From d6adcee27747ad92b8ce4de1350c692f5032dfdd Mon Sep 17 00:00:00 2001
From: Adam Soltys <adam@coinos.io>
Date: Sat, 22 Aug 2026 08:43:38 -0700
Subject: deps: upgrade fastify v4 to v5 line to fix dependabot alerts

Fastify 4.x is EOL with no backported fixes; all six open alerts
(critical http-proxy header stripping, static path traversal + auth
bypass, fastify body-validation bypass / host spoofing / DoS) are only
patched on the v5 line. Bump fastify to 5.12.0 and all @fastify/*
plugins to their v5-compatible majors, and migrate the two options v5
deprecated (disableRequestLogging -> logController, maxParamLength ->
routerOptions).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 bun.lockb    | Bin 235864 -> 242536 bytes
 lib/app.ts   |   4 ++--
 package.json |  18 +++++++++---------
 3 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/bun.lockb b/bun.lockb
index cc0f1089..1a005144 100755
Binary files a/bun.lockb and b/bun.lockb differ
diff --git a/lib/app.ts b/lib/app.ts
index 3b00c702..d2949e61 100644
--- a/lib/app.ts
+++ b/lib/app.ts
@@ -15,8 +15,8 @@ import { jwtStrategy } from "$lib/auth";
 
 const app = fastify({
   logger: true,
-  disableRequestLogging: true,
-  maxParamLength: 500,
+  logController: new fastify.LogController({ disableRequestLogging: true }),
+  routerOptions: { maxParamLength: 500 },
 });
 
 const reqLogger = pino(pino.destination("req"));
diff --git a/package.json b/package.json
index a08b9911..01a3a5e4 100644
--- a/package.json
+++ b/package.json
@@ -16,21 +16,21 @@
     "@aws-sdk/client-ses": "^3.997.0",
     "@cashu/cashu-ts": "^2.9.0",
     "@coinos/rpc": "^0.0.6",
-    "@fastify/cors": "^8.5.0",
-    "@fastify/http-proxy": "^9.5.0",
-    "@fastify/multipart": "^8.3.1",
-    "@fastify/passport": "^2.5.0",
-    "@fastify/rate-limit": "^9.1.0",
-    "@fastify/secure-session": "^7.5.1",
-    "@fastify/static": "^6.12.0",
-    "@fastify/websocket": "^10.0.1",
+    "@fastify/cors": "^11.3.0",
+    "@fastify/http-proxy": "^11.6.0",
+    "@fastify/multipart": "^10.1.1",
+    "@fastify/passport": "^4.0.2",
+    "@fastify/rate-limit": "^11.2.0",
+    "@fastify/secure-session": "^8.3.0",
+    "@fastify/static": "^10.1.3",
+    "@fastify/websocket": "^11.3.0",
     "@noble/hashes": "^1.8.0",
     "@scure/base": "^1.2.6",
     "bech32": "^2.0.0",
     "buffer-crc32": "^0.2.13",
     "clightning-client": "github:asoltys/lightning-client-js#master",
     "date-fns": "^2.30.0",
-    "fastify": "^4.29.1",
+    "fastify": "^5.12.0",
     "file-type": "^21.3.1",
     "fluent-ffmpeg": "^2.1.3",
     "got": "^13.0.0",
-- 
cgit v1.2.3