Skip to content

build(deps): bump the npm_and_yarn group across 1 directory with 2 updates - #1510

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-2be1d1c79f
Open

build(deps): bump the npm_and_yarn group across 1 directory with 2 updates#1510
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-2be1d1c79f

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 5, 2026

Copy link
Copy Markdown

Bumps the npm_and_yarn group with 2 updates in the / directory: @fastify/static and find-my-way.

Updates @fastify/static from 7.0.4 to 10.1.2

Release notes

Sourced from @​fastify/static's releases.

v10.1.2

⚠️ Security Release

What's Changed

Full Changelog: fastify/fastify-static@v10.1.1...v10.1.2

v10.1.1

⚠️ Security Release

What's Changed

Full Changelog: fastify/fastify-static@v10.1.0...v10.1.1

v10.1.0

What's Changed

New Contributors

Full Changelog: fastify/fastify-static@v10.0.0...v10.1.0

v10.0.0

Breaking Changes

  • setHeaders now using FastifyReply instead of Response.

You should refactor your code to use the reply helpers. For example,

// Before
const fastify = require('fastify')({logger: true})
const path = require('node:path')
fastify.register(require('@​fastify/static'), {
root: path.join(__dirname, 'public'),
prefix: '/public/', // optional: default '/',
setHeaders(res) {
res.setHeader('X-Test', 'Foo')
}
})
</tr></table>

... (truncated)

Commits

Updates find-my-way from 8.2.2 to 9.9.0

Release notes

Sourced from find-my-way's releases.

v9.9.0

What's Changed

Full Changelog: delvedor/find-my-way@v9.8.0...v9.9.0

v9.8.0

What's Changed

New Contributors

Full Changelog: delvedor/find-my-way@v9.7.0...v9.8.0

v9.7.0

What's Changed

New Contributors

Full Changelog: delvedor/find-my-way@v9.6.0...v9.7.0

v9.6.0

What's Changed

... (truncated)

Commits
  • 31aa3ae Bumped v9.9.0
  • b8f9502 fix: parse absolute-form request targets safely (#451)
  • a0429ea chore: migrate to ESLint 9 and neostandard (#450)
  • 7b4a234 Bumped v9.8.0
  • 5c08aaa refactor(types): migrate from tsd to tstyche (#444)
  • b3aca1e perf: faster route lookup (+18.7% geomean, every benchmark scenario faster) (...
  • 69f4454 chore: bump chalk from 5.6.2 to 6.0.0 in the dev-dependencies group (#446)
  • 00b598a chore: bump actions/setup-node from 6 to 7 (#445)
  • b0c8047 fix: keep static parts between parameters in the route pattern (#442)
  • dd8a8b6 fix: serialize RegExp values in prettyPrint constraints and meta (#443)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
build(deps): bump the npm_and_yarn group across 1 directory with 2 up…
ecf1d0e 
…dates

Bumps the npm_and_yarn group with 2 updates in the / directory: [@fastify/static](https://github.com/fastify/fastify-static) and [find-my-way](https://github.com/delvedor/find-my-way).


Updates `@fastify/static` from 7.0.4 to 10.1.2
- [Release notes](https://github.com/fastify/fastify-static/releases)
- [Commits](fastify/fastify-static@v7.0.4...v10.1.2)

Updates `find-my-way` from 8.2.2 to 9.9.0
- [Release notes](https://github.com/delvedor/find-my-way/releases)
- [Commits](delvedor/find-my-way@v8.2.2...v9.9.0)

---
updated-dependencies:
- dependency-name: "@fastify/static"
  dependency-version: 10.1.2
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: find-my-way
  dependency-version: 9.9.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 5, 2026
@pedramamini

pedramamini commented Sep 5, 2026

Copy link
Copy Markdown
Collaborator

Thanks for the bump, @dependabot. The @fastify/static advisories behind this (GHSA-8pvw-jcv7-9cmj and GHSA-83w8-p2f5-377r) are worth taking, so I'd like to see this land. As it stands though, it isn't mergeable yet. Details below.

1. The change is much wider than the title advertises

The description says "2 updates" (@fastify/static, find-my-way), but package.json carries four major bumps:

package from to majors
@fastify/static ^7.0.4 ^10.1.2 +3
fastify ^4.25.2 ^5.12.3 +1
js-yaml ^4.2.0 ^5.4.1 +1
electron (dev) ^41.5.0 ^44.2.0 +3

fastify, js-yaml, and electron are not mentioned anywhere in the release notes. Electron is a 3-major jump for a desktop app and shouldn't ride along silently on a security patch.

2. CI is red: the Electron 44 bump breaks the native rebuild

Both test and lint-and-format fail during npm ci, at the postinstall step (patch-package && electron-rebuild -f -w node-pty,better-sqlite3). better-sqlite3@12.9.0 does not compile against Electron 44's V8 headers:

../src/util/helpers.cpp:89:56: error: call of overloaded 'SetNativeDataProperty(...)' is ambiguous
../src/util/macros.cpp:30:76: error: no matching function for call to 'v8::External::Value()'

Install dies there, so nothing in this PR was actually linted or tested. better-sqlite3 is on 13.0.3 now, which is likely the Electron 44 compatible line, but that pairing needs its own verification.

3. Fastify v5 without its plugin majors will break the web server at boot

fastify goes 4 to 5, but the sibling plugins are untouched and all three still declare v4-only support in their plugin metadata:

  • @fastify/cors@8.5.0 declares fastify: '4.x'
  • @fastify/rate-limit@9.1.0 declares fastify: '4.x'
  • @fastify/websocket@9.0.0 declares fastify: '^4.16.0'

src/main/web-server/WebServer.ts registers all four of these together, so this will throw FST_ERR_PLUGIN_VERSION_MISMATCH at startup. CI never surfaced it because the install failed first. The v5-compatible majors are @fastify/cors@11, @fastify/rate-limit@11, and @fastify/websocket@11.

To be clear, the Fastify 5 move itself is not optional here: there is no patched 7.x backport (the 7 line ends at 7.0.4), and @fastify/static@10.1.2 builds against fastify ^5.1.0. So the fix genuinely requires Fastify 5 plus the matching plugin majors.

One piece of good news: we don't call setHeaders anywhere, so the @fastify/static v10 breaking change (Response to FastifyReply) doesn't affect us.

Suggested path

Please split this into two PRs:

  1. Security fix: @fastify/static to v10 + find-my-way, together with fastify v5 and the @fastify/cors@11 / @fastify/rate-limit@11 / @fastify/websocket@11 majors, so the web server still boots.
  2. Separate PR: Electron 44 paired with a compatible better-sqlite3. That one needs real testing on all three platforms and shouldn't block the security fix.

The js-yaml 4 to 5 bump should also be called out explicitly wherever it lands, rather than arriving unannounced.

No merge conflicts on this branch, so there's nothing to rebase. It's the scope and the red CI that need addressing.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@pedramamini