@nestjs/config 12.1.0

Release 12.1.0

on Node.js NPM

Security

This release fixes several security issues in how ConfigService resolves property paths and how ConfigModule.forRoot() loads and validates environment variables. See GHSA-q989-84g5-qg72 for details. Upgrading is recommended.

Behavior changes

Some fixes change what ConfigService returns. Please review them before upgrading:

• Property paths only resolve members a configuration object defines (own properties and members of your own classes). Members inherited from built-ins resolve to undefined, e.g. get('database.toString'), get('constructor.prototype') or get('cert.length') for a Buffer. set() never writes through them, and paths through __proto__, constructor or prototype are ignored.
• Validated variables take precedence:
  • A variable that the validator maps to undefined is no longer served from process.env. get(key, defaultValue) returns the default.
  • A variable that a validationSchema declares and removes (e.g. Joi .strip()) is no longer merged back. Undeclared variables are still kept.
  • With skipProcessEnv: true and a validationSchema, undeclared variables from process.env are no longer served. Declared ones still are. A validate function's output is served as it is.
  • With validatePredefined: false, a predefined variable now takes precedence over a different value from the env file, and get() returns it as it is.
  • A second validated forRoot() no longer replaces the converted values of another one.
• expandVariables:
  • Expanded values are assigned to process.env after validation, not before.
  • Several env files are expanded once, so $ and \$ in earlier files are no longer expanded again.
  • With override: true, a variable's reference to itself (e.g. PATH=/opt/bin:$PATH) expands to its previous value.
• Env files: a value containing a NUL character now fails startup instead of being truncated in process.env. __proto__ keys returned by a custom parser are ignored.
• ConfigService.set():
  • Dependent variables are re-expanded from the definitions loaded at startup. The env files are not read again.
  • Values passed to earlier set() calls and variables set in the environment are kept.
  • The expandVariables.processEnv target is honored.
  • A re-expanded value longer than 128 KiB throws.
• Load order:
  • ConfigService from a plain imports: [ConfigModule] or ConfigModule.forFeature() is provided once forRoot() has merged its load factories.
  • ConfigModule.envVariablesLoaded (used by ConditionalModule.registerWhen()) waits until every forRoot() in progress has loaded its environment variables.
• Validation errors no longer include the rejected value: Joi pattern() messages leave it out, and a quoted value is replaced with [redacted].

Features

• validate may be an async function. A rejected promise stops startup.
• ConfigService.set() re-interpolates variables that depend on the changed key, including chains of references (#2463).

Bug fixes

• override: true takes precedence when expanding variables (#2465).
• get('_PROCESS_ENV_VALIDATED') no longer returns the internal snapshot of validated variables.

Deprecations

• ConfigService.setEnvFilePaths() and ConfigService.setParser(). ConfigModule.forRoot() no longer uses them.

Full Changelog: 12.0.1...12.1.0