v2.2.6

A patch release. It fixes cursor-mode pagination's handling of a route's default sort and closes every security advisory reported since 2.2.5.

Fixed

• Cursor-mode getMany now falls back to a route's @Crud({ query: { sort } }) default when a request omits ?sort=, matching how offset mode has always resolved sort. Applies to @nestjs-crud/typeorm, @nestjs-crud/drizzle, @nestjs-crud/mikro-orm, and @nestjs-crud/prisma. A route default that declares two or more sort fields still returns 400, now with a message naming the field count and noting it came from the route configuration. A request with no sort anywhere still returns 400, with a message describing both failure cases instead of reporting a bare field count of zero.
• In @nestjs-crud/drizzle, @nestjs-crud/mikro-orm, and @nestjs-crud/prisma, the first cursor page now always orders by the sort field plus a primary-key tie-breaker. Before this fix, the first page could return ties in unspecified order, risking skipped or duplicated rows once pagination continued.

Security

This release closes every dependabot advisory reported since 2.2.5: 56 advisories, all closed through dependency and lockfile updates, none through dismissal.

• The most severe was a critical archive-extraction denial-of-service in build tooling, affecting both the root workspace and the example app. Neither issue reached the installed dependency closure of a published package.
• One item carries forward: the @nestjs-crud/typeorm peer range on typeorm still admits older releases for consumers who pin low. Tightening that range is planned peer-floor work for the next minor.