chore(deps): bump @fastify/rate-limit from 10.3.0 to 11.2.0 in /server - #135
dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [@fastify/rate-limit](https://github.com/fastify/fastify-rate-limit) from 10.3.0 to 11.2.0. - [Release notes](https://github.com/fastify/fastify-rate-limit/releases) - [Commits](fastify/fastify-rate-limit@v10.3.0...v11.2.0) --- updated-dependencies: - dependency-name: "@fastify/rate-limit" dependency-version: 11.2.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
dependabot
Bot
added
dependencies
|
Dependabot attempted to update this pull request, but because the branch |
@fastify/rate-limit < 11.2.0 is vulnerable to rate-limit bypass via
IPv6 address rotation (high; not yet in the npm audit feed, published
as a GitHub repository advisory). The only patched release is on the
11.x major, whose one documented breaking change is the removal of
deprecated type aliases that this codebase never imported -- the
plugin is registered with `{ max, timeWindow }` only.
Verified: typecheck, build, test:coverage (1670 passed), audit clean,
plus a direct inject smoke (max=2 -> 200, 200, 429).
Supersedes #135.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
|
This was written agentically; verify its assertions: Closing as superseded by #153 (merged as 4bc264f), which landed this bump together with every other open advisory fix. The per-package PRs could not merge individually: branch protection requires the 🤖 Co-authored by Claude Fable 5.1. |
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
1 participant
Bumps @fastify/rate-limit from 10.3.0 to 11.2.0.
Release notes
Sourced from @fastify/rate-limit's releases.
... (truncated)
Commits
92da964Bumped v11.2.01aee036Merge commit from fork65e9965chore: Bump c8 from 11.0.0 to 12.0.0 (#457)d9d6100ci: pin actions to commit-hasha5c9630chore: Bump@types/nodein the dev-dependencies-typescript group (#455)3998ebddocs: fix broken linksd7d6086Bumped v11.1.0c76be97feat: add increment option to createRateLimit (#449)f65adefchore(package.json): fix delvedor's personal urlfd252f0chore: Bump fastify-plugin from 5.1.0 to 6.0.0 in the dependencies group (#450)You can trigger a rebase of this PR by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)