ValidationPipe uses class-transformer to convert the plain JSON body into an instance of the DTO class, then uses class-validator to run all decorator-based validation rules on that instance. The whitelist option strips unknown properties; forbidNonWhitelisted throws if unknown properties are sent; transform auto-converts types.
whitelist: true — strips any property not declared in the DTO before the handler runs.
forbidNonWhitelisted: true — throws BadRequestException instead of silently stripping.
transform: true — uses class-transformer to convert the raw object to a typed DTO instance.
transformOptions.enableImplicitConversion — auto-converts query string numbers without @Type(() => Number).
disableErrorMessages: true — hides validation details from error responses (useful in production).