Skip to content

fix(deps): update dependency fastify to v5.8.3 [security]#737

Open
renovate[bot] wants to merge 1 commit intomasterfrom
renovate/npm-fastify-vulnerability
Open

fix(deps): update dependency fastify to v5.8.3 [security]#737
renovate[bot] wants to merge 1 commit intomasterfrom
renovate/npm-fastify-vulnerability

Conversation

@renovate
Copy link
Copy Markdown
Contributor

@renovate renovate Bot commented Apr 18, 2025 •
edited
Loading

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
fastify (source) 5.2.1 → 5.8.3 age confidence
fastify (source) ^3.24.0 → ^5.8.3 age confidence

Fastify vulnerable to invalid content-type parsing, which could lead to validation bypass

CVE-2025-32442 / GHSA-mg2h-6x62-wpwc

More information

Details

Impact

In applications that specify different validation strategies for different content types, it's possible to bypass the validation by providing a slightly altered content type such as with different casing or altered whitespacing before ;.

Users using the the following pattern are affected:

fastify.post('/', {
  handler(request, reply) {
    reply.code(200).send(request.body)
  },
  schema: {
    body: {
      content: {
        'application/json': {
          schema: {
            type: 'object',
            properties: {
              'foo': {
                type: 'string',
              }
            },
            required: ['foo']
          }
        },
      }
    }
  }
})

User using the following pattern are not affected:

fastify.post('/', {
  handler(request, reply) {
    reply.code(200).send(request.body)
  },
  schema: {
    body: {
      type: 'object',
      properties: {
        'foo': {
          type: 'string',
        }
      },
      required: ['foo']
    }
  }
})
Patches

This was patched in v5.3.1, but unfortunately it did not cover all problems. This has been fully patched in v5.3.2.
Version v4.9.0 was also affected by this issue. This has been fully patched in v4.9.1.

Workarounds

Do not specify multiple content types in the schema.

References

Are there any links users can visit to find out more?

https://hackerone.com/reports/3087928

Severity

  • CVSS Score: 7.5 / 10 (High)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Fastify's Content-Type header tab character allows body validation bypass

CVE-2026-25223 / GHSA-jx2c-rxcm-jvmq

More information

Details

Impact

A validation bypass vulnerability exists in Fastify where request body validation schemas specified by Content-Type can be completely circumvented. By appending a tab character (\t) followed by arbitrary content to the Content-Type header, attackers can bypass body validation while the server still processes the body as the original content type.

For example, a request with Content-Type: application/json\ta will bypass JSON schema validation but still be parsed as JSON.

This vulnerability affects all Fastify users who rely on Content-Type-based body validation schemas to enforce data integrity or security constraints. The concrete impact depends on the handler implementation and the level of trust placed in the validated request body, but at the library level, this allows complete bypass of body validation for any handler using Content-Type-discriminated schemas.

This issue is a regression or missed edge case from the fix for a previously reported vulnerability.

Patches

This vulnerability has been patched in Fastify v5.7.2. All users should upgrade to this version or later immediately.

Workarounds

If upgrading is not immediately possible, user can implement a custom onRequest hook to reject requests containing tab characters in the Content-Type header:

fastify.addHook('onRequest', async (request, reply) => {
  const contentType = request.headers['content-type']
  if (contentType && contentType.includes('\t')) {
    reply.code(400).send({ error: 'Invalid Content-Type header' })
  }
})
Resources

Severity

  • CVSS Score: 7.5 / 10 (High)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Fastify Vulnerable to DoS via Unbounded Memory Allocation in sendWebStream

CVE-2026-25224 / GHSA-mrq3-vjjr-p77c

More information

Details

Impact

A Denial of Service vulnerability in Fastify’s Web Streams response handling can allow a remote client to exhaust server memory. Applications that return a ReadableStream (or Response with a Web Stream body) via reply.send() are impacted. A slow or non-reading client can trigger unbounded buffering when backpressure is ignored, leading to process crashes or severe degradation.

Patches

The issue is fixed in Fastify 5.7.3. Users should upgrade to 5.7.3 or later.

Workarounds

Avoid sending Web Streams from Fastify responses (e.g., ReadableStream or Response bodies). Use Node.js streams (stream.Readable) or buffered payloads instead until the project can upgrade.

References

Severity

  • CVSS Score: 3.7 / 10 (Low)
  • Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

fastify: request.protocol and request.host Spoofable via X-Forwarded-Proto/Host from Untrusted Connections

CVE-2026-3635 / GHSA-444r-cwp2-x5xf

More information

Details

Summary

When trustProxy is configured with a restrictive trust function (e.g., a specific IP like trustProxy: '10.0.0.1', a subnet, a hop count, or a custom function), the request.protocol and request.host getters read X-Forwarded-Proto and X-Forwarded-Host headers from any connection — including connections from untrusted IPs. This allows an attacker connecting directly to Fastify (bypassing the proxy) to spoof both the protocol and host seen by the application.

Affected Versions

fastify <= 5.8.2

Impact

Applications using request.protocol or request.host for security decisions (HTTPS enforcement, secure cookie flags, CSRF origin checks, URL construction, host-based routing) are affected when trustProxy is configured with a restrictive trust function.

When trustProxy: true (trust everything), both host and protocol trust all forwarded headers — this is expected behavior. The vulnerability only manifests with restrictive trust configurations.

Severity

  • CVSS Score: 6.1 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

fastify/fastify (fastify)

v5.8.3

Compare Source

⚠️ Security Release

This fixes CVE CVE-2026-3635 GHSA-444r-cwp2-x5xf.

What's Changed

New Contributors

Full Changelog: fastify/fastify@v5.8.2...v5.8.3

v5.8.2

Compare Source

What's Changed

New Contributors

Full Changelog: fastify/fastify@v5.8.1...v5.8.2

v5.8.1

Compare Source

⚠️ Security Release

Fixes "Missing End Anchor in "subtypeNameReg" Allows Malformed Content-Types to Pass Validation": GHSA-573f-x89g-hqp9.

CVE-2026-3419

Full Changelog: fastify/fastify@v5.8.0...v5.8.1

v5.8.0

Compare Source

What's Changed

New Contributors

Full Changelog: fastify/fastify@v5.7.4...v5.8.0

v5.7.4

Compare Source

Full Changelog: fastify/fastify@v5.7.3...v5.7.4

v5.7.3

Compare Source

⚠️ Security Release
What's Changed

Full Changelog: fastify/fastify@v5.7.2...v5.7.3

v5.7.2

Compare Source

⚠️ Notice ⚠️

Parsing of the content-type header has been improved to a strict parser in PR #​6414. This means only header values in the form described in RFC 9110 are accepted.

What's Changed

New Contributors

Full Changelog: fastify/fastify@v5.7.1...v5.7.2

v5.7.1

Compare Source

What's Changed

Full Changelog: fastify/fastify@v5.7.0...v5.7.1

v5.7.0

Compare Source

What's Changed

New Contributors

Full Changelog: fastify/fastify@v5.6.2...v5.7.0

v5.6.2

Compare Source

v5.6.1

Compare Source

What's Changed

New Contributors

Full Changelog: fastify/fastify@v5.6.0...v5.6.1

v5.6.0

Compare Source

What's Changed

New Contributors

Full Changelog: fastify/fastify@v5.5.0...v5.6.0

v5.5.0

Compare Source

What's Changed

New Contributors

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • ""
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot changed the title chore(deps): update dependency fastify to v5.3.1 [security] chore(deps): update dependency fastify to v5.3.2 [security] Apr 18, 2025
@renovate renovate Bot force-pushed the renovate/npm-fastify-vulnerability branch from 77060e3 to 4b95665 Compare April 24, 2025 09:49
@renovate renovate Bot force-pushed the renovate/npm-fastify-vulnerability branch from 4b95665 to ccf6f0b Compare May 19, 2025 21:29
@renovate renovate Bot force-pushed the renovate/npm-fastify-vulnerability branch 2 times, most recently from f677419 to a2a6ac1 Compare June 4, 2025 07:03
@renovate renovate Bot force-pushed the renovate/npm-fastify-vulnerability branch from a2a6ac1 to 7de2a40 Compare July 2, 2025 15:00
@renovate renovate Bot force-pushed the renovate/npm-fastify-vulnerability branch from 7de2a40 to 758dfe5 Compare August 10, 2025 15:01
@socket-security
Copy link
Copy Markdown

socket-security Bot commented Aug 10, 2025 •
edited
Loading

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Warn Critical
Critical CVE: CASL Ability is Vulnerable to Prototype Pollution in npm @casl/ability

CVE: GHSA-x9vf-53q3-cvx6 CASL Ability is Vulnerable to Prototype Pollution (CRITICAL)

Affected versions: >= 2.4.0 < 6.7.5

Patched version: 6.7.5

From: packages/plugin-casl/package.json → npm/@casl/ability@6.7.3

ℹ Read more on: This package | This alert | What is a critical CVE?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@casl/ability@6.7.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Critical
Critical CVE: Basic FTP has Path Traversal Vulnerability in its downloadToDir() method in npm basic-ftp

CVE: GHSA-5rq4-664w-9x2c Basic FTP has Path Traversal Vulnerability in its downloadToDir() method (CRITICAL)

Affected versions: < 5.2.0

Patched version: 5.2.0

From: pnpm-lock.yaml → npm/basic-ftp@5.0.5

ℹ Read more on: This package | This alert | What is a critical CVE?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/basic-ftp@5.0.5. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Critical
Critical CVE: npm form-data uses unsafe random function in form-data for choosing boundary

CVE: GHSA-fjxv-7rqg-78g4 form-data uses unsafe random function in form-data for choosing boundary (CRITICAL)

Affected versions: < 2.5.4; >= 3.0.0 < 3.0.4; >= 4.0.0 < 4.0.4

Patched version: 4.0.4

From: pnpm-lock.yaml → npm/form-data@4.0.1

ℹ Read more on: This package | This alert | What is a critical CVE?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/form-data@4.0.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Critical
Critical CVE: Handlebars.js has JavaScript Injection via AST Type Confusion

CVE: GHSA-2w6w-674q-4c4q Handlebars.js has JavaScript Injection via AST Type Confusion (CRITICAL)

Affected versions: >= 4.0.0 < 4.7.9

Patched version: 4.7.9

From: packages/plugin-router-hapi/package.json → npm/handlebars@4.7.8

ℹ Read more on: This package | This alert | What is a critical CVE?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/handlebars@4.7.8. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm @makeomatic/node-rdkafka is 98.0% likely obfuscated

Confidence: 0.98

Location: Package overview

From: packages/plugin-kafka-types/package.json → npm/@makeomatic/node-rdkafka@2.18.0

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@makeomatic/node-rdkafka@2.18.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm buffer is 96.0% likely obfuscated

Confidence: 0.96

Location: Package overview

From: pnpm-lock.yaml → npm/aws-sdk@2.1692.0 → npm/buffer@4.9.2

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/buffer@4.9.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm entities is 91.0% likely obfuscated

Confidence: 0.91

Location: Package overview

From: pnpm-lock.yaml → npm/cheerio@1.0.0 → npm/entities@4.5.0

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/entities@4.5.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm ioredis is 96.0% likely obfuscated

Confidence: 0.96

Location: Package overview

From: packages/plugin-dlock/package.json → npm/ioredis@5.4.2

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/ioredis@5.4.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

@renovate renovate Bot force-pushed the renovate/npm-fastify-vulnerability branch 2 times, most recently from 2d1cfc3 to 626421a Compare August 19, 2025 16:32
@renovate renovate Bot force-pushed the renovate/npm-fastify-vulnerability branch from 626421a to 159faab Compare August 31, 2025 10:17
@renovate renovate Bot force-pushed the renovate/npm-fastify-vulnerability branch from 159faab to 4658eb2 Compare September 25, 2025 21:10
@renovate renovate Bot force-pushed the renovate/npm-fastify-vulnerability branch from 4658eb2 to 72d8521 Compare October 21, 2025 16:04
@renovate renovate Bot force-pushed the renovate/npm-fastify-vulnerability branch from 72d8521 to 2c1a9b2 Compare November 10, 2025 16:04
@renovate renovate Bot force-pushed the renovate/npm-fastify-vulnerability branch from 2c1a9b2 to 0978ea0 Compare December 3, 2025 20:00
@socket-security
Copy link
Copy Markdown

socket-security Bot commented Dec 3, 2025 •
edited
Loading

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Added@​casl/​ability@​6.7.31002510088100
Updatedhandlebars@​4.7.9 ⏵ 4.7.89925 -7510088100
Added@​esbuild/​linux-arm64@​0.23.11001003993100
Addedaws-sdk@​2.1692.0911001005080
Addedconsul@​0.40.01001001005070
Addedeslint@​8.57.18910010050100
Updatedglob@​10.5.0 ⏵ 11.0.19985 -1510050100
Added@​types/​lodash.merge@​4.6.91001005780100
Addedeslint-config-makeomatic@​6.0.0681006776100
Updated@​types/​qs@​6.15.0 ⏵ 6.9.181001007084100
Added@​makeomatic/​node-rdkafka@​2.18.0701001008280
Added@​types/​glob@​8.1.01001007081100
Added@​typescript-eslint/​parser@​7.18.01001007198100
Added@​types/​cheerio@​0.22.351001007281100
Added@​types/​bluebird-retry@​0.11.8911007280100
Added@​types/​aws4@​1.11.61001007280100
Added@​types/​hapi__vision@​5.5.8951007280100
Addedlsmod@​1.0.01001007275100
Updated@​microfleet/​amqp-coffee@​1.3.1 ⏵ 2.8.27610072 -2782100
Added@​types/​split2@​4.2.31001007378100
Added@​makeomatic/​deploy@​13.1.0731009980100
Added@​types/​callsite@​1.0.34921007380100
Addedesbuild@​0.23.191997393100
Added@​types/​consul@​0.40.3961007480100
Added@​types/​semver@​7.5.81001007481100
Updated@​types/​common-errors@​1.0.6 ⏵ 1.0.582 -31007477 -3100
Added@​types/​readable-stream@​4.0.181001007583100
Updated@​hapi/​boom@​9.1.4 ⏵ 10.0.11001007585100
Updatedlodash@​4.18.1 ⏵ 4.17.217582 -188788100
Added@​microfleet/​dlock@​16.0.07510010082100
Addedbluebird-retry@​0.11.010010010075100
Addedlodash.merge@​4.6.21001007775100
Added@​hapi/​vision@​7.0.3991007685100
See 37 more rows in the dashboard

View full report

@renovate renovate Bot force-pushed the renovate/npm-fastify-vulnerability branch from 0978ea0 to 541fa9b Compare December 31, 2025 14:56
@renovate renovate Bot force-pushed the renovate/npm-fastify-vulnerability branch from 541fa9b to 0f83609 Compare January 8, 2026 17:15
@renovate renovate Bot force-pushed the renovate/npm-fastify-vulnerability branch from 0f83609 to 658ed4d Compare January 19, 2026 17:50
@renovate renovate Bot force-pushed the renovate/npm-fastify-vulnerability branch from 658ed4d to 49ed3b6 Compare February 2, 2026 22:47
@renovate renovate Bot changed the title chore(deps): update dependency fastify to v5.3.2 [security] fix(deps): update dependency fastify [security] Feb 2, 2026
@renovate renovate Bot force-pushed the renovate/npm-fastify-vulnerability branch from 49ed3b6 to e18349e Compare February 3, 2026 02:34
@renovate renovate Bot changed the title fix(deps): update dependency fastify [security] fix(deps): update dependency fastify to v5.7.3 [security] Feb 3, 2026
@renovate renovate Bot force-pushed the renovate/npm-fastify-vulnerability branch from e18349e to a8e5727 Compare February 12, 2026 11:12
@renovate renovate Bot changed the title fix(deps): update dependency fastify to v5.7.3 [security] fix(deps): update dependency fastify [security] Feb 12, 2026
@renovate renovate Bot force-pushed the renovate/npm-fastify-vulnerability branch from a8e5727 to 8f15ac9 Compare February 12, 2026 17:16
@renovate renovate Bot changed the title fix(deps): update dependency fastify [security] fix(deps): update dependency fastify to v5.7.3 [security] Feb 12, 2026
@renovate renovate Bot force-pushed the renovate/npm-fastify-vulnerability branch from 8f15ac9 to 8305012 Compare February 16, 2026 12:45
@renovate renovate Bot changed the title fix(deps): update dependency fastify to v5.7.3 [security] fix(deps): update dependency fastify [security] Feb 16, 2026
@renovate renovate Bot force-pushed the renovate/npm-fastify-vulnerability branch from 8305012 to aa9ca38 Compare February 16, 2026 17:49
@renovate renovate Bot force-pushed the renovate/npm-fastify-vulnerability branch from bff36ec to 268ce81 Compare March 25, 2026 21:24
@renovate renovate Bot changed the title fix(deps): update dependency fastify to v5.7.3 [security] fix(deps): update dependency fastify to v5.8.3 [security] Mar 25, 2026
@renovate renovate Bot force-pushed the renovate/npm-fastify-vulnerability branch from 268ce81 to 45c6879 Compare March 26, 2026 18:35
@renovate renovate Bot changed the title fix(deps): update dependency fastify to v5.8.3 [security] fix(deps): update dependency fastify [security] Mar 26, 2026
@renovate renovate Bot force-pushed the renovate/npm-fastify-vulnerability branch from 45c6879 to 17c9a0f Compare March 26, 2026 21:04
@renovate renovate Bot changed the title fix(deps): update dependency fastify [security] fix(deps): update dependency fastify to v5.8.3 [security] Mar 26, 2026
@renovate renovate Bot changed the title fix(deps): update dependency fastify to v5.8.3 [security] fix(deps): update dependency fastify to v5.8.3 [security] - autoclosed Mar 27, 2026
@renovate renovate Bot closed this Mar 27, 2026
@renovate renovate Bot deleted the renovate/npm-fastify-vulnerability branch March 27, 2026 01:57
@renovate renovate Bot changed the title fix(deps): update dependency fastify to v5.8.3 [security] - autoclosed fix(deps): update dependency fastify to v5.8.3 [security] Mar 30, 2026
@renovate renovate Bot reopened this Mar 30, 2026
@renovate renovate Bot force-pushed the renovate/npm-fastify-vulnerability branch 3 times, most recently from 96a7b06 to c719c7f Compare April 1, 2026 17:53
@renovate renovate Bot changed the title fix(deps): update dependency fastify to v5.8.3 [security] fix(deps): update dependency fastify [security] Apr 1, 2026
@renovate renovate Bot force-pushed the renovate/npm-fastify-vulnerability branch from c719c7f to 9ceecae Compare April 1, 2026 23:58
@renovate renovate Bot changed the title fix(deps): update dependency fastify [security] fix(deps): update dependency fastify to v5.8.3 [security] Apr 1, 2026
@renovate renovate Bot force-pushed the renovate/npm-fastify-vulnerability branch from 9ceecae to d4dcb6d Compare April 8, 2026 20:08
@renovate renovate Bot changed the title fix(deps): update dependency fastify to v5.8.3 [security] fix(deps): update dependency fastify [security] Apr 8, 2026
@renovate renovate Bot force-pushed the renovate/npm-fastify-vulnerability branch from d4dcb6d to aae9eeb Compare April 8, 2026 23:59
@renovate renovate Bot changed the title fix(deps): update dependency fastify [security] fix(deps): update dependency fastify to v5.8.3 [security] Apr 8, 2026
@renovate renovate Bot force-pushed the renovate/npm-fastify-vulnerability branch from aae9eeb to e0c6acf Compare April 15, 2026 10:05
@renovate renovate Bot changed the title fix(deps): update dependency fastify to v5.8.3 [security] fix(deps): update dependency fastify [security] Apr 15, 2026
@renovate renovate Bot force-pushed the renovate/npm-fastify-vulnerability branch from e0c6acf to 30e3847 Compare April 16, 2026 09:02
@renovate renovate Bot changed the title fix(deps): update dependency fastify [security] fix(deps): update dependency fastify to v5.8.3 [security] Apr 16, 2026
@renovate renovate Bot force-pushed the renovate/npm-fastify-vulnerability branch from 30e3847 to 664fdac Compare April 16, 2026 17:01
@renovate renovate Bot changed the title fix(deps): update dependency fastify to v5.8.3 [security] fix(deps): update dependency fastify [security] Apr 16, 2026
@renovate renovate Bot force-pushed the renovate/npm-fastify-vulnerability branch from 664fdac to 76bd001 Compare April 16, 2026 23:48
@renovate renovate Bot changed the title fix(deps): update dependency fastify [security] fix(deps): update dependency fastify to v5.8.3 [security] Apr 16, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants