object (enum, for example).
     // Otherwise, the error will be thrown.
-    // @see https://github.com/nestjs/nest/issues/12680
+    // @see [https://github.com/nestjs/nest/issues/12680](https://github.com/nestjs/nest/issues/12680)
     return '';
   }
 
@@ -253,13 +259,29 @@ export class ValidationPipe implements PipeTransform<any> {
     ) {
       return;
     }
+
+    // Skip built-in JavaScript primitives to avoid Jest useFakeTimers conflicts
+    if (BUILT_IN_TYPES.some(type => value instanceof type)) {
+      return;
+    }
+
     if (Array.isArray(value)) {
       for (const v of value) {
         this.stripProtoKeys(v);
       }
       return;
     }
+
+    // Delete dangerous prototype pollution keys
     delete value.__proto__;
+    delete value.prototype;
+
+    // Only delete constructor if it's NOT a built-in type
+    const constructorType = value?.constructor;
+    if (constructorType && !BUILT_IN_TYPES.includes(constructorType)) {
+      delete value.constructor;
+    }
+
     for (const key in value) {
       this.stripProtoKeys(value[key]);
     }

packages/common/serializer/class-serializer.interceptor.ts

@@ -24,8 +24,7 @@ const REFLECTOR = 'Reflector';
 /**
  * @publicApi
  */
-export interface ClassSerializerInterceptorOptions
-  extends ClassTransformOptions {
+export interface ClassSerializerInterceptorOptions extends ClassTransformOptions {
   transformerPackage?: TransformerPackage;
 }
 

packages/common/services/console-logger.service.ts

@@ -522,10 +522,10 @@ export class ConsoleLogger implements LoggerService {
       breakLength,
     };
 
-    if (this.options.maxArrayLength) {
+    if (typeof this.options.maxArrayLength !== 'undefined') {
       inspectOptions.maxArrayLength = this.options.maxArrayLength;
     }
-    if (this.options.maxStringLength) {
+    if (typeof this.options.maxStringLength !== 'undefined') {
       inspectOptions.maxStringLength = this.options.maxStringLength;
     }
 
@@ -574,10 +574,7 @@ export class ConsoleLogger implements LoggerService {
             stack: args[1] as string,
             context: this.context,
           }
-        : {
-            messages: [args[0]],
-            context: args[1] as string,
-          };
+        : { ...this.getContextAndMessagesToPrint(args) };
     }
 
     const { messages, context } = this.getContextAndMessagesToPrint(args);

packages/common/services/utils/is-log-level-enabled.util.ts

@@ -24,9 +24,12 @@ export function isLogLevelEnabled(
   if (logLevels.includes(targetLevel)) {
     return true;
   }
-  const highestLogLevelValue = logLevels
-    .map(level => LOG_LEVEL_VALUES[level])
-    .sort((a, b) => b - a)?.[0];
+
+  let highestLogLevelValue = -Infinity;
+  for (const level of logLevels) {
+    const v = LOG_LEVEL_VALUES[level];
+    if (v > highestLogLevelValue) highestLogLevelValue = v;
+  }
 
   const targetLevelValue = LOG_LEVEL_VALUES[targetLevel];
   return targetLevelValue >= highestLogLevelValue;

packages/common/test/decorators/sse.decorator.spec.ts

@@ -8,6 +8,9 @@ describe('@Sse', () => {
   class Test {
     @Sse(prefix)
     public static test() {}
+
+    @Sse(prefix, { method: RequestMethod.POST })
+    public static testUsingOptions() {}
   }
 
   it('should enhance method with expected http status code', () => {
@@ -20,4 +23,14 @@ describe('@Sse', () => {
     const metadata = Reflect.getMetadata(SSE_METADATA, Test.test);
     expect(metadata).to.be.eql(true);
   });
+  it('should enhance method with expected http status code and method from options', () => {
+    const path = Reflect.getMetadata(PATH_METADATA, Test.testUsingOptions);
+    expect(path).to.be.eql('/prefix');
+
+    const method = Reflect.getMetadata(METHOD_METADATA, Test.testUsingOptions);
+    expect(method).to.be.eql(RequestMethod.POST);
+
+    const metadata = Reflect.getMetadata(SSE_METADATA, Test.testUsingOptions);
+    expect(metadata).to.be.eql(true);
+  });
 });

packages/common/test/exceptions/http.exception.spec.ts

@@ -1,4 +1,3 @@
-/* eslint-disable @typescript-eslint/restrict-template-expressions */
 import { expect } from 'chai';
 import { Type } from '../../../common';
 import {

packages/common/test/file-stream/streamable-file.spec.ts

@@ -1,6 +1,8 @@
 import { expect } from 'chai';
+import * as sinon from 'sinon';
 import { Readable } from 'stream';
 import { StreamableFile } from '../../file-stream';
+import { HttpStatus } from '../../enums';
 
 describe('StreamableFile', () => {
   describe('when input is a readable stream', () => {
@@ -17,6 +19,13 @@ describe('StreamableFile', () => {
       expect(streamableFile.getStream()).to.equal(stream);
     });
   });
+  describe('when input is neither Uint8Array nor has pipe method', () => {
+    it('should not set stream property', () => {
+      const invalidInput = { notPipe: true };
+      const streamableFile = new StreamableFile(invalidInput as any);
+      expect(streamableFile.getStream()).to.be.undefined;
+    });
+  });
   describe('when options is empty', () => {
     it('should return application/octet-stream for type and undefined for others', () => {
       const stream = new Readable();
@@ -61,4 +70,135 @@ describe('StreamableFile', () => {
       });
     });
   });
+
+  describe('errorHandler', () => {
+    it('should return the default error handler', () => {
+      const stream = new Readable();
+      const streamableFile = new StreamableFile(stream);
+      expect(streamableFile.errorHandler).to.be.a('function');
+    });
+
+    describe('default error handler behavior', () => {
+      it('should do nothing when response is destroyed', () => {
+        const stream = new Readable();
+        const streamableFile = new StreamableFile(stream);
+        const res = {
+          destroyed: true,
+          headersSent: false,
+          statusCode: 200,
+          end: sinon.spy(),
+          send: sinon.spy(),
+        };
+
+        streamableFile.errorHandler(new Error('test error'), res as any);
+
+        expect(res.end.called).to.be.false;
+        expect(res.send.called).to.be.false;
+      });
+
+      it('should call res.end() when headers are already sent', () => {
+        const stream = new Readable();
+        const streamableFile = new StreamableFile(stream);
+        const res = {
+          destroyed: false,
+          headersSent: true,
+          statusCode: 200,
+          end: sinon.spy(),
+          send: sinon.spy(),
+        };
+
+        streamableFile.errorHandler(new Error('test error'), res as any);
+
+        expect(res.end.calledOnce).to.be.true;
+        expect(res.send.called).to.be.false;
+      });
+
+      it('should set status code to BAD_REQUEST and send error message', () => {
+        const stream = new Readable();
+        const streamableFile = new StreamableFile(stream);
+        const res = {
+          destroyed: false,
+          headersSent: false,
+          statusCode: 200,
+          end: sinon.spy(),
+          send: sinon.spy(),
+        };
+        const error = new Error('test error message');
+
+        streamableFile.errorHandler(error, res as any);
+
+        expect(res.statusCode).to.equal(HttpStatus.BAD_REQUEST);
+        expect(res.send.calledOnceWith('test error message')).to.be.true;
+      });
+    });
+  });
+
+  describe('setErrorHandler', () => {
+    it('should set a custom error handler', () => {
+      const stream = new Readable();
+      const streamableFile = new StreamableFile(stream);
+      const customHandler = sinon.spy();
+
+      streamableFile.setErrorHandler(customHandler);
+
+      expect(streamableFile.errorHandler).to.equal(customHandler);
+    });
+
+    it('should return the instance for chaining', () => {
+      const stream = new Readable();
+      const streamableFile = new StreamableFile(stream);
+      const customHandler = sinon.spy();
+
+      const result = streamableFile.setErrorHandler(customHandler);
+
+      expect(result).to.equal(streamableFile);
+    });
+  });
+
+  describe('errorLogger', () => {
+    it('should return the default error logger', () => {
+      const stream = new Readable();
+      const streamableFile = new StreamableFile(stream);
+      expect(streamableFile.errorLogger).to.be.a('function');
+    });
+
+    describe('default error logger behavior', () => {
+      it('should call logger.error with the error', () => {
+        const stream = new Readable();
+        const streamableFile = new StreamableFile(stream);
+        const loggerErrorStub = sinon.stub(
+          (streamableFile as any).logger,
+          'error',
+        );
+        const error = new Error('test error');
+
+        streamableFile.errorLogger(error);
+
+        expect(loggerErrorStub.calledOnceWith(error)).to.be.true;
+        loggerErrorStub.restore();
+      });
+    });
+  });
+
+  describe('setErrorLogger', () => {
+    it('should set a custom error logger', () => {
+      const stream = new Readable();
+      const streamableFile = new StreamableFile(stream);
+      const customLogger = sinon.spy();
+
+      streamableFile.setErrorLogger(customLogger);
+
+      expect(streamableFile.errorLogger).to.equal(customLogger);
+    });
+
+    it('should return the instance for chaining', () => {
+      const stream = new Readable();
+      const streamableFile = new StreamableFile(stream);
+      const customLogger = sinon.spy();
+
+      const result = streamableFile.setErrorLogger(customLogger);
+
+      expect(result).to.equal(streamableFile);
+    });
+  });
 });

packages/common/test/pipes/file/file-type.validator.spec.ts

@@ -233,6 +233,32 @@ describe('FileTypeValidator', () => {
 
       expect(await fileTypeValidator.isValid(requestFile)).to.equal(false);
     });
+
+    it('should return true when no buffer is provided but fallbackToMimetype is enabled and mimetype matches', async () => {
+      const fileTypeValidator = new FileTypeValidator({
+        fileType: 'image/jpeg',
+        fallbackToMimetype: true,
+      });
+
+      const requestFile = {
+        mimetype: 'image/jpeg', // matches
+      } as IFile;
+
+      expect(await fileTypeValidator.isValid(requestFile)).to.equal(true);
+    });
+
+    it('should return false when no buffer is provided and fallbackToMimetype is enabled but mimetype does not match', async () => {
+      const fileTypeValidator = new FileTypeValidator({
+        fileType: 'image/jpeg',
+        fallbackToMimetype: true,
+      });
+
+      const requestFile = {
+        mimetype: 'image/png',
+      } as IFile;
+
+      expect(await fileTypeValidator.isValid(requestFile)).to.equal(false);
+    });
   });
 
   describe('buildErrorMessage', () => {
@@ -311,5 +337,36 @@ describe('FileTypeValidator', () => {
 
       expect(await fileTypeValidator.isValid(requestFile)).to.equal(false);
     });
+
+    it('should return a static custom error message when the file type does not match', async () => {
+      const expectedFileType = 'image/png';
+      const actualFileType = 'text/csv';
+
+      const fileTypeValidator = new FileTypeValidator({
+        fileType: expectedFileType,
+        errorMessage: 'invalid type',
+      });
+      const requestFile = { mimetype: actualFileType } as IFile;
+
+      expect(fileTypeValidator.buildErrorMessage(requestFile)).to.equal(
+        'invalid type',
+      );
+    });
+
+    it('should return a dynamic custom error message based on context when the file type does not match', async () => {
+      const expectedFileType = 'image/png';
+      const actualFileType = 'text/csv';
+
+      const fileTypeValidator = new FileTypeValidator({
+        fileType: expectedFileType,
+        errorMessage: ctx =>
+          `Received file type '${ctx.file?.mimetype}', but expected '${ctx.config.fileType}'.`,
+      });
+      const requestFile = { mimetype: actualFileType } as IFile;
+
+      expect(fileTypeValidator.buildErrorMessage(requestFile)).to.equal(
+        `Received file type '${actualFileType}', but expected '${expectedFileType}'.`,
+      );
+    });
   });
 });

packages/common/test/pipes/file/max-file-size.validator.spec.ts

@@ -1,5 +1,6 @@
 import { expect } from 'chai';
 import { MaxFileSizeValidator } from '../../../pipes';
+import { IFile } from '@nestjs/common/pipes/file/interfaces';
 
 describe('MaxFileSizeValidator', () => {
   const oneKb = 1024;
@@ -73,5 +74,45 @@ describe('MaxFileSizeValidator', () => {
         `Validation failed (current file size is ${currentFileSize}, expected size is less than ${oneKb})`,
       );
     });
+
+    it('should support deprecated message option', async () => {
+      const currentFileSize = oneKb + 1;
+      const maxFileSizeValidator = new MaxFileSizeValidator({
+        maxSize: oneKb,
+        message: 'File size exceeds the limit',
+      });
+      const requestFile = { size: currentFileSize } as IFile;
+
+      expect(maxFileSizeValidator.buildErrorMessage(requestFile)).to.equal(
+        'File size exceeds the limit',
+      );
+    });
+
+    it('should return a static custom error message when the file size exceeds the limit', async () => {
+      const currentFileSize = oneKb + 1;
+      const maxFileSizeValidator = new MaxFileSizeValidator({
+        maxSize: oneKb,
+        errorMessage: 'File size exceeds the limit',
+      });
+      const requestFile = { size: currentFileSize } as IFile;
+
+      expect(maxFileSizeValidator.buildErrorMessage(requestFile)).to.equal(
+        'File size exceeds the limit',
+      );
+    });
+
+    it('should return a dynamic custom error message based on context when the file size exceeds the limit', async () => {
+      const currentFileSize = oneKb + 1;
+      const maxFileSizeValidator = new MaxFileSizeValidator({
+        maxSize: oneKb,
+        errorMessage: ctx =>
+          `Received file size is ${ctx.file?.size}, but it must be smaller than ${ctx.config.maxSize}.`,
+      });
+      const requestFile = { size: currentFileSize } as IFile;
+
+      expect(maxFileSizeValidator.buildErrorMessage(requestFile)).to.equal(
+        `Received file size is ${currentFileSize}, but it must be smaller than ${oneKb}.`,
+      );
+    });
   });
 });

packages/common/test/pipes/validation.pipe.spec.ts

@@ -609,4 +609,133 @@ describe('ValidationPipe', () => {
       expect(await target.transform(testObj, m)).to.deep.equal(testObj);
     });
   });
+  describe('stripProtoKeys', () => {
+    beforeEach(() => {
+      target = new ValidationPipe();
+    });
+
+    describe('with built-in JavaScript primitives', () => {
+      it('should not throw error when processing Date objects', () => {
+        const value = { date: new Date() };
+        expect(() => target['stripProtoKeys'](value)).to.not.throw();
+      });
+
+      it('should not throw error when processing RegExp objects', () => {
+        const value = { regex: /test/i };
+        expect(() => target['stripProtoKeys'](value)).to.not.throw();
+      });
+
+      it('should not throw error when processing Error objects', () => {
+        const value = { error: new Error('test') };
+        expect(() => target['stripProtoKeys'](value)).to.not.throw();
+      });
+
+      it('should not throw error when processing Map objects', () => {
+        const value = { map: new Map() };
+        expect(() => target['stripProtoKeys'](value)).to.not.throw();
+      });
+
+      it('should not throw error when processing Set objects', () => {
+        const value = { set: new Set() };
+        expect(() => target['stripProtoKeys'](value)).to.not.throw();
+      });
+
+      it('should preserve Date object properties', () => {
+        const date = new Date();
+        const value = { date };
+        target['stripProtoKeys'](value);
+        expect(value.date).to.equal(date);
+        expect(value.date.constructor).to.equal(Date);
+      });
+    });
+
+    describe('with plain objects', () => {
+      it('should still strip constructor from regular objects', () => {
+        const value = { nested: { constructor: 'malicious' } };
+        target['stripProtoKeys'](value);
+        // Check if 'constructor' is NOT an own property
+        expect(value.nested).to.not.have.ownProperty('constructor');
+      });
+
+      it('should strip __proto__ from objects', () => {
+        const value = { __proto__: { malicious: 'code' } };
+        target['stripProtoKeys'](value);
+        expect(value).to.not.have.ownProperty('__proto__');
+      });
+
+      it('should strip prototype from objects', () => {
+        const value = { prototype: { malicious: 'code' } };
+        target['stripProtoKeys'](value);
+        expect(value).to.not.have.ownProperty('prototype');
+      });
+
+      it('should recursively strip nested objects', () => {
+        const value = {
+          level1: {
+            constructor: 'malicious',
+            level2: {
+              constructor: 'alsoMalicious',
+            },
+          },
+        };
+        target['stripProtoKeys'](value);
+        expect(value.level1).to.not.have.ownProperty('constructor');
+        expect(value.level1.level2).to.not.have.ownProperty('constructor');
+      });
+    });
+
+    describe('with arrays', () => {
+      it('should process arrays recursively', () => {
+        const value = {
+          items: [
+            { constructor: 'malicious' },
+            { constructor: 'alsoMalicious' },
+          ],
+        };
+        target['stripProtoKeys'](value);
+        expect(value.items[0]).to.not.have.ownProperty('constructor');
+        expect(value.items[1]).to.not.have.ownProperty('constructor');
+      });
+
+      it('should not throw error when array contains Date objects', () => {
+        const value = { dates: [new Date(), new Date()] };
+        expect(() => target['stripProtoKeys'](value)).to.not.throw();
+      });
+    });
+
+    describe('Issue #16195: Jest useFakeTimers compatibility', () => {
+      beforeEach(() => {
+        target = new ValidationPipe();
+      });
+
+      it('should handle Date objects with non-configurable constructor', () => {
+        const value = { date: new Date() };
+
+        // Make constructor non-configurable like Jest does
+        Object.defineProperty(value.date, 'constructor', {
+          value: Date,
+          writable: false,
+          enumerable: false,
+          configurable: false,
+        });
+
+        // This should NOT throw "Cannot delete property 'constructor'"
+        expect(() => target['stripProtoKeys'](value)).to.not.throw();
+      });
+
+      it('should not attempt to delete constructor from built-in types', () => {
+        const testCases = [
+          { date: new Date() },
+          { regex: /test/i },
+          { error: new Error('test') },
+          { map: new Map() },
+          { set: new Set() },
+        ];
+
+        testCases.forEach(testCase => {
+          expect(() => target['stripProtoKeys'](testCase)).to.not.throw();
+        });
+      });
+    });
+  });
 });

packages/common/test/serializer/class-serializer.interceptor.spec.ts

@@ -0,0 +1,468 @@
+import { expect } from 'chai';
+import * as sinon from 'sinon';
+import { of, throwError } from 'rxjs';
+import { ClassSerializerInterceptor } from '../../serializer/class-serializer.interceptor';
+import { ExecutionContext, CallHandler } from '../../interfaces';
+import { StreamableFile } from '../../file-stream';
+
+describe('ClassSerializerInterceptor', () => {
+  let interceptor: ClassSerializerInterceptor;
+  let mockReflector: any;
+  let mockTransformerPackage: any;
+  let sandbox: sinon.SinonSandbox;
+
+  beforeEach(() => {
+    sandbox = sinon.createSandbox();
+    mockReflector = {
+      getAllAndOverride: sandbox.stub(),
+    };
+    mockTransformerPackage = {
+      classToPlain: sandbox.stub(),
+      plainToInstance: sandbox.stub(),
+    };
+  });
+
+  afterEach(() => {
+    sandbox.restore();
+  });
+
+  describe('constructor', () => {
+    it('should create interceptor with default transformer package', () => {
+      // This would normally load 'class-transformer' package
+      // For testing, we pass a mock transformer package
+      const options = {
+        transformerPackage: mockTransformerPackage,
+      };
+
+      interceptor = new ClassSerializerInterceptor(mockReflector, options);
+
+      expect(interceptor).to.be.instanceOf(ClassSerializerInterceptor);
+    });
+
+    it('should use provided transformer package from options', () => {
+      const customTransformer = {
+        classToPlain: sandbox.stub(),
+        plainToInstance: sandbox.stub(),
+      };
+
+      const options = {
+        transformerPackage: customTransformer,
+      };
+
+      interceptor = new ClassSerializerInterceptor(mockReflector, options);
+
+      expect(interceptor).to.be.instanceOf(ClassSerializerInterceptor);
+    });
+  });
+
+  describe('intercept', () => {
+    let mockExecutionContext: ExecutionContext;
+    let mockCallHandler: CallHandler;
+
+    beforeEach(() => {
+      interceptor = new ClassSerializerInterceptor(mockReflector, {
+        transformerPackage: mockTransformerPackage,
+      });
+
+      mockExecutionContext = {
+        getHandler: sandbox.stub(),
+        getClass: sandbox.stub(),
+      } as any;
+
+      mockCallHandler = {
+        handle: sandbox.stub(),
+      } as any;
+    });
+
+    it('should transform plain object response', done => {
+      const response = { id: 1, name: 'Test' };
+      const transformedResponse = { id: 1, name: 'Test' };
+
+      mockReflector.getAllAndOverride.returns(undefined);
+      mockTransformerPackage.classToPlain.returns(transformedResponse);
+      (mockCallHandler.handle as sinon.SinonStub).returns(of(response));
+
+      interceptor
+        .intercept(mockExecutionContext, mockCallHandler)
+        .subscribe(result => {
+          expect(result).to.equal(transformedResponse);
+          done();
+        });
+    });
+
+    it('should transform array of objects', done => {
+      const response = [
+        { id: 1, name: 'Test1' },
+        { id: 2, name: 'Test2' },
+      ];
+      const transformedItem1 = { id: 1, name: 'Test1' };
+      const transformedItem2 = { id: 2, name: 'Test2' };
+
+      mockReflector.getAllAndOverride.returns(undefined);
+      mockTransformerPackage.classToPlain
+        .onFirstCall()
+        .returns(transformedItem1);
+      mockTransformerPackage.classToPlain
+        .onSecondCall()
+        .returns(transformedItem2);
+      (mockCallHandler.handle as sinon.SinonStub).returns(of(response));
+
+      interceptor
+        .intercept(mockExecutionContext, mockCallHandler)
+        .subscribe(result => {
+          expect(result).to.be.an('array').with.lengthOf(2);
+          expect(result[0]).to.equal(transformedItem1);
+          expect(result[1]).to.equal(transformedItem2);
+          done();
+        });
+    });
+
+    it('should merge context options with default options', done => {
+      const response = { id: 1, name: 'Test' };
+      const defaultOptions = { excludeExtraneousValues: true };
+      const contextOptions = { groups: ['user'] };
+      const transformedResponse = { id: 1 };
+
+      interceptor = new ClassSerializerInterceptor(mockReflector, {
+        transformerPackage: mockTransformerPackage,
+        ...defaultOptions,
+      });
+
+      mockReflector.getAllAndOverride.returns(contextOptions);
+      mockTransformerPackage.classToPlain.returns(transformedResponse);
+      (mockCallHandler.handle as sinon.SinonStub).returns(of(response));
+
+      interceptor
+        .intercept(mockExecutionContext, mockCallHandler)
+        .subscribe(result => {
+          const callArgs = mockTransformerPackage.classToPlain.getCall(0).args;
+          expect(callArgs[1]).to.deep.include(defaultOptions);
+          expect(callArgs[1]).to.deep.include(contextOptions);
+          done();
+        });
+    });
+
+    it('should call reflector with handler and class', done => {
+      const response = { id: 1 };
+      const mockHandler = {};
+      const mockClass = {};
+
+      (mockExecutionContext.getHandler as sinon.SinonStub).returns(mockHandler);
+      (mockExecutionContext.getClass as sinon.SinonStub).returns(mockClass);
+      mockReflector.getAllAndOverride.returns(undefined);
+      mockTransformerPackage.classToPlain.returns(response);
+      (mockCallHandler.handle as sinon.SinonStub).returns(of(response));
+
+      interceptor
+        .intercept(mockExecutionContext, mockCallHandler)
+        .subscribe(() => {
+          expect(mockReflector.getAllAndOverride.calledOnce).to.be.true;
+          const args = mockReflector.getAllAndOverride.getCall(0).args;
+          expect(args[1]).to.deep.equal([mockHandler, mockClass]);
+          done();
+        });
+    });
+  });
+
+  describe('serialize', () => {
+    beforeEach(() => {
+      interceptor = new ClassSerializerInterceptor(mockReflector, {
+        transformerPackage: mockTransformerPackage,
+      });
+    });
+
+    it('should return primitive values unchanged', () => {
+      expect(interceptor.serialize('string' as any, {})).to.equal('string');
+      expect(interceptor.serialize(123 as any, {})).to.equal(123);
+      expect(interceptor.serialize(true as any, {})).to.equal(true);
+    });
+
+    it('should return null unchanged', () => {
+      expect(interceptor.serialize(null as any, {})).to.be.null;
+    });
+
+    it('should return undefined unchanged', () => {
+      expect(interceptor.serialize(undefined as any, {})).to.be.undefined;
+    });
+
+    it('should return StreamableFile unchanged', () => {
+      const streamableFile = new StreamableFile(Buffer.from('test'));
+      const result = interceptor.serialize(streamableFile as any, {});
+
+      expect(result).to.equal(streamableFile);
+      expect(mockTransformerPackage.classToPlain.called).to.be.false;
+    });
+
+    it('should transform plain object', () => {
+      const input = { id: 1, name: 'Test' };
+      const output = { id: 1 };
+
+      mockTransformerPackage.classToPlain.returns(output);
+
+      const result = interceptor.serialize(input, {});
+
+      expect(result).to.equal(output);
+      expect(mockTransformerPackage.classToPlain.calledOnce).to.be.true;
+    });
+
+    it('should transform array of objects', () => {
+      const input = [{ id: 1 }, { id: 2 }];
+      const output1 = { id: 1 };
+      const output2 = { id: 2 };
+
+      mockTransformerPackage.classToPlain.onFirstCall().returns(output1);
+      mockTransformerPackage.classToPlain.onSecondCall().returns(output2);
+
+      const result = interceptor.serialize(input, {});
+
+      expect(result).to.be.an('array').with.lengthOf(2);
+      expect(result[0]).to.equal(output1);
+      expect(result[1]).to.equal(output2);
+      expect(mockTransformerPackage.classToPlain.calledTwice).to.be.true;
+    });
+
+    it('should handle empty array', () => {
+      const input: any[] = [];
+
+      const result = interceptor.serialize(input, {});
+
+      expect(result).to.be.an('array').that.is.empty;
+      expect(mockTransformerPackage.classToPlain.called).to.be.false;
+    });
+  });
+
+  describe('transformToPlain', () => {
+    beforeEach(() => {
+      interceptor = new ClassSerializerInterceptor(mockReflector, {
+        transformerPackage: mockTransformerPackage,
+      });
+    });
+
+    it('should return falsy values unchanged', () => {
+      expect(interceptor.transformToPlain(null, {})).to.be.null;
+      expect(interceptor.transformToPlain(undefined, {})).to.be.undefined;
+      expect(interceptor.transformToPlain(0 as any, {})).to.equal(0);
+      expect(interceptor.transformToPlain(false as any, {})).to.be.false;
+      expect(interceptor.transformToPlain('' as any, {})).to.equal('');
+    });
+
+    it('should use classToPlain when no type option provided', () => {
+      const input = { id: 1, name: 'Test' };
+      const output = { id: 1 };
+
+      mockTransformerPackage.classToPlain.returns(output);
+
+      const result = interceptor.transformToPlain(input, {});
+
+      expect(result).to.equal(output);
+      expect(mockTransformerPackage.classToPlain.calledOnceWith(input, {})).to
+        .be.true;
+      expect(mockTransformerPackage.plainToInstance.called).to.be.false;
+    });
+
+    it('should use classToPlain when input is instance of options.type', () => {
+      class UserDto {
+        id: number;
+        name: string;
+      }
+
+      const input = new UserDto();
+      input.id = 1;
+      input.name = 'Test';
+
+      const output = { id: 1 };
+      const options = { type: UserDto };
+
+      mockTransformerPackage.classToPlain.returns(output);
+
+      const result = interceptor.transformToPlain(input, options);
+
+      expect(result).to.equal(output);
+      expect(mockTransformerPackage.classToPlain.calledOnce).to.be.true;
+      expect(mockTransformerPackage.plainToInstance.called).to.be.false;
+    });
+
+    it('should convert plain to instance then to plain when type provided but not matching', () => {
+      class UserDto {
+        id: number;
+      }
+
+      const plainInput = { id: 1, name: 'Test', password: 'secret' };
+      const instanceOutput = new UserDto();
+      instanceOutput.id = 1;
+
+      const finalOutput = { id: 1 };
+      const options = { type: UserDto };
+
+      mockTransformerPackage.plainToInstance.returns(instanceOutput);
+      mockTransformerPackage.classToPlain.returns(finalOutput);
+
+      const result = interceptor.transformToPlain(plainInput, options);
+
+      expect(result).to.equal(finalOutput);
+      expect(
+        mockTransformerPackage.plainToInstance.calledOnceWith(
+          UserDto,
+          plainInput,
+          options,
+        ),
+      ).to.be.true;
+      expect(
+        mockTransformerPackage.classToPlain.calledOnceWith(
+          instanceOutput,
+          options,
+        ),
+      ).to.be.true;
+    });
+
+    it('should handle complex nested objects', () => {
+      const input = {
+        user: { id: 1, name: 'Test' },
+        posts: [{ id: 1, title: 'Post 1' }],
+      };
+      const output = {
+        user: { id: 1 },
+        posts: [{ id: 1 }],
+      };
+
+      mockTransformerPackage.classToPlain.returns(output);
+
+      const result = interceptor.transformToPlain(input, {});
+
+      expect(result).to.equal(output);
+    });
+  });
+
+  describe('getContextOptions', () => {
+    beforeEach(() => {
+      interceptor = new ClassSerializerInterceptor(mockReflector, {
+        transformerPackage: mockTransformerPackage,
+      });
+    });
+
+    it('should call reflector getAllAndOverride with correct arguments', () => {
+      const mockHandler = {};
+      const mockClass = {};
+      const mockContext = {
+        getHandler: sandbox.stub().returns(mockHandler),
+        getClass: sandbox.stub().returns(mockClass),
+      } as any;
+
+      const expectedOptions = { groups: ['admin'] };
+      mockReflector.getAllAndOverride.returns(expectedOptions);
+
+      const result = (interceptor as any).getContextOptions(mockContext);
+
+      expect(mockReflector.getAllAndOverride.calledOnce).to.be.true;
+      const callArgs = mockReflector.getAllAndOverride.getCall(0).args;
+      expect(callArgs[1]).to.deep.equal([mockHandler, mockClass]);
+      expect(result).to.equal(expectedOptions);
+    });
+
+    it('should return undefined when no metadata exists', () => {
+      const mockContext = {
+        getHandler: sandbox.stub().returns({}),
+        getClass: sandbox.stub().returns({}),
+      } as any;
+
+      mockReflector.getAllAndOverride.returns(undefined);
+
+      const result = (interceptor as any).getContextOptions(mockContext);
+
+      expect(result).to.be.undefined;
+    });
+
+    it('should respect handler metadata over class metadata', () => {
+      const mockHandler = {};
+      const mockClass = {};
+      const mockContext = {
+        getHandler: sandbox.stub().returns(mockHandler),
+        getClass: sandbox.stub().returns(mockClass),
+      } as any;
+
+      // getAllAndOverride should merge with handler taking precedence
+      const handlerOptions = {
+        groups: ['user'],
+        excludeExtraneousValues: true,
+      };
+      mockReflector.getAllAndOverride.returns(handlerOptions);
+
+      const result = (interceptor as any).getContextOptions(mockContext);
+
+      expect(result).to.deep.equal(handlerOptions);
+      // Verify it's checking handler first, then class
+      const callArgs = mockReflector.getAllAndOverride.getCall(0).args;
+      expect(callArgs[1][0]).to.equal(mockHandler);
+      expect(callArgs[1][1]).to.equal(mockClass);
+    });
+  });
+
+  describe('edge cases and error handling', () => {
+    beforeEach(() => {
+      interceptor = new ClassSerializerInterceptor(mockReflector, {
+        transformerPackage: mockTransformerPackage,
+      });
+    });
+
+    it('should handle array with mixed types', () => {
+      const input = [
+        { id: 1, name: 'Test' },
+        null,
+        undefined,
+        { id: 2, name: 'Test2' },
+      ];
+
+      mockTransformerPackage.classToPlain
+        .onCall(0)
+        .returns({ id: 1, name: 'Test' });
+      mockTransformerPackage.classToPlain.onCall(1).returns(null);
+      mockTransformerPackage.classToPlain.onCall(2).returns(undefined);
+      mockTransformerPackage.classToPlain
+        .onCall(3)
+        .returns({ id: 2, name: 'Test2' });
+
+      const result = interceptor.serialize(input, {});
+
+      expect(result).to.be.an('array').with.lengthOf(4);
+      expect(result[1]).to.be.null;
+      expect(result[2]).to.be.undefined;
+    });
+
+    it('should not transform when response is not an object', () => {
+      const input = 'plain string';
+
+      const result = interceptor.serialize(input as any, {});
+
+      expect(result).to.equal(input);
+      expect(mockTransformerPackage.classToPlain.called).to.be.false;
+    });
+
+    it('should handle Date objects', () => {
+      const date = new Date();
+      const output = { date: date.toISOString() };
+
+      mockTransformerPackage.classToPlain.returns(output);
+
+      const result = interceptor.serialize({ date } as any, {});
+
+      expect(mockTransformerPackage.classToPlain.calledOnce).to.be.true;
+    });
+
+    it('should pass through options to transformer', () => {
+      const input = { id: 1, name: 'Test', password: 'secret' };
+      const options = {
+        excludeExtraneousValues: true,
+        groups: ['public'],
+        strategy: 'excludeAll',
+      };
+
+      mockTransformerPackage.classToPlain.returns({ id: 1, name: 'Test' });
+
+      interceptor.transformToPlain(input, options as any);
+
+      expect(mockTransformerPackage.classToPlain.calledOnce).to.be.true;
+      const callArgs = mockTransformerPackage.classToPlain.getCall(0).args;
+      expect(callArgs[1]).to.deep.include(options);
+    });
+  });
+});

packages/common/test/services/logger.service.spec.ts

@@ -897,6 +897,36 @@ describe('Logger', () => {
       processStdoutWriteSpy.restore();
     });
 
+    it('should respect maxStringLength when set to 0', () => {
+      const consoleLogger = new ConsoleLogger({
+        colors: false,
+        compact: false,
+        maxStringLength: 0,
+      });
+
+      consoleLogger.log({ name: 'abcdef' });
+
+      expect(processStdoutWriteSpy.calledOnce).to.be.true;
+      expect(processStdoutWriteSpy.firstCall.firstArg).to.include(
+        "''... 6 more characters",
+      );
+    });
+
+    it('should respect maxArrayLength when set to 0', () => {
+      const consoleLogger = new ConsoleLogger({
+        colors: false,
+        compact: false,
+        maxArrayLength: 0,
+      });
+
+      consoleLogger.log({ items: ['a', 'b', 'c'] });
+
+      expect(processStdoutWriteSpy.calledOnce).to.be.true;
+      expect(processStdoutWriteSpy.firstCall.firstArg).to.include(
+        '... 3 more items',
+      );
+    });
+
     it('should support custom formatter', () => {
       class CustomConsoleLogger extends ConsoleLogger {
         protected formatMessage(

packages/core/Readme.md

@@ -1,5 +1,5 @@
 <p align="center">
-  <a href="https://nestjs.com/" target="blank"><img src="https://nestjs.com/img/logo-small.svg" width="120" alt="Nest Logo" /></a>
+  <a href="https://nestjs.com/" target="_blank"><img src="https://nestjs.com/img/logo-small.svg" width="120" alt="Nest Logo" /></a>
 </p>
 
 [circleci-image]: https://img.shields.io/circleci/build/github/nestjs/nest/master?token=abc123def456
@@ -49,7 +49,7 @@ Please make sure to read the [Issue Reporting Checklist](https://github.com/nest
 
 ## Consulting
 
-With official support, you can get expert help straight from Nest core team. We provide dedicated technical support, migration strategies, advice on best practices (and design decisions), PR reviews, and team augmentation. Read more about [support here](https://enterprise.nestjs.com).
+With official support, you can get expert help straight from the Nest core team. We provide dedicated technical support, migration strategies, advice on best practices (and design decisions), PR reviews, and team augmentation. Read more about [support here](https://enterprise.nestjs.com).
 
 ## Support
 
@@ -63,6 +63,7 @@ Nest is an MIT-licensed open source project. It can grow thanks to the sponsors
 <td><a href="https://microsoft.com/" target="_blank"><img src="https://nestjs.com/img/logos/microsoft-logo.png" width="180" valign="middle" /></a></td>
 <td><a href="https://mojam.co" target="_blank"><img src="https://nestjs.com/img/logos/mojam-logo.png" width="80" valign="middle" /></a></td>
 <td><a href="https://valor-software.com/" target="_blank"><img src="https://docs.nestjs.com/assets/sponsors/valor-software.png" width="170" valign="middle" /></a></td>
+<td><a href="https://serpapi.com/" target="_blank"><img src="https://nestjs.com/img/logos/serpapi-logo.png" width="150" valign="middle" /></a></td>
 </tr>
 </table>
 
@@ -92,6 +93,8 @@ Nest is an MIT-licensed open source project. It can grow thanks to the sponsors
 <td align="center" valign="middle"><a href="https://www.itflashcards.com/" target="_blank"><img src="https://nestjs.com/img/logos/it_flashcards-logo.png" width="170" valign="middle" /></a></td>
 <td align="center" valign="middle"><a href="https://arcjet.com/?ref=nestjs" target="_blank"><img src="https://nestjs.com/img/logos/arcjet-logo.svg" width="170" valign="middle" /></a></td>
 <td align="center" valign="middle"><a href="https://crawljobs.com" target="_blank"><img src="https://nestjs.com/img/logos/crawljobs-logo.svg" width="130" valign="middle" /></a></td>
+</tr><tr>
+<td align="center" valign="middle"><a href="https://pandektes.com" target="_blank"><img src="https://nestjs.com/img/logos/pandektes-logo.png" width="65" valign="middle" /></a></td>
 </tr>
 </table>
 

packages/core/adapters/http-adapter.ts

@@ -9,8 +9,7 @@ export abstract class AbstractHttpAdapter<
   TServer = any,
   TRequest = any,
   TResponse = any,
-> implements HttpServer<TRequest, TResponse>
-{
+> implements HttpServer<TRequest, TResponse> {
   protected httpServer: TServer;
   protected onRouteTriggered:
     | ((requestMethod: RequestMethod, path: string) => void)

packages/core/injector/abstract-instance-resolver.ts

@@ -29,7 +29,8 @@ export abstract class AbstractInstanceResolver {
     const pluckInstance = ({ wrapperRef }: InstanceLink) => {
       if (
         wrapperRef.scope === Scope.REQUEST ||
-        wrapperRef.scope === Scope.TRANSIENT
+        wrapperRef.scope === Scope.TRANSIENT ||
+        !wrapperRef.isDependencyTreeStatic()
       ) {
         throw new InvalidClassScopeException(typeOrToken);
       }
@@ -59,7 +60,7 @@ export abstract class AbstractInstanceResolver {
     const pluckInstance = async (instanceLink: InstanceLink) => {
       const { wrapperRef, collection } = instanceLink;
       if (wrapperRef.isDependencyTreeStatic() && !wrapperRef.isTransient) {
-        return this.get(typeOrToken, { strict: options?.strict });
+        return wrapperRef.instance;
       }
 
       const ctorHost = wrapperRef.instance || { constructor: typeOrToken };

packages/core/injector/injector.ts

@@ -553,9 +553,13 @@ export class Injector {
        * instantiated beforehand.
        */
       instanceHost.donePromise &&
-        void instanceHost.donePromise.then(() =>
-          this.loadProvider(instanceWrapper, moduleRef, contextId, inquirer),
-        );
+        void instanceHost.donePromise
+          .then(() =>
+            this.loadProvider(instanceWrapper, moduleRef, contextId, inquirer),
+          )
+          .catch(err => {
+            instanceWrapper.settlementSignal?.error(err);
+          });
     }
     if (instanceWrapper.async) {
       const host = instanceWrapper.getInstanceByContextId(
@@ -615,7 +619,7 @@ export class Injector {
       moduleRef,
       dependencyContext.name!,
       wrapper,
-      [],
+      new Set<string>(),
       contextId,
       inquirer,
       keyOrIndex,
@@ -635,7 +639,7 @@ export class Injector {
     moduleRef: Module,
     name: InjectionToken,
     wrapper: InstanceWrapper,
-    moduleRegistry: any[] = [],
+    moduleRegistry: Set<string> = new Set<string>(),
     contextId = STATIC_CONTEXT,
     inquirer?: InstanceWrapper,
     keyOrIndex?: symbol | string | number,
@@ -653,11 +657,11 @@ export class Injector {
       );
     }
     for (const relatedModule of children) {
-      if (moduleRegistry.includes(relatedModule.id)) {
+      if (moduleRegistry.has(relatedModule.id)) {
         continue;
       }
       this.printLookingForProviderLog(name, relatedModule);
-      moduleRegistry.push(relatedModule.id);
+      moduleRegistry.add(relatedModule.id);
 
       const { providers, exports } = relatedModule;
       if (!exports.has(name) || !providers.has(name)) {

packages/core/injector/instance-wrapper.ts

@@ -408,17 +408,36 @@ export class InstanceWrapper<T = any> {
     contextId: ContextId,
     inquirer: InstanceWrapper | undefined,
   ): boolean {
+    if (!this.isDependencyTreeStatic() || contextId !== STATIC_CONTEXT) {
+      return false;
+    }
+
+    // Non-transient provider in static context
+    if (!this.isTransient) {
+      return true;
+    }
+
     const isInquirerRequestScoped =
       inquirer && !inquirer.isDependencyTreeStatic();
     const isStaticTransient = this.isTransient && !isInquirerRequestScoped;
     const rootInquirer = inquirer?.getRootInquirer();
-    return (
-      this.isDependencyTreeStatic() &&
-      contextId === STATIC_CONTEXT &&
-      (!this.isTransient ||
-        (isStaticTransient && !!inquirer && !inquirer.isTransient) ||
-        (isStaticTransient && !!rootInquirer && !rootInquirer.isTransient))
-    );
+
+    // Transient provider inquired by non-transient (e.g., DEFAULT -> TRANSIENT)
+    if (isStaticTransient && inquirer && !inquirer.isTransient) {
+      return true;
+    }
+
+    // Nested transient with non-transient root (e.g., DEFAULT -> TRANSIENT -> TRANSIENT)
+    if (isStaticTransient && rootInquirer && !rootInquirer.isTransient) {
+      return true;
+    }
+
+    // Nested transient during initial instantiation (rootInquirer not yet set)
+    if (isStaticTransient && inquirer?.isTransient && !rootInquirer) {
+      return true;
+    }
+
+    return false;
   }
 
   public attachRootInquirer(inquirer: InstanceWrapper) {

packages/core/injector/opaque-key-factory/by-reference-module-opaque-key-factory.ts

@@ -7,9 +7,7 @@ import { ModuleOpaqueKeyFactory } from './interfaces/module-opaque-key-factory.i
 
 const K_MODULE_ID = Symbol('K_MODULE_ID');
 
-export class ByReferenceModuleOpaqueKeyFactory
-  implements ModuleOpaqueKeyFactory
-{
+export class ByReferenceModuleOpaqueKeyFactory implements ModuleOpaqueKeyFactory {
   private readonly keyGenerationStrategy: 'random' | 'shallow';
 
   constructor(options?: { keyGenerationStrategy: 'random' | 'shallow' }) {

packages/core/injector/opaque-key-factory/deep-hashed-module-opaque-key-factory.ts

@@ -10,9 +10,7 @@ import { ModuleOpaqueKeyFactory } from './interfaces/module-opaque-key-factory.i
 const CLASS_STR = 'class ';
 const CLASS_STR_LEN = CLASS_STR.length;
 
-export class DeepHashedModuleOpaqueKeyFactory
-  implements ModuleOpaqueKeyFactory
-{
+export class DeepHashedModuleOpaqueKeyFactory implements ModuleOpaqueKeyFactory {
   private readonly moduleIdsCache = new WeakMap<Type<unknown>, string>();
   private readonly moduleTokenCache = new Map<string, string>();
   private readonly logger = new Logger(DeepHashedModuleOpaqueKeyFactory.name, {

packages/core/middleware/middleware-module.ts

@@ -33,8 +33,8 @@ import { RouteInfoPathExtractor } from './route-info-path-extractor';
 import { RoutesMapper } from './routes-mapper';
 
 export class MiddlewareModule<
-  TAppOptions extends
-    NestApplicationContextOptions = NestApplicationContextOptions,
+  TAppOptions extends NestApplicationContextOptions =
+    NestApplicationContextOptions,
 > {
   private readonly routerProxy = new RouterProxy();
   private readonly exceptionFiltersCache = new WeakMap();

packages/core/nest-application-context.ts

@@ -10,6 +10,7 @@ import {
   DynamicModule,
   GetOrResolveOptions,
   SelectOptions,
+  ShutdownHooksOptions,
   Type,
 } from '@nestjs/common/interfaces';
 import { NestApplicationContextOptions } from '@nestjs/common/interfaces/nest-application-context-options.interface';
@@ -37,9 +38,9 @@ import { Module } from './injector/module';
  * @publicApi
  */
 export class NestApplicationContext<
-    TOptions extends
-      NestApplicationContextOptions = NestApplicationContextOptions,
-  >
+  TOptions extends NestApplicationContextOptions =
+    NestApplicationContextOptions,
+>
   extends AbstractInstanceResolver
   implements INestApplicationContext
 {
@@ -316,10 +317,14 @@ export class NestApplicationContext<
    * process receives a shutdown signal.
    *
    * @param {ShutdownSignal[]} [signals=[]] The system signals it should listen to
+   * @param {ShutdownHooksOptions} [options={}] Options for configuring shutdown hooks behavior
    *
    * @returns {this} The Nest application context instance
    */
-  public enableShutdownHooks(signals: (ShutdownSignal | string)[] = []): this {
+  public enableShutdownHooks(
+    signals: (ShutdownSignal | string)[] = [],
+    options: ShutdownHooksOptions = {},
+  ): this {
     if (isEmpty(signals)) {
       signals = Object.keys(ShutdownSignal).map(
         (key: string) => ShutdownSignal[key],
@@ -336,7 +341,7 @@ export class NestApplicationContext<
       .filter(signal => !this.activeShutdownSignals.includes(signal))
       .toArray();
 
-    this.listenToShutdownSignals(signals);
+    this.listenToShutdownSignals(signals, options);
     return this;
   }
 
@@ -351,8 +356,12 @@ export class NestApplicationContext<
    * process events
    *
    * @param {string[]} signals The system signals it should listen to
+   * @param {ShutdownHooksOptions} options Options for configuring shutdown hooks behavior
    */
-  protected listenToShutdownSignals(signals: string[]) {
+  protected listenToShutdownSignals(
+    signals: string[],
+    options: ShutdownHooksOptions = {},
+  ) {
     let receivedSignal = false;
     const cleanup = async (signal: string) => {
       try {
@@ -368,7 +377,15 @@ export class NestApplicationContext<
         await this.dispose();
         await this.callShutdownHook(signal);
         signals.forEach(sig => process.removeListener(sig, cleanup));
-        process.kill(process.pid, signal);
+
+        if (options.useProcessExit) {
+          // Use process.exit() to ensure the 'exit' event is properly triggered.
+          // This is required for async loggers (like Pino with transports)
+          // to flush their buffers before the process terminates.
+          process.exit(0);
+        } else {
+          process.kill(process.pid, signal);
+        }
       } catch (err) {
         Logger.error(
           MESSAGES.ERROR_DURING_SHUTDOWN,

packages/core/nest-application.ts

@@ -394,6 +394,9 @@ export class NestApplication
   }
 
   public useGlobalFilters(...filters: ExceptionFilter[]): this {
+    filters = this.applyInstanceDecoratorIfRegistered<ExceptionFilter>(
+      ...filters,
+    );
     this.config.useGlobalFilters(...filters);
     filters.forEach(item =>
       this.graphInspector.insertOrphanedEnhancer({
@@ -405,6 +408,9 @@ export class NestApplication
   }
 
   public useGlobalPipes(...pipes: PipeTransform<any>[]): this {
+    pipes = this.applyInstanceDecoratorIfRegistered<PipeTransform<any>>(
+      ...pipes,
+    );
     this.config.useGlobalPipes(...pipes);
     pipes.forEach(item =>
       this.graphInspector.insertOrphanedEnhancer({
@@ -416,6 +422,9 @@ export class NestApplication
   }
 
   public useGlobalInterceptors(...interceptors: NestInterceptor[]): this {
+    interceptors = this.applyInstanceDecoratorIfRegistered<NestInterceptor>(
+      ...interceptors,
+    );
     this.config.useGlobalInterceptors(...interceptors);
     interceptors.forEach(item =>
       this.graphInspector.insertOrphanedEnhancer({
@@ -427,6 +436,7 @@ export class NestApplication
   }
 
   public useGlobalGuards(...guards: CanActivate[]): this {
+    guards = this.applyInstanceDecoratorIfRegistered<CanActivate>(...guards);
     this.config.useGlobalGuards(...guards);
     guards.forEach(item =>
       this.graphInspector.insertOrphanedEnhancer({
@@ -474,4 +484,14 @@ export class NestApplication
       instance,
     );
   }
+
+  private applyInstanceDecoratorIfRegistered<T>(...instances: T[]): T[] {
+    if (this.appOptions.instrument?.instanceDecorator) {
+      return instances.map(
+        instance =>
+          this.appOptions.instrument!.instanceDecorator(instance) as T,
+      );
+    }
+    return instances;
+  }
 }

packages/core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nestjs/core",
-  "version": "11.1.8",
+  "version": "11.1.14",
   "description": "Nest - modern, fast, powerful node.js web framework (@core)",
   "author": "Kamil Mysliwiec",
   "license": "MIT",
@@ -39,7 +39,7 @@
     "uid": "2.0.2"
   },
   "devDependencies": {
-    "@nestjs/common": "11.1.8"
+    "@nestjs/common": "11.1.14"
   },
   "peerDependencies": {
     "@nestjs/common": "^11.0.0",
@@ -59,5 +59,6 @@
     "@nestjs/platform-express": {
       "optional": true
     }
-  }
+  },
+  "gitHead": "bcb4747f7598a9d2655c8184a6d729ebefa07fbd"
 }

packages/core/router/router-execution-context.ts

@@ -434,7 +434,7 @@ export class RouterExecutionContext {
     }
     const isSseHandler = !!this.reflectSse(callback);
     if (isSseHandler) {
-      return <
+      return async <
         TResult extends Observable<unknown> = any,
         TResponse extends HeaderStream = any,
         TRequest extends IncomingMessage = any,
@@ -443,7 +443,7 @@ export class RouterExecutionContext {
         res: TResponse,
         req: TRequest,
       ) => {
-        this.responseController.sse(
+        await this.responseController.sse(
           result,
           (res as any).raw || res,
           (req as any).raw || req,

packages/core/router/router-response-controller.ts

@@ -99,12 +99,12 @@ export class RouterResponseController {
     this.applicationRef.status(response, statusCode);
   }
 
-  public sse<
+  public async sse<
     TInput extends Observable<unknown> = any,
     TResponse extends WritableHeaderStream = any,
     TRequest extends IncomingMessage = any,
   >(
-    result: TInput,
+    result: TInput | Promise<TInput>,
     response: TResponse,
     request: TRequest,
     options?: { additionalHeaders: AdditionalHeaders },
@@ -114,12 +114,22 @@ export class RouterResponseController {
       return;
     }
 
-    this.assertObservable(result);
+    const observableResult = await Promise.resolve(result);
+
+    this.assertObservable(observableResult);
 
     const stream = new SseStream(request);
-    stream.pipe(response, options);
 
-    const subscription = result
+    // Extract custom status code from response if it was set
+    const customStatusCode = (response as any).statusCode;
+    const pipeOptions =
+      typeof customStatusCode !== 'undefined'
+        ? { ...options, statusCode: customStatusCode }
+        : options;
+
+    stream.pipe(response, pipeOptions);
+
+    const subscription = observableResult
       .pipe(
         map((message): MessageEvent => {
           if (isObject(message)) {

packages/core/router/sse-stream.ts

@@ -66,11 +66,13 @@ export class SseStream extends Transform {
     destination: T,
     options?: {
       additionalHeaders?: AdditionalHeaders;
+      statusCode?: number;
       end?: boolean;
     },
   ): T {
     if (destination.writeHead) {
-      destination.writeHead(200, {
+      const statusCode = options?.statusCode ?? 200;
+      destination.writeHead(statusCode, {
         ...options?.additionalHeaders,
         // See https://github.com/dunglas/mercure/blob/master/hub/subscribe.go#L124-L130
         'Content-Type': 'text/event-stream',

packages/core/test/discovery/discoverable-meta-host-collection.spec.ts

@@ -0,0 +1,424 @@
+import { expect } from 'chai';
+import { InstanceWrapper } from '../../injector/instance-wrapper';
+import { ModulesContainer } from '../../injector/modules-container';
+import { DiscoverableMetaHostCollection } from '../../discovery/discoverable-meta-host-collection';
+
+describe('DiscoverableMetaHostCollection', () => {
+  beforeEach(() => {
+    // Clear the metaHostLinks map before each test
+    DiscoverableMetaHostCollection.metaHostLinks.clear();
+  });
+
+  describe('addClassMetaHostLink', () => {
+    it('should add a link between a class reference and a metadata key', () => {
+      class TestClass {}
+      const metadataKey = 'test-meta-key';
+
+      DiscoverableMetaHostCollection.addClassMetaHostLink(
+        TestClass,
+        metadataKey,
+      );
+
+      expect(DiscoverableMetaHostCollection.metaHostLinks.get(TestClass)).to.eq(
+        metadataKey,
+      );
+    });
+
+    it('should overwrite existing link for the same class', () => {
+      class TestClass {}
+
+      DiscoverableMetaHostCollection.addClassMetaHostLink(TestClass, 'key1');
+      DiscoverableMetaHostCollection.addClassMetaHostLink(TestClass, 'key2');
+
+      expect(DiscoverableMetaHostCollection.metaHostLinks.get(TestClass)).to.eq(
+        'key2',
+      );
+    });
+  });
+
+  describe('insertByMetaKey', () => {
+    it('should create a new set when metaKey does not exist in collection', () => {
+      const collection = new Map<string, Set<InstanceWrapper>>();
+      const instanceWrapper = new InstanceWrapper({
+        token: 'TestToken',
+        name: 'TestProvider',
+      });
+      const metaKey = 'test-key';
+
+      DiscoverableMetaHostCollection.insertByMetaKey(
+        metaKey,
+        instanceWrapper,
+        collection,
+      );
+
+      expect(collection.has(metaKey)).to.be.true;
+      expect(collection.get(metaKey)!.has(instanceWrapper)).to.be.true;
+      expect(collection.get(metaKey)!.size).to.eq(1);
+    });
+
+    it('should add to existing set when metaKey already exists', () => {
+      const collection = new Map<string, Set<InstanceWrapper>>();
+      const instanceWrapper1 = new InstanceWrapper({
+        token: 'TestToken1',
+        name: 'TestProvider1',
+      });
+      const instanceWrapper2 = new InstanceWrapper({
+        token: 'TestToken2',
+        name: 'TestProvider2',
+      });
+      const metaKey = 'test-key';
+
+      DiscoverableMetaHostCollection.insertByMetaKey(
+        metaKey,
+        instanceWrapper1,
+        collection,
+      );
+      DiscoverableMetaHostCollection.insertByMetaKey(
+        metaKey,
+        instanceWrapper2,
+        collection,
+      );
+
+      expect(collection.get(metaKey)!.size).to.eq(2);
+      expect(collection.get(metaKey)!.has(instanceWrapper1)).to.be.true;
+      expect(collection.get(metaKey)!.has(instanceWrapper2)).to.be.true;
+    });
+  });
+
+  describe('getProvidersByMetaKey', () => {
+    it('should return empty set when hostContainerRef is not registered', () => {
+      const hostContainerRef = new ModulesContainer();
+      const metaKey = 'test-key';
+
+      const result = DiscoverableMetaHostCollection.getProvidersByMetaKey(
+        hostContainerRef,
+        metaKey,
+      );
+
+      expect(result).to.be.instanceOf(Set);
+      expect(result.size).to.eq(0);
+    });
+
+    it('should return empty set when metaKey is not found', () => {
+      const hostContainerRef = new ModulesContainer();
+      class TestClass {}
+
+      // Register a provider with a different metaKey
+      DiscoverableMetaHostCollection.addClassMetaHostLink(
+        TestClass,
+        'other-key',
+      );
+      const instanceWrapper = new InstanceWrapper({
+        token: TestClass,
+        name: 'TestProvider',
+        metatype: TestClass,
+      });
+      DiscoverableMetaHostCollection.inspectProvider(
+        hostContainerRef,
+        instanceWrapper,
+      );
+
+      const result = DiscoverableMetaHostCollection.getProvidersByMetaKey(
+        hostContainerRef,
+        'non-existent-key',
+      );
+
+      expect(result).to.be.instanceOf(Set);
+      expect(result.size).to.eq(0);
+    });
+
+    it('should return providers with matching metaKey', () => {
+      const hostContainerRef = new ModulesContainer();
+      class TestClass {}
+      const metaKey = 'test-key';
+
+      DiscoverableMetaHostCollection.addClassMetaHostLink(TestClass, metaKey);
+      const instanceWrapper = new InstanceWrapper({
+        token: TestClass,
+        name: 'TestProvider',
+        metatype: TestClass,
+      });
+      DiscoverableMetaHostCollection.inspectProvider(
+        hostContainerRef,
+        instanceWrapper,
+      );
+
+      const result = DiscoverableMetaHostCollection.getProvidersByMetaKey(
+        hostContainerRef,
+        metaKey,
+      );
+
+      expect(result.size).to.eq(1);
+      expect(result.has(instanceWrapper)).to.be.true;
+    });
+  });
+
+  describe('getControllersByMetaKey', () => {
+    it('should return empty set when hostContainerRef is not registered', () => {
+      const hostContainerRef = new ModulesContainer();
+      const metaKey = 'test-key';
+
+      const result = DiscoverableMetaHostCollection.getControllersByMetaKey(
+        hostContainerRef,
+        metaKey,
+      );
+
+      expect(result).to.be.instanceOf(Set);
+      expect(result.size).to.eq(0);
+    });
+
+    it('should return controllers with matching metaKey', () => {
+      const hostContainerRef = new ModulesContainer();
+      class TestController {}
+      const metaKey = 'controller-key';
+
+      DiscoverableMetaHostCollection.addClassMetaHostLink(
+        TestController,
+        metaKey,
+      );
+      const instanceWrapper = new InstanceWrapper({
+        token: TestController,
+        name: 'TestController',
+        metatype: TestController,
+      });
+      DiscoverableMetaHostCollection.inspectController(
+        hostContainerRef,
+        instanceWrapper,
+      );
+
+      const result = DiscoverableMetaHostCollection.getControllersByMetaKey(
+        hostContainerRef,
+        metaKey,
+      );
+
+      expect(result.size).to.eq(1);
+      expect(result.has(instanceWrapper)).to.be.true;
+    });
+  });
+
+  describe('inspectProvider', () => {
+    it('should not add provider when no metaKey is linked', () => {
+      const hostContainerRef = new ModulesContainer();
+      class UnlinkedClass {}
+
+      const instanceWrapper = new InstanceWrapper({
+        token: UnlinkedClass,
+        name: 'UnlinkedProvider',
+        metatype: UnlinkedClass,
+      });
+
+      DiscoverableMetaHostCollection.inspectProvider(
+        hostContainerRef,
+        instanceWrapper,
+      );
+
+      const result = DiscoverableMetaHostCollection.getProvidersByMetaKey(
+        hostContainerRef,
+        'any-key',
+      );
+      expect(result.size).to.eq(0);
+    });
+
+    it('should add provider when metaKey is linked', () => {
+      const hostContainerRef = new ModulesContainer();
+      class LinkedClass {}
+      const metaKey = 'linked-key';
+
+      DiscoverableMetaHostCollection.addClassMetaHostLink(LinkedClass, metaKey);
+      const instanceWrapper = new InstanceWrapper({
+        token: LinkedClass,
+        name: 'LinkedProvider',
+        metatype: LinkedClass,
+      });
+
+      DiscoverableMetaHostCollection.inspectProvider(
+        hostContainerRef,
+        instanceWrapper,
+      );
+
+      const result = DiscoverableMetaHostCollection.getProvidersByMetaKey(
+        hostContainerRef,
+        metaKey,
+      );
+      expect(result.size).to.eq(1);
+      expect(result.has(instanceWrapper)).to.be.true;
+    });
+
+    it('should not add provider when metatype is null and inject is not provided (useValue without inject)', () => {
+      const hostContainerRef = new ModulesContainer();
+      class ValueClass {}
+      const metaKey = 'value-key';
+
+      DiscoverableMetaHostCollection.addClassMetaHostLink(ValueClass, metaKey);
+      const instance = new ValueClass();
+      const instanceWrapper = new InstanceWrapper({
+        token: 'VALUE_TOKEN',
+        name: 'ValueProvider',
+        metatype: null as any,
+        instance,
+      });
+
+      DiscoverableMetaHostCollection.inspectProvider(
+        hostContainerRef,
+        instanceWrapper,
+      );
+
+      // When metatype is null and inject is not provided, the provider cannot be resolved
+      // because the code uses `metatype || inject` condition for performance optimization
+      const result = DiscoverableMetaHostCollection.getProvidersByMetaKey(
+        hostContainerRef,
+        metaKey,
+      );
+      expect(result.size).to.eq(0);
+    });
+
+    it('should use instance constructor when metatype is null but inject is provided', () => {
+      const hostContainerRef = new ModulesContainer();
+      class ValueClass {}
+      const metaKey = 'value-key';
+
+      DiscoverableMetaHostCollection.addClassMetaHostLink(ValueClass, metaKey);
+      const instance = new ValueClass();
+      const instanceWrapper = new InstanceWrapper({
+        token: 'VALUE_TOKEN',
+        name: 'ValueProvider',
+        metatype: null as any,
+        inject: [], // Providing inject (even empty) makes the condition truthy
+        instance,
+      });
+
+      DiscoverableMetaHostCollection.inspectProvider(
+        hostContainerRef,
+        instanceWrapper,
+      );
+
+      const result = DiscoverableMetaHostCollection.getProvidersByMetaKey(
+        hostContainerRef,
+        metaKey,
+      );
+      expect(result.size).to.eq(1);
+    });
+
+    it('should use instance constructor when inject is provided (useFactory)', () => {
+      const hostContainerRef = new ModulesContainer();
+      class FactoryResultClass {}
+      const metaKey = 'factory-key';
+
+      DiscoverableMetaHostCollection.addClassMetaHostLink(
+        FactoryResultClass,
+        metaKey,
+      );
+      const instance = new FactoryResultClass();
+      const instanceWrapper = new InstanceWrapper({
+        token: 'FACTORY_TOKEN',
+        name: 'FactoryProvider',
+        metatype: () => instance,
+        inject: ['DEP1', 'DEP2'],
+        instance,
+      });
+
+      DiscoverableMetaHostCollection.inspectProvider(
+        hostContainerRef,
+        instanceWrapper,
+      );
+
+      const result = DiscoverableMetaHostCollection.getProvidersByMetaKey(
+        hostContainerRef,
+        metaKey,
+      );
+      expect(result.size).to.eq(1);
+    });
+  });
+
+  describe('inspectController', () => {
+    it('should not add controller when no metaKey is linked', () => {
+      const hostContainerRef = new ModulesContainer();
+      class UnlinkedController {}
+
+      const instanceWrapper = new InstanceWrapper({
+        token: UnlinkedController,
+        name: 'UnlinkedController',
+        metatype: UnlinkedController,
+      });
+
+      DiscoverableMetaHostCollection.inspectController(
+        hostContainerRef,
+        instanceWrapper,
+      );
+
+      const result = DiscoverableMetaHostCollection.getControllersByMetaKey(
+        hostContainerRef,
+        'any-key',
+      );
+      expect(result.size).to.eq(0);
+    });
+
+    it('should add controller when metaKey is linked', () => {
+      const hostContainerRef = new ModulesContainer();
+      class LinkedController {}
+      const metaKey = 'linked-controller-key';
+
+      DiscoverableMetaHostCollection.addClassMetaHostLink(
+        LinkedController,
+        metaKey,
+      );
+      const instanceWrapper = new InstanceWrapper({
+        token: LinkedController,
+        name: 'LinkedController',
+        metatype: LinkedController,
+      });
+
+      DiscoverableMetaHostCollection.inspectController(
+        hostContainerRef,
+        instanceWrapper,
+      );
+
+      const result = DiscoverableMetaHostCollection.getControllersByMetaKey(
+        hostContainerRef,
+        metaKey,
+      );
+      expect(result.size).to.eq(1);
+      expect(result.has(instanceWrapper)).to.be.true;
+    });
+  });
+
+  describe('inspectInstanceWrapper with existing collection', () => {
+    it('should add to existing collection when hostContainerRef is already registered', () => {
+      const hostContainerRef = new ModulesContainer();
+      class TestClass1 {}
+      class TestClass2 {}
+      const metaKey = 'shared-key';
+
+      DiscoverableMetaHostCollection.addClassMetaHostLink(TestClass1, metaKey);
+      DiscoverableMetaHostCollection.addClassMetaHostLink(TestClass2, metaKey);
+
+      const instanceWrapper1 = new InstanceWrapper({
+        token: TestClass1,
+        name: 'TestProvider1',
+        metatype: TestClass1,
+      });
+      const instanceWrapper2 = new InstanceWrapper({
+        token: TestClass2,
+        name: 'TestProvider2',
+        metatype: TestClass2,
+      });
+
+      DiscoverableMetaHostCollection.inspectProvider(
+        hostContainerRef,
+        instanceWrapper1,
+      );
+      DiscoverableMetaHostCollection.inspectProvider(
+        hostContainerRef,
+        instanceWrapper2,
+      );
+
+      const result = DiscoverableMetaHostCollection.getProvidersByMetaKey(
+        hostContainerRef,
+        metaKey,
+      );
+      expect(result.size).to.eq(2);
+      expect(result.has(instanceWrapper1)).to.be.true;
+      expect(result.has(instanceWrapper2)).to.be.true;
+    });
+  });
+});

packages/core/test/discovery/discovery-service.spec.ts

@@ -0,0 +1,539 @@
+import { expect } from 'chai';
+import * as sinon from 'sinon';
+import { DiscoveryService } from '../../discovery/discovery-service';
+import { InstanceWrapper } from '../../injector/instance-wrapper';
+import { Module } from '../../injector/module';
+import { ModulesContainer } from '../../injector/modules-container';
+import { DiscoverableMetaHostCollection } from '../../discovery/discoverable-meta-host-collection';
+
+describe('DiscoveryService', () => {
+  let discoveryService: DiscoveryService;
+  let modulesContainer: ModulesContainer;
+  let sandbox: sinon.SinonSandbox;
+
+  beforeEach(() => {
+    modulesContainer = new ModulesContainer();
+    discoveryService = new DiscoveryService(modulesContainer);
+    sandbox = sinon.createSandbox();
+  });
+
+  afterEach(() => {
+    sandbox.restore();
+  });
+
+  describe('createDecorator', () => {
+    it('should create a decorator with a unique KEY', () => {
+      const decorator1 = DiscoveryService.createDecorator();
+      const decorator2 = DiscoveryService.createDecorator();
+
+      expect(decorator1.KEY).to.be.a('string');
+      expect(decorator2.KEY).to.be.a('string');
+      expect(decorator1.KEY).to.not.equal(decorator2.KEY);
+    });
+
+    it('should create a decorator that can decorate classes', () => {
+      const TestDecorator = DiscoveryService.createDecorator<{
+        value: string;
+      }>();
+
+      @TestDecorator({ value: 'test' })
+      class TestClass {}
+
+      const metadata = Reflect.getMetadata(TestDecorator.KEY, TestClass);
+      expect(metadata).to.deep.equal({ value: 'test' });
+    });
+
+    it('should create a decorator that can decorate methods', () => {
+      const TestDecorator = DiscoveryService.createDecorator<{
+        event: string;
+      }>();
+
+      class TestClass {
+        @TestDecorator({ event: 'click' })
+        handleClick() {}
+      }
+
+      const metadata = Reflect.getMetadata(
+        TestDecorator.KEY,
+        new TestClass().handleClick,
+      );
+      expect(metadata).to.deep.equal({ event: 'click' });
+    });
+
+    it('should use empty object as default metadata when no options provided', () => {
+      const TestDecorator = DiscoveryService.createDecorator();
+
+      @TestDecorator()
+      class TestClass {}
+
+      const metadata = Reflect.getMetadata(TestDecorator.KEY, TestClass);
+      expect(metadata).to.deep.equal({});
+    });
+
+    it('should add class to DiscoverableMetaHostCollection when decorating a class', () => {
+      const addClassMetaHostLinkSpy = sandbox.spy(
+        DiscoverableMetaHostCollection,
+        'addClassMetaHostLink',
+      );
+      const TestDecorator = DiscoveryService.createDecorator();
+
+      @TestDecorator()
+      class TestClass {}
+
+      expect(addClassMetaHostLinkSpy.calledOnce).to.be.true;
+      expect(addClassMetaHostLinkSpy.calledWith(TestClass, TestDecorator.KEY))
+        .to.be.true;
+    });
+
+    it('should not add to DiscoverableMetaHostCollection when decorating a method', () => {
+      const addClassMetaHostLinkSpy = sandbox.spy(
+        DiscoverableMetaHostCollection,
+        'addClassMetaHostLink',
+      );
+      const TestDecorator = DiscoveryService.createDecorator();
+
+      class TestClass {
+        @TestDecorator()
+        testMethod() {}
+      }
+
+      expect(addClassMetaHostLinkSpy.called).to.be.false;
+    });
+  });
+
+  describe('getProviders', () => {
+    it('should return all providers from all modules when no options provided', () => {
+      const module1 = new Module(class Module1 {}, modulesContainer as any);
+      const module2 = new Module(class Module2 {}, modulesContainer as any);
+
+      // Clear default providers
+      module1.providers.clear();
+      module2.providers.clear();
+
+      const provider1 = new InstanceWrapper({
+        name: 'Provider1',
+        token: 'PROVIDER_1',
+      });
+      const provider2 = new InstanceWrapper({
+        name: 'Provider2',
+        token: 'PROVIDER_2',
+      });
+      const provider3 = new InstanceWrapper({
+        name: 'Provider3',
+        token: 'PROVIDER_3',
+      });
+
+      module1.providers.set('PROVIDER_1', provider1);
+      module1.providers.set('PROVIDER_2', provider2);
+      module2.providers.set('PROVIDER_3', provider3);
+
+      modulesContainer.set('Module1', module1);
+      modulesContainer.set('Module2', module2);
+
+      const providers = discoveryService.getProviders();
+
+      expect(providers).to.have.lengthOf(3);
+      expect(providers).to.include(provider1);
+      expect(providers).to.include(provider2);
+      expect(providers).to.include(provider3);
+    });
+
+    it('should return empty array when no modules exist', () => {
+      const providers = discoveryService.getProviders();
+      expect(providers).to.be.an('array').that.is.empty;
+    });
+
+    it('should return empty array when modules have no providers', () => {
+      const module1 = new Module(class Module1 {}, modulesContainer as any);
+      module1.providers.clear();
+      modulesContainer.set('Module1', module1);
+
+      const providers = discoveryService.getProviders();
+      expect(providers).to.be.an('array').that.is.empty;
+    });
+
+    it('should filter providers by metadataKey when provided', () => {
+      const metadataKey = 'test-metadata-key';
+      const provider1 = new InstanceWrapper({
+        name: 'Provider1',
+        token: 'PROVIDER_1',
+      });
+      const provider2 = new InstanceWrapper({
+        name: 'Provider2',
+        token: 'PROVIDER_2',
+      });
+
+      const providerSet = new Set([provider1, provider2]);
+      const getProvidersByMetaKeyStub = sandbox
+        .stub(DiscoverableMetaHostCollection, 'getProvidersByMetaKey')
+        .returns(providerSet);
+
+      const providers = discoveryService.getProviders({ metadataKey });
+
+      expect(getProvidersByMetaKeyStub.calledOnce).to.be.true;
+      expect(
+        getProvidersByMetaKeyStub.calledWith(modulesContainer, metadataKey),
+      ).to.be.true;
+      expect(providers).to.have.lengthOf(2);
+      expect(providers).to.include(provider1);
+      expect(providers).to.include(provider2);
+    });
+
+    it('should return empty array when no providers match the metadataKey', () => {
+      const metadataKey = 'non-existent-key';
+      const emptySet = new Set<InstanceWrapper>();
+
+      sandbox
+        .stub(DiscoverableMetaHostCollection, 'getProvidersByMetaKey')
+        .returns(emptySet);
+
+      const providers = discoveryService.getProviders({ metadataKey });
+      expect(providers).to.be.an('array').that.is.empty;
+    });
+
+    it('should filter providers by included modules', () => {
+      class Module1 {}
+      class Module2 {}
+      class Module3 {}
+
+      const module1 = new Module(Module1, modulesContainer as any);
+      const module2 = new Module(Module2, modulesContainer as any);
+      const module3 = new Module(Module3, modulesContainer as any);
+
+      // Clear default providers
+      module1.providers.clear();
+      module2.providers.clear();
+      module3.providers.clear();
+
+      const provider1 = new InstanceWrapper({
+        name: 'Provider1',
+        token: 'PROVIDER_1',
+      });
+      const provider2 = new InstanceWrapper({
+        name: 'Provider2',
+        token: 'PROVIDER_2',
+      });
+      const provider3 = new InstanceWrapper({
+        name: 'Provider3',
+        token: 'PROVIDER_3',
+      });
+
+      module1.providers.set('PROVIDER_1', provider1);
+      module2.providers.set('PROVIDER_2', provider2);
+      module3.providers.set('PROVIDER_3', provider3);
+
+      modulesContainer.set('Module1', module1);
+      modulesContainer.set('Module2', module2);
+      modulesContainer.set('Module3', module3);
+
+      const providers = discoveryService.getProviders({
+        include: [Module1, Module2],
+      });
+
+      expect(providers).to.have.lengthOf(2);
+      expect(providers).to.include(provider1);
+      expect(providers).to.include(provider2);
+      expect(providers).to.not.include(provider3);
+    });
+
+    it('should return empty array when include option is empty array', () => {
+      const module1 = new Module(class Module1 {}, modulesContainer as any);
+      const provider1 = new InstanceWrapper({
+        name: 'Provider1',
+        token: 'PROVIDER_1',
+      });
+      module1.providers.set('PROVIDER_1', provider1);
+      modulesContainer.set('Module1', module1);
+
+      const providers = discoveryService.getProviders({ include: [] });
+      expect(providers).to.be.an('array').that.is.empty;
+    });
+  });
+
+  describe('getControllers', () => {
+    it('should return all controllers from all modules when no options provided', () => {
+      const module1 = new Module(class Module1 {}, modulesContainer as any);
+      const module2 = new Module(class Module2 {}, modulesContainer as any);
+
+      const controller1 = new InstanceWrapper({
+        name: 'Controller1',
+        token: 'CONTROLLER_1',
+      });
+      const controller2 = new InstanceWrapper({
+        name: 'Controller2',
+        token: 'CONTROLLER_2',
+      });
+
+      module1.controllers.set('CONTROLLER_1', controller1);
+      module2.controllers.set('CONTROLLER_2', controller2);
+
+      modulesContainer.set('Module1', module1);
+      modulesContainer.set('Module2', module2);
+
+      const controllers = discoveryService.getControllers();
+
+      expect(controllers).to.have.lengthOf(2);
+      expect(controllers).to.include(controller1);
+      expect(controllers).to.include(controller2);
+    });
+
+    it('should return empty array when no controllers exist', () => {
+      const module1 = new Module(class Module1 {}, modulesContainer as any);
+      modulesContainer.set('Module1', module1);
+
+      const controllers = discoveryService.getControllers();
+      expect(controllers).to.be.an('array').that.is.empty;
+    });
+
+    it('should filter controllers by metadataKey when provided', () => {
+      const metadataKey = 'controller-metadata-key';
+      const controller1 = new InstanceWrapper({
+        name: 'Controller1',
+        token: 'CONTROLLER_1',
+      });
+
+      const controllerSet = new Set([controller1]);
+      const getControllersByMetaKeyStub = sandbox
+        .stub(DiscoverableMetaHostCollection, 'getControllersByMetaKey')
+        .returns(controllerSet);
+
+      const controllers = discoveryService.getControllers({ metadataKey });
+
+      expect(getControllersByMetaKeyStub.calledOnce).to.be.true;
+      expect(
+        getControllersByMetaKeyStub.calledWith(modulesContainer, metadataKey),
+      ).to.be.true;
+      expect(controllers).to.have.lengthOf(1);
+      expect(controllers).to.include(controller1);
+    });
+
+    it('should filter controllers by included modules', () => {
+      class Module1 {}
+      class Module2 {}
+
+      const module1 = new Module(Module1, modulesContainer as any);
+      const module2 = new Module(Module2, modulesContainer as any);
+
+      const controller1 = new InstanceWrapper({
+        name: 'Controller1',
+        token: 'CONTROLLER_1',
+      });
+      const controller2 = new InstanceWrapper({
+        name: 'Controller2',
+        token: 'CONTROLLER_2',
+      });
+
+      module1.controllers.set('CONTROLLER_1', controller1);
+      module2.controllers.set('CONTROLLER_2', controller2);
+
+      modulesContainer.set('Module1', module1);
+      modulesContainer.set('Module2', module2);
+
+      const controllers = discoveryService.getControllers({
+        include: [Module1],
+      });
+
+      expect(controllers).to.have.lengthOf(1);
+      expect(controllers).to.include(controller1);
+      expect(controllers).to.not.include(controller2);
+    });
+  });
+
+  describe('getMetadataByDecorator', () => {
+    it('should retrieve metadata from class using decorator', () => {
+      const TestDecorator = DiscoveryService.createDecorator<{
+        role: string;
+      }>();
+
+      @TestDecorator({ role: 'admin' })
+      class TestClass {}
+
+      const instance = new TestClass();
+      const wrapper = new InstanceWrapper({
+        name: 'TestClass',
+        token: TestClass,
+        metatype: TestClass,
+        instance,
+      });
+
+      const metadata = discoveryService.getMetadataByDecorator(
+        TestDecorator,
+        wrapper,
+      );
+
+      expect(metadata).to.deep.equal({ role: 'admin' });
+    });
+
+    it('should retrieve metadata from method using decorator and methodKey', () => {
+      const TestDecorator = DiscoveryService.createDecorator<{
+        event: string;
+      }>();
+
+      class TestClass {
+        @TestDecorator({ event: 'created' })
+        onCreate() {}
+      }
+
+      const instance = new TestClass();
+      const wrapper = new InstanceWrapper({
+        name: 'TestClass',
+        token: TestClass,
+        metatype: TestClass,
+        instance,
+      });
+
+      const metadata = discoveryService.getMetadataByDecorator(
+        TestDecorator,
+        wrapper,
+        'onCreate',
+      );
+
+      expect(metadata).to.deep.equal({ event: 'created' });
+    });
+
+    it('should return undefined when metadata does not exist', () => {
+      const TestDecorator = DiscoveryService.createDecorator();
+
+      class TestClass {}
+
+      const instance = new TestClass();
+      const wrapper = new InstanceWrapper({
+        name: 'TestClass',
+        token: TestClass,
+        metatype: TestClass,
+        instance,
+      });
+
+      const metadata = discoveryService.getMetadataByDecorator(
+        TestDecorator,
+        wrapper,
+      );
+
+      expect(metadata).to.be.undefined;
+    });
+
+    it('should return undefined when methodKey does not exist on instance', () => {
+      const TestDecorator = DiscoveryService.createDecorator();
+
+      class TestClass {
+        existingMethod() {}
+      }
+
+      const instance = new TestClass();
+      const wrapper = new InstanceWrapper({
+        name: 'TestClass',
+        token: TestClass,
+        metatype: TestClass,
+        instance,
+      });
+
+      const metadata = discoveryService.getMetadataByDecorator(
+        TestDecorator,
+        wrapper,
+        'existingMethod', // Use existing method to avoid undefined reference error
+      );
+
+      expect(metadata).to.be.undefined;
+    });
+
+    it('should use metatype when instance.constructor is undefined', () => {
+      const TestDecorator = DiscoveryService.createDecorator<{
+        value: number;
+      }>();
+
+      @TestDecorator({ value: 42 })
+      class TestClass {}
+
+      const instanceWithoutConstructor: any = Object.create(null);
+
+      const wrapper = new InstanceWrapper({
+        name: 'TestClass',
+        token: TestClass,
+        metatype: TestClass,
+        instance: instanceWithoutConstructor,
+      });
+
+      const metadata = discoveryService.getMetadataByDecorator(
+        TestDecorator,
+        wrapper,
+      );
+
+      expect(metadata).to.deep.equal({ value: 42 });
+    });
+
+    it('should handle undefined instance gracefully', () => {
+      const TestDecorator = DiscoveryService.createDecorator<{
+        test: string;
+      }>();
+
+      @TestDecorator({ test: 'value' })
+      class TestClass {}
+
+      const wrapper = new InstanceWrapper({
+        name: 'TestClass',
+        token: TestClass,
+        metatype: TestClass,
+        instance: undefined,
+      });
+
+      const metadata = discoveryService.getMetadataByDecorator(
+        TestDecorator,
+        wrapper,
+      );
+
+      expect(metadata).to.deep.equal({ test: 'value' });
+    });
+  });
+
+  describe('getModules', () => {
+    it('should return all modules when no options provided', () => {
+      const module1 = new Module(class Module1 {}, modulesContainer as any);
+      const module2 = new Module(class Module2 {}, modulesContainer as any);
+
+      modulesContainer.set('Module1', module1);
+      modulesContainer.set('Module2', module2);
+
+      const modules = (discoveryService as any).getModules();
+
+      expect(modules).to.have.lengthOf(2);
+      expect(modules).to.include(module1);
+      expect(modules).to.include(module2);
+    });
+
+    it('should return empty array when no modules exist', () => {
+      const modules = (discoveryService as any).getModules();
+      expect(modules).to.be.an('array').that.is.empty;
+    });
+
+    it('should filter modules by include option', () => {
+      class Module1 {}
+      class Module2 {}
+      class Module3 {}
+
+      const module1 = new Module(Module1, modulesContainer as any);
+      const module2 = new Module(Module2, modulesContainer as any);
+      const module3 = new Module(Module3, modulesContainer as any);
+
+      modulesContainer.set('Module1', module1);
+      modulesContainer.set('Module2', module2);
+      modulesContainer.set('Module3', module3);
+
+      const modules = (discoveryService as any).getModules({
+        include: [Module1, Module3],
+      });
+
+      expect(modules).to.have.lengthOf(2);
+      expect(modules).to.include(module1);
+      expect(modules).to.include(module3);
+      expect(modules).to.not.include(module2);
+    });
+
+    it('should return empty array when include option is empty', () => {
+      const module1 = new Module(class Module1 {}, modulesContainer as any);
+      modulesContainer.set('Module1', module1);
+
+      const modules = (discoveryService as any).getModules({ include: [] });
+      expect(modules).to.be.an('array').that.is.empty;
+    });
+  });
+});

packages/core/test/injector/helpers/silent-logger.spec.ts

@@ -0,0 +1,52 @@
+import { expect } from 'chai';
+import { Logger } from '@nestjs/common';
+import { SilentLogger } from '../../../injector/helpers/silent-logger';
+
+describe('SilentLogger', () => {
+  let silentLogger: SilentLogger;
+
+  beforeEach(() => {
+    silentLogger = new SilentLogger();
+  });
+
+  it('should be an instance of Logger', () => {
+    expect(silentLogger).to.be.instanceOf(Logger);
+  });
+
+  describe('logging methods', () => {
+    it('should have log method that does nothing', () => {
+      expect(() => silentLogger.log()).to.not.throw();
+      expect(silentLogger.log()).to.be.undefined;
+    });
+
+    it('should have error method that does nothing', () => {
+      expect(() => silentLogger.error()).to.not.throw();
+      expect(silentLogger.error()).to.be.undefined;
+    });
+
+    it('should have warn method that does nothing', () => {
+      expect(() => silentLogger.warn()).to.not.throw();
+      expect(silentLogger.warn()).to.be.undefined;
+    });
+
+    it('should have debug method that does nothing', () => {
+      expect(() => silentLogger.debug()).to.not.throw();
+      expect(silentLogger.debug()).to.be.undefined;
+    });
+
+    it('should have verbose method that does nothing', () => {
+      expect(() => silentLogger.verbose()).to.not.throw();
+      expect(silentLogger.verbose()).to.be.undefined;
+    });
+
+    it('should have fatal method that does nothing', () => {
+      expect(() => silentLogger.fatal()).to.not.throw();
+      expect(silentLogger.fatal()).to.be.undefined;
+    });
+
+    it('should have setLogLevels method that does nothing', () => {
+      expect(() => silentLogger.setLogLevels()).to.not.throw();
+      expect(silentLogger.setLogLevels()).to.be.undefined;
+    });
+  });
+});

packages/core/test/injector/injector.spec.ts

@@ -11,6 +11,7 @@ import { NestContainer } from '../../injector/container';
 import { Injector, PropertyDependency } from '../../injector/injector';
 import { InstanceWrapper } from '../../injector/instance-wrapper';
 import { Module } from '../../injector/module';
+import { SettlementSignal } from '../../injector/settlement-signal';
 
 chai.use(chaiAsPromised);
 
@@ -546,6 +547,34 @@ describe('Injector', () => {
         expect(result.instance).to.be.true;
       });
     });
+
+    describe('when instanceWrapper has forward ref and is in non-static context', () => {
+      it('should call settlementSignal.error when loadProvider throws', async () => {
+        const error = new Error('Test error');
+        const settlementSignal = new SettlementSignal();
+        const errorSpy = sinon.spy(settlementSignal, 'error');
+
+        const wrapper = new InstanceWrapper({
+          isResolved: false,
+          forwardRef: true,
+        });
+        wrapper.settlementSignal = settlementSignal;
+
+        const contextId = { id: 2 };
+        const instanceHost = wrapper.getInstanceByContextId(contextId);
+        instanceHost.donePromise = Promise.resolve();
+
+        sinon
+          .stub(injector, 'loadProvider')
+          .callsFake(() => Promise.reject(error));
+
+        await injector.resolveComponentHost(module, wrapper, contextId);
+        await new Promise(resolve => setImmediate(resolve));
+
+        expect(errorSpy.calledOnce).to.be.true;
+        expect(errorSpy.calledWith(error)).to.be.true;
+      });
+    });
   });
 
   describe('applyProperties', () => {

packages/core/test/injector/nested-transient-isolation.spec.ts

@@ -190,4 +190,83 @@ describe('Nested Transient Isolation', () => {
       );
     });
   });
+
+  describe('when DEFAULT scoped provider depends on nested TRANSIENT chain', () => {
+    @Injectable({ scope: Scope.TRANSIENT })
+    class NestedTransientService {
+      public static constructorCalled = false;
+      public readonly value = 'nested-initialized';
+
+      constructor() {
+        NestedTransientService.constructorCalled = true;
+      }
+    }
+
+    @Injectable({ scope: Scope.TRANSIENT })
+    class TransientService {
+      public static constructorCalled = false;
+
+      constructor(public readonly nested: NestedTransientService) {
+        TransientService.constructorCalled = true;
+      }
+    }
+
+    @Injectable()
+    class DefaultScopedParent {
+      constructor(public readonly transient: TransientService) {}
+    }
+
+    let nestedTransientWrapper: InstanceWrapper;
+    let transientWrapper: InstanceWrapper;
+    let parentWrapper: InstanceWrapper;
+
+    beforeEach(() => {
+      NestedTransientService.constructorCalled = false;
+      TransientService.constructorCalled = false;
+
+      nestedTransientWrapper = new InstanceWrapper({
+        name: NestedTransientService.name,
+        token: NestedTransientService,
+        metatype: NestedTransientService,
+        scope: Scope.TRANSIENT,
+        host: module,
+      });
+
+      transientWrapper = new InstanceWrapper({
+        name: TransientService.name,
+        token: TransientService,
+        metatype: TransientService,
+        scope: Scope.TRANSIENT,
+        host: module,
+      });
+
+      parentWrapper = new InstanceWrapper({
+        name: DefaultScopedParent.name,
+        token: DefaultScopedParent,
+        metatype: DefaultScopedParent,
+        scope: Scope.DEFAULT,
+        host: module,
+      });
+
+      module.providers.set(NestedTransientService, nestedTransientWrapper);
+      module.providers.set(TransientService, transientWrapper);
+      module.providers.set(DefaultScopedParent, parentWrapper);
+    });
+
+    it('should instantiate nested TRANSIENT providers from DEFAULT scope', async () => {
+      await injector.loadInstance(parentWrapper, module.providers, module);
+
+      const parentInstance = parentWrapper.instance;
+
+      expect(TransientService.constructorCalled).to.be.true;
+      expect(NestedTransientService.constructorCalled).to.be.true;
+      expect(parentInstance.transient).to.be.instanceOf(TransientService);
+      expect(parentInstance.transient.nested).to.be.instanceOf(
+        NestedTransientService,
+      );
+      expect(parentInstance.transient.nested.value).to.equal(
+        'nested-initialized',
+      );
+    });
+  });
 });

packages/core/test/injector/topology-tree/tree-node.spec.ts

@@ -0,0 +1,160 @@
+import { expect } from 'chai';
+import { TreeNode } from '../../../injector/topology-tree/tree-node';
+
+describe('TreeNode', () => {
+  describe('constructor', () => {
+    it('should create a node with the given value', () => {
+      const node = new TreeNode({ value: 'test', parent: null });
+      expect(node.value).to.equal('test');
+    });
+
+    it('should create a node with null parent', () => {
+      const node = new TreeNode({ value: 'test', parent: null });
+      expect(node.children.size).to.equal(0);
+    });
+
+    it('should create a node with a parent', () => {
+      const parent = new TreeNode({ value: 'parent', parent: null });
+      const child = new TreeNode({ value: 'child', parent });
+      expect(child.value).to.equal('child');
+    });
+  });
+
+  describe('addChild', () => {
+    it('should add a child to the node', () => {
+      const parent = new TreeNode({ value: 'parent', parent: null });
+      const child = new TreeNode({ value: 'child', parent: null });
+
+      parent.addChild(child);
+
+      expect(parent.children.has(child)).to.be.true;
+      expect(parent.children.size).to.equal(1);
+    });
+
+    it('should add multiple children', () => {
+      const parent = new TreeNode({ value: 'parent', parent: null });
+      const child1 = new TreeNode({ value: 'child1', parent: null });
+      const child2 = new TreeNode({ value: 'child2', parent: null });
+
+      parent.addChild(child1);
+      parent.addChild(child2);
+
+      expect(parent.children.size).to.equal(2);
+    });
+  });
+
+  describe('removeChild', () => {
+    it('should remove a child from the node', () => {
+      const parent = new TreeNode({ value: 'parent', parent: null });
+      const child = new TreeNode({ value: 'child', parent: null });
+
+      parent.addChild(child);
+      parent.removeChild(child);
+
+      expect(parent.children.has(child)).to.be.false;
+      expect(parent.children.size).to.equal(0);
+    });
+
+    it('should do nothing when removing a non-existent child', () => {
+      const parent = new TreeNode({ value: 'parent', parent: null });
+      const child = new TreeNode({ value: 'child', parent: null });
+
+      parent.removeChild(child);
+
+      expect(parent.children.size).to.equal(0);
+    });
+  });
+
+  describe('relink', () => {
+    it('should change the parent of a node', () => {
+      const oldParent = new TreeNode({ value: 'oldParent', parent: null });
+      const newParent = new TreeNode({ value: 'newParent', parent: null });
+      const child = new TreeNode({ value: 'child', parent: oldParent });
+
+      oldParent.addChild(child);
+      child.relink(newParent);
+
+      expect(oldParent.children.has(child)).to.be.false;
+      expect(newParent.children.has(child)).to.be.true;
+    });
+
+    it('should work when node has no previous parent', () => {
+      const newParent = new TreeNode({ value: 'newParent', parent: null });
+      const child = new TreeNode({ value: 'child', parent: null });
+
+      child.relink(newParent);
+
+      expect(newParent.children.has(child)).to.be.true;
+    });
+  });
+
+  describe('getDepth', () => {
+    it('should return 1 for a root node', () => {
+      const root = new TreeNode({ value: 'root', parent: null });
+      expect(root.getDepth()).to.equal(1);
+    });
+
+    it('should return 2 for a child of root', () => {
+      const root = new TreeNode({ value: 'root', parent: null });
+      const child = new TreeNode({ value: 'child', parent: root });
+      expect(child.getDepth()).to.equal(2);
+    });
+
+    it('should return correct depth for deeply nested nodes', () => {
+      const root = new TreeNode({ value: 'root', parent: null });
+      const level1 = new TreeNode({ value: 'level1', parent: root });
+      const level2 = new TreeNode({ value: 'level2', parent: level1 });
+      const level3 = new TreeNode({ value: 'level3', parent: level2 });
+
+      expect(level3.getDepth()).to.equal(4);
+    });
+
+    it('should return -1 when a cycle is detected', () => {
+      const nodeA = new TreeNode({ value: 'a', parent: null });
+      const nodeB = new TreeNode({ value: 'b', parent: nodeA });
+      const nodeC = new TreeNode({ value: 'c', parent: nodeB });
+
+      // Create cycle: A -> B -> C -> A
+      nodeA.relink(nodeC);
+
+      expect(nodeA.getDepth()).to.equal(-1);
+    });
+  });
+
+  describe('hasCycleWith', () => {
+    it('should return false when there is no cycle', () => {
+      const root = new TreeNode({ value: 'root', parent: null });
+      const child = new TreeNode({ value: 'child', parent: root });
+
+      expect(child.hasCycleWith('nonexistent')).to.be.false;
+    });
+
+    it('should return true when the target value exists in the parent chain', () => {
+      const root = new TreeNode({ value: 'root', parent: null });
+      const child = new TreeNode({ value: 'child', parent: root });
+
+      expect(child.hasCycleWith('root')).to.be.true;
+    });
+
+    it('should return true when checking against own value', () => {
+      const node = new TreeNode({ value: 'self', parent: null });
+      expect(node.hasCycleWith('self')).to.be.true;
+    });
+
+    it('should return false for root node with non-matching value', () => {
+      const root = new TreeNode({ value: 'root', parent: null });
+      expect(root.hasCycleWith('other')).to.be.false;
+    });
+
+    it('should return false when cycle exists but target not in chain', () => {
+      const nodeA = new TreeNode({ value: 'a', parent: null });
+      const nodeB = new TreeNode({ value: 'b', parent: nodeA });
+      const nodeC = new TreeNode({ value: 'c', parent: nodeB });
+
+      // Create cycle: A -> B -> C -> A
+      nodeA.relink(nodeC);
+
+      expect(nodeA.hasCycleWith('nonexistent')).to.be.false;
+    });
+  });
+});

packages/core/test/nest-application-context.spec.ts

@@ -1,4 +1,4 @@
-import { InjectionToken, Provider, Scope } from '@nestjs/common';
+import { Injectable, InjectionToken, Provider, Scope } from '@nestjs/common';
 import { expect } from 'chai';
 import * as sinon from 'sinon';
 import { setTimeout } from 'timers/promises';
@@ -154,6 +154,56 @@ describe('NestApplicationContext', () => {
 
       clock.restore();
     });
+
+    it('should use process.exit when useProcessExit option is enabled', async () => {
+      const signal = 'SIGTERM';
+      const applicationContext = await testHelper(A, Scope.DEFAULT);
+
+      const processExitStub = sinon.stub(process, 'exit');
+      const processKillStub = sinon.stub(process, 'kill');
+
+      applicationContext.enableShutdownHooks([signal], {
+        useProcessExit: true,
+      });
+
+      const hookStub = sinon
+        .stub(applicationContext as any, 'callShutdownHook')
+        .callsFake(async () => undefined);
+
+      const shutdownCleanupRef = applicationContext['shutdownCleanupRef']!;
+      await shutdownCleanupRef(signal);
+
+      hookStub.restore();
+      processExitStub.restore();
+      processKillStub.restore();
+
+      expect(processExitStub.calledOnceWith(0)).to.be.true;
+      expect(processKillStub.called).to.be.false;
+    });
+
+    it('should use process.kill when useProcessExit option is not enabled', async () => {
+      const signal = 'SIGTERM';
+      const applicationContext = await testHelper(A, Scope.DEFAULT);
+
+      const processExitStub = sinon.stub(process, 'exit');
+      const processKillStub = sinon.stub(process, 'kill');
+
+      applicationContext.enableShutdownHooks([signal]);
+
+      const hookStub = sinon
+        .stub(applicationContext as any, 'callShutdownHook')
+        .callsFake(async () => undefined);
+
+      const shutdownCleanupRef = applicationContext['shutdownCleanupRef']!;
+      await shutdownCleanupRef(signal);
+
+      hookStub.restore();
+      processExitStub.restore();
+      processKillStub.restore();
+
+      expect(processKillStub.calledOnceWith(process.pid, signal)).to.be.true;
+      expect(processExitStub.called).to.be.false;
+    });
   });
 
   describe('get', () => {
@@ -375,4 +425,124 @@ describe('NestApplicationContext', () => {
       });
     });
   });
+
+  describe('implicit request scope via enhancers', () => {
+    it('get() should throw when dependency tree is not static (request-scoped enhancer attached)', async () => {
+      class Host {}
+      @Injectable({ scope: Scope.REQUEST })
+      class ReqScopedPipe {}
+
+      const nestContainer = new NestContainer();
+      const injector = new Injector();
+      const instanceLoader = new InstanceLoader(
+        nestContainer,
+        injector,
+        new GraphInspector(nestContainer),
+      );
+      const { moduleRef } = (await nestContainer.addModule(class T {}, []))!;
+
+      // Register Host as a controller (matches real-world controller case)
+      nestContainer.addController(Host, moduleRef.token);
+
+      // Register a request-scoped injectable and attach it as an enhancer to Host
+      // This simulates a method-level pipe/guard/interceptor making Host implicitly request-scoped
+      nestContainer.addInjectable(ReqScopedPipe, moduleRef.token, 'pipe', Host);
+
+      const modules = nestContainer.getModules();
+      await instanceLoader.createInstancesOfDependencies(modules);
+
+      const appCtx = new NestApplicationContext(nestContainer);
+
+      // With a non-static dependency tree, get() should refuse and instruct to use resolve()
+      expect(() => appCtx.get(Host)).to.throw();
+    });
+
+    it('resolve() should instantiate when dependency tree is not static (request-scoped enhancer attached)', async () => {
+      class Host {}
+      @Injectable({ scope: Scope.REQUEST })
+      class ReqScopedPipe {}
+
+      const nestContainer = new NestContainer();
+      const injector = new Injector();
+      const instanceLoader = new InstanceLoader(
+        nestContainer,
+        injector,
+        new GraphInspector(nestContainer),
+      );
+      const { moduleRef } = (await nestContainer.addModule(class T {}, []))!;
+
+      // Register Host as a controller
+      nestContainer.addController(Host, moduleRef.token);
+
+      nestContainer.addInjectable(ReqScopedPipe, moduleRef.token, 'pipe', Host);
+
+      const modules = nestContainer.getModules();
+      await instanceLoader.createInstancesOfDependencies(modules);
+
+      const appCtx = new NestApplicationContext(nestContainer);
+
+      const instance = await appCtx.resolve(Host);
+      expect(instance).instanceOf(Host);
+    });
+  });
+
+  describe('resolve with each: true', () => {
+    it('should resolve all default-scoped providers registered under the same token', async () => {
+      class Service1 {}
+      class Service2 {}
+      class Service3 {}
+      const TOKEN = 'MULTI_TOKEN';
+
+      const nestContainer = new NestContainer();
+      const injector = new Injector();
+      const instanceLoader = new InstanceLoader(
+        nestContainer,
+        injector,
+        new GraphInspector(nestContainer),
+      );
+
+      // Create three modules, each with a provider under the same token
+      const { moduleRef: module1 } = (await nestContainer.addModule(
+        class Module1 {},
+        [],
+      ))!;
+      const { moduleRef: module2 } = (await nestContainer.addModule(
+        class Module2 {},
+        [],
+      ))!;
+      const { moduleRef: module3 } = (await nestContainer.addModule(
+        class Module3 {},
+        [],
+      ))!;
+
+      nestContainer.addProvider(
+        { provide: TOKEN, useClass: Service1 },
+        module1.token,
+      );
+      nestContainer.addProvider(
+        { provide: TOKEN, useClass: Service2 },
+        module2.token,
+      );
+      nestContainer.addProvider(
+        { provide: TOKEN, useClass: Service3 },
+        module3.token,
+      );
+
+      const modules = nestContainer.getModules();
+      await instanceLoader.createInstancesOfDependencies(modules);
+
+      const appCtx = new NestApplicationContext(nestContainer);
+
+      const instances = await appCtx.resolve(TOKEN, undefined, {
+        strict: false,
+        each: true,
+      });
+
+      expect(instances).to.be.an('array');
+      expect(instances).to.have.length(3);
+      expect(instances[0]).to.be.instanceOf(Service1);
+      expect(instances[1]).to.be.instanceOf(Service2);
+      expect(instances[2]).to.be.instanceOf(Service3);
+    });
+  });
 });

packages/core/test/router/router-response-controller.spec.ts

@@ -263,7 +263,7 @@ describe('RouterResponseController', () => {
     it('should accept only observables', async () => {
       const result = Promise.resolve('test');
       try {
-        routerResponseController.sse(
+        await routerResponseController.sse(
           result as unknown as any,
           {} as unknown as ServerResponse,
           {} as unknown as IncomingMessage,
@@ -275,6 +275,76 @@ describe('RouterResponseController', () => {
       }
     });
 
+    it('should accept Promise<Observable>', async () => {
+      class Sink extends Writable {
+        private readonly chunks: string[] = [];
+
+        _write(
+          chunk: any,
+          encoding: string,
+          callback: (error?: Error | null) => void,
+        ): void {
+          this.chunks.push(chunk);
+          callback();
+        }
+
+        get content() {
+          return this.chunks.join('');
+        }
+      }
+
+      const written = (stream: Writable) =>
+        new Promise((resolve, reject) =>
+          stream.on('error', reject).on('finish', resolve),
+        );
+
+      const result = Promise.resolve(of('test'));
+      const response = new Sink();
+      const request = new PassThrough();
+      await routerResponseController.sse(
+        result,
+        response as unknown as ServerResponse,
+        request as unknown as IncomingMessage,
+      );
+      request.destroy();
+      await written(response);
+      expect(response.content).to.eql(
+        `
+id: 1
+data: test
+
+`,
+      );
+    });
+
+    it('should use custom status code from response', async () => {
+      class SinkWithStatusCode extends Writable {
+        statusCode = 404;
+        writeHead = sinon.spy();
+        flushHeaders = sinon.spy();
+
+        _write(
+          chunk: any,
+          encoding: string,
+          callback: (error?: Error | null) => void,
+        ): void {
+          callback();
+        }
+      }
+
+      const result = of('test');
+      const response = new SinkWithStatusCode();
+      const request = new PassThrough();
+      await routerResponseController.sse(
+        result,
+        response as unknown as ServerResponse,
+        request as unknown as IncomingMessage,
+      );
+
+      expect(response.writeHead.firstCall.args[0]).to.equal(404);
+      request.destroy();
+    });
+
     it('should write string', async () => {
       class Sink extends Writable {
         private readonly chunks: string[] = [];
@@ -301,7 +371,7 @@ describe('RouterResponseController', () => {
       const result = of('test');
       const response = new Sink();
       const request = new PassThrough();
-      routerResponseController.sse(
+      void routerResponseController.sse(
         result,
         response as unknown as ServerResponse,
         request as unknown as IncomingMessage,
@@ -326,7 +396,7 @@ data: test
       const request = new Writable();
       request._write = () => {};
 
-      routerResponseController.sse(
+      void routerResponseController.sse(
         result,
         response as unknown as ServerResponse,
         request as unknown as IncomingMessage,
@@ -343,7 +413,7 @@ data: test
       const request = new Writable();
       request._write = () => {};
 
-      routerResponseController.sse(
+      void routerResponseController.sse(
         result,
         response as unknown as ServerResponse,
         request as unknown as IncomingMessage,
@@ -360,7 +430,7 @@ data: test
       request._write = () => {};
 
       try {
-        routerResponseController.sse(
+        void routerResponseController.sse(
           result as unknown as Observable<string>,
           response as unknown as ServerResponse,
           request as unknown as IncomingMessage,
@@ -423,7 +493,7 @@ data: test
         const request = new Writable();
         request._write = () => {};
 
-        routerResponseController.sse(
+        void routerResponseController.sse(
           result,
           response as unknown as ServerResponse,
           request as unknown as IncomingMessage,
@@ -450,7 +520,7 @@ data: test
         const request = new Writable();
         request._write = () => {};
 
-        routerResponseController.sse(
+        void routerResponseController.sse(
           result,
           response as unknown as ServerResponse,
           request as unknown as IncomingMessage,
@@ -485,7 +555,7 @@ data: test
         const result = new Subject();
         const response = new Sink();
         const request = new PassThrough();
-        routerResponseController.sse(
+        void routerResponseController.sse(
           result,
           response as unknown as ServerResponse,
           request as unknown as IncomingMessage,

packages/core/test/router/sse-stream.spec.ts

@@ -160,6 +160,34 @@ data: hello
     });
   });
 
+  it('sets custom status code when provided', callback => {
+    const sse = new SseStream();
+    const sink = new Sink(
+      (status: number, headers: string | OutgoingHttpHeaders) => {
+        expect(status).to.equal(404);
+        callback();
+        return sink;
+      },
+    );
+
+    sse.pipe(sink, {
+      statusCode: 404,
+    });
+  });
+
+  it('defaults to 200 status code when not provided', callback => {
+    const sse = new SseStream();
+    const sink = new Sink(
+      (status: number, headers: string | OutgoingHttpHeaders) => {
+        expect(status).to.equal(200);
+        callback();
+        return sink;
+      },
+    );
+
+    sse.pipe(sink);
+  });
+
   it('allows an eventsource to connect', callback => {
     let sse: SseStream;
     const server = createServer((req, res) => {

packages/microservices/Readme.md

@@ -1,5 +1,5 @@
 <p align="center">
-  <a href="https://nestjs.com/" target="blank"><img src="https://nestjs.com/img/logo-small.svg" width="120" alt="Nest Logo" /></a>
+  <a href="https://nestjs.com/" target="_blank"><img src="https://nestjs.com/img/logo-small.svg" width="120" alt="Nest Logo" /></a>
 </p>
 
 [circleci-image]: https://img.shields.io/circleci/build/github/nestjs/nest/master?token=abc123def456
@@ -49,7 +49,7 @@ Please make sure to read the [Issue Reporting Checklist](https://github.com/nest
 
 ## Consulting
 
-With official support, you can get expert help straight from Nest core team. We provide dedicated technical support, migration strategies, advice on best practices (and design decisions), PR reviews, and team augmentation. Read more about [support here](https://enterprise.nestjs.com).
+With official support, you can get expert help straight from the Nest core team. We provide dedicated technical support, migration strategies, advice on best practices (and design decisions), PR reviews, and team augmentation. Read more about [support here](https://enterprise.nestjs.com).
 
 ## Support
 
@@ -63,6 +63,7 @@ Nest is an MIT-licensed open source project. It can grow thanks to the sponsors
 <td><a href="https://microsoft.com/" target="_blank"><img src="https://nestjs.com/img/logos/microsoft-logo.png" width="180" valign="middle" /></a></td>
 <td><a href="https://mojam.co" target="_blank"><img src="https://nestjs.com/img/logos/mojam-logo.png" width="80" valign="middle" /></a></td>
 <td><a href="https://valor-software.com/" target="_blank"><img src="https://docs.nestjs.com/assets/sponsors/valor-software.png" width="170" valign="middle" /></a></td>
+<td><a href="https://serpapi.com/" target="_blank"><img src="https://nestjs.com/img/logos/serpapi-logo.png" width="150" valign="middle" /></a></td>
 </tr>
 </table>
 
@@ -92,6 +93,8 @@ Nest is an MIT-licensed open source project. It can grow thanks to the sponsors
 <td align="center" valign="middle"><a href="https://www.itflashcards.com/" target="_blank"><img src="https://nestjs.com/img/logos/it_flashcards-logo.png" width="170" valign="middle" /></a></td>
 <td align="center" valign="middle"><a href="https://arcjet.com/?ref=nestjs" target="_blank"><img src="https://nestjs.com/img/logos/arcjet-logo.svg" width="170" valign="middle" /></a></td>
 <td align="center" valign="middle"><a href="https://crawljobs.com" target="_blank"><img src="https://nestjs.com/img/logos/crawljobs-logo.svg" width="130" valign="middle" /></a></td>
+</tr><tr>
+<td align="center" valign="middle"><a href="https://pandektes.com" target="_blank"><img src="https://nestjs.com/img/logos/pandektes-logo.png" width="65" valign="middle" /></a></td>
 </tr>
 </table>
 

packages/microservices/client/client-nats.ts

@@ -151,7 +151,7 @@ export class ClientNats extends ClientProxy<NatsEvents, NatsStatus> {
     EventKey extends keyof NatsEvents = keyof NatsEvents,
     EventCallback extends NatsEvents[EventKey] = NatsEvents[EventKey],
   >(event: EventKey, callback: EventCallback) {
-    this.statusEventEmitter.on(event, callback as any);
+    this.statusEventEmitter.on(event as string | symbol, callback as any);
   }
 
   public unwrap<T>(): T {

packages/microservices/client/client-tcp.ts

@@ -19,6 +19,7 @@ export class ClientTCP extends ClientProxy<TcpEvents, TcpStatus> {
   protected readonly host: string;
   protected readonly socketClass: Type<TcpSocket>;
   protected readonly tlsOptions?: ConnectionOptions;
+  protected readonly maxBufferSize?: number;
   protected socket: TcpSocket | null = null;
   protected connectionPromise: Promise<any> | null = null;
   protected pendingEventListeners: Array<{
@@ -32,6 +33,7 @@ export class ClientTCP extends ClientProxy<TcpEvents, TcpStatus> {
     this.host = this.getOptionsProp(options, 'host', TCP_DEFAULT_HOST);
     this.socketClass = this.getOptionsProp(options, 'socketClass', JsonSocket);
     this.tlsOptions = this.getOptionsProp(options, 'tlsOptions');
+    this.maxBufferSize = this.getOptionsProp(options, 'maxBufferSize');
 
     this.initializeSerializer(options);
     this.initializeDeserializer(options);
@@ -108,6 +110,13 @@ export class ClientTCP extends ClientProxy<TcpEvents, TcpStatus> {
     } else {
       socket = new net.Socket();
     }
+    // Pass maxBufferSize only if socketClass is JsonSocket
+    // For custom socket classes, users should handle maxBufferSize in their own implementation
+    if (this.maxBufferSize !== undefined && this.socketClass === JsonSocket) {
+      return new this.socketClass(socket, {
+        maxBufferSize: this.maxBufferSize,
+      });
+    }
     return new this.socketClass(socket);
   }
 

packages/microservices/context/request-context-host.ts

@@ -7,8 +7,7 @@ import { RequestContext } from '../interfaces';
 export class RequestContextHost<
   TData = any,
   TContext extends BaseRpcContext = any,
-> implements RequestContext<TData>
-{
+> implements RequestContext<TData> {
   constructor(
     public readonly pattern: string | Record<string, any>,
     public readonly data: TData,

packages/microservices/decorators/message-pattern.decorator.ts

@@ -152,16 +152,18 @@ export function GrpcStreamMethod(
 
     // Override original method to call the "drainBuffer" method on the first parameter
     // This is required to avoid premature message emission
-    descriptor.value = async function (
-      this: any,
-      observable: any,
-      ...args: any[]
-    ) {
-      const result = await Promise.resolve(
-        originalMethod.apply(this, [observable, ...args]),
-      );
+    descriptor.value = function (this: any, observable: any, ...args: any[]) {
+      const result = originalMethod.apply(this, [observable, ...args]);
+      const isPromise = result && typeof result.then === 'function';
+      if (isPromise) {
+        return result.then((data: any) => {
+          if (observable && observable.drainBuffer) {
+            observable.drainBuffer();
+          }
+          return data;
+        });
+      }
 
-      // Drain buffer if "drainBuffer" method is available
       if (observable && observable.drainBuffer) {
         observable.drainBuffer();
       }

packages/microservices/deserializers/kafka-response.deserializer.ts

@@ -5,9 +5,10 @@ import { Deserializer, IncomingResponse } from '../interfaces';
 /**
  * @publicApi
  */
-export class KafkaResponseDeserializer
-  implements Deserializer<any, IncomingResponse>
-{
+export class KafkaResponseDeserializer implements Deserializer<
+  any,
+  IncomingResponse
+> {
   deserialize(message: any, options?: Record<string, any>): IncomingResponse {
     const id = message.headers[KafkaHeaders.CORRELATION_ID].toString();
     if (!isUndefined(message.headers[KafkaHeaders.NEST_ERR])) {

packages/microservices/exceptions/base-rpc-exception-filter.ts

@@ -12,9 +12,10 @@ import { RpcException } from './rpc-exception';
 /**
  * @publicApi
  */
-export class BaseRpcExceptionFilter<T = any, R = any>
-  implements RpcExceptionFilter<T>
-{
+export class BaseRpcExceptionFilter<
+  T = any,
+  R = any,
+> implements RpcExceptionFilter<T> {
   private static readonly logger = new Logger('RpcExceptionsHandler');
 
   public catch(exception: T, host: ArgumentsHost): Observable<R> {

packages/microservices/helpers/json-socket.ts

@@ -4,7 +4,11 @@ import { CorruptedPacketLengthException } from '../errors/corrupted-packet-lengt
 import { MaxPacketLengthExceededException } from '../errors/max-packet-length-exceeded.exception';
 import { TcpSocket } from './tcp-socket';
 
-const MAX_BUFFER_SIZE = (512 * 1024 * 1024) / 4; // 512 MBs in characters with 4 bytes per character (32-bit)
+const DEFAULT_MAX_BUFFER_SIZE = (512 * 1024 * 1024) / 4; // 512 MBs in characters with 4 bytes per character (32-bit)
+
+export interface JsonSocketOptions {
+  maxBufferSize?: number;
+}
 
 export class JsonSocket extends TcpSocket {
   private contentLength: number | null = null;
@@ -12,6 +16,12 @@ export class JsonSocket extends TcpSocket {
 
   private readonly stringDecoder = new StringDecoder();
   private readonly delimiter = '#';
+  private readonly maxBufferSize: number;
+
+  constructor(socket: any, options?: JsonSocketOptions) {
+    super(socket);
+    this.maxBufferSize = options?.maxBufferSize ?? DEFAULT_MAX_BUFFER_SIZE;
+  }
 
   protected handleSend(message: any, callback?: (err?: any) => void) {
     this.socket.write(this.formatMessageData(message), 'utf-8', callback);
@@ -23,7 +33,7 @@ export class JsonSocket extends TcpSocket {
       : dataRaw;
     this.buffer += data;
 
-    if (this.buffer.length > MAX_BUFFER_SIZE) {
+    if (this.buffer.length > this.maxBufferSize) {
       const bufferLength = this.buffer.length;
       this.buffer = '';
       throw new MaxPacketLengthExceededException(bufferLength);

packages/microservices/interfaces/client-kafka-proxy.interface.ts

@@ -6,8 +6,10 @@ import {
   TopicPartitionOffsetAndMetadata,
 } from '../external/kafka.interface';
 
-export interface ClientKafkaProxy
-  extends Omit<ClientProxy<never, KafkaStatus>, 'on'> {
+export interface ClientKafkaProxy extends Omit<
+  ClientProxy<never, KafkaStatus>,
+  'on'
+> {
   /**
    * Reference to the Kafka consumer instance.
    */

packages/microservices/interfaces/client-metadata.interface.ts

@@ -43,5 +43,10 @@ export interface TcpClientOptions {
     deserializer?: Deserializer;
     tlsOptions?: ConnectionOptions;
     socketClass?: Type<TcpSocket>;
+    /**
+     * Maximum buffer size in characters (default: 128MB in characters, i.e., (512 * 1024 * 1024) / 4).
+     * This limit prevents memory exhaustion when receiving large TCP messages.
+     */
+    maxBufferSize?: number;
   };
 }

packages/microservices/interfaces/microservice-configuration.interface.ts

@@ -109,6 +109,11 @@ export interface TcpOptions {
     tlsOptions?: TlsOptions;
     deserializer?: Deserializer;
     socketClass?: Type<TcpSocket>;
+    /**
+     * Maximum buffer size in characters (default: 128MB in characters, i.e., (512 * 1024 * 1024) / 4).
+     * This limit prevents memory exhaustion when receiving large TCP messages.
+     */
+    maxBufferSize?: number;
   };
 }
 
@@ -334,6 +339,11 @@ export interface KafkaOptions {
     postfixId?: string;
     client?: KafkaConfig;
     consumer?: ConsumerConfig;
+    /**
+     * Options passed to KafkaJS consumer.run().
+     * Note: `partitionsConsumedConcurrently` (KafkaJS parameter) controls
+     * concurrent processing at the partition level (not topic level).
+     */
     run?: Omit<ConsumerRunConfig, 'eachBatch' | 'eachMessage'>;
     subscribe?: Omit<ConsumerSubscribeTopics, 'topics'>;
     producer?: ProducerConfig;

packages/microservices/microservices-module.ts

@@ -21,8 +21,8 @@ import { ListenersController } from './listeners-controller';
 import { Server } from './server/server';
 
 export class MicroservicesModule<
-  TAppOptions extends
-    NestApplicationContextOptions = NestApplicationContextOptions,
+  TAppOptions extends NestApplicationContextOptions =
+    NestApplicationContextOptions,
 > {
   private readonly clientsContainer = new ClientsContainer();
   private listenersController: ListenersController;

packages/microservices/module/interfaces/clients-module.interface.ts

@@ -18,8 +18,10 @@ export interface ClientsModuleOptionsFactory {
   createClientOptions(): Promise<ClientProvider> | ClientProvider;
 }
 
-export interface ClientsProviderAsyncOptions
-  extends Pick<ModuleMetadata, 'imports'> {
+export interface ClientsProviderAsyncOptions extends Pick<
+  ModuleMetadata,
+  'imports'
+> {
   useExisting?: Type<ClientsModuleOptionsFactory>;
   useClass?: Type<ClientsModuleOptionsFactory>;
   useFactory?: (...args: any[]) => Promise<ClientProvider> | ClientProvider;

packages/microservices/nest-microservice.ts

@@ -170,6 +170,10 @@ export class NestMicroservice
         'Cannot apply global exception filters: registration must occur before initialization.',
       );
     }
+
+    filters = this.applyInstanceDecoratorIfRegistered<ExceptionFilter>(
+      ...filters,
+    );
     this.applicationConfig.useGlobalFilters(...filters);
     filters.forEach(item =>
       this.graphInspector.insertOrphanedEnhancer({
@@ -191,6 +195,10 @@ export class NestMicroservice
         'Global pipes registered after initialization will not be applied.',
       );
     }
+
+    pipes = this.applyInstanceDecoratorIfRegistered<PipeTransform<any>>(
+      ...pipes,
+    );
     this.applicationConfig.useGlobalPipes(...pipes);
     pipes.forEach(item =>
       this.graphInspector.insertOrphanedEnhancer({
@@ -212,6 +220,10 @@ export class NestMicroservice
         'Cannot apply global interceptors: registration must occur before initialization.',
       );
     }
+
+    interceptors = this.applyInstanceDecoratorIfRegistered<NestInterceptor>(
+      ...interceptors,
+    );
     this.applicationConfig.useGlobalInterceptors(...interceptors);
     interceptors.forEach(item =>
       this.graphInspector.insertOrphanedEnhancer({
@@ -228,6 +240,8 @@ export class NestMicroservice
         'Cannot apply global guards: registration must occur before initialization.',
       );
     }
+
+    guards = this.applyInstanceDecoratorIfRegistered<CanActivate>(...guards);
     this.applicationConfig.useGlobalGuards(...guards);
     guards.forEach(item =>
       this.graphInspector.insertOrphanedEnhancer({
@@ -354,4 +368,14 @@ export class NestMicroservice
     );
     return config.useFactory(...args);
   }
+
+  private applyInstanceDecoratorIfRegistered<T>(...instances: T[]): T[] {
+    if (this.appOptions.instrument?.instanceDecorator) {
+      return instances.map(
+        instance =>
+          this.appOptions.instrument!.instanceDecorator(instance) as T,
+      );
+    }
+    return instances;
+  }
 }