[fxa-agent]

Because

• The nest-typed-config/class-validator resolution pinned class-validator to 0.14.1 for typed config.
• The root class-validator was pinned to 0.14.1, so FxA did not get the 0.15.x releases.
• After 0.14.2, validate() rejects an unknown object by default when it gets no options. This breaks two payments-next action results.

This pull request

• Removes the nest-typed-config/class-validator resolution from package.json.
• Changes the root class-validator from 0.14.1 to ^0.15.1. yarn.lock resolves it to 0.15.1.
• Adds @IsArray() to churnInterventions in GetCMSChurnInterventionActionResult.ts.
• Adds @IsOptional() and @IsObject() to experiments in GetExperimentsActionResult.ts.
• Adds NextIOValidator.spec.ts with 5 tests for these two classes.

Issue that this pull request solves

Closes: FXA-11987

Checklist

Put an x in the boxes that apply

• My commit is GPG signed.
• If applicable, I have modified or added tests which pass locally.
• I have added necessary documentation (if appropriate).
• I have verified that my changes render correctly in RTL (if appropriate).
• I have manually reviewed all AI generated code.

How to review (Optional)

• Key files/areas to focus on: the two validator classes, the new spec, and the yarn.lock entries for class-validator.
• Suggested review order: package.json, yarn.lock, the two validator classes, the spec.
• Risky or complex parts: the two copies of class-validator, and the top-level only validation.
• One reviewer call: is top-level validation enough for now? See "Other information".

Screenshots (Optional)

Not applicable. No user interface change.

Other information (Optional)

Why the validator classes changed

• NextIOValidator calls new Validator().validateOrReject(output) with no options.
• In 0.14.2 and later, forbidUnknownValues is true by default in that case.
• GetExperimentsActionResult and GetCMSChurnInterventionActionResult had no decorated properties.
• Every getExperiments and getCMSChurnIntervention action then failed with "unknownValue: an unknown value was passed to the validate function".
• The new spec showed this exact error before the fix.
• A metadata scan of the 105 validator classes in libs/payments/ui found only these two.
• The decorators are top-level only. I did not add @ValidateNested. Before this change, nothing in these results was validated. The CMS and Nimbus data has extra fields that nested rules could reject. Nested validation can be a follow-up.

Two copies of class-validator

• nest-typed-config 2.10.1 requires ^0.14.0. It keeps its own 0.14.4 copy. The root uses 0.15.1. I did not force one version, because the ticket forbids a new resolution.
• The two copies share the global metadata storage. A check showed that nest-typed-config accepted valid config and rejected invalid config, declared with the root 0.15.1 decorators.
• @nestjs/mapped-types declares the peer class-validator ^0.13 || ^0.14, so yarn prints a peer warning. A follow-up can upgrade @nestjs/mapped-types. It is out of scope here.
• The 0.15.1 breaking change is the IsIBAN options argument. FxA does not use IsIBAN.

What I ran, all passed

• The new spec, getExperimentsAction.spec.ts, and related libs/payments/ui specs.
• ESLint and Prettier on the changed files.
• Metadata scan: no validator class without metadata. It listed 2 before the fix.
• nest-typed-config typed config check: valid config accepted, invalid config rejected.
• yarn why class-validator: 0.15.1 at the root, 0.14.4 under nest-typed-config.
• nx build payments-next: it compiles and passes its TypeScript stage.
• tsc in libs/payments/ui: no errors except TS2688 for the next type library. Main has the same error in this VM.
• tsc --noEmit in fxa-settings: no errors.

What I could not check

• The full nx build payments-next fails at the prerender of /_global-error with "TypeError: Cannot read properties of null (reading 'useContext')". It fails the same way on main with 0.14.1 in this VM. CI covers the full build.
• payments-next dev started and its typed config loaded with no class-validator error. Nest then stopped at the MySQL connection, because payments is not supported on the VM.
• I did not check the checkout, coupon, and churn flows at runtime. CI and reviewer QA must cover them.

[fxa-agent]

Updated evidence from the latest automated round.

signin-signIn-severity-2-s-e7b7a-n-login-as-an-existing-user-local.webm

[Copilot]

🟡 Changes recommended

Two moderate compatibility and null-output validation issues remain unresolved.

1 open issue

• Handle undefined getExperiments results before validation · New

What changed in this PR

Updates class-validator to 0.15.1 and adjusts payments/settings validation to prevent unknown-value failures.

Changes:

• Removes the nested validator resolution and updates dependency locks.
• Adds validation decorators and adjusts base-model validation.
• Adds regression tests for payments action results.

Two moderate issues remain: undefined getExperiments results are still rejected (4 votes), and class-validator 0.15.1 is outside the installed mapped-types peer range (1 vote).

File	Summary
yarn.lock	Records updated validator dependency versions.
packages/​fxa-settings/​src/​lib/​model-data/​model-data-provider.ts	Adjusts validation for undecorated base models.
package.json	Updates class-validator and removes the resolution.
libs/​payments/​ui/​src/​lib/​nestapp/​validators/​GetExperimentsActionResult.ts	Adds experiments result validation.
libs/​payments/​ui/​src/​lib/​nestapp/​validators/​GetCMSChurnInterventionActionResult.ts	Adds churn intervention array validation.
libs/​payments/​ui/​src/​lib/​nestapp/​NextIOValidator.spec.ts	Adds validator behavior tests.

_{Review effort: Lite}

[fxa-agent]

Not changed: class-validator 0.14.1 on main also rejects validateOrReject(undefined), so this is not new with the upgrade; tracked as a follow-up.