[Snyk] Security upgrade @fastify/static from 8.3.0 to 9.1.1

[Skandesh]

Snyk has created this PR to fix 2 vulnerabilities in the pnpm dependencies of this project.

Snyk changed the following file(s):

• packages/server/package.json

⚠️ Warning

Failed to update the pnpm-lock.yaml, please update manually before merging.

Vulnerabilities that will be fixed with an upgrade:

	Issue
	Improper Handling of URL Encoding (Hex Encoding) SNYK-JS-FASTIFYSTATIC-16098210
	Directory Traversal SNYK-JS-FASTIFYSTATIC-16098211

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Directory Traversal

---

Summary by cubic

Upgrades @fastify/static to 9.1.1 in the server package to remediate two vulnerabilities and keep static file serving secure. Fixes issues related to URL hex encoding handling and directory traversal.

• Dependencies

  • Bump @fastify/static from ^8.0.0 to ^9.1.1 in packages/server/package.json.
  • Addresses Snyk: Improper Handling of URL Encoding (Hex Encoding) and Directory Traversal.

• Migration

  • Run pnpm install to update the lockfile.
  • Smoke-test static asset routes for any plugin behavior changes.

^{Written for commit 9de861f. Summary will update on new commits. Review in cubic}

[coderabbitai]

Important

Review skipped

Ignore keyword(s) in the title.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 6881729b-acb9-423d-bb90-fe42913b941c

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch snyk-fix-f4fcf6b8ae31f2cea4ef95e78c27da04

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[gemini-code-assist]

Code Review

This pull request updates the @fastify/static dependency in packages/server/package.json from version 8.0.0 to 9.1.1. Feedback indicates that the pnpm-lock.yaml file was not updated, which is necessary to ensure consistent installations and the application of security fixes across all environments.

[gemini-code-assist]

The pnpm-lock.yaml file was not updated in this PR, as noted in the warning in the PR description. In a pnpm workspace, this is a high-priority issue because the lockfile must be synchronized with package.json changes to ensure consistent installations across all environments (CI/CD, development, and production). Since Snyk was unable to update it automatically—likely due to the workspace:* dependencies—you must run pnpm install locally and commit the updated lockfile. Without this, the security fixes provided by @fastify/static@9.1.1 may not be correctly applied in environments that rely on the lockfile.

[cubic-dev-ai]

No issues found across 1 file

_{Re-trigger cubic}