@nestjs/platform-fastify 12.1.2 → 12.2.0

package/adapters/utils/get-media-type-version.util.d.ts

@@ -6,6 +6,10 @@
  * media range of a list (`text/html, application/json;v=2`); the first match
  * wins. Returns `undefined` when no parameter starts with the key.
  *
+ * Quoted parameter values are unescaped, and separators inside them are ignored.
+ * An unterminated quoted string runs to the end of the header value, so a
+ * version that follows its opening quote is not read.
+ *
  * Duplicated in each platform package so that a platform package never
  * depends on a newer `@nestjs/core` than the one installed.
  */

package/adapters/utils/get-media-type-version.util.js

@@ -1,3 +1,29 @@
+/**
+ * Splits a header value at separators outside quoted strings in linear time.
+ * Backslash-escaped characters inside quoted strings are treated as literals.
+ */
+const splitOutsideQuotes = (value, separator) => {
+    const parts = [];
+    let start = 0;
+    let isQuoted = false;
+    const len = value.length;
+    for (let index = 0; index < len; index++) {
+        const character = value[index];
+        if (isQuoted && character === '\\') {
+            // A quoted-pair consumes the next character, including an escaped quote.
+            index++;
+        }
+        else if (character === '"') {
+            isQuoted = !isQuoted;
+        }
+        else if (character === separator && !isQuoted) {
+            parts.push(value.slice(start, index));
+            start = index + 1;
+        }
+    }
+    parts.push(value.slice(start));
+    return parts;
+};
 /**
  * Returns the version carried by an `Accept` header for media type versioning,
  * e.g. `2` for `application/json;v=2` with the `v=` key.
@@ -6,19 +32,27 @@
  * media range of a list (`text/html, application/json;v=2`); the first match
  * wins. Returns `undefined` when no parameter starts with the key.
  *
+ * Quoted parameter values are unescaped, and separators inside them are ignored.
+ * An unterminated quoted string runs to the end of the header value, so a
+ * version that follows its opening quote is not read.
+ *
  * Duplicated in each platform package so that a platform package never
  * depends on a newer `@nestjs/core` than the one installed.
  */
 export function getMediaTypeVersion(acceptHeader, key) {
     const mediaRanges = []
         .concat(acceptHeader ?? [])
-        .flatMap(value => value.split(','));
+        .flatMap(value => splitOutsideQuotes(value, ','));
     for (const mediaRange of mediaRanges) {
-        const [, ...parameters] = mediaRange.split(';');
+        const [, ...parameters] = splitOutsideQuotes(mediaRange, ';');
         for (const parameter of parameters) {
             const trimmedParameter = parameter.trim();
             if (trimmedParameter.startsWith(key)) {
-                return trimmedParameter.slice(key.length);
+                const version = trimmedParameter.slice(key.length);
+                if (version.startsWith('"') && version.endsWith('"')) {
+                    return version.slice(1, -1).replace(/\\([\s\S])/g, '$1');
+                }
+                return version;
             }
         }
     }

package/multipart/interfaces/multipart-options.interface.d.ts

@@ -12,11 +12,11 @@ export interface MultipartStorageEngine {
 /**
  * Same keys as platform-express's `MulterLimits`.
  *
- * Limits that are not set fall back to the options `@fastify/multipart` was
- * registered with, and then to its own defaults. Unlike multer (which
- * defaults `fileSize` and `parts` to `Infinity`), `@fastify/multipart` caps
- * `fileSize` at the Fastify instance's `bodyLimit` (1 MiB unless configured)
- * and `parts` at 1000.
+ * Limits that are not set, or set to `null` or `undefined`, fall back to the
+ * options `@fastify/multipart` was registered with, and then to its own
+ * defaults. Unlike multer (which defaults `fileSize` and `parts` to
+ * `Infinity`), `@fastify/multipart` caps `fileSize` at the Fastify
+ * instance's `bodyLimit` (1 MiB unless configured) and `parts` at 1000.
  *
  * @publicApi
  */
@@ -39,6 +39,20 @@ export interface MultipartLimits {
     parts?: number;
     /** For multipart forms, the max number of header key => value pairs to parse (Default: 2000) */
     headerPairs?: number;
+    /**
+     * Max nesting depth of field names; `a[b][c]` has 2 levels (Default: 32,
+     * where multer's own default is Infinity). Set it to `Infinity` to lift
+     * the limit. Like `fieldNameSize`, it does not fall back to the options
+     * `@fastify/multipart` was registered with.
+     */
+    fieldNestingDepth?: number;
+    /**
+     * Max numeric array index accepted in field names; `a[3]` uses index 3
+     * (Default: 1000, where multer's own default is Infinity). Set it to
+     * `Infinity` to lift the limit. Like `fieldNameSize`, it does not fall back
+     * to the options `@fastify/multipart` was registered with.
+     */
+    fieldArrayIndexLimit?: number;
 }
 /**
  * Same keys and semantics as platform-express's `MulterOptions`, so option

package/multipart/multipart/append-field.util.d.ts

@@ -1,6 +1,7 @@
 /**
  * Appends a text field to `store` using multer's bracket notation.
- * Returns `false` (leaving `store` untouched) for names that would pollute a
- * prototype.
+ * Returns `false` for names it cannot apply: names that would pollute a
+ * prototype (leaving `store` untouched) and appends to an array that already
+ * has the maximum length.
  */
 export declare function appendField(store: object, key: string, value: unknown): boolean;

package/multipart/multipart/append-field.util.js

@@ -84,11 +84,13 @@ function setValue(ctx, step, current, value) {
             }
             obj = Object.create(null);
             ctx[step.key] = obj;
-            current.forEach((item, i) => {
-                if (item !== undefined) {
-                    obj['' + i] = item;
+            // Only the indices that hold a value, so that the work depends on the
+            // number of items rather than on the length of a sparse array.
+            for (const index of Object.keys(current)) {
+                if (current[index] !== undefined) {
+                    obj[index] = current[index];
                 }
-            });
+            }
             return obj;
         case 'scalar':
             obj = Object.create(null);
@@ -99,14 +101,23 @@ function setValue(ctx, step, current, value) {
 }
 /**
  * Appends a text field to `store` using multer's bracket notation.
- * Returns `false` (leaving `store` untouched) for names that would pollute a
- * prototype.
+ * Returns `false` for names it cannot apply: names that would pollute a
+ * prototype (leaving `store` untouched) and appends to an array that already
+ * has the maximum length.
  */
 export function appendField(store, key, value) {
     const steps = parsePath(key);
     if (steps.some(step => FORBIDDEN_KEYS.has(String(step.key)))) {
         return false;
     }
-    steps.reduce((ctx, step) => setValue(ctx, step, ctx[step.key], value), store);
+    try {
+        steps.reduce((ctx, step) => setValue(ctx, step, ctx[step.key], value), store);
+    }
+    catch (err) {
+        if (err instanceof RangeError) {
+            return false;
+        }
+        throw err;
+    }
     return true;
 }

package/multipart/multipart/multipart-interceptor.factory.js

@@ -1,10 +1,12 @@
 import { __decorate, __metadata, __param } from "tslib";
 import { Inject, mixin, Optional, StreamableFile, } from '@nestjs/common';
 import { HttpAdapterHost } from '@nestjs/core';
+import { isRejectedByPipes } from '@nestjs/core/internal';
 import { catchError, concatMap, from, throwError } from 'rxjs';
+import { finished } from 'stream';
 import { MULTIPART_MODULE_OPTIONS } from '../files.constants.js';
 import { MISSING_PLUGIN_MESSAGE, PLUGIN_NOT_REGISTERED_AT_STARTUP_MESSAGE, WRONG_ADAPTER_MESSAGE, } from './multipart.constants.js';
-import { drainRequest, processMultipart, processStream, resolveStorage, validateLimits, } from './multipart.parser.js';
+import { drainRequest, processMultipart, processStream, removeFiles, resolveStorage, validateLimits, } from './multipart.parser.js';
 import { mergeMultipartOptions } from './multipart.utils.js';
 const verifiedInstances = new WeakSet();
 /**
@@ -78,9 +80,23 @@ export function createMultipartInterceptor(spec, localOptions) {
             this.storage = resolveStorage(this.options);
         }
         async intercept(context, next) {
-            const req = context.switchToHttp().getRequest();
-            await processMultipart(req, spec, this.options, this.storage);
-            return next.handle();
+            const ctx = context.switchToHttp();
+            const req = ctx.getRequest();
+            const stored = await processMultipart(req, spec, this.options, this.storage);
+            return next.handle().pipe(
+            // When the route's pipes reject the request (e.g. `ParseFilePipe`),
+            // the route handler never sees the files, and nothing else would
+            // remove them. They are removed once the response has been sent, as
+            // an exception filter may still use (or remove) them.
+            catchError(err => {
+                if (isRejectedByPipes(req)) {
+                    const reply = ctx.getResponse();
+                    finished(reply.raw, () => {
+                        removeFiles(this.storage, req, stored).catch(() => undefined);
+                    });
+                }
+                return throwError(() => err);
+            }));
         }
     };
     MixinInterceptor = __decorate([

package/multipart/multipart/multipart.constants.d.ts

@@ -14,9 +14,23 @@ export declare const multerExceptions: {
     readonly LIMIT_UNEXPECTED_FILE: "Unexpected file field";
     readonly MISSING_FIELD_NAME: "Field name missing";
     readonly LIMIT_FIELD_NESTING: "Field name nesting too deep";
+    readonly LIMIT_FIELD_ARRAY_INDEX: "Field name array index too large";
     readonly INVALID_FIELD_NAME: "Invalid field name";
 };
 export type MultipartErrorCode = keyof typeof multerExceptions;
+/**
+ * Defaults of the field name limits that multer leaves at `Infinity`, which
+ * let a single small request build an arbitrarily deep `req.body`
+ * (`fieldNestingDepth`) or arrays of arbitrary length (`fieldArrayIndexLimit`).
+ * `32` is the nesting depth `body-parser` allows in the urlencoded bodies the
+ * ExpressAdapter parses; `1000` is the number of parameters it parses, and
+ * the number of parts `@fastify/multipart` accepts. Kept identical to
+ * platform-express's `DEFAULT_FIELD_NAME_LIMITS`.
+ */
+export declare const DEFAULT_FIELD_NAME_LIMITS: {
+    readonly fieldNestingDepth: 32;
+    readonly fieldArrayIndexLimit: 1000;
+};
 /**
  * The messages platform-express reports for busboy 1.x parser errors
  * (prefixed with "Multipart: "), which is what multer bundles.

package/multipart/multipart/multipart.constants.js

@@ -15,10 +15,24 @@ export const multerExceptions = {
     LIMIT_UNEXPECTED_FILE: 'Unexpected file field',
     MISSING_FIELD_NAME: 'Field name missing',
     LIMIT_FIELD_NESTING: 'Field name nesting too deep',
+    LIMIT_FIELD_ARRAY_INDEX: 'Field name array index too large',
     // A multer 2.4 code that platform-express's table lacks. Raised here for
     // field names that would pollute a prototype, which multer accepts.
     INVALID_FIELD_NAME: 'Invalid field name',
 };
+/**
+ * Defaults of the field name limits that multer leaves at `Infinity`, which
+ * let a single small request build an arbitrarily deep `req.body`
+ * (`fieldNestingDepth`) or arrays of arbitrary length (`fieldArrayIndexLimit`).
+ * `32` is the nesting depth `body-parser` allows in the urlencoded bodies the
+ * ExpressAdapter parses; `1000` is the number of parameters it parses, and
+ * the number of parts `@fastify/multipart` accepts. Kept identical to
+ * platform-express's `DEFAULT_FIELD_NAME_LIMITS`.
+ */
+export const DEFAULT_FIELD_NAME_LIMITS = {
+    fieldNestingDepth: 32,
+    fieldArrayIndexLimit: 1000,
+};
 /**
  * The messages platform-express reports for busboy 1.x parser errors
  * (prefixed with "Multipart: "), which is what multer bundles.

package/multipart/multipart/multipart.parser.d.ts

@@ -1,6 +1,6 @@
 import type { FastifyRequest } from 'fastify';
 import type { IncomingMessage } from 'http';
-import type { MultipartField, MultipartLimits, MultipartOptions, MultipartStorageEngine } from '../interfaces/index.js';
+import type { MultipartField, MultipartLimits, MultipartOptions, MultipartStorageEngine, UploadedMultipartFile } from '../interfaces/index.js';
 /**
  * Where accepted files end up, named after multer's `FileAppender` strategies.
  */
@@ -12,6 +12,7 @@ export interface UploadSpec {
 }
 /** Same resolution order as multer: `storage`, then `dest`, then memory. */
 export declare function resolveStorage(options: MultipartOptions): MultipartStorageEngine;
+export declare function removeFiles(storage: MultipartStorageEngine, req: FastifyRequest, files: UploadedMultipartFile[]): Promise<void[]>;
 /**
  * Stops parsing and discards the rest of the body, so that an error response
  * does not race a client that is still uploading (multer does the same
@@ -26,10 +27,11 @@ export declare function drainRequest(raw: IncomingMessage): Promise<void>;
 export declare function validateLimits(limits: MultipartLimits | undefined): void;
 /**
  * Parses the multipart body with multer's semantics and populates
- * `req.body` and `req.file` / `req.files`. Requests that are not multipart
- * are passed through untouched, as multer does.
+ * `req.body` and `req.file` / `req.files`, and returns the stored files.
+ * Requests that are not multipart are passed through untouched, as multer
+ * does.
  */
-export declare function processMultipart(request: FastifyRequest, spec: UploadSpec, options: MultipartOptions, storage: MultipartStorageEngine): Promise<void>;
+export declare function processMultipart(request: FastifyRequest, spec: UploadSpec, options: MultipartOptions, storage: MultipartStorageEngine): Promise<UploadedMultipartFile[]>;
 /**
  * Parses up to and including the first file in `fieldName`, then stops and
  * hands that file's stream to the route handler (`req.file.stream`). Text

package/multipart/multipart/multipart.parser.js

@@ -2,7 +2,7 @@ import { BadRequestException, PayloadTooLargeException } from '@nestjs/common';
 import { diskStorage } from '../storage/disk.storage.js';
 import { memoryStorage } from '../storage/memory.storage.js';
 import { appendField } from './append-field.util.js';
-import { busboyExceptions, MISSING_PLUGIN_MESSAGE, multerExceptions, } from './multipart.constants.js';
+import { busboyExceptions, DEFAULT_FIELD_NAME_LIMITS, MISSING_PLUGIN_MESSAGE, multerExceptions, } from './multipart.constants.js';
 import { MultipartError } from './multipart.error.js';
 import { transformException } from './multipart.utils.js';
 /** Same resolution order as multer: `storage`, then `dest`, then memory. */
@@ -22,15 +22,18 @@ function assertPluginRegistered(req) {
 }
 /**
  * Per-route options handed to `req.parts()`; `@fastify/multipart` deep-merges
- * them over the options the plugin was registered with. `@fastify/busboy`
- * treats `fileSize` and `parts` as "max allowed" (it fires once a limit is
+ * them over the options the plugin was registered with. Limits set to `null`
+ * or `undefined` are left out, as the merge would copy them over the
+ * plugin's limits (and its `fileSize` and `parts` defaults), which
+ * `@fastify/busboy` then reads as no limit. `@fastify/busboy` treats
+ * `fileSize` and `parts` as "max allowed" (it fires once a limit is
  * exceeded), so unlike multer there is no `+1` adjustment. Truncation is
  * detected here (`file.truncated`), so the plugin's own throw is disabled.
  */
 function toBusboyConfig(limits, options) {
     const config = { throwFileSizeLimit: false };
     if (limits) {
-        config.limits = { ...limits };
+        config.limits = Object.fromEntries(Object.entries(limits).filter(([, value]) => value != null));
     }
     if (options.preservePath !== undefined) {
         config.preservePath = options.preservePath;
@@ -86,9 +89,12 @@ const ABORTED = Symbol('aborted');
  * the engine (e.g. by a `pipeline()` to a file that cannot be written), which
  * reports that error itself.
  *
- * Whatever the engine stores after an abort is removed once it calls back,
- * as multer does: what it stored when it succeeds, and the file at `path`
- * (which engines set before writing, by multer's convention) when it fails.
+ * Whatever the engine stores after an abort is removed, as multer does. The
+ * file at `path` (which engines set before writing, by multer's convention)
+ * is removed right away, as an engine waiting on `pipeline()` never calls
+ * back for a stream destroyed after its last chunk; removing it clears
+ * `path`. What the engine stored is removed once it calls back: what it
+ * returned when it succeeds, and the file at `path` when it fails.
  */
 function storeFile(storage, req, file) {
     return new Promise((resolve, reject) => {
@@ -101,6 +107,10 @@ function storeFile(storage, req, file) {
             if (!stream.readableEnded && !stream.errored) {
                 aborted = true;
                 resolve(ABORTED);
+                const partial = file;
+                if (partial.path) {
+                    removeFiles(storage, req, [partial]).catch(() => undefined);
+                }
             }
         };
         stream.once('close', onClose);
@@ -116,7 +126,7 @@ function storeFile(storage, req, file) {
         });
     });
 }
-function removeFiles(storage, req, files) {
+export function removeFiles(storage, req, files) {
     return Promise.all(files.map(file => new Promise(resolve => storage._removeFile(req, file, () => resolve()))));
 }
 /**
@@ -197,6 +207,39 @@ function checkFieldNameSize(rawName, limits) {
         throw new MultipartError('LIMIT_FIELD_KEY');
     }
 }
+/**
+ * Whether the field name holds a numeric index above `limit`, decided as
+ * multer does. Only a name `appendField` parses as a bracket path builds an
+ * array; one it keeps as a literal key (`a[6]suffix`, `[6]`) never does.
+ */
+function exceedsArrayIndexLimit(name, limit) {
+    if (!/^[^[]+(?:\[[^\]]+\])*(?:\[\])?$/.test(name)) {
+        return false;
+    }
+    for (const [, index] of name.matchAll(/\[(\d+)\]/g)) {
+        if (Number(index) > limit) {
+            return true;
+        }
+    }
+    return false;
+}
+/**
+ * `fieldNestingDepth` and `fieldArrayIndexLimit` are multer's own limits
+ * (busboy knows neither), so they are checked here, against the decoded name.
+ * Unlike multer, they default to `DEFAULT_FIELD_NAME_LIMITS`.
+ */
+function checkFieldNameShape(name, limits) {
+    const nestingDepth = limits?.fieldNestingDepth ?? DEFAULT_FIELD_NAME_LIMITS.fieldNestingDepth;
+    if (name.split('[').length - 1 > nestingDepth) {
+        throw new MultipartError('LIMIT_FIELD_NESTING', name);
+    }
+    const arrayIndexLimit = limits?.fieldArrayIndexLimit ??
+        DEFAULT_FIELD_NAME_LIMITS.fieldArrayIndexLimit;
+    if (arrayIndexLimit !== Infinity &&
+        exceedsArrayIndexLimit(name, arrayIndexLimit)) {
+        throw new MultipartError('LIMIT_FIELD_ARRAY_INDEX', name);
+    }
+}
 /**
  * Adds a text field to `body`, with multer's checks, in multer's order.
  */
@@ -209,6 +252,7 @@ function appendTextField(body, part, limits) {
         throw new MultipartError('LIMIT_FIELD_VALUE', part.fieldname);
     }
     checkFieldNameSize(rawName, limits);
+    checkFieldNameShape(part.fieldname, limits);
     if (!appendField(body, part.fieldname, part.value)) {
         throw new MultipartError('INVALID_FIELD_NAME', part.fieldname);
     }
@@ -229,15 +273,16 @@ function readFilePart(part, limits) {
 }
 /**
  * Parses the multipart body with multer's semantics and populates
- * `req.body` and `req.file` / `req.files`. Requests that are not multipart
- * are passed through untouched, as multer does.
+ * `req.body` and `req.file` / `req.files`, and returns the stored files.
+ * Requests that are not multipart are passed through untouched, as multer
+ * does.
  */
 export async function processMultipart(request, spec, options, storage) {
     const req = request;
     assertPluginRegistered(req);
     resetFiles(req);
     if (!req.isMultipart()) {
-        return;
+        return [];
     }
     const filesLeft = new Map();
     if (spec.fields !== 'ANY') {
@@ -308,6 +353,7 @@ export async function processMultipart(request, spec, options, storage) {
             break;
         }
     }
+    return stored;
 }
 /**
  * Parses up to and including the first file in `fieldName`, then stops and

package/multipart/multipart/multipart.utils.js

@@ -13,6 +13,11 @@ export function mergeMultipartOptions(options = {}, localOptions = {}) {
     if (isPlainObject(options.limits) && isPlainObject(localOptions.limits)) {
         merged.limits = { ...options.limits, ...localOptions.limits };
     }
+    // `dest` and `storage` both say where files go, and `resolveStorage()`
+    // prefers `storage`, so a global storage engine would shadow a local `dest`.
+    if (localOptions.dest && !localOptions.storage) {
+        delete merged.storage;
+    }
     return merged;
 }
 /**

package/multipart/storage/disk.storage.js

@@ -3,10 +3,24 @@ import { createWriteStream, mkdirSync } from 'fs';
 import { unlink } from 'fs/promises';
 import { tmpdir } from 'os';
 import { join } from 'path';
-import { pipeline } from 'stream/promises';
+import { finished, pipeline } from 'stream/promises';
 function resolveName(resolver, req, file) {
     return new Promise((resolve, reject) => resolver(req, file, (err, value) => (err ? reject(err) : resolve(value))));
 }
+const STREAM_DESTROYED_MESSAGE = 'File stream was destroyed';
+/**
+ * Rejects once `stream` is destroyed before its end without an error, as
+ * `@fastify/multipart` does when the form is cut off. `pipeline()` never
+ * settles then if the last chunk had already been pushed: it waits for an
+ * 'end' that is never emitted, with the file still open.
+ */
+function rejectWhenCutOff(stream) {
+    return new Promise((_resolve, reject) => stream.once('close', () => {
+        if (!stream.readableEnded && !stream.errored) {
+            reject(new Error(STREAM_DESTROYED_MESSAGE));
+        }
+    }));
+}
 /**
  * Writes each file to disk, with multer's `diskStorage` defaults and file
  * shape (`destination`, `filename`, `path`, `size`).
@@ -30,14 +44,25 @@ export function diskStorage(options = {}) {
     const store = async (req, file) => {
         const destination = await resolveName(resolveDestination, req, file);
         const filename = await resolveName(resolveFilename, req, file);
+        // As in multer, no file is created for a stream destroyed in the meantime.
+        if (file.stream.destroyed) {
+            throw new Error(STREAM_DESTROYED_MESSAGE);
+        }
         const path = join(destination, filename);
         // As in multer, `path` is known to the file before it is written.
         file.path = path;
         const out = createWriteStream(path);
         try {
-            await pipeline(file.stream, out);
+            await Promise.race([
+                pipeline(file.stream, out),
+                rejectWhenCutOff(file.stream),
+            ]);
         }
         catch (err) {
+            // Removed once closed: a file still being opened would be created
+            // after the unlink.
+            out.destroy();
+            await finished(out).catch(() => undefined);
             await unlink(path).catch(() => undefined);
             throw err;
         }

package/multipart/storage/memory.storage.js

@@ -8,12 +8,20 @@ export function memoryStorage() {
     return {
         _handleFile(_req, file, callback) {
             const chunks = [];
-            file.stream.on('data', (chunk) => chunks.push(chunk));
-            file.stream.once('error', callback);
-            file.stream.once('end', () => {
+            const onData = (chunk) => chunks.push(chunk);
+            const onError = (err) => {
+                stopListening();
+                callback(err);
+            };
+            const onEnd = () => {
+                stopListening();
                 const buffer = Buffer.concat(chunks);
                 callback(null, { buffer, size: buffer.length });
-            });
+            };
+            // `@fastify/multipart` keeps every part's stream until the request
+            // ends, and with it these listeners and the chunks they hold.
+            const stopListening = () => file.stream.off('data', onData).off('error', onError).off('end', onEnd);
+            file.stream.on('data', onData).once('error', onError).once('end', onEnd);
         },
         _removeFile(_req, file, callback) {
             delete file.buffer;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nestjs/platform-fastify",
-  "version": "12.1.2",
+  "version": "12.2.0",
   "description": "Nest - modern, fast, powerful node.js web framework (@platform-fastify)",
   "author": "Kamil Mysliwiec",
   "license": "MIT",
@@ -8,6 +8,7 @@
   "main": "./index.js",
   "exports": {
     ".": "./index.js",
+    "./package.json": "./package.json",
     "./multipart": "./multipart/index.js",
     "./*.js": "./*.js",
     "./*": "./*.js"
@@ -26,13 +27,13 @@
     "access": "public"
   },
   "dependencies": {
-    "@fastify/cors": "11.3.0",
-    "@fastify/formbody": "9.0.0",
-    "@fastify/middie": "9.3.4",
+    "@fastify/cors": "11.3.1",
+    "@fastify/formbody": "9.0.1",
+    "@fastify/middie": "9.3.5",
     "fast-querystring": "1.1.2",
-    "fastify": "5.12.5",
-    "find-my-way": "9.9.0",
-    "light-my-request": "6.6.0",
+    "fastify": "5.12.7",
+    "find-my-way": "9.10.0",
+    "light-my-request": "6.8.0",
     "path-to-regexp": "8.4.2",
     "tslib": "2.8.1"
   },
@@ -54,5 +55,5 @@
       "optional": true
     }
   },
-  "gitHead": "8ab60aa1b2927fbe0e23135ffc65d610c623236a"
+  "gitHead": "af37111368de7fd2dfab0bdec2f530c7845510c2"
 }