Merge pull request #385 from formidablejs/patch/security-2025-08-11

Patch/security 2025 08 11

Author: donaldp

package-lock.json

@@ -33,7 +33,7 @@
   },
   "dependencies": {
     "@fastify/cookie": "^11.0.2",
-    "@fastify/cors": "^11.0.1",
+    "@fastify/cors": "^11.1.0",
     "@fastify/formbody": "^8.0.2",
     "@fastify/multipart": "^9.0.3",
     "@fastify/session": "^11.1.0",
@@ -42,10 +42,10 @@
     "bcrypt": "^6.0.0",
     "connect-redis": "^9.0.0",
     "detect-port": "^2.1.0",
-    "dotenv": "^17.0.1",
-    "express-session": "^1.18.1",
+    "dotenv": "^17.2.0",
+    "express-session": "^1.18.2",
     "fastify": "^5.4.0",
-    "fs-extra": "^11.3.0",
+    "fs-extra": "^11.3.1",
     "html-escaper": "^3.0.3",
     "inquirer": "^8.2.4",
     "jsonwebtoken": "^9.0.2",
@@ -55,7 +55,7 @@
     "ms": "^2.1.3",
     "nodemon": "^3.1.10",
     "pluralize": "^8.0.0",
-    "redis": "^5.5.6",
+    "redis": "^5.8.0",
     "session-file-store": "^1.5.0",
     "stacktrace-js": "^2.0.2",
     "ts-node": "^10.9.2",

package.json

@@ -16,7 +16,8 @@ export default class Repository
 		env = fs.existsSync(envPath) ? envPath : path.join(root, '.env')
 
 		dotenv.config({
-			path: env
+			path: env,
+			quiet: true,
 		})
 
 		delete process.env.BUILD_ENV

src/Environment/Repository.imba

@@ -127,7 +127,7 @@ export default class FormRequest {
 	/**
 	 * Get request headers.
 	 */
-	headers(): any;
+	headers<T = any>(): T;
 
 	/**
 	 * Check if header is present.
@@ -152,32 +152,32 @@ export default class FormRequest {
 	 * Get specified header.
 	 * @param {string} header
 	 */
-	header(header: string, default$?: any): any;
+	header<T = any>(header: string, default$?: T): T;
 
 	/**
 	 * Get bearer token used to authenticate current request.
 	 */
-	bearerToken(): any;
+	bearerToken(): string | null;
 
 	/**
 	 * Get request referer.
 	 */
-	referer(): any;
+	referer(): string | null;
 
 	/**
 	 * Get request host.
 	 */
-	getHost(): any;
+	getHost(): string | null;
 
 	/**
 	 * Get full request host.
 	 */
-	getFullOrigin(): any;
+	getFullOrigin(): string | null;
 
 	/**
 	 * Get request origin.
 	 */
-	getOrigin(): any;
+	getOrigin(): string | null;
 
 	/**
 	 * Get request origin protocol.
@@ -187,7 +187,7 @@ export default class FormRequest {
 	/**
 	 * Get request ip address.
 	 */
-	ip(): any;
+	ip(): string | null;
 
 	/**
 	 * Check if path matches.
@@ -205,7 +205,7 @@ export default class FormRequest {
 	 * Get url param.
 	 * @param {string} name
 	 */
-	param(name: string): string | number;
+	param<T = string | number>(name: string): T;
 
 	/**
 	 * Get all url params.
@@ -221,7 +221,7 @@ export default class FormRequest {
 	 * Get body input or specified query keys.
 	 * @param {string[]} keys
 	 */
-	all(keys?: string[]): any;
+	all<T = any>(keys?: string[]): T;
 
 	/**
 	 * Get specified input from body.
@@ -251,7 +251,7 @@ export default class FormRequest {
 	 * Get specified query.
 	 * @param {string|null} key
 	 */
-	query(key?: string | null, default$?: any): string | number;
+	query<T = string | number>(key?: string | null, default$?: any): T
 
 	/**
 	 * Get files.
@@ -302,7 +302,7 @@ export default class FormRequest {
 	 * Get request rules.
 	 * @returns {object}
 	 */
-	getRules(): object;
+	getRules<T = ReturnType<T['rules']>>(): T;
 
 	/**
 	 * Get currently authenticated user.
@@ -324,6 +324,7 @@ import type Session from "./Session";
 import type Cookies from "./Cookies";
 import type { FastifyRequest } from "fastify";
 import type { FastifyReply } from "fastify";
+import s from "connect-redis";
 
 declare const $__patch__$: unique symbol;
 declare const $__init__$: unique symbol;