[dependabot]

Warning

Cooldown could not be applied because no publication date was available from the registry.

Bumps the version-updates group with 1 update in the /docker/backend directory: python.
Bumps the version-updates group with 3 updates in the /docker/code-checks directory: hashicorp/terraform, astral-sh/uv and terraform-linters/tflint.
Bumps the version-updates group with 1 update in the /docker/docs directory: python.
Bumps the version-updates group with 1 update in the /docker/e2e directory: playwright.
Bumps the version-updates group with 2 updates in the /docker/infrastructure directory: python and hashicorp/terraform.
Bumps the version-updates group with 1 update in the /docker/localstack directory: localstack/localstack.
Bumps the version-updates group with 1 update in the /docker/semgrep directory: semgrep/semgrep.
Bumps the version-updates group with 1 update in the /docker/tools directory: python.
Bumps the version-updates group with 1 update in the /docker/trivy directory: aquasec/trivy.

Updates python from 3.13.15-alpine3.23 to 3.13.16-alpine3.23

Updates hashicorp/terraform from 1.16.4 to 1.16.5

Updates astral-sh/uv from 0.13.5 to 0.13.6

Release notes

Sourced from astral-sh/uv's releases.

0.13.6

Release Notes

Released on 2026-10-26.

Enhancements

• Accept an empty UV_RUN_RECURSION_DEPTH as zero and report invalid values consistently (#22814)
• Explain how to add project metadata when uv init finds a pyproject.toml without a [project] table (#22916)

Python

• Add CPython 3.11.18, 3.12.16, 3.13.18, 3.14.10, and 3.15.2 (#22938)

Preview features

• Detect NVIDIA GPU capabilities when selecting compatible wheel variants with wheel-variants (#22690)
• Nest each module's owners in an object in uv workspace metadata output (#22638)
• Report the unsupported properties required by an incompatible wheel variant (#22719)

Performance

• Reduce peak memory use when resolving large workspaces (#22860, #22863, #22864, #22866, #22870)
• Reduce peak memory use when locking or upgrading large projects (#22833, #22834)
• Speed up redirected output from uv export and uv pip compile (#22840)
• Reuse cached or active environments when running PEP 723 scripts without dependencies (#21458)
• Reduce parsing overhead for build dependency and build backend settings (#22848, #22871, #22879, #22884)
• Reduce parsing overhead for project sources and workspace references (#22880, #22883)
• Reduce parsing overhead for cache, exclusion, cutoff, and preview settings (#22876, #22877, #22878, #22887)
• Reduce PyPI metadata parsing overhead (#22874, #22875)
• Speed up parsing tool receipt requirements (#22885)

Bug fixes

• Prevent uv run --active --script and uv sync --active --script from deleting non-virtual-environment directories (#21464)
• Use AMD64 for platform_machine when resolving for x86-64 Windows (#22935)
• Preserve free-threaded and other non-default variants in uv python upgrade (#22836)
• Allow uv init --no-package and uv init --script when UV_INIT_BUILD_BACKEND is set (#22907)
• Prevent panics when rendering containment markers with local versions (#22815)

Documentation

• Update the Docker guide and reproduction examples to use uv 0.13.5 (#22867)

Install uv 0.13.6

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.13.6/uv-installer.sh | sh
</tr></table> 

... (truncated)

Changelog

Sourced from astral-sh/uv's changelog.

0.13.6

Released on 2026-10-26.

Enhancements

• Accept an empty UV_RUN_RECURSION_DEPTH as zero and report invalid values consistently (#22814)
• Explain how to add project metadata when uv init finds a pyproject.toml without a [project] table (#22916)

Python

• Add CPython 3.11.18, 3.12.16, 3.13.18, 3.14.10, and 3.15.2 (#22938)

Preview features

• Detect NVIDIA GPU capabilities when selecting compatible wheel variants with wheel-variants (#22690)
• Nest each module's owners in an object in uv workspace metadata output (#22638)
• Report the unsupported properties required by an incompatible wheel variant (#22719)

Performance

• Reduce peak memory use when resolving large workspaces (#22860, #22863, #22864, #22866, #22870)
• Reduce peak memory use when locking or upgrading large projects (#22833, #22834)
• Speed up redirected output from uv export and uv pip compile (#22840)
• Reuse cached or active environments when running PEP 723 scripts without dependencies (#21458)
• Reduce parsing overhead for build dependency and build backend settings (#22848, #22871, #22879, #22884)
• Reduce parsing overhead for project sources and workspace references (#22880, #22883)
• Reduce parsing overhead for cache, exclusion, cutoff, and preview settings (#22876, #22877, #22878, #22887)
• Reduce PyPI metadata parsing overhead (#22874, #22875)
• Speed up parsing tool receipt requirements (#22885)

Bug fixes

• Prevent uv run --active --script and uv sync --active --script from deleting non-virtual-environment directories (#21464)
• Use AMD64 for platform_machine when resolving for x86-64 Windows (#22935)
• Preserve free-threaded and other non-default variants in uv python upgrade (#22836)
• Allow uv init --no-package and uv init --script when UV_INIT_BUILD_BACKEND is set (#22907)
• Prevent panics when rendering containment markers with local versions (#22815)

Documentation

• Update the Docker guide and reproduction examples to use uv 0.13.5 (#22867)

Commits

• 329bf94 Bump version to 0.13.6 (#22947)
• 5b5a53e Use checked-in Python download metadata for release preparation (#22945)
• b8b339f Update Rust crate h2 to v0.4.19 (#21873)
• 1eb5989 Update Rust crate hyper to v1.11.1 (#20903)
• 68677f5 Update Rust crate reqwest to v0.13.5 (#22475)
• 69e574e Cargo vet integration (#21610)
• acee8d9 Sync latest Python releases, Python 3.11.18, 3.12.16, 3.13.18, 3.14.10, 3.15....
• 4b46af0 Fix io-bound Windows CI nextest grouping (#22939)
• d397ecb Add hints when uv init finds pyproject.toml without a project table (#22916)
• 7b5d227 Let --no-package and --script take precedence over `UV_INIT_BUILD_BACKEND...
• Additional commits viewable in compare view

Updates terraform-linters/tflint from v0.64.0 to v0.65.0

Release notes

Sourced from terraform-linters/tflint's releases.

v0.65.0

What's Changed

Security Fixes

• deps: Bump Go version to 1.26.10 by @​wata727 in terraform-linters/tflint#2672

Enhancements

• formatter: make JUnit error testcase names unique by @​Kunalbehbud in terraform-linters/tflint#2592

Changes

• terraform: iterate primary files in a deterministic order by @​KetchupBomb in terraform-linters/tflint#2633
• langserver: log request params only at trace level by @​chernetskyi in terraform-linters/tflint#2642

Chores

• build(deps): Bump golang from 1.26.4-alpine3.23 to 1.26.5-alpine3.23 by @​dependabot[bot] in terraform-linters/tflint#2601
• build(deps): Bump the go-x group with 3 updates by @​dependabot[bot] in terraform-linters/tflint#2602
• build(deps): Bump github.com/klauspost/compress from 1.18.6 to 1.19.0 by @​dependabot[bot] in terraform-linters/tflint#2603
• build(deps): Bump github.com/zclconf/go-cty from 1.18.1 to 1.19.0 by @​dependabot[bot] in terraform-linters/tflint#2604
• build(deps): Bump docker/setup-buildx-action from 4.1.0 to 4.2.0 by @​dependabot[bot] in terraform-linters/tflint#2589
• build(deps): Bump docker/login-action from 4.2.0 to 4.4.0 by @​dependabot[bot] in terraform-linters/tflint#2590
• build(deps): Bump docker/metadata-action from 6.1.0 to 6.2.0 by @​dependabot[bot] in terraform-linters/tflint#2586
• Remove broken badges and charts from README by @​wata727 in terraform-linters/tflint#2605
• Postpone the deletion date for the installation script by @​wata727 in terraform-linters/tflint#2606
• build(deps): Bump google.golang.org/grpc from 1.82.0 to 1.82.1 by @​dependabot[bot] in terraform-linters/tflint#2610
• build(deps): Bump actions/checkout from 7.0.0 to 7.0.1 by @​dependabot[bot] in terraform-linters/tflint#2611
• build(deps): Bump github.com/klauspost/compress from 1.19.0 to 1.19.1 by @​dependabot[bot] in terraform-linters/tflint#2614
• build(deps): Bump actions/setup-go from 6.5.0 to 7.0.0 by @​dependabot[bot] in terraform-linters/tflint#2612
• build(deps): Bump actions/attest from 4.1.1 to 4.2.0 by @​dependabot[bot] in terraform-linters/tflint#2613
• Modernize the codebase with go fix by @​bendrucker in terraform-linters/tflint#2616
• build(deps): Bump docker/login-action from 4.4.0 to 4.5.2 by @​dependabot[bot] in terraform-linters/tflint#2618
• build(deps): Bump docker/login-action from 4.5.2 to 4.6.0 by @​dependabot[bot] in terraform-linters/tflint#2620
• build(deps): Bump actions/attest from 4.2.0 to 4.2.1 by @​dependabot[bot] in terraform-linters/tflint#2619
• build(deps): Bump github.com/sourcegraph/jsonrpc2 from 0.2.1 to 0.2.2 by @​dependabot[bot] in terraform-linters/tflint#2623
• build(deps): Bump github.com/sigstore/sigstore-go from 1.2.2 to 1.3.0 by @​dependabot[bot] in terraform-linters/tflint#2622
• build(deps): Bump google.golang.org/grpc from 1.82.1 to 1.83.0 by @​dependabot[bot] in terraform-linters/tflint#2621
• Bump Go version to 1.26.5 by @​apoiget in terraform-linters/tflint#2626
• build(deps): Bump golang from 1.26.5-alpine3.23 to 1.27rc2-alpine3.23 by @​dependabot[bot] in terraform-linters/tflint#2627
• build(deps): Bump actions/attest from 4.2.1 to 4.2.2 by @​dependabot[bot] in terraform-linters/tflint#2629
• build(deps): Bump github.com/klauspost/compress from 1.19.1 to 1.19.2 by @​dependabot[bot] in terraform-linters/tflint#2628
• build(deps): Bump golang from 1.27rc2-alpine3.23 to 1.27rc3-alpine3.23 by @​dependabot[bot] in terraform-linters/tflint#2630
• build(deps): Bump the go-x group with 3 updates by @​dependabot[bot] in terraform-linters/tflint#2631
• build(deps): Bump docker/setup-buildx-action from 4.2.0 to 4.3.0 by @​dependabot[bot] in terraform-linters/tflint#2632
• build(deps): Bump golang from 1.27rc3-alpine3.23 to 1.27-alpine3.23 by @​dependabot[bot] in terraform-linters/tflint#2637
• build(deps): Bump google.golang.org/grpc from 1.83.0 to 1.83.1 by @​dependabot[bot] in terraform-linters/tflint#2638
• build(deps): Bump google.golang.org/grpc from 1.83.1 to 1.83.2 by @​dependabot[bot] in terraform-linters/tflint#2641
• Remove the auto installation script by @​wata727 in terraform-linters/tflint#2607
• build(deps): Bump github.com/klauspost/compress from 1.19.2 to 1.20.0 by @​dependabot[bot] in terraform-linters/tflint#2646
• build(deps): Bump the go-x group with 2 updates by @​dependabot[bot] in terraform-linters/tflint#2645
• build(deps): Bump go.opentelemetry.io/otel/sdk from 1.44.0 to 1.45.0 by @​dependabot[bot] in terraform-linters/tflint#2649
• build(deps): Bump the go-x group with 3 updates by @​dependabot[bot] in terraform-linters/tflint#2650

... (truncated)

Commits

• 502b6a3 Bump up version to v0.65.0
• 6b2ea9c deps: Bump Go version to 1.26.10 (#2672)
• c3f3c48 Add CONTRIBUTING.md and Terraform fork contribution terms check (#2665)
• 671045a build(deps): Bump goreleaser/goreleaser-action from 7.2.3 to 7.3.0 (#2669)
• 45bb6e6 build(deps): Bump github.com/klauspost/compress from 1.20.1 to 1.20.3 (#2670)
• 0e47fab build(deps): Bump github.com/mattn/go-colorable from 0.1.15 to 0.1.16 (#2668)
• 94172c5 build(deps): Bump the go-x group with 3 updates (#2667)
• 82d7279 build(deps): Bump actions/create-github-app-token from 3.2.0 to 3.3.0 (#2666)
• 1880e65 Update the latest supported Terraform version to 1.16 (#2664)
• cff2ce7 build(deps): Bump docker/setup-buildx-action from 4.3.0 to 4.4.1 (#2655)
• Additional commits viewable in compare view

Updates python from 3.13.15-alpine3.23 to 3.13.16-alpine3.23

Updates playwright from 7e9f074 to 6075bd9

Updates python from 3.13.15-alpine3.23 to 3.13.16-alpine3.23

Updates hashicorp/terraform from 1.16.4 to 1.16.5

Updates localstack/localstack from 2026.8.5 to 2026.9.1

Updates semgrep/semgrep from 1.178.0 to 1.180.0

Updates python from 3.13.15-alpine3.23 to 3.13.16-alpine3.23

Updates aquasec/trivy from 0.74.0 to 0.75.0

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: OWASP/Nest
• Branch: main
• File: .coderabbit.yaml
• Commit: 4156e57
• Layers: Repository YAML
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: dc61e3d4-ba54-4d1a-96f0-0d3b3cd9a563

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 98.60%. Comparing base (4156e57) to head (444fcbf).

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #5776   +/-   ##
=======================================
  Coverage   98.60%   98.60%           
=======================================
  Files         551      551           
  Lines       18430    18430           
  Branches     2685     2685           
=======================================
  Hits        18172    18172           
  Misses        126      126           
  Partials      132      132           

Flag	Coverage Δ
backend	98.99% <ø> (ø)
frontend	97.36% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

---

Continue to review full report in Codecov by Harness.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 4156e57...444fcbf. Read the comment docs.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.