Skip to content

build(deps): bump @fastify/static from 8.3.0 to 10.1.2 - #139

Merged
ribato22 merged 1 commit into
mainfrom
dependabot/npm_and_yarn/fastify/static-10.1.2
Jul 27, 2026
Merged

build(deps): bump @fastify/static from 8.3.0 to 10.1.2#139
ribato22 merged 1 commit into
mainfrom
dependabot/npm_and_yarn/fastify/static-10.1.2

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 27, 2026

Copy link
Copy Markdown
Contributor

Bumps @fastify/static from 8.3.0 to 10.1.2.

Release notes

Sourced from @​fastify/static's releases.

v10.1.2

⚠️ Security Release

What's Changed

Full Changelog: fastify/fastify-static@v10.1.1...v10.1.2

v10.1.1

⚠️ Security Release

What's Changed

Full Changelog: fastify/fastify-static@v10.1.0...v10.1.1

v10.1.0

What's Changed

New Contributors

Full Changelog: fastify/fastify-static@v10.0.0...v10.1.0

v10.0.0

Breaking Changes

  • setHeaders now using FastifyReply instead of Response.

You should refactor your code to use the reply helpers. For example,

// Before
const fastify = require('fastify')({logger: true})
const path = require('node:path')
fastify.register(require('@​fastify/static'), {
root: path.join(__dirname, 'public'),
prefix: '/public/', // optional: default '/',
setHeaders(res) {
res.setHeader('X-Test', 'Foo')
}
})
</tr></table>

... (truncated)

Commits

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 27, 2026
@dependabot
dependabot Bot requested a review from ribato22 as a code owner July 27, 2026 08:36
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 27, 2026
@ribato22

Copy link
Copy Markdown
Owner

@dependabot rebase

1 similar comment
@ribato22

Copy link
Copy Markdown
Owner

@dependabot rebase

Bumps [@fastify/static](https://github.com/fastify/fastify-static) from 8.3.0 to 10.1.2.
- [Release notes](https://github.com/fastify/fastify-static/releases)
- [Commits](fastify/fastify-static@v8.3.0...v10.1.2)

---
updated-dependencies:
- dependency-name: "@fastify/static"
  dependency-version: 10.1.2
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/fastify/static-10.1.2 branch from 1dd4ea6 to 92b95ec Compare July 27, 2026 08:47
@ribato22
ribato22 merged commit a65117d into main Jul 27, 2026
8 checks passed
@ribato22

Copy link
Copy Markdown
Owner

@dependabot rebase

@ribato22
ribato22 deleted the dependabot/npm_and_yarn/fastify/static-10.1.2 branch July 27, 2026 08:55
@dependabot @github

dependabot Bot commented on behalf of github Jul 27, 2026

Copy link
Copy Markdown
Contributor Author

Looks like this PR has already been merged!

ribato22 added a commit that referenced this pull request Jul 27, 2026
…ed majors (#140)

Closes out the second Dependabot triage wave.

## 1. Align `vitest` across the workspace
`packages/sdk` pinned `vitest ^1.2.2` while `apps/api` and `apps/worker`
were on `^2.0.0`. **That split is itself a PR generator** — it's why
Dependabot kept proposing a separate sdk-only bump (#134, `1.6.1 →
4.1.10`) that could never merge cleanly and would have left the
workspace split three ways.

Aligning sdk to `^2.0.0` means one vitest major governs everything (and
matches the `^2` pin on `@vitest/coverage-v8`). Drops **249 lines** of
duplicate vitest-1 tree from the lockfile; sdk tests stay green (17/17).

## 2. Three more `ignore` rules for migration-gated majors
| dep | why it can't be a drop-in bump |
|-----|-------------------------------|
| `next` | Next 15+ **requires React 19**, which is already ignored for
the same reason — the admin crosses both majors together or not at all
(#138 closed) |
| `vitest` | must move in lockstep with `@vitest/coverage-v8` **and**
every workspace package → one deliberate PR, never per-package (#134
closed) |
| `n8n-workflow` | 2.x is a new n8n node-API major; the published
`n8n-nodes-multiwa` must be reconciled against it and re-published (#137
closed) |

## Verification
- All 5 workspace packages build ✓ · `api`/`worker`/`admin` typecheck ✓
- **api 324/324** · **worker 34/34** · **sdk 17/17** ✓
- Lockfile still **air-gap safe** (0 `ssh://` refs)
- `dependabot.yml` parses; 13 migration-gated majors now ignored

## This wave's triage
**Merged (4):** #135 `@fastify/multipart` 10 · #136 `@types/nodemailer`
8 (aligned all 3 packages) · **#139 `@fastify/static` 10.1.2 — SECURITY
FIX** · this PR
**Closed with reasons (3):** #134 vitest (workspace split) · #137
n8n-workflow 2.x · #138 next 14→16

> ⚠️ **#139 was a real vulnerability:** `@fastify/static@8.3.0` was
affected by
[GHSA-8pvw-jcv7-9cmj](GHSA-8pvw-jcv7-9cmj)
— *Authorization Bypass via Non-Canonical URL Paths* (MODERATE, affects
`<= 10.1.1`). First patched version is exactly `10.1.2`, so the major
bump was the only remedy. Now on `10.1.2`.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant