Skip to content

fix: upgrade vulnerable fastify dependency#720

Open
samsamtrum wants to merge 1 commit into
pimlicolabs:mainfrom
samsamtrum:fix-fastify-vulnerability
Open

fix: upgrade vulnerable fastify dependency#720
samsamtrum wants to merge 1 commit into
pimlicolabs:mainfrom
samsamtrum:fix-fastify-vulnerability

Conversation

@samsamtrum
Copy link
Copy Markdown

Summary

  • Upgrade fastify from ^4.25.2 to ^5.7.2 to address GHSA-jx2c-rxcm-jvmq / CVE-2026-25223.
  • Update the lockfile so the workspace resolves Fastify 5.x.
  • Adjust two small Fastify 5 typing/API compatibility points:
    • initialize the request rpcMethod decorator with a string value instead of null
    • normalize request.routeOptions.url before using it in route metrics labels

Closes #684.

Verification

  • corepack pnpm install --ignore-scripts --lockfile-only --filter ./src
  • corepack pnpm install --ignore-scripts --frozen-lockfile --filter ./src...
  • corepack pnpm --filter alto run build

Build gets past the Fastify 5 type changes and stops because the generated contract JSON artifacts are not present in this checkout:

TS2307: Cannot find module '../contracts/EntryPointSimulations.sol/EntryPointSimulations07.json'
TS2307: Cannot find module '../contracts/EntryPointSimulations.sol/EntryPointSimulations08.json'
TS2307: Cannot find module '../contracts/EntryPointSimulations.sol/EntryPointSimulations09.json'
TS2307: Cannot find module '../contracts/PimlicoSimulations.sol/PimlicoSimulations.json'
TS2307: Cannot find module '../../contracts/EntryPointGasEstimationOverride.sol/EntryPointGasEstimationOverride06.json'
TS2307: Cannot find module '../contracts/EntryPointFilterOpsOverride.sol/EntryPointFilterOpsOverride06.json'
TS2307: Cannot find module '../contracts/EntryPointFilterOpsOverride.sol/EntryPointFilterOpsOverride07.json'
TS2307: Cannot find module '../contracts/EntryPointFilterOpsOverride.sol/EntryPointFilterOpsOverride08.json'
TS2307: Cannot find module '../contracts/EntryPointFilterOpsOverride.sol/EntryPointFilterOpsOverride09.json'

@sonarqubecloud
Copy link
Copy Markdown

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Upgrade vulnerable fastify dependency

1 participant