[dependabot]

Bumps the fastify group with 2 updates in the / directory: @fastify/static and fastify.

Updates @fastify/static from 10.1.2 to 10.1.6

Release notes

Sourced from @​fastify/static's releases.

v10.1.6

What's Changed

• ci: enable trusted publishing releases by @​Puppo in fastify/fastify-static#615

Full Changelog: fastify/fastify-static@v10.1.5...v10.1.6

v10.1.5

What's Changed

• fix: use registered root for relative downloads by @​lprnmns in fastify/fastify-static#610

New Contributors

• @​lprnmns made their first contribution in fastify/fastify-static#610

Full Changelog: fastify/fastify-static@v10.1.4...v10.1.5

v10.1.4

This is a security release for GHSA-r799-r9gc-m956 (CVE-2026-90982).

It fixes a route guard and allowedPath bypass on case-insensitive filesystems. Users should upgrade to @fastify/static 10.1.4.

Full Changelog: fastify/fastify-static@v10.1.3...v10.1.4

v10.1.3

What's Changed

• chore: bump c8 from 11.0.0 to 12.0.0 by @​dependabot[bot] in fastify/fastify-static#602
• chore(.npmrc): add min-release-age by @​Fdawgs in fastify/fastify-static#603
• chore: bump fastify/workflows/.github/workflows/lock-threads.yml from 6.0.0 to 7.0.0 by @​dependabot[bot] in fastify/fastify-static#605

Full Changelog: fastify/fastify-static@v10.1.2...v10.1.3

Commits

• b38a463 Bumped v10.1.6
• a57db88 ci: enable trusted publishing releases
• 2f0953a Bumped v10.1.5
• 275d87e fix: use registered root for relative downloads (#610)
• a39a464 Bumped v10.1.4
• ac46015 Ignore .pi
• 6288466 test: consume compressed response bodies
• 04134a4 test: cover rootless path validation on Windows
• d9a8c0a test: make case-folding fallback portable
• dbe65e8 Merge commit from fork
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​fastify/static since your current version.

Updates fastify from 5.3.2 to 5.12.7

Release notes

Sourced from fastify's releases.

v5.12.7

Full Changelog: fastify/fastify@v5.12.6...v5.12.7

v5.12.6

⚠️ Security Release

• Fix for GHSA-389g-gv7q-r4x8

What's Changed

• [Backport 5.x] types: restrict route lookup methods by @​github-actions[bot] in fastify/fastify#7048
• [Backport 5.x] perf: decode string bodies once instead of per chunk by @​github-actions[bot] in fastify/fastify#7053
• [Backport 5.x] perf: avoid resetting the level of request child loggers by @​github-actions[bot] in fastify/fastify#7058
• [Backport 5.x] fix: resolve reply.mediaType from raw response headers by @​github-actions[bot] in fastify/fastify#7067
• [Backport 5.x] perf: use a FIFO cache for parsed content-types by @​github-actions[bot] in fastify/fastify#7072
• [Backport 5.x] fix(validation): lowercase header names in propertyNames enum/const by @​mcollina in fastify/fastify#7104
• [Backport 5.x] fix: copy a set-cookie array passed to reply.header instead of storing it by @​github-actions[bot] in fastify/fastify#7087
• [Backport 5.x] fix: remove error when HTTP QUERY request has empty body by @​github-actions[bot] in fastify/fastify#7060
• [Backport 5.x] docs: document fastify.query() shorthand for RFC 10008 by @​github-actions[bot] in fastify/fastify#7094

Full Changelog: fastify/fastify@v5.12.5...v5.12.6

v5.12.5

⚠️ Security release

• Fix for GHSA-4mh8-r7rc-xpvc

What's Changed

• [Backport 5.x] perf: reduce content-type parser overhead by @​github-actions[bot] in fastify/fastify#7019
• [Backport 5.x] perf: avoid redundant request-part reads during validation by @​github-actions[bot] in fastify/fastify#7020

Full Changelog: fastify/fastify@v5.12.4...v5.12.5

v5.12.4

Fixed the fastify.js version mismatch.

Full Changelog: fastify/fastify@v5.12.2...v5.12.4

v5.12.2

⚠️ Security release

• Fix for GHSA-9q9j-q6p8-xq58
• Fix for GHSA-hwr6-493r-vm6h
• Fix for GHSA-p68q-wchp-6fh7
• Fix for GHSA-667r-xxjv-c9mm

What's Changed

• [Backport 5.x] fix: callNotFound should run not-found preHandler regardless of registration order by @​github-actions[bot] in fastify/fastify#6973
• [Backport 5.x] chore: npm ignore remaining agent files by @​github-actions[bot] in fastify/fastify#7003

... (truncated)

Commits

• 9f40003 Bumped v5.12.7
• 16469b9 Bumped v5.12.6
• 63496de [Backport 5.x] docs: document fastify.query() shorthand for RFC 10008 (#7094)
• 20b55d4 [Backport 5.x] fix: remove error when HTTP QUERY request has empty body (#7060)
• 38d2b63 [Backport 5.x] fix: copy a set-cookie array passed to reply.header instead of...
• 3241fbd [Backport 5.x] fix(validation): lowercase header names in propertyNames enum/...
• 1a46b1b [Backport 5.x] perf: use a FIFO cache for parsed content-types (#7072)
• 7e06676 [Backport 5.x] fix: resolve reply.mediaType from raw response headers (#7067)
• 1b0eb32 [Backport 5.x] perf: avoid resetting the level of request child loggers (#7058)
• a636a10 [Backport 5.x] perf: decode string bodies once instead of per chunk (#7053)
• Additional commits viewable in compare view

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.