fix(deps): update dependency fastify to v5.8.5 [security]

package.json

@@ -54,19 +54,19 @@
     "@bull-board/api": "6.10.1",
     "@bull-board/fastify": "6.10.1",
     "@bull-board/ui": "6.10.1",
-    "@fastify/busboy": "3.1.1",
-    "@fastify/cors": "11.0.1",
-    "@fastify/error": "4.1.0",
+    "@fastify/busboy": "3.2.0",
+    "@fastify/cors": "11.2.0",
+    "@fastify/error": "4.2.0",
     "@fastify/forwarded": "3.0.1",
     "@fastify/helmet": "13.0.2",
-    "@fastify/multipart": "9.0.3",
+    "@fastify/multipart": "9.4.0",
     "@fastify/passport": "3.0.2",
-    "@fastify/secure-session": "8.2.0",
+    "@fastify/secure-session": "8.3.0",
     "@fastify/static": "9.1.3",
-    "@fastify/swagger": "9.5.2",
-    "@fastify/swagger-ui": "5.2.5",
+    "@fastify/swagger": "9.7.0",
+    "@fastify/swagger-ui": "5.2.6",
     "@fastify/type-provider-typebox": "5.1.0",
-    "@fastify/websocket": "11.0.2",
+    "@fastify/websocket": "11.2.0",
     "@graasp/etherpad-api": "2.1.1",
     "@graasp/sdk": "5.18.1",
     "@rapideditor/country-coder": "5.4.0",
@@ -81,9 +81,9 @@
     "drizzle-orm": "0.41.0",
     "extract-zip": "2.0.1",
     "fast-json-stringify": "6.0.1",
-    "fastify": "5.7.4",
+    "fastify": "5.8.5",
     "fastify-nodemailer": "5.0.0",
-    "fastify-plugin": "5.0.1",
+    "fastify-plugin": "5.1.0",
     "form-data": "4.0.5",
     "fs-extra": "11.3.0",
     "geoip-lite": "1.4.10",
@@ -180,7 +180,9 @@
     "y-websocket": "3.0.0"
   },
   "resolutions": {
-    "sodium-native": "4.2.0"
+    "sodium-native": "4.2.0",
+    "fastify": "5.8.5",
+    "@sinclair/typebox": "0.34.48"
   },
   "packageManager": "yarn@4.14.1"
 }

src/services/auth/plugins/captcha/captcha.ts

@@ -1,7 +1,9 @@
 import fetch from 'node-fetch';
 
 import { forwarded } from '@fastify/forwarded';
-import type { FastifyReply, FastifyRequest, RouteHandlerMethod } from 'fastify';
+import type { FastifyReply, FastifyRequest } from 'fastify';
+import type { preHandlerHookHandler } from 'fastify/types/hooks';
+import type { RouteShorthandHook } from 'fastify/types/route';
 
 import type { RecaptchaActionType } from '@graasp/sdk';
 
@@ -24,7 +26,7 @@ type CaptchaResponse = { success?: boolean; action?: RecaptchaActionType; score?
 export default function captchaPreHandler(
   action: RecaptchaActionType,
   options?: { shouldFail: boolean },
-): RouteHandlerMethod {
+): RouteShorthandHook<preHandlerHookHandler> {
   // eslint-disable-next-line @typescript-eslint/ban-ts-comment
   // @ts-ignore
   return async (request: FastifyRequest<{ Body: { captcha: string } }>, _reply: FastifyReply) => {

src/services/auth/plugins/magicLink/magicLink.controller.ts

@@ -2,7 +2,8 @@ import { StatusCodes } from 'http-status-codes';
 
 import fastifyPassport from '@fastify/passport';
 import type { FastifyPluginAsyncTypebox } from '@fastify/type-provider-typebox';
-import type { PassportUser } from 'fastify';
+import type { PassportUser, preHandlerHookHandler } from 'fastify';
+import type { RouteShorthandHook } from 'fastify/types/route';
 
 import { ClientManager, Context, DEFAULT_LANG, RecaptchaAction } from '@graasp/sdk';
 
@@ -102,7 +103,7 @@ const plugin: FastifyPluginAsyncTypebox = async (fastify) => {
             request.authInfo = info;
           }
         },
-      ),
+      ) as RouteShorthandHook<preHandlerHookHandler>,
     },
     async (request, reply) => {
       const {

src/services/auth/plugins/passport/preHandlers.ts

@@ -1,5 +1,7 @@
 import fastifyPassport from '@fastify/passport';
-import type { FastifyRequest, RouteGenericInterface, RouteHandlerMethod } from 'fastify';
+import type { FastifyRequest, RouteGenericInterface } from 'fastify';
+import type { preHandlerHookHandler } from 'fastify/types/hooks';
+import type { RouteShorthandHook } from 'fastify/types/route';
 
 import { InsufficientPermission } from '../../../../utils/errors';
 import { PassportStrategy } from './strategies';
@@ -20,7 +22,7 @@ import { PassportStrategy } from './strategies';
 export const optionalIsAuthenticated = fastifyPassport.authenticate(
   // PassportStrategy.MobileJwt,
   PassportStrategy.Session,
-);
+) as RouteShorthandHook<preHandlerHookHandler>;
 
 /**
  * Validate authentication.
@@ -29,13 +31,15 @@ export const optionalIsAuthenticated = fastifyPassport.authenticate(
 export const isAuthenticated = fastifyPassport.authenticate(
   // PassportStrategy.MobileJwt,
   PassportStrategy.StrictSession,
-);
+) as RouteShorthandHook<preHandlerHookHandler>;
 
 //-- Password Strategies --//
 /**
  * Classic password authentication to create a session.
  */
-export const authenticatePassword = fastifyPassport.authenticate(PassportStrategy.Password);
+export const authenticatePassword = fastifyPassport.authenticate(
+  PassportStrategy.Password,
+) as RouteShorthandHook<preHandlerHookHandler>;
 
 //-- JWT Strategies --//
 /**
@@ -44,21 +48,21 @@ export const authenticatePassword = fastifyPassport.authenticate(PassportStrateg
 export const authenticatePasswordReset = fastifyPassport.authenticate(
   PassportStrategy.PasswordReset,
   { session: false },
-);
+) as RouteShorthandHook<preHandlerHookHandler>;
 
 /**
  * JWT authentication for email change operation.
  */
 export const authenticateEmailChange = fastifyPassport.authenticate(PassportStrategy.EmailChange, {
   session: false,
-});
+}) as RouteShorthandHook<preHandlerHookHandler>;
 
 /**
  * Items app authentication
  */
 export const authenticateAppsJWT = fastifyPassport.authenticate(PassportStrategy.AppsJwt, {
   session: false,
-});
+}) as RouteShorthandHook<preHandlerHookHandler>;
 
 /**
  *  Items app authentication. Allows authentication without member, can fail if item is not found.
@@ -68,7 +72,7 @@ export const guestAuthenticateAppsJWT = fastifyPassport.authenticate(
   {
     session: false,
   },
-);
+) as RouteShorthandHook<preHandlerHookHandler>;
 
 /**
  * Pre-handler function that checks if the user meets at least one of the specified access preconditions.
@@ -78,7 +82,7 @@ export const guestAuthenticateAppsJWT = fastifyPassport.authenticate(
  */
 export function matchOne<R extends RouteGenericInterface>(
   ...strategies: RessourceAuthorizationStrategy<R>[]
-): RouteHandlerMethod {
+): RouteShorthandHook<preHandlerHookHandler> {
   // eslint-disable-next-line @typescript-eslint/ban-ts-comment
   // @ts-expect-error
   return async (req: FastifyRequest<R>) => {

src/services/member/plugins/thumbnail/memberThumbnail.controller.ts

@@ -88,9 +88,9 @@ const plugin: FastifyPluginAsyncTypebox<GraaspThumbnailsOptions> = async (fastif
       });
 
       if (!url) {
-        reply.status(StatusCodes.NO_CONTENT);
+        reply.code(StatusCodes.NO_CONTENT);
       } else {
-        reply.status(StatusCodes.OK).send(url);
+        reply.code(StatusCodes.OK).send(url);
       }
     },
   );