Feature request: Update Mongoose, Multer, and Swagger dependencies to address security vulnerabilities #1030

What do you want to see in the API?

Update the following dependencies to remediate the reported security vulnerabilities:

• mongoose: 8.19.4 → 8.24.4
• @nestjs/platform-express: 11.1.27 → 11.2.6
• multer: 2.1.1 → 2.4.0 (transitive dependency)
• @types/multer: 2.0.0 → 2.3.0 (optional type update)
• @nestjs/swagger: 11.4.4 → 11.4.7 (remediates the js-yaml findings)

No changes to the public API or runtime behavior are expected.

How do you think this should work?

Update the direct dependencies and regenerate the lockfile. The multer update should be resolved transitively through @nestjs/platform-express.

Mongoose 8.24 introduces stricter generic typing for Model.bulkWrite() and related model operations. The shared BasicService and IService typings therefore need to be updated so that their model, input, output, update, and bulk-write types remain compatible with Mongoose 8.24.

The existing service API and its current call sites should remain backward-compatible. After the updates, the project should pass at least:

npm install
npm run build

Relevant automated tests should also be run to verify that database operations and Swagger generation continue to work as before.

Any additional info?

These updates address findings involving:

• Mongoose vulnerabilities
• Multiple Multer denial-of-service and upload-limit issues
• js-yaml denial-of-service issues reported through @nestjs/swagger

multer is not a direct dependency and should normally be updated through @nestjs/platform-express. Updating only @types/multer does not update the runtime package or fix its vulnerabilities.

The Mongoose update is not entirely dependency-only: Mongoose 8.24 contains type-definition changes that require adjustments to the generic typings in BasicService.ts and IService.ts.

Mongoose 8.24 also introduced stricter typing for referenced fields. The room_id property needed to support both the string IDs currently passed by the service layer and populated Room values:

@Prop({ type: MongooseSchema.Types.ObjectId, ref: ModelName.ROOM })
room_id: string | Room;

No database migration is required. The schema continues to store room_id as an ObjectId. The change only updates the TypeScript type to reflect the string identifiers accepted and cast by Mongoose, as well as populated Room values.