Skip to content

chore(fastify): Update dependency fastify to v5.3.2 [SECURITY] #5667

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 2 commits into from
Apr 28, 2025
Merged

chore(fastify): Update dependency fastify to v5.3.2 [SECURITY] #5667

merged 2 commits into from
Apr 28, 2025

Conversation

renovate[bot]
Copy link
Contributor

@renovate renovate bot commented Apr 18, 2025 •
edited
Loading

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
fastify (source) 5.0.0 -> 5.3.2 age adoption passing confidence

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

GitHub Vulnerability Alerts

CVE-2025-32442

Impact

In applications that specify different validation strategies for different content types, it's possible to bypass the validation by providing a slightly altered content type such as with different casing or altered whitespacing before ;.

Users using the the following pattern are affected:

fastify.post('/', {
  handler(request, reply) {
    reply.code(200).send(request.body)
  },
  schema: {
    body: {
      content: {
        'application/json': {
          schema: {
            type: 'object',
            properties: {
              'foo': {
                type: 'string',
              }
            },
            required: ['foo']
          }
        },
      }
    }
  }
})

User using the following pattern are not affected:

fastify.post('/', {
  handler(request, reply) {
    reply.code(200).send(request.body)
  },
  schema: {
    body: {
      type: 'object',
      properties: {
        'foo': {
          type: 'string',
        }
      },
      required: ['foo']
    }
  }
})

Patches

This was patched in v5.3.1, but unfortunately it did not cover all problems. This has been fully patched in v5.3.2.

Workarounds

Do not specify multiple content types in the schema.

References

Are there any links users can visit to find out more?

https://hackerone.com/reports/3087928

Release Notes

fastify/fastify (fastify)

v5.3.2

Compare Source

v5.3.1

Compare Source

v5.3.0

Compare Source

What's Changed

New Contributors

Full Changelog: fastify/fastify@v5.2.2...v5.3.0

v5.2.2

Compare Source

What's Changed

New Contributors

Full Changelog: fastify/fastify@v5.2.1...v5.2.2

v5.2.1

Compare Source

What's Changed
New Contributors

Full Changelog: fastify/fastify@v5.2.0...v5.2.1

v5.2.0

Compare Source

What's Changed
New Contributors

Full Changelog: fastify/fastify@v5.1.0...v5.2.0

v5.1.0

Compare Source

What's Changed
New Contributors

Full Changelog: fastify/fastify@v5.0.0...v5.1.0

Configuration

📅 Schedule: Branch creation - "" in timezone GMT, Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@vercel Vercel
Copy link

vercel bot commented Apr 18, 2025 •
edited
Loading

The latest updates on your projects. Learn more about Vercel for Git ↗︎

1 Skipped Deployment
Name Status Preview Comments Updated (UTC)
clerk-js-sandbox ⬜️ Skipped (Inspect) Apr 28, 2025 5:54am

@renovate renovate bot added the dependencies Pull requests that update a dependency file label Apr 18, 2025
@renovate renovate bot enabled auto-merge (squash) April 18, 2025 15:40
@changeset-bot changeset-bot
Copy link

changeset-bot bot commented Apr 18, 2025 •
edited
Loading

⚠️ No Changeset found

Latest commit: dbb20b0

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

@renovate renovate bot force-pushed the renovate/npm-fastify-vulnerability branch from d1d59f7 to 2cb4293 Compare April 18, 2025 18:21
@renovate renovate bot force-pushed the renovate/npm-fastify-vulnerability branch from 2cb4293 to 232ecf2 Compare April 18, 2025 20:15
@renovate renovate bot force-pushed the renovate/npm-fastify-vulnerability branch from 232ecf2 to bc72892 Compare April 18, 2025 22:01
@renovate renovate bot changed the title chore(fastify): Update dependency fastify to v5.3.1 [SECURITY] chore(fastify): Update dependency fastify to v5.3.2 [SECURITY] Apr 18, 2025
@renovate renovate bot force-pushed the renovate/npm-fastify-vulnerability branch from bc72892 to 3d3f8c0 Compare April 18, 2025 22:47
@renovate renovate bot force-pushed the renovate/npm-fastify-vulnerability branch from 3d3f8c0 to f62edc8 Compare April 21, 2025 14:58
@renovate renovate bot force-pushed the renovate/npm-fastify-vulnerability branch from f62edc8 to 718c9a8 Compare April 21, 2025 18:01
@renovate renovate bot force-pushed the renovate/npm-fastify-vulnerability branch from 718c9a8 to 39c9a0e Compare April 21, 2025 18:19
@renovate renovate bot force-pushed the renovate/npm-fastify-vulnerability branch from 39c9a0e to 35bd777 Compare April 21, 2025 20:43
@renovate renovate bot force-pushed the renovate/npm-fastify-vulnerability branch from 35bd777 to 2670a83 Compare April 21, 2025 23:02
@renovate renovate bot force-pushed the renovate/npm-fastify-vulnerability branch from 2670a83 to 796d143 Compare April 22, 2025 00:43
@renovate renovate bot force-pushed the renovate/npm-fastify-vulnerability branch from 796d143 to 08f88d9 Compare April 22, 2025 11:14
@renovate renovate bot force-pushed the renovate/npm-fastify-vulnerability branch from 08f88d9 to 86cf03d Compare April 22, 2025 13:54
@renovate renovate bot force-pushed the renovate/npm-fastify-vulnerability branch from 3d5afb8 to 957057b Compare April 25, 2025 18:01
@renovate renovate bot force-pushed the renovate/npm-fastify-vulnerability branch from 957057b to 210e764 Compare April 25, 2025 18:20
@renovate renovate bot force-pushed the renovate/npm-fastify-vulnerability branch from 210e764 to 4442a74 Compare April 25, 2025 18:47
@renovate renovate bot force-pushed the renovate/npm-fastify-vulnerability branch from 4442a74 to f753db9 Compare April 25, 2025 20:03
@renovate renovate bot force-pushed the renovate/npm-fastify-vulnerability branch from f753db9 to 1ef1253 Compare April 25, 2025 21:02
@renovate renovate bot force-pushed the renovate/npm-fastify-vulnerability branch from 1ef1253 to a167d20 Compare April 28, 2025 02:31
@renovate renovate bot force-pushed the renovate/npm-fastify-vulnerability branch from a167d20 to 6c7221a Compare April 28, 2025 02:50
@renovate renovate bot force-pushed the renovate/npm-fastify-vulnerability branch from 6c7221a to 5a4bfc9 Compare April 28, 2025 02:59
@renovate renovate bot force-pushed the renovate/npm-fastify-vulnerability branch from 5a4bfc9 to 59b785e Compare April 28, 2025 03:13
@renovate renovate bot force-pushed the renovate/npm-fastify-vulnerability branch from 59b785e to aca4f29 Compare April 28, 2025 03:46
@renovate renovate bot force-pushed the renovate/npm-fastify-vulnerability branch from aca4f29 to 5c325bc Compare April 28, 2025 05:52
@renovate Renovate
Copy link
Contributor Author

renovate bot commented Apr 28, 2025

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

@renovate renovate bot merged commit 11c9299 into main Apr 28, 2025
31 checks passed
@renovate renovate bot deleted the renovate/npm-fastify-vulnerability branch April 28, 2025 06:31
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@LekoArts LekoArts LekoArts approved these changes

Assignees
No one assigned
Labels
dependencies Pull requests that update a dependency file
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
1 participant
@LekoArts