fix(controlplane): upgrade fastify to v5 - #3193
Conversation
Closes dependabot #843 (find-my-way <= 9.6.0, CVE-2026-47219), the one alert #3190 couldn't clear. There's no 8.x fix; find-my-way 9.7.0 only ships with fastify 5. This takes controlplane to fastify 5.12.1, which pulls in find-my-way 9.9.0. Almost none of the v5 breaking-change list applies here: no route JSON schemas, no decorateRequest/decorateReply, no request.routerPath or routeConfig, no reply.sent, no hasRoute, no route version constraints. listen() was already object-form and every reply.redirect() call passes a single argument. @connectrpc/connect-fastify already accepted ^5.1.0. The only forced API change is logger -> loggerInstance: v5 splits the option so that a pre-built pino instance has to arrive under the new name. Three constructor sites needed it. Also bumps the catalog pino to 9, which fastify 5 depends on internally. That surfaced two logger.error('msg', { error }) calls in the analytics bufservices. Those match pino's (msg, ...args) overload, so the error object was being treated as an interpolation argument and dropped - the error was never actually logged. Swapped to the object-first form used elsewhere in the package. The metrics plugin no longer reaches into fastify/types/instance.js; both types it wanted are re-exported from the package root.
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
Claude Code Review
This repository is configured for manual code reviews. Comment @claude review for a one-time review, or @claude review always to subscribe this PR to a review on every future push.
Tip: disable this comment in your organization's Code Review settings.
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (7)
Included review availability: 4 reviews are currently available. Your included PR review attempts over the past 7 days set your current allowance at 5 reviews per hour. WalkthroughThe control plane updates Fastify-related dependencies and Pino to newer major versions. Fastify instances now use ChangesFastify and Pino upgrade
Estimated code review effort: 2 (Simple) | ~10 minutes Merge Risk: ⚪ Minimal · up to This localized dependency upgrade and compatibility update is merge-ready after normal checks and review; no actionable merge-blocking risk remains. 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
Full details: Docstring CoverageExplanation Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 3 functions across 5 files. (2 skipped: 2 unsupported.)
✨ Finishing Touches 💡 1📝 Generate docstrings 💡
Comment |
Codecov Report❌ Patch coverage is
❌ Your patch check has failed because the patch coverage (60.00%) is below the target coverage (90.00%). You can increase the patch coverage or adjust the target coverage. Additional details and impacted files@@ Coverage Diff @@
## main #3193 +/- ##
===========================================
+ Coverage 38.83% 50.20% +11.36%
===========================================
Files 815 1159 +344
Lines 109765 163126 +53361
Branches 7475 12005 +4530
===========================================
+ Hits 42627 81895 +39268
- Misses 66794 79327 +12533
- Partials 344 1904 +1560
🚀 New features to boost your workflow:
|
Router-nonroot image scan passed✅ No security vulnerabilities found in image: |
1 participant
Closes find-my-way #843 (CVE-2026-47219), the last alert behind COSMO-381 and the one #3190 left out. There is no 8.x fix — find-my-way 9.7.0 only ships with fastify 5 — so closing it meant moving controlplane off fastify 4. The alert was dismissed as
not_used(the DDoS path is HTTP/2-only, we serve HTTP/1.1); this is the upgrade that dismissal promised.Almost none of the v5 breaking-change list applies. The only forced change is
logger→loggerInstanceat three constructor sites. Bumping the catalog pino to 9 surfaced twologger.error('msg', { error })calls that were silently dropping the error object.Full suite: 1776 passed, 2 failed — both confirmed pre-existing by re-running against unmodified
main.Summary by CodeRabbit
Bug Fixes
Chores