fastify 4.25.2 → 4.26.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/.vscode/settings.json +22 -0
- package/EXPENSE_POLICY.md +105 -0
- package/GOVERNANCE.md +2 -103
- package/LICENSE +1 -1
- package/README.md +13 -9
- package/SECURITY.md +2 -157
- package/SPONSORS.md +20 -0
- package/build/build-validation.js +3 -1
- package/docs/Guides/Ecosystem.md +27 -9
- package/docs/Guides/Getting-Started.md +16 -3
- package/docs/Guides/Style-Guide.md +7 -7
- package/docs/Reference/Decorators.md +1 -1
- package/docs/Reference/Errors.md +63 -1
- package/docs/Reference/Hooks.md +1 -1
- package/docs/Reference/Logging.md +3 -3
- package/docs/Reference/Reply.md +70 -1
- package/docs/Reference/Server.md +90 -0
- package/docs/Reference/Warnings.md +2 -0
- package/fastify.d.ts +3 -2
- package/fastify.js +25 -7
- package/lib/configValidator.js +62 -33
- package/lib/contentTypeParser.js +9 -2
- package/lib/error-handler.js +1 -1
- package/lib/error-serializer.js +2 -0
- package/lib/errors.js +4 -0
- package/lib/fourOhFour.js +4 -3
- package/lib/hooks.js +1 -5
- package/lib/reply.js +68 -10
- package/lib/reqIdGenFactory.js +5 -0
- package/lib/route.js +22 -6
- package/lib/schema-controller.js +37 -4
- package/lib/symbols.js +1 -0
- package/lib/warnings.js +6 -0
- package/package.json +17 -5
- package/test/async_hooks.test.js +69 -0
- package/test/findRoute.test.js +135 -0
- package/test/genReqId.test.js +392 -0
- package/test/hooks.on-listen.test.js +66 -14
- package/test/internals/errors.test.js +17 -7
- package/test/internals/initialConfig.test.js +7 -3
- package/test/internals/reply.test.js +80 -5
- package/test/schema-serialization.test.js +41 -0
- package/test/schema-validation.test.js +115 -6
- package/test/serialize-response.test.js +187 -0
- package/test/types/instance.test-d.ts +14 -1
- package/test/types/reply.test-d.ts +4 -2
- package/test/types/route.test-d.ts +15 -1
- package/test/useSemicolonDelimiter.test.js +113 -0
- package/test/web-api.test.js +208 -0
- package/types/instance.d.ts +23 -10
- package/types/reply.d.ts +4 -0
- package/test/types/import.js +0 -2
|
@@ -0,0 +1,22 @@
|
|
|
1
|
+
{
|
|
2
|
+
"workbench.colorCustomizations": {
|
|
3
|
+
"[GitHub Dark]": {
|
|
4
|
+
"tab.activeBackground": "#0d0d0d",
|
|
5
|
+
"tab.activeBorder": "#ffff00"
|
|
6
|
+
},
|
|
7
|
+
"activityBar.background": "#BEE077",
|
|
8
|
+
"activityBar.foreground": "#1C6B58",
|
|
9
|
+
"activityBar.inactiveForeground": "#444444",
|
|
10
|
+
"activityBar.activeBorder": "#411f88",
|
|
11
|
+
"activityBar.activeBackground": "#2F9980",
|
|
12
|
+
"activityBar.border": "#2F9980",
|
|
13
|
+
"titleBar.activeBackground": "#A6D83D",
|
|
14
|
+
"titleBar.activeForeground": "#1C6B58",
|
|
15
|
+
"titleBar.inactiveBackground": "#9cbb5a",
|
|
16
|
+
"titleBar.inactiveForeground": "#444444",
|
|
17
|
+
"titleBar.border": "#2F9980",
|
|
18
|
+
"statusBar.background": "#98C538",
|
|
19
|
+
"statusBar.foreground": "#1C6B58",
|
|
20
|
+
"statusBar.border": "#2F9980"
|
|
21
|
+
}
|
|
22
|
+
}
|
|
@@ -0,0 +1,105 @@
|
|
|
1
|
+
# Expense Policy
|
|
2
|
+
|
|
3
|
+
Fastify collaborators accept donations through the [Open Collective](https://opencollective.com/fastify/)
|
|
4
|
+
platform and [GitHub Sponsors](https://github.com/sponsors/fastify)
|
|
5
|
+
to enhance the project and support the community.
|
|
6
|
+
|
|
7
|
+
This Collective is run by and for the benefit of the independent contributors to
|
|
8
|
+
the Fastify open source software project.
|
|
9
|
+
This Collective is not endorsed or administered by OpenJS Foundation, Inc.
|
|
10
|
+
(the “OpenJS Foundation”). The OpenJS Foundation does not receive or have
|
|
11
|
+
control over any funds contributed. The OpenJS Foundation does not direct or
|
|
12
|
+
otherwise supervise the actions of any contributor to the Fastify project,
|
|
13
|
+
and all donations made will be expended for the private benefit of or otherwise
|
|
14
|
+
to reimburse individuals that do not have an employer/employee, contractor, or
|
|
15
|
+
other agency relationship with the OpenJS Foundation.
|
|
16
|
+
The Fastify marks used herein are used under license from the OpenJS Foundation
|
|
17
|
+
for the benefit of the open source software community.
|
|
18
|
+
|
|
19
|
+
The admins of the Fastify Collective are the [lead maintainers](./GOVERNANCE.md)
|
|
20
|
+
of the project.
|
|
21
|
+
|
|
22
|
+
This document outlines the process for requesting reimbursement or an invoice
|
|
23
|
+
for expenses.
|
|
24
|
+
|
|
25
|
+
## Reimbursement
|
|
26
|
+
|
|
27
|
+
Reimbursement is applicable for expenses already paid, such as:
|
|
28
|
+
|
|
29
|
+
- Stickers
|
|
30
|
+
- Gadgets
|
|
31
|
+
- Hosting
|
|
32
|
+
|
|
33
|
+
**Before making any purchases**, initiate a [new discussion](https://github.com/orgs/fastify/discussions)
|
|
34
|
+
in the `fastify` organization with the following information:
|
|
35
|
+
|
|
36
|
+
- What is needed
|
|
37
|
+
- Why it is needed
|
|
38
|
+
- Cost
|
|
39
|
+
- Deadline
|
|
40
|
+
|
|
41
|
+
Once the discussion is approved by a lead maintainer and with no unresolved objections,
|
|
42
|
+
the purchase can proceed, and an expense can be submitted to the [Open Collective][submit].
|
|
43
|
+
This process takes a minimum of 3 business days from the request to allow time for
|
|
44
|
+
discussion approval.
|
|
45
|
+
|
|
46
|
+
The discussion helps prevent misunderstandings and ensures the expense is not rejected.
|
|
47
|
+
As a project under the OpenJS Foundation, Fastify benefits from the Foundation's
|
|
48
|
+
resources, including servers, domains, and [travel funds](https://github.com/openjs-foundation/community-fund/tree/main/programs/travel-fund).
|
|
49
|
+
|
|
50
|
+
Always seek approval first.
|
|
51
|
+
|
|
52
|
+
## Invoice
|
|
53
|
+
|
|
54
|
+
Invoices are for services provided to the Fastify project, such as PR reviews,
|
|
55
|
+
documentation, etc.
|
|
56
|
+
A VAT number is not required to submit an invoice.
|
|
57
|
+
Refer to the [Open Collective documentation][openc_docs] for details.
|
|
58
|
+
|
|
59
|
+
### Adding a bounty to an issue
|
|
60
|
+
|
|
61
|
+
Issues become eligible for a bounty when the core team adds the `bounty` label,
|
|
62
|
+
with the amount determined by the core team based on `estimated hours * rate`
|
|
63
|
+
(suggested $50 per hour).
|
|
64
|
+
|
|
65
|
+
> Example: If the estimated time to fix the issue is 2 hours,
|
|
66
|
+
> the bounty will be $100.
|
|
67
|
+
|
|
68
|
+
To add a bounty:
|
|
69
|
+
|
|
70
|
+
- Apply the `bounty` label to the issue
|
|
71
|
+
- Comment on the issue with the bounty amount
|
|
72
|
+
- Edit the first comment of the issue using this template:
|
|
73
|
+
|
|
74
|
+
```
|
|
75
|
+
## 💰 Bounty
|
|
76
|
+
|
|
77
|
+
This issue has a bounty of [$AMOUNT](LINK TO THE BOUNTY COMMENT).
|
|
78
|
+
_Read more about [the bounty program](./EXPENSE_POLICY.md)_
|
|
79
|
+
```
|
|
80
|
+
|
|
81
|
+
For discussions on bounties or determining amounts, open a [new discussion](https://github.com/orgs/fastify/discussions/new?category=bounty).
|
|
82
|
+
|
|
83
|
+
### Outstanding contributions
|
|
84
|
+
|
|
85
|
+
The lead team can decide to add a bounty to an issue or PR not labeled as `bounty`
|
|
86
|
+
if the contribution is outstanding.
|
|
87
|
+
|
|
88
|
+
### Claiming a bounty
|
|
89
|
+
|
|
90
|
+
To claim a bounty:
|
|
91
|
+
|
|
92
|
+
- Submit a PR that fixes the issue
|
|
93
|
+
- If multiple submissions exist, a core member will choose the best solution
|
|
94
|
+
- Once merged, the PR author can claim the bounty by:
|
|
95
|
+
- Submitting an expense to the [Open Collective][submit] with the PR link
|
|
96
|
+
- Adding a comment on the PR with a link to their Open Collective expense to
|
|
97
|
+
ensure the claimant is the issue resolver
|
|
98
|
+
- The expense will be validated by a lead maintainer and then the payment will be
|
|
99
|
+
processed by Open Collective
|
|
100
|
+
|
|
101
|
+
If the Open Collective budget is insufficient, the expense will be rejected.
|
|
102
|
+
Unclaimed bounties are available for other issues.
|
|
103
|
+
|
|
104
|
+
[submit]: https://opencollective.com/fastify/expenses/new
|
|
105
|
+
[openc_docs]: https://docs.oscollective.org/how-it-works/basics/invoice-and-reimbursement-examples
|
package/GOVERNANCE.md
CHANGED
|
@@ -1,105 +1,4 @@
|
|
|
1
1
|
# Fastify Project Governance
|
|
2
2
|
|
|
3
|
-
|
|
4
|
-
|
|
5
|
-
* [Lead Maintainers](#lead-maintainers)
|
|
6
|
-
* [Collaborators](#collaborators)
|
|
7
|
-
* [Collaborator activities](#collaborator-activities)
|
|
8
|
-
* [Great Contributors](#great-contributors)
|
|
9
|
-
* [Collaborator nominations](#collaborator-maintainers-nominations)
|
|
10
|
-
* [Lead Maintainers nominations](#lead-maintainers-nominations)
|
|
11
|
-
* [Consensus seeking process](#consensus-seeking-process)
|
|
12
|
-
|
|
13
|
-
<!-- /TOC -->
|
|
14
|
-
|
|
15
|
-
## Lead Maintainers
|
|
16
|
-
|
|
17
|
-
Fastify Lead Maintainers are the organization owners.
|
|
18
|
-
They are the only members of the `@fastify/leads` team. The Lead
|
|
19
|
-
Maintainers are the curator of the Fastify project and their key responsibility
|
|
20
|
-
is to issue releases of Fastify and its dependencies.
|
|
21
|
-
|
|
22
|
-
## Collaborators
|
|
23
|
-
|
|
24
|
-
Fastify Collaborators maintain the projects of the Fastify organization.
|
|
25
|
-
|
|
26
|
-
They are split into the following teams:
|
|
27
|
-
|
|
28
|
-
| Team | Responsibility | Repository |
|
|
29
|
-
|---|---|---|
|
|
30
|
-
| `@fastify/leads` | Fastify Lead Maintainers | GitHub organization owners |
|
|
31
|
-
| `@fastify/core` | Fastify Core development | `fastify`, `fast-json-stringify`, `light-my-request`, `fastify-plugin`, `middie` |
|
|
32
|
-
| `@fastify/plugins` | Build, maintain and release Fastify plugins | All plugins repositories |
|
|
33
|
-
| `@fastify/benchmarks` | Build and maintain our benchmarks suite | `benchmarks` |
|
|
34
|
-
| `@fastify/docs-chinese` | Translate the Fastify documentation in Chinese | `docs-chinese` |
|
|
35
|
-
|
|
36
|
-
Every member of the org is also part of `@fastify/fastify`.
|
|
37
|
-
|
|
38
|
-
Collaborators have:
|
|
39
|
-
|
|
40
|
-
* Commit access to the projects repository of the team they belong
|
|
41
|
-
* Grant to release new versions of the project
|
|
42
|
-
|
|
43
|
-
Both Collaborators and non-Collaborators may propose changes to the source code
|
|
44
|
-
of the projects of the organization. The mechanism to propose such a change is a
|
|
45
|
-
GitHub pull request. Collaborators review and merge (_land_) pull requests
|
|
46
|
-
following the [CONTRIBUTING](CONTRIBUTING.md#rules) guidelines.
|
|
47
|
-
|
|
48
|
-
### Collaborator activities
|
|
49
|
-
|
|
50
|
-
* Helping users and novice contributors
|
|
51
|
-
* Contributing code and documentation changes that improve the project
|
|
52
|
-
* Reviewing and commenting on issues and pull requests
|
|
53
|
-
* Participation in working groups
|
|
54
|
-
* Merging pull requests
|
|
55
|
-
* Release plugins
|
|
56
|
-
|
|
57
|
-
The Lead Maintainers can remove inactive Collaborators or provide them with
|
|
58
|
-
_Past Collaborators_ status. Past Collaborators may request that the Lead
|
|
59
|
-
Maintainers restore them to active status.
|
|
60
|
-
|
|
61
|
-
|
|
62
|
-
## Great Contributors
|
|
63
|
-
|
|
64
|
-
Great contributors on a specific area in the Fastify ecosystem will be invited
|
|
65
|
-
to join this group by Lead Maintainers. This group has the same permissions of a
|
|
66
|
-
contributor.
|
|
67
|
-
|
|
68
|
-
## Collaborator nominations
|
|
69
|
-
|
|
70
|
-
Individuals making significant and valuable contributions to the project may be
|
|
71
|
-
a candidate to join the Fastify organization.
|
|
72
|
-
|
|
73
|
-
A Collaborator needs to open a private team discussion on GitHub and list the
|
|
74
|
-
candidates they want to sponsor with a link to the user's contributions. For
|
|
75
|
-
example:
|
|
76
|
-
|
|
77
|
-
* Activities in the Fastify organization
|
|
78
|
-
`[USERNAME](https://github.com/search?q=author:USERNAME+org:fastify)`
|
|
79
|
-
|
|
80
|
-
Otherwise, a Contributor may self-apply if they believe they meet the above
|
|
81
|
-
criteria by reaching out to a Lead Maintainer privately with the links to their
|
|
82
|
-
valuable contributions. The Lead Maintainers will reply to the Contributor and
|
|
83
|
-
will decide if candidate it to be made a collaborator.
|
|
84
|
-
|
|
85
|
-
The consensus to grant a new candidate Collaborator status is reached when:
|
|
86
|
-
|
|
87
|
-
- at least one of the Lead Maintainers approve
|
|
88
|
-
- at least two of the Team Members approve
|
|
89
|
-
|
|
90
|
-
After these conditions are satisfied, the [onboarding
|
|
91
|
-
process](CONTRIBUTING.md#onboarding-collaborators) may start.
|
|
92
|
-
|
|
93
|
-
|
|
94
|
-
## Lead Maintainers nominations
|
|
95
|
-
|
|
96
|
-
A Team Member may be promoted to a Lead Maintainers only through nomination by a
|
|
97
|
-
Lead maintainer and with agreement from the rest of Lead Maintainers.
|
|
98
|
-
|
|
99
|
-
|
|
100
|
-
## Consensus seeking process
|
|
101
|
-
|
|
102
|
-
The Fastify organization follows a [Consensus Seeking][] decision-making model.
|
|
103
|
-
|
|
104
|
-
[Consensus Seeking]:
|
|
105
|
-
https://en.wikipedia.org/wiki/Consensus-seeking_decision-making
|
|
3
|
+
Please see Fastify's [organization-wide governance
|
|
4
|
+
](https://github.com/fastify/.github/blob/main/GOVERNANCE.md) document.
|
package/LICENSE
CHANGED
package/README.md
CHANGED
|
@@ -29,6 +29,7 @@ downloads](https://img.shields.io/npm/dm/fastify.svg?style=flat)](https://www.np
|
|
|
29
29
|
Disclosure](https://img.shields.io/badge/Security-Responsible%20Disclosure-yellow.svg)](https://github.com/fastify/fastify/blob/main/SECURITY.md)
|
|
30
30
|
[](https://discord.gg/fastify)
|
|
31
31
|
[](https://gitpod.io/#https://github.com/fastify/fastify)
|
|
32
|
+

|
|
32
33
|
|
|
33
34
|
</div>
|
|
34
35
|
|
|
@@ -171,15 +172,6 @@ fastify.listen({ port: 3000 }, (err, address) => {
|
|
|
171
172
|
Do you want to know more? Head to the <a
|
|
172
173
|
href="./docs/Guides/Getting-Started.md"><code><b>Getting Started</b></code></a>.
|
|
173
174
|
|
|
174
|
-
|
|
175
|
-
### Fastify v1.x and v2.x
|
|
176
|
-
|
|
177
|
-
Code for Fastify's **v1.x** is in [**`branch
|
|
178
|
-
1.x`**](https://github.com/fastify/fastify/tree/1.x), so all Fastify 1.x related
|
|
179
|
-
changes should be based on **`branch 1.x`**. In a similar way, all Fastify
|
|
180
|
-
**v2.x** related changes should be based on [**`branch
|
|
181
|
-
2.x`**](https://github.com/fastify/fastify/tree/2.x).
|
|
182
|
-
|
|
183
175
|
> ## Note
|
|
184
176
|
> `.listen` binds to the local host, `localhost`, interface by default
|
|
185
177
|
> (`127.0.0.1` or `::1`, depending on the operating system configuration). If
|
|
@@ -275,6 +267,12 @@ application, you should __always__ benchmark if performance matters to you.
|
|
|
275
267
|
Please visit [Fastify help](https://github.com/fastify/help) to view prior
|
|
276
268
|
support issues and to ask new support questions.
|
|
277
269
|
|
|
270
|
+
## Contributing
|
|
271
|
+
|
|
272
|
+
Whether reporting bugs, discussing improvements and new ideas or writing code,
|
|
273
|
+
we welcome contributions from anyone and everyone. Please read the [CONTRIBUTING](./CONTRIBUTING.md)
|
|
274
|
+
guidelines before submitting pull requests.
|
|
275
|
+
|
|
278
276
|
## Team
|
|
279
277
|
|
|
280
278
|
_Fastify_ is the result of the work of a great community. Team members are
|
|
@@ -383,6 +381,12 @@ We are a [At-Large
|
|
|
383
381
|
Project](https://github.com/openjs-foundation/cross-project-council/blob/HEAD/PROJECT_PROGRESSION.md#at-large-projects)
|
|
384
382
|
in the [OpenJS Foundation](https://openjsf.org/).
|
|
385
383
|
|
|
384
|
+
## Sponsors
|
|
385
|
+
|
|
386
|
+
Support this project by becoming a [SPONSOR](./SPONSORS.md)!
|
|
387
|
+
Fastify has an [Open Collective](https://opencollective.com/fastify)
|
|
388
|
+
page where we accept and manage financial contributions.
|
|
389
|
+
|
|
386
390
|
## Acknowledgements
|
|
387
391
|
|
|
388
392
|
This project is kindly sponsored by:
|
package/SECURITY.md
CHANGED
|
@@ -1,159 +1,4 @@
|
|
|
1
1
|
# Security Policy
|
|
2
2
|
|
|
3
|
-
|
|
4
|
-
|
|
5
|
-
|
|
6
|
-
## Reporting vulnerabilities
|
|
7
|
-
|
|
8
|
-
Individuals who find potential vulnerabilities in Fastify are invited to
|
|
9
|
-
complete a vulnerability report via the dedicated HackerOne page:
|
|
10
|
-
[https://hackerone.com/fastify](https://hackerone.com/fastify).
|
|
11
|
-
|
|
12
|
-
### Strict measures when reporting vulnerabilities
|
|
13
|
-
|
|
14
|
-
It is of the utmost importance that you read carefully and follow these
|
|
15
|
-
guidelines to ensure the ecosystem as a whole isn't disrupted due to improperly
|
|
16
|
-
reported vulnerabilities:
|
|
17
|
-
|
|
18
|
-
* Avoid creating new "informative" reports on HackerOne. Only create new
|
|
19
|
-
HackerOne reports on a vulnerability if you are absolutely sure this should be
|
|
20
|
-
tagged as an actual vulnerability. Third-party vendors and individuals are
|
|
21
|
-
tracking any new vulnerabilities reported in HackerOne and will flag them as
|
|
22
|
-
such for their customers (think about snyk, npm audit, ...).
|
|
23
|
-
* HackerOne reports should never be created and triaged by the same person. If
|
|
24
|
-
you are creating a HackerOne report for a vulnerability that you found, or on
|
|
25
|
-
behalf of someone else, there should always be a 2nd Security Team member who
|
|
26
|
-
triages it. If in doubt, invite more Fastify Collaborators to help triage the
|
|
27
|
-
validity of the report. In any case, the report should follow the same process
|
|
28
|
-
as outlined below of inviting the maintainers to review and accept the
|
|
29
|
-
vulnerability.
|
|
30
|
-
* ***Do not*** attempt to show CI/CD vulnerabilities by creating new pull
|
|
31
|
-
requests to any of the Fastify organization's repositories. Doing so will
|
|
32
|
-
result in a [content report][cr] to GitHub as an unsolicited exploit.
|
|
33
|
-
The proper way to provide such reports is by creating a new repository,
|
|
34
|
-
configured in the same manner as the repository you would like to submit
|
|
35
|
-
a report about, and with a pull request to your own repository showing
|
|
36
|
-
the proof of concept.
|
|
37
|
-
|
|
38
|
-
[cr]: https://docs.github.com/en/communities/maintaining-your-safety-on-github/reporting-abuse-or-spam#reporting-an-issue-or-pull-request
|
|
39
|
-
|
|
40
|
-
### Vulnerabilities found outside this process
|
|
41
|
-
|
|
42
|
-
⚠ The Fastify project does not support any reporting outside the HackerOne
|
|
43
|
-
process.
|
|
44
|
-
|
|
45
|
-
## Handling vulnerability reports
|
|
46
|
-
|
|
47
|
-
When a potential vulnerability is reported, the following actions are taken:
|
|
48
|
-
|
|
49
|
-
### Triage
|
|
50
|
-
|
|
51
|
-
**Delay:** 4 business days
|
|
52
|
-
|
|
53
|
-
Within 4 business days, a member of the security team provides a first answer to
|
|
54
|
-
the individual who submitted the potential vulnerability. The possible responses
|
|
55
|
-
can be:
|
|
56
|
-
|
|
57
|
-
* Acceptance: what was reported is considered as a new vulnerability
|
|
58
|
-
* Rejection: what was reported is not considered as a new vulnerability
|
|
59
|
-
* Need more information: the security team needs more information in order to
|
|
60
|
-
evaluate what was reported.
|
|
61
|
-
|
|
62
|
-
Triaging should include updating issue fields:
|
|
63
|
-
* Asset - set/create the module affected by the report
|
|
64
|
-
* Severity - TBD, currently left empty
|
|
65
|
-
|
|
66
|
-
Reference: [HackerOne: Submitting
|
|
67
|
-
Reports](https://docs.hackerone.com/hackers/submitting-reports.html)
|
|
68
|
-
|
|
69
|
-
### Correction follow-up
|
|
70
|
-
|
|
71
|
-
**Delay:** 90 days
|
|
72
|
-
|
|
73
|
-
When a vulnerability is confirmed, a member of the security team volunteers to
|
|
74
|
-
follow up on this report.
|
|
75
|
-
|
|
76
|
-
With the help of the individual who reported the vulnerability, they contact the
|
|
77
|
-
maintainers of the vulnerable package to make them aware of the vulnerability.
|
|
78
|
-
The maintainers can be invited as participants to the reported issue.
|
|
79
|
-
|
|
80
|
-
With the package maintainer, they define a release date for the publication of
|
|
81
|
-
the vulnerability. Ideally, this release date should not happen before the
|
|
82
|
-
package has been patched.
|
|
83
|
-
|
|
84
|
-
The report's vulnerable versions upper limit should be set to:
|
|
85
|
-
* `*` if there is no fixed version available by the time of publishing the
|
|
86
|
-
report.
|
|
87
|
-
* the last vulnerable version. For example: `<=1.2.3` if a fix exists in `1.2.4`
|
|
88
|
-
|
|
89
|
-
### Publication
|
|
90
|
-
|
|
91
|
-
**Delay:** 90 days
|
|
92
|
-
|
|
93
|
-
Within 90 days after the triage date, the vulnerability must be made public.
|
|
94
|
-
|
|
95
|
-
**Severity**: Vulnerability severity is assessed using [CVSS
|
|
96
|
-
v.3](https://www.first.org/cvss/user-guide). More information can be found on
|
|
97
|
-
[HackerOne documentation](https://docs.hackerone.com/hackers/severity.html)
|
|
98
|
-
|
|
99
|
-
If the package maintainer is actively developing a patch, an additional delay
|
|
100
|
-
can be added with the approval of the security team and the individual who
|
|
101
|
-
reported the vulnerability.
|
|
102
|
-
|
|
103
|
-
At this point, a CVE should be requested through the HackerOne platform through
|
|
104
|
-
the UI, which should include the Report ID and a summary.
|
|
105
|
-
|
|
106
|
-
Within HackerOne, this is handled through a "public disclosure request".
|
|
107
|
-
|
|
108
|
-
Reference: [HackerOne:
|
|
109
|
-
Disclosure](https://docs.hackerone.com/hackers/disclosure.html)
|
|
110
|
-
|
|
111
|
-
## The Fastify Security team
|
|
112
|
-
|
|
113
|
-
The core team is responsible for the management of HackerOne program and this
|
|
114
|
-
policy and process.
|
|
115
|
-
|
|
116
|
-
Members of this team are expected to keep all information that they have
|
|
117
|
-
privileged access to by being on the team completely private to the team. This
|
|
118
|
-
includes agreeing to not notify anyone outside the team of issues that have not
|
|
119
|
-
yet been disclosed publicly, including the existence of issues, expectations of
|
|
120
|
-
upcoming releases, and patching of any issues other than in the process of their
|
|
121
|
-
work as a member of the Fastify Core team.
|
|
122
|
-
|
|
123
|
-
### Members
|
|
124
|
-
|
|
125
|
-
* [__Matteo Collina__](https://github.com/mcollina),
|
|
126
|
-
<https://twitter.com/matteocollina>, <https://www.npmjs.com/~matteo.collina>
|
|
127
|
-
* [__Tomas Della Vedova__](https://github.com/delvedor),
|
|
128
|
-
<https://twitter.com/delvedor>, <https://www.npmjs.com/~delvedor>
|
|
129
|
-
* [__Vincent Le Goff__](https://github.com/zekth)
|
|
130
|
-
* [__KaKa Ng__](https://github.com/climba03003)
|
|
131
|
-
* [__James Sumners__](https://github.com/jsumners),
|
|
132
|
-
<https://twitter.com/jsumners79>, <https://www.npmjs.com/~jsumners>
|
|
133
|
-
|
|
134
|
-
## OpenSSF CII Best Practices
|
|
135
|
-
|
|
136
|
-
[](https://bestpractices.coreinfrastructure.org/projects/7585)
|
|
137
|
-
|
|
138
|
-
There are three “tiers”: passing, silver, and gold.
|
|
139
|
-
|
|
140
|
-
### Passing
|
|
141
|
-
We meet 100% of the “passing” criteria.
|
|
142
|
-
|
|
143
|
-
### Silver
|
|
144
|
-
We meet 87% of the “silver” criteria. The gaps are as follows:
|
|
145
|
-
- we do not have a DCO or a CLA process for contributions.
|
|
146
|
-
- we do not currently document
|
|
147
|
-
“what the user can and cannot expect in terms of security” for our project.
|
|
148
|
-
- we do not currently document ”the architecture (aka high-level design)”
|
|
149
|
-
for our project.
|
|
150
|
-
|
|
151
|
-
### Gold
|
|
152
|
-
We meet 70% of the “gold” criteria. The gaps are as follows:
|
|
153
|
-
- we do not yet have the “silver” badge; see all the gaps above.
|
|
154
|
-
- We do not include a copyright or license statement in each source file.
|
|
155
|
-
Efforts are underway to change this archaic practice into a
|
|
156
|
-
suggestion instead of a hard requirement.
|
|
157
|
-
- There are a few unanswered questions around cryptography that are
|
|
158
|
-
waiting for clarification.
|
|
159
|
-
|
|
3
|
+
Please see Fastify's [organization-wide security policy
|
|
4
|
+
](https://github.com/fastify/.github/blob/main/SECURITY.md).
|
package/SPONSORS.md
ADDED
|
@@ -0,0 +1,20 @@
|
|
|
1
|
+
# Sponsors
|
|
2
|
+
|
|
3
|
+
All active sponsors of Fastify are listed here, in order of contribution!
|
|
4
|
+
Our sponsors are the reason why we can work on some issues or features
|
|
5
|
+
that otherwise would be impossible to do.
|
|
6
|
+
|
|
7
|
+
If you want to become a sponsor, please check out our [Open Collective page](https://opencollective.com/fastify)
|
|
8
|
+
or [GitHub Sponsors](https://github.com/sponsors/fastify)!
|
|
9
|
+
|
|
10
|
+
## Tier 4
|
|
11
|
+
|
|
12
|
+
_Be the first!_
|
|
13
|
+
|
|
14
|
+
## Tier 3
|
|
15
|
+
|
|
16
|
+
_Be the first!_
|
|
17
|
+
|
|
18
|
+
## Tier 2
|
|
19
|
+
|
|
20
|
+
_Be the first!_
|
|
@@ -41,7 +41,8 @@ const defaultInitOptions = {
|
|
|
41
41
|
requestIdHeader: 'request-id',
|
|
42
42
|
requestIdLogLabel: 'reqId',
|
|
43
43
|
http2SessionTimeout: 72000, // 72 seconds
|
|
44
|
-
exposeHeadRoutes: true
|
|
44
|
+
exposeHeadRoutes: true,
|
|
45
|
+
useSemicolonDelimiter: true
|
|
45
46
|
}
|
|
46
47
|
|
|
47
48
|
const schema = {
|
|
@@ -101,6 +102,7 @@ const schema = {
|
|
|
101
102
|
requestIdLogLabel: { type: 'string', default: defaultInitOptions.requestIdLogLabel },
|
|
102
103
|
http2SessionTimeout: { type: 'integer', default: defaultInitOptions.http2SessionTimeout },
|
|
103
104
|
exposeHeadRoutes: { type: 'boolean', default: defaultInitOptions.exposeHeadRoutes },
|
|
105
|
+
useSemicolonDelimiter: { type: 'boolean', default: defaultInitOptions.useSemicolonDelimiter },
|
|
104
106
|
// deprecated style of passing the versioning constraint
|
|
105
107
|
versioning: {
|
|
106
108
|
type: 'object',
|
package/docs/Guides/Ecosystem.md
CHANGED
|
@@ -13,7 +13,7 @@ section.
|
|
|
13
13
|
- [`@fastify/accepts-serializer`](https://github.com/fastify/fastify-accepts-serializer)
|
|
14
14
|
to serialize to output according to the `Accept` header.
|
|
15
15
|
- [`@fastify/any-schema`](https://github.com/fastify/any-schema-you-like) Save
|
|
16
|
-
multiple schemas and decide which one to use to serialize the payload
|
|
16
|
+
multiple schemas and decide which one to use to serialize the payload.
|
|
17
17
|
- [`@fastify/auth`](https://github.com/fastify/fastify-auth) Run multiple auth
|
|
18
18
|
functions in Fastify.
|
|
19
19
|
- [`@fastify/autoload`](https://github.com/fastify/fastify-autoload) Require all
|
|
@@ -53,6 +53,8 @@ section.
|
|
|
53
53
|
configuration.
|
|
54
54
|
- [`@fastify/etag`](https://github.com/fastify/fastify-etag) Automatically
|
|
55
55
|
generate ETags for HTTP responses.
|
|
56
|
+
- [`@fastify/express`](https://github.com/fastify/fastify-express) Express
|
|
57
|
+
compatibility layer for Fastify.
|
|
56
58
|
- [`@fastify/flash`](https://github.com/fastify/fastify-flash) Set and get flash
|
|
57
59
|
messages using the session.
|
|
58
60
|
- [`@fastify/formbody`](https://github.com/fastify/fastify-formbody) Plugin to
|
|
@@ -69,6 +71,8 @@ section.
|
|
|
69
71
|
your HTTP requests to another server, with hooks.
|
|
70
72
|
- [`@fastify/jwt`](https://github.com/fastify/fastify-jwt) JWT utils for
|
|
71
73
|
Fastify, internally uses [fast-jwt](https://github.com/nearform/fast-jwt).
|
|
74
|
+
- [`@fastify/kafka`](https://github.com/fastify/fastify-kafka) Plugin to interact
|
|
75
|
+
with Apache Kafka.
|
|
72
76
|
- [`@fastify/leveldb`](https://github.com/fastify/fastify-leveldb) Plugin to
|
|
73
77
|
share a common LevelDB connection across Fastify.
|
|
74
78
|
- [`@fastify/middie`](https://github.com/fastify/middie) Middleware engine for
|
|
@@ -78,6 +82,8 @@ section.
|
|
|
78
82
|
connection pool across every part of your server.
|
|
79
83
|
- [`@fastify/multipart`](https://github.com/fastify/fastify-multipart) Multipart
|
|
80
84
|
support for Fastify.
|
|
85
|
+
- [`@fastify/mysql`](https://github.com/fastify/fastify-mysql) Fastify MySQL
|
|
86
|
+
connection plugin.
|
|
81
87
|
- [`@fastify/nextjs`](https://github.com/fastify/fastify-nextjs) React
|
|
82
88
|
server-side rendering support for Fastify with
|
|
83
89
|
[Next](https://github.com/zeit/next.js/).
|
|
@@ -85,6 +91,8 @@ section.
|
|
|
85
91
|
[`simple-oauth2`](https://github.com/lelylan/simple-oauth2).
|
|
86
92
|
- [`@fastify/one-line-logger`](https://github.com/fastify/one-line-logger) Formats
|
|
87
93
|
Fastify's logs into a nice one-line message.
|
|
94
|
+
- [`@fastify/passport`](https://github.com/fastify/fastify-passport) Use Passport
|
|
95
|
+
strategies to authenticate requests and protect route.
|
|
88
96
|
- [`@fastify/postgres`](https://github.com/fastify/fastify-postgres) Fastify
|
|
89
97
|
PostgreSQL connection plugin, with this you can share the same PostgreSQL
|
|
90
98
|
connection pool in every part of your server.
|
|
@@ -104,6 +112,8 @@ section.
|
|
|
104
112
|
A simple plugin that enables response validation for Fastify.
|
|
105
113
|
- [`@fastify/routes`](https://github.com/fastify/fastify-routes) Plugin that
|
|
106
114
|
provides a `Map` of routes.
|
|
115
|
+
- [`@fastify/routes-stats`](https://github.com/fastify/fastify-routes-stats)
|
|
116
|
+
Provide stats for routes using `node:perf_hooks`.
|
|
107
117
|
- [`@fastify/schedule`](https://github.com/fastify/fastify-schedule) Plugin for
|
|
108
118
|
scheduling periodic jobs, based on
|
|
109
119
|
[toad-scheduler](https://github.com/kibertoad/toad-scheduler).
|
|
@@ -121,15 +131,17 @@ section.
|
|
|
121
131
|
- [`@fastify/swagger`](https://github.com/fastify/fastify-swagger) Plugin for
|
|
122
132
|
serving Swagger/OpenAPI documentation for Fastify, supporting dynamic
|
|
123
133
|
generation.
|
|
134
|
+
- [`@fastify/swagger-ui`](https://github.com/fastify/fastify-swagger-ui) Plugin
|
|
135
|
+
for serving Swagger UI.
|
|
124
136
|
- [`@fastify/throttle`](https://github.com/fastify/fastify-throttle) Plugin for
|
|
125
137
|
throttling the download speed of a request.
|
|
126
138
|
- [`@fastify/type-provider-json-schema-to-ts`](https://github.com/fastify/fastify-type-provider-json-schema-to-ts)
|
|
127
139
|
Fastify
|
|
128
|
-
[type provider](https://
|
|
140
|
+
[type provider](https://fastify.dev/docs/latest/Reference/Type-Providers/)
|
|
129
141
|
for [json-schema-to-ts](https://github.com/ThomasAribart/json-schema-to-ts).
|
|
130
142
|
- [`@fastify/type-provider-typebox`](https://github.com/fastify/fastify-type-provider-typebox)
|
|
131
143
|
Fastify
|
|
132
|
-
[type provider](https://
|
|
144
|
+
[type provider](https://fastify.dev/docs/latest/Reference/Type-Providers/)
|
|
133
145
|
for [Typebox](https://github.com/sinclairzx81/typebox).
|
|
134
146
|
- [`@fastify/under-pressure`](https://github.com/fastify/under-pressure) Measure
|
|
135
147
|
process load with automatic handling of _"Service Unavailable"_ plugin for
|
|
@@ -142,6 +154,8 @@ section.
|
|
|
142
154
|
[Vite](https://vitejs.dev/), allows for serving SPA/MPA/SSR Vite applications.
|
|
143
155
|
- [`@fastify/websocket`](https://github.com/fastify/fastify-websocket) WebSocket
|
|
144
156
|
support for Fastify. Built upon [ws](https://github.com/websockets/ws).
|
|
157
|
+
- [`@fastify/zipkin`](https://github.com/fastify/fastify-zipkin) Plugin
|
|
158
|
+
for Zipkin distributed tracing system.
|
|
145
159
|
|
|
146
160
|
#### [Community](#community)
|
|
147
161
|
|
|
@@ -206,9 +220,6 @@ section.
|
|
|
206
220
|
- [`apitally`](https://github.com/apitally/nodejs-client) Fastify plugin to
|
|
207
221
|
integrate with [Apitally](https://apitally.io), a simple API monitoring &
|
|
208
222
|
API key management solution.
|
|
209
|
-
- [`apollo-server-fastify`](https://github.com/apollographql/apollo-server/tree/master/packages/apollo-server-fastify)
|
|
210
|
-
Run an [Apollo Server](https://github.com/apollographql/apollo-server) to
|
|
211
|
-
serve GraphQL with Fastify.
|
|
212
223
|
- [`arecibo`](https://github.com/nucleode/arecibo) Fastify ping responder for
|
|
213
224
|
Kubernetes Liveness and Readiness Probes.
|
|
214
225
|
- [`cls-rtracer`](https://github.com/puzpuzpuz/cls-rtracer) Fastify middleware
|
|
@@ -384,6 +395,11 @@ section.
|
|
|
384
395
|
- [`fastify-hemera`](https://github.com/hemerajs/fastify-hemera) Fastify Hemera
|
|
385
396
|
plugin, for writing reliable & fault-tolerant microservices with
|
|
386
397
|
[nats.io](https://nats.io/).
|
|
398
|
+
- [`fastify-hl7`](https://github.com/Bugs5382/fastify-hl7) A Fastify Plugin to
|
|
399
|
+
create a server, build, and send HL7 formatted Hl7 messages. Using
|
|
400
|
+
[node-hl7-client](https://github.com/Bugs5382/node-hl7-client) and
|
|
401
|
+
[node-hl7-server](https://github.com/Bugs5382/node-hl7-server) as the
|
|
402
|
+
underlining technology to do this.
|
|
387
403
|
- [`fastify-http-client`](https://github.com/kenuyx/fastify-http-client) Plugin
|
|
388
404
|
to send HTTP(s) requests. Built upon [urllib](https://github.com/node-modules/urllib).
|
|
389
405
|
- [`fastify-http-context`](https://github.com/thorough-developer/fastify-http-context)
|
|
@@ -537,7 +553,7 @@ middlewares into Fastify plugins
|
|
|
537
553
|
[qs](https://github.com/ljharb/qs).
|
|
538
554
|
- [`fastify-rabbitmq`](https://github.com/Bugs5382/fastify-rabbitmq) Fastify
|
|
539
555
|
RabbitMQ plugin that uses
|
|
540
|
-
[node-
|
|
556
|
+
[node-rabbitmq-client](https://github.com/cody-greene/node-rabbitmq-client)
|
|
541
557
|
plugin as a wrapper.
|
|
542
558
|
- [`fastify-racing`](https://github.com/metcoder95/fastify-racing) Fastify's
|
|
543
559
|
plugin that adds support to handle an aborted request asynchronous.
|
|
@@ -600,6 +616,8 @@ middlewares into Fastify plugins
|
|
|
600
616
|
HTTP part of the request.
|
|
601
617
|
- [`fastify-sqlite`](https://github.com/Eomm/fastify-sqlite) connects your
|
|
602
618
|
application to a sqlite3 database.
|
|
619
|
+
- [`fastify-sqlite-typed`](https://github.com/yoav0gal/fastify-sqlite-typed) connects
|
|
620
|
+
your application to a SQLite database with full Typescript support.
|
|
603
621
|
- [`fastify-sse`](https://github.com/lolo32/fastify-sse) to provide Server-Sent
|
|
604
622
|
Events with `reply.sse( … )` to Fastify.
|
|
605
623
|
- [`fastify-sse-v2`](https://github.com/nodefactoryio/fastify-sse-v2) to provide
|
|
@@ -625,11 +643,11 @@ middlewares into Fastify plugins
|
|
|
625
643
|
Useful functions for Twitch Extension Backend Services (EBS).
|
|
626
644
|
- [`fastify-type-provider-effect-schema`](https://github.com/daotl/fastify-type-provider-effect-schema)
|
|
627
645
|
Fastify
|
|
628
|
-
[type provider](https://
|
|
646
|
+
[type provider](https://fastify.dev/docs/latest/Reference/Type-Providers/)
|
|
629
647
|
for [@effect/schema](https://github.com/effect-ts/schema).
|
|
630
648
|
- [`fastify-type-provider-zod`](https://github.com/turkerdev/fastify-type-provider-zod)
|
|
631
649
|
Fastify
|
|
632
|
-
[type provider](https://
|
|
650
|
+
[type provider](https://fastify.dev/docs/latest/Reference/Type-Providers/)
|
|
633
651
|
for [zod](https://github.com/colinhacks/zod).
|
|
634
652
|
- [`fastify-typeorm-plugin`](https://github.com/inthepocket/fastify-typeorm-plugin)
|
|
635
653
|
Fastify plugin to work with TypeORM.
|