# Upgrade NestJS Dependencies Every Week

Yes. Each week a Rush agent bumps your NestJS app's exact-pinned npm packages, runs the build and e2e tests, reverts what fails and opens one pull request.

[Run this on Rush](https://cloud.getrush.ai/run/upgrade-dependencies-weekly/nestjs/), in a Project that has your repository.

## What the agent does

In a NestJS API like brocoders/nestjs-boilerplate, most dependencies are pinned to exact versions, not ranges: @nestjs/common, @nestjs/core and @nestjs/platform-express at 11.1.18, @nestjs/config 4.0.3, @nestjs/typeorm 11.0.1, @nestjs/mongoose 11.0.4, @nestjs/swagger 11.2.6, typeorm 0.3.28, mongoose 9.4.1, passport 0.7.0 and passport-jwt 4.0.1. In devDependencies, @nestjs/cli 11.0.18, @nestjs/testing 11.1.18, jest 30.3.0, ts-jest 29.4.6 and typescript 5.9.3 are exact too. npm update does nothing to an exact pin, so the agent sets each new version explicitly. .nvmrc says Node 24.14.1, and the agent uses that.

npm test here is jest with rootDir src and testRegex .*\.spec\.ts$, and there are no spec files under src, so it finds no tests. The real coverage is the e2e suite in test/ (test/admin/auth.e2e-spec.ts, test/admin/users.e2e-spec.ts and test/user/auth.e2e-spec.ts), run by npm run test:e2e with test/jest-e2e.json. It needs a running API and database: .github/workflows/docker-e2e.yml runs it twice through docker compose, once with docker-compose.relational.ci.yaml (TypeORM and Postgres) and once with docker-compose.document.ci.yaml (Mongoose and MongoDB). The agent runs npm run build and npm run lint after each change, runs the e2e suite against a database in the sandbox where it can, and says which of the two setups it ran.

It moves the @nestjs/* packages in sets that share a release line (common, core, platform-express and testing on one version), and checks each adapter (@nestjs/typeorm, @nestjs/mongoose, @nestjs/swagger, @nestjs/jwt, @nestjs/passport) against the core version it supports. typeorm, mongoose, nestjs-i18n and the passport strategies are upgraded one at a time, since each touches a different module under src.

A set that fails the build, lint or e2e tests is reverted in package.json and package-lock.json, with the failing command and its error recorded. renovate.json extends config:base, so the agent's pull request is one more alongside Renovate's, not a replacement for its configuration.

## Start it with one API call

`POST https://api.prix.dev/o/{org}/sessions`

```json
{
  "agent": "codex",
  "input": "Upgrade this project's npm dependencies to their latest compatible releases, keeping exact pins exact. Move @nestjs/common, core, platform-express and testing together, and check each @nestjs adapter against that core version. After each set run npm run build and npm run lint, and run npm run test:e2e against a local Postgres with the relational config; say if you could not run it, and note that npm test finds no spec files. Revert any set that fails and record the error. Open one pull request listing each bump with its old and new version and each skipped upgrade with the error that blocked it.",
  "resources": [
    {
      "url": "https://github.com/your-org/your-app"
    }
  ]
}
```

1. **Get an API key.** In the console, open Settings, then API keys, and create a key for your org. Send it in the Authorization header as a Bearer token.
2. **Send the request.** POST the body in request.json to https://api.prix.dev/o/{org}/sessions, with your repository as the resources URL. The run starts in its own cloud sandbox.
3. **Read what came back.** Follow the run on its live stream or wait for the run.completed webhook, then read the result and its trajectory.

## What comes back

The pull request changes package.json and package-lock.json, and source files under src only when an upgrade required it, each listed with its reason. The description groups the bumps (Nest core, Nest adapters, ORM and database drivers, auth, tooling) with old and new versions, states which e2e setup ran in the sandbox, and lists each skipped upgrade with its failing command. docker-e2e.yml then runs both the TypeORM and the Mongoose e2e suites on the pull request.

A reviewer checks that both docker-e2e jobs pass, reads the TypeORM and Mongoose changelogs if either moved a minor version, and looks at any change to entity or schema files, since those affect migrations.

## Run it on every Monday morning

Exact pins mean nothing moves until someone moves it. A weekly job, from cron or a scheduled workflow, can send this request every Monday so Nest's frequent patch releases arrive as one pull request that has been built and tested.

To get told when it is done, give the API key a webhook URL; Rush sends run.completed with a session_url, and your handler can post the pull request link for review.

## Why run it on Rush?

Testing a NestJS upgrade properly means a running database and the e2e suite, not npm test, which in this project runs nothing. In a Rush sandbox the agent can install Postgres, start the API with the project's env-example-relational settings and run the e2e tests after each set, and every npm and jest command stays in the transcript with its output.

Renovate opens a pull request per package or group on its own schedule; each still waits for review and a green Docker build. This run gives one tested pull request with the reasons for anything left out, and several Nest services can each run it at the same time.

## Frequently asked questions

### Why not just run npm test?

In this project npm test looks for *.spec.ts files under src and there are none. The e2e suite under test/ is what exercises the API, so the agent runs that.

### Will it change exact pins to caret ranges?

No. An exact pin stays exact at the new version, because the project chose exact pins.

### Does it test both TypeORM and Mongoose?

It runs the relational setup in the sandbox and says whether it could. docker-e2e.yml runs both the relational and the document suites on the pull request.

### Will it fight with Renovate?

It opens its own pull request on a branch of its own. Renovate's open pull requests for the same packages become redundant once this one merges, and Renovate closes or rebases them.