Skip to main content
interlace
Plugin: nestjs-security

Changelog

Release history and version updates for eslint-plugin-nestjs-security

Generated from the release history

Built from this package's CHANGELOG.md at deploy time, so it matches the version these docs describe. The full cross-package history lives on the changelog.

3.1.3

  • FixThe README logo now links to the plugin's own documentation.

3.1.2

  • FixNestJS gates resolve a subscripted member
  • Dependenciesupdated workspace dependencies: @interlace/eslint-devkit@1.19.0

3.1.1

  • FixAdd an install-size badge to the README prelude, linking to each package's packagephobia page. npm renders the README from the last publish, so a badge only appears on npmjs.com after a release.
  • Dependenciesupdated workspace dependencies: @interlace/eslint-devkit@1.18.2

3.1.0

  • Featureno-permissive-cors takes environmentHintNames
  • Dependenciesupdated workspace dependencies: @interlace/eslint-devkit@1.18.0

3.0.1

  • Fixpoint meta.docs.url at documentation that exists #683
  • Dependenciesupdated workspace dependencies: @interlace/eslint-devkit@1.17.2

3.0.0

  • Share one SDK-evidence probe, and gate the last plugin that had none #502
  • DependenciesUpdated internal dependencies

2.3.0

  • Fix a false negative in no-permissive-cors and add no-unsafe-multer-filename. #435
  • Correct the declared ESLint floor: ^8.0.0 → ^8.40.0. #407
  • Test infrastructure only — no rule, config, or API behavior changes. These #329
  • Correct the ESLint peer range shown in the README Compatibility table. #423
  • DependenciesUpdated internal dependencies

2.2.0

  • no-res-bypass-serialization no longer reports without evidence of a serializer #419
  • no-hybrid-app-config-loss reports an accurate CWE and severity #419
  • require-guards reported the wrong CWE at the wrong severity on every finding. #410
  • require-guards recognises an in-handler check against a configured secret #421

2.1.1

  • Ship the JavaScript without tsc's layout. #411
  • DependenciesUpdated internal dependencies

2.1.0

  • New rule `no-hybrid-app-config-loss` (CWE-284), and an honest severity for #380
  • DependenciesUpdated internal dependencies

2.0.2

  • Document every rule option, and add description to the schemas that had none #383
  • Load rule modules on demand instead of at plugin load. #381
  • Declare what we support, load only what we use #381
  • Fix the ./oxlint subpath export, which pointed at src/oxlint.js — a file no build produces. require('<package>/oxlint') threw MODULE_NOT_FOUND on every published package, while every README documented that exact wiring for oxlint's jsPlugins. The export now points at the build output, dist/src/oxlint.js. #335
  • Fix SDK peer declarations that npm silently ignored #335
  • DependenciesUpdated internal dependencies

2.0.1

  • Add the ecosystem and oxlint marks to the README logo row. Each plugin now #364

2.0.0

  • Two rules removed, two added, and every remaining rule narrowed against a #336
  • Fix SDK peer declarations that npm silently ignored #358
  • DependenciesUpdated internal dependencies

1.4.0

  • Two new rules, both in recommended at error: no-permissive-cors and #327
  • Re-publish every package so npm carries the optimised artifact #338
  • DependenciesUpdated internal dependencies

1.3.0

  • Eliminate the false-positive storm on real NestJS codebases. Scanning two #287
  • Rewrite description and keywords on every published package for npm search discovery. npm ranks on name, description, and keywords, and the registry only picks up these fields at publish — so this is metadata-only and takes effect for each package on its next release. #294
  • DependenciesUpdated internal dependencies

1.2.6

  • Docsdocs: dual-logo README header (Interlace mark + ESLint mark side by side) and closing Interlace footer — refreshes the README rendered on npmjs.com. No runtime changes. #269
  • DependenciesUpdated internal dependencies

1.2.5

  • Fix Codecov badge showing "unknown" — switch from flag to component URL format #252

1.2.4

  • Fixfix(no-missing-null-checks): eliminate 53 false positives via three new narrowing patterns #143
  • DependenciesUpdated internal dependencies

1.2.3

  • align codecov component IDs with full package names
  • fix changelog header format across all packages
  • Ofri Peretz

1.2.2

  • align codecov component names and update docs components
  • Ofri Peretz

1.0.0

  • require-guards - Require @UseGuards decorator on controllers/handlers (CWE-284)
  • no-exposed-private-fields - Detect exposed sensitive fields in DTOs/entities (CWE-200)
  • no-missing-validation-pipe - Require ValidationPipe for DTO parameters (CWE-20)
  • require-class-validator - Require class-validator decorators on DTO properties (CWE-20)
  • require-throttler - Require ThrottlerGuard/@Throttle for rate limiting (CWE-770)
  • recommended - Balanced security defaults
  • strict - All 5 rules as errors
  • LLM-optimized error messages with CWE references
  • OWASP Top 10 2021 alignment (A01, A03, A05)
  • Decorator-aware detection (@UseGuards, @UsePipes, @Throttle, @Exclude)
  • assumeGlobal* options for teams using global configuration
  • Support for public/skip decorators (@Public, @SkipAuth, @AllowAnonymous, @SkipThrottle)
  • TypeScript support
  • Comprehensive test coverage (79 tests, 96.09% line coverage)
  • Covers 4 CWEs: 20, 200, 284, 770
  • Maps to OWASP Top 10 2021: A01, A03, A05

View on GitHub →

Building secure JavaScript with Interlace? Star the repo to get new rules and CWE coverage as we ship them — or follow the AI-code-security benchmarks behind them.

Follow the benchmarksStar on GitHub

eslint-plugin-nestjs-security

NestJS security rules for guards, validation pipes, throttling, and more

Rules

All ESLint security rules provided by eslint-plugin-nestjs-security