chore(deps): bump fastify from 4.9.2 to 4.10.2

[dependabot]

Bumps fastify from 4.9.2 to 4.10.2.

Release notes

Sourced from fastify's releases.

v4.10.2

⚠️ Security Release ⚠️

• Fix for "Incorrect Content-Type parsing can lead to CSRF attack" and CVE-2022-41919

Full Changelog: fastify/fastify@v4.10.1...v4.10.2

v4.10.1

What's Changed

• fix node 19.1.0 port validation test by @​Uzlopak in fastify/fastify#4427
• Add fastify-constraints to community plugins by @​Ceres6 in fastify/fastify#4428
• build(deps-dev): bump @​sinonjs/fake-timers from 9.1.2 to 10.0.0 by @​dependabot in fastify/fastify#4421
• add silent option to LogLevel by @​Uzlopak in fastify/fastify#4432

New Contributors

• @​Ceres6 made their first contribution in fastify/fastify#4428

Full Changelog: fastify/fastify@v4.10.0...v4.10.1

v4.10.0

What's Changed

• docs(reference/reply): spelling fixes by @​Fdawgs in fastify/fastify#4358
• Support different content-type typed reply with TypeProvider by @​rain714 in fastify/fastify#4360
• chore: remove leading empty lines by @​LinusU in fastify/fastify#4364
• fix types after pino 8.7.0 change by @​mcollina in fastify/fastify#4365
• Node.js V19 support by @​mcollina in fastify/fastify#4366
• fix: no check on null or undefined values passed as fn by @​metcoder95 in fastify/fastify#4367
• docs(server): config is lost when reply.call not found() is called by @​cesarvspr in fastify/fastify#4368
• Fix typo - 'sever' to 'server' by @​utsav91 in fastify/fastify#4372
• Add platformatic to the Acknowledgements by @​mcollina in fastify/fastify#4378
• docs: add Simone Busoli to plugin maintainers by @​simoneb in fastify/fastify#4379
• add missing 'validationContext' field to FastifyError type by @​jakubburzynski in fastify/fastify#4363
• fix(type-providers): assignability of instance with enabled type provider by @​driimus in fastify/fastify#4371
• feat: support async trailer by @​climba03003 in fastify/fastify#4380
• fix: trailers async race condition by @​climba03003 in fastify/fastify#4383
• docs(ecosystem): Add fastify-list-routes by @​chuongtrh in fastify/fastify#4385
• build(deps-dev): bump @​sinclair/typebox from 0.24.51 to 0.25.2 by @​dependabot in fastify/fastify#4388
• [ Fix ] Improve error message for hooks check by @​debadutta98 in fastify/fastify#4387
• fix: tiny-lru usage by @​climba03003 in fastify/fastify#4391
• Removes old note about named imports in ESM by @​fox1t in fastify/fastify#4392
• docs: Add section about capacity planning by @​kibertoad in fastify/fastify#4386
• docs(recommendations): grammar fixes by @​Fdawgs in fastify/fastify#4396
• chore(doc): duplicated menu item by @​Eomm in fastify/fastify#4398
• feat: add request.routeOptions object by @​debadutta98 in fastify/fastify#4397
• docs: Document multiple app approach by @​kibertoad in fastify/fastify#4393
• fix example using db decorator on fastify instance by @​mmarti in fastify/fastify#4406
• docs: fix removeAdditional refer by @​shunyue1320 in fastify/fastify#4410

... (truncated)

Commits

• 62dde76 Merge pull request from GHSA-3fjj-p79j-c9hh
• 6fc06c1 Bumped v4.10.1
• a8873ef add silent option to LogLevel (#4432)
• 9c1be2a build(deps-dev): bump @​sinonjs/fake-timers from 9.1.2 to 10.0.0 (#4421)
• 9c85bed Add fastify-constraints to community plugins (#4428)
• 36d84bc fix node 19.1.0 port validation test (#4427)
• 3767bc2 Bumped v4.10.0
• 5c8039c docs: fix removeAdditional refer (#4410)
• ea58581 docs: fix example using db decorator on fastify instance (#4406)
• 675b00d docs: Document multiple app approach (#4393)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[coveralls]

Pull Request Test Coverage Report for Build 3cd8035e-566b-4f83-8df3-f4fbf70c1d27

• 0 of 0 changed or added relevant lines in 0 files are covered.
• No unchanged relevant lines lost coverage.
• Overall coverage remained the same at 93.404%

---

Totals
Change from base Build a213a525-4c5b-48ee-9803-b76e72178509:	0.0%
Covered Lines:	6202
Relevant Lines:	6640

---

💛 - Coveralls

[gjasny]

This fixes GHSA-3fjj-p79j-c9hh

[elbasan]

when can we expect this to be merged?

[goriunov]

Same, waiting for this to be merged 😢

[micalevisk]

Tip

🏓 @ufec

---

If it is just a matter of upgrading the fastify dependency from @nestjs/platform-fastify, you don't need to wait for this PR 😄 Follow this:

for NPM v8+

1. If you have fastify as a dependency in your project already, add this entry to your package.json:

  "overrides": {
    "@nestjs/platform-fastify": {
      "fastify": "$fastify"
    }
  }

If fastify is not a directly dependency of your project, add this one instead:

  "overrides": {
    "@nestjs/platform-fastify": {
      "fastify": "^4.10.2"
    }
  }

2. delete the lock file: rm -f package-lock.json
3. delete the node_modules: rm -r node_modules
4. npm install
5. Check out the result: npm ls fastify

for Yarn v1

Use the resolutions feature

and see yarn why fastify

These two are the ones I tried and they worked here.

[goriunov]

@micalevisk the suggestion works, but we use an internal common module that wraps different utilities around the platform-fastify and nestjs that is where we have the platform-fastify installed, also we have tons of microservices over 70 that use that utility, and that means that for every microservice we have to go and add

 "overrides": {
    "@nestjs/platform-fastify": {
      "fastify": "^4.10.2"
    }
  }

as it is not propagating from the common module configuration. Also, this is a temporary change as when this PR is merged we will have to remove the overrides from every single place...

I am wondering if there could be another way to allow the manual fastify version update in the future, may be with peer dependency and weaker limitations..

[micalevisk]

@goriunov got you

I don't see why we couldn't move fastify to peer dep instead in the next major bump. But that is probably something that Kamil had evaluated in the past.

[batflarrow]

@micalevisk I am currently trying to resolve the fastify security vulnerability and I am forced to upgrade @nestjs/platform-fastify to V9 because fastify was upgraded to a non-vulnerable version in nest v9 but our current nest version is v8 and we don't want to upgrade to v9 just yet, is there any way I can resolve the vulnerability and still remain on the same version?