[Snyk] Upgrade fastify from 5.4.0 to 5.6.2

[clovercrash]

Snyk has created this PR to upgrade fastify from 5.4.0 to 5.6.2.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

---

• The recommended version is 4 versions ahead of your current version.

• The recommended version was released a month ago.

Issues fixed by the recommended upgrade:

	Issue	Score	Exploit Maturity
	Incomplete Filtering of One or More Instances of Special Elements SNYK-JS-VALIDATOR-13653476	372	Proof of Concept
	Directory Traversal SNYK-JS-VITEPLUGINSTATICCOPY-12179280	372	Proof of Concept
	Command Injection SNYK-JS-GLOB-14040952	372	Proof of Concept
	Command Injection SNYK-JS-GLOB-14040952	372	Proof of Concept
	Improper Validation of Specified Type of Input SNYK-JS-VALIDATOR-13395830	372	Proof of Concept
	Directory Traversal SNYK-JS-VITE-13644406	372	Proof of Concept
	Open Redirect SNYK-JS-ASTROJSNODE-11951436	372	Proof of Concept
	Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') SNYK-JS-ASTROJSNODE-13535086	372	Proof of Concept
	Relative Path Traversal SNYK-JS-ASTROJSNODE-14059141	372	Proof of Concept
	Allocation of Resources Without Limits or Throttling SNYK-JS-AXIOS-12613773	372	Proof of Concept
	Missing Release of Resource after Effective Lifetime SNYK-JS-INFLIGHT-6095116	372	Proof of Concept
	Prototype Pollution SNYK-JS-JSYAML-13961110	372	No Known Exploit
	Relative Path Traversal SNYK-JS-VITE-12558116	372	Proof of Concept
	Prototype Pollution SNYK-JS-DEVALUE-12205530	372	Proof of Concept
	Predictable Value Range from Previous Values SNYK-JS-FORMDATA-10841150	372	Proof of Concept
	Symlink Following SNYK-JS-TARFS-13045213	372	No Known Exploit

Release notes

Package name: fastify

• 5.6.2 - 2025-11-09
  

  What's Changed

  • refactor: rename source file names with kebab-case by @ jean-michelet in #6331
  • ci(ci): check dependabot prs originate from repo by @ Fdawgs in #6330
  • fix: accept htab ows by @ jean-michelet in #6303
  • fix: handle non FastifyErrors in custom handler properly, set type of error-parameter for setErrorHandler and errorHandler to unknown, but configurable via generic TError by @ Uzlopak in #6308
  • build(deps-dev): remove @ fastify/pre-commit by @ Fdawgs in #6319
  • ci: improve citgm workflows by @ Uzlopak in #6334
  • docs: explain stream error handling by @ lundibundi in #5746
  • fix: error throwing in reply by @ juanlet in #6299
  • refactor: delegate options processing to a dedicated function by @ jean-michelet in #6333
  • ci: remove label of citgm only on pull_request.labeled, add options for workflow_dispatch by @ Uzlopak in #6335
  • chore: Bump actions/checkout from 4 to 5 by @ dependabot[bot] in #6343
  • chore: Bump joi from 17.13.3 to 18.0.1 by @ dependabot[bot] in #6347
  • chore: Bump lycheeverse/lychee-action from 2.4.1 to 2.6.1 by @ dependabot[bot] in #6345
  • chore: Bump actions/dependency-review-action from 4.7.1 to 4.8.0 by @ dependabot[bot] in #6344
  • chore: Bump actions/labeler from 5 to 6 by @ dependabot[bot] in #6341
  • chore: Bump actions/setup-node from 4 to 5 by @ dependabot[bot] in #6342
  • chore: Bump actions/github-script from 7 to 8 by @ dependabot[bot] in #6340
  • docs: mention that addHttpMethod override existing methods by @ jean-michelet in #6350
  • chore: remove reference to simple-get by @ ilteoood in #6353
  • chore: remove commented tests by @ ilteoood in #6352
  • fix: respect child logger factory in fastify options by @ cysp in #6349
  • docs(ecosystem): adding attaryz/fastify-devtools to community plugins by @ attaryz in #6339
  • docs: remove ambiguity from statement by @ udohjeremiah in #6360
  • chore: add @ fastify/sse as fastify core plugin to documentation and citgm by @ manshusainishab in #6364
  • docs(guides/fluent-schema): replace last nb usage by @ Fdawgs in #6365
  • style(ci): remove whitespace from concurrency group by @ Fdawgs in #6366
  • docs: Fix broken link to TypeBox doc website wrt AJV setup by @ melroy89 in #6367
  • docs(reference/plugins): mention async plugins by @ Fdawgs in #6357
  • chore: add max-len ESLint rule with 120 character limit by @ emicovi in #6221
  • chore: Bump actions/dependency-review-action from 4.8.0 to 4.8.1 by @ dependabot[bot] in #6374
  • chore: Bump pino from 9.14.0 to 10.1.0 in the dependencies-major group by @ dependabot[bot] in #6378
  • chore: Bump pnpm/action-setup from 4.1.0 to 4.2.0 by @ dependabot[bot] in #6375
  • chore: Bump tsd from 0.32.0 to 0.33.0 in the dev-dependencies-typescript group by @ dependabot[bot] in #6346
  • chore: Bump lycheeverse/lychee-action from 2.6.1 to 2.7.0 by @ dependabot[bot] in #6377
  • fix: handle web stream payload in HEAD route by @ orionmiz in #6372
  • chore: Bump actions/setup-node from 5 to 6 by @ dependabot[bot] in #6376
  • chore: Bump borp from 0.20.2 to 0.21.0 by @ dependabot[bot] in #6379
  • fix: parse ipv6 hostname by @ jean-michelet in #6373
  • fix: consistent error handling for custom validators in async validation contexts by @ emicovi in #6247

  New Contributors

  • @ juanlet made their first contribution in #6299
  • @ cysp made their first contribution in #6349
  • @ attaryz made their first contribution in #6339
  • @ udohjeremiah made their first contribution in #6360
  • @ manshusainishab made their first contribution in #6364
  • @ orionmiz made their first contribution in #6372

  Full Changelog: v5.6.1...v5.6.2

• 5.6.1 - 2025-09-22
  

  What's Changed

  • fix: fix typo of deprecation warning FSTDEP022 by @ Uzlopak in #6313
  • docs(decorators): fix TypeScript inconsistency by @ emicovi in #6224
  • chore: fix typos by @ deining in #6316
  • docs(security): add secondary contact/security escalation policy by @ UlisesGascon in #6315
  • chore(gha): remove benchmark github workflows by @ Eomm in #6322
  • chore(sponsor): add lambdatest by @ Eomm in #6324
  • fix: (types) allow FastifySchemaValidationError[] as an error by @ gurgunday in #6326
  • fix: correct session.close() context in http2 timeout handler by @ David-van-der-Sluijs in #6327
  • fix: close http2 sessions on close server by @ kostyak127 in #6137

  New Contributors

  • @ deining made their first contribution in #6316
  • @ UlisesGascon made their first contribution in #6315
  • @ David-van-der-Sluijs made their first contribution in #6327
  • @ kostyak127 made their first contribution in #6137

  Full Changelog: v5.6.0...v5.6.1

• 5.6.0 - 2025-09-05
  

  What's Changed

  • fix: update typescript pino type to pick by @ dancastillo in #6287
  • feat(types): router option types by @ dancastillo in #6282
  • fix(types): Fix use of "esModuleInterop: false" by @ joshkel in #6292
  • docs: fix typo in Reference: TypeScript.md by @ hmanzoni in #6302
  • docs: clarify router performance note by @ Prasad2604 in #6306

  New Contributors

  • @ joshkel made their first contribution in #6292
  • @ hmanzoni made their first contribution in #6302
  • @ Prasad2604 made their first contribution in #6306

  Full Changelog: v5.5.0...v5.6.0

• 5.5.0 - 2025-08-11
  

  What's Changed

  • docs: fix markdown linting issue by @ Uzlopak in #6175
  • chore: removed simple-get from mkcalendar tests by @ ilteoood in #6199
  • chore: removed simple-get from versioned-routes tests by @ ilteoood in #6202
  • chore: removed simple-get from hooks tests by @ ilteoood in #6210
  • fix: close pipelining test by @ ilteoood in #6204
  • chore: removed simple-get from unlock test by @ ilteoood in #6178
  • chore: removed simple-get from use-semicolon-delimiter tests by @ ilteoood in #6203
  • chore: removed simple-get from custom-https-server tests by @ ilteoood in #6201
  • chore: remove simple-get from custom parser 5 by @ ilteoood in #6172
  • chore: removed simple-get from head tests by @ ilteoood in #6196
  • chore: removed simple-get from request id tests by @ ilteoood in #6193
  • chore: remove simple get from custom parser 1 by @ ilteoood in #6167
  • chore: removed simple-get from custom-parser-0 by @ ilteoood in #6168
  • chore: remove simple-get from custom parser 2 by @ ilteoood in #6169
  • chore: remove simple-get from custom parser 4 by @ ilteoood in #6171
  • chore: removed simple-get from promises test by @ ilteoood in #6183
  • chore: removed simple-get from move test by @ ilteoood in #6179
  • chore: remove simple-get from custom querystring parser by @ ilteoood in #6166
  • chore: remove simple-get from propfind by @ ilteoood in #6174
  • chore: removed simple-get from case insensitive test by @ ilteoood in #6188
  • chore: remove simple get from async-await tests by @ ilteoood in #6165
  • chore: removed simple-get from header overflow test by @ ilteoood in