feat: security and auditing

2026-02-04 16:48:08 -08:00
parent 11be34cd21
commit 0a654f423a
42 changed files with 2195 additions and 160 deletions
@@ -32,12 +32,24 @@ importers:
      '@fastify/cookie':
        specifier: ^11.0.2
        version: 11.0.2
+      '@fastify/cors':
+        specifier: ^11.0.0
+        version: 11.2.0
+      '@fastify/csrf-protection':
+        specifier: ^7.1.0
+        version: 7.1.0
+      '@fastify/helmet':
+        specifier: ^13.0.2
+        version: 13.0.2
      '@fastify/jwt':
        specifier: ^10.0.0
        version: 10.0.0
      '@fastify/oauth2':
        specifier: ^8.1.2
        version: 8.1.2
+      '@fastify/rate-limit':
+        specifier: ^10.3.0
+        version: 10.3.0
      '@fastify/sensible':
        specifier: 6.0.4
        version: 6.0.4
@@ -51,8 +63,8 @@ importers:
        specifier: ^3.3.1
        version: 3.3.1
      fastify:
-        specifier: 5.2.2
-        version: 5.2.2
+        specifier: 5.7.3
+        version: 5.7.3
      fastify-plugin:
        specifier: 5.0.1
        version: 5.0.1
@@ -1599,6 +1611,15 @@ packages:
  '@fastify/cookie@11.0.2':
    resolution: {integrity: sha512-GWdwdGlgJxyvNv+QcKiGNevSspMQXncjMZ1J8IvuDQk0jvkzgWWZFNC2En3s+nHndZBGV8IbLwOI/sxCZw/mzA==}

+  '@fastify/cors@11.2.0':
+    resolution: {integrity: sha512-LbLHBuSAdGdSFZYTLVA3+Ch2t+sA6nq3Ejc6XLAKiQ6ViS2qFnvicpj0htsx03FyYeLs04HfRNBsz/a8SvbcUw==}
+
+  '@fastify/csrf-protection@7.1.0':
+    resolution: {integrity: sha512-I2TDd4SRRYQivKCMHdB/8py+CPO9DT0e63lh4DO8MDCJh8NROq8HD/iO0IjYtwhsD3bZhr0cBXsFdfPvyTmzNw==}
+
+  '@fastify/csrf@8.0.1':
+    resolution: {integrity: sha512-dAmCrdfJ3CV/A/hHHK/rRBjjLRRSIltgJB0BxiVfbhr/31G6fgF8l2I8evtH8mjS5kTIvd0JOh7MOA3HA6eYDw==}
+
  '@fastify/error@4.2.0':
    resolution: {integrity: sha512-RSo3sVDXfHskiBZKBPRgnQTtIqpi/7zhJOEmAxCiBcM7d0uwdGdxLlsCaLzGs8v8NnxIRlfG0N51p5yFaOentQ==}

@@ -1608,6 +1629,9 @@ packages:
  '@fastify/forwarded@3.0.1':
    resolution: {integrity: sha512-JqDochHFqXs3C3Ml3gOY58zM7OqO9ENqPo0UqAjAjH8L01fRZqwX9iLeX34//kiJubF7r2ZQHtBRU36vONbLlw==}

+  '@fastify/helmet@13.0.2':
+    resolution: {integrity: sha512-tO1QMkOfNeCt9l4sG/FiWErH4QMm+RjHzbMTrgew1DYOQ2vb/6M1G2iNABBrD7Xq6dUk+HLzWW8u+rmmhQHifA==}
+
  '@fastify/jwt@10.0.0':
    resolution: {integrity: sha512-2Qka3NiyNNcsfejMUvyzot1T4UYIzzcbkFGDdVyrl344fRZ/WkD6VFXOoXhxe2Pzf3LpJNkoSxUM4Ru4DVgkYA==}

@@ -1620,6 +1644,9 @@ packages:
  '@fastify/proxy-addr@5.1.0':
    resolution: {integrity: sha512-INS+6gh91cLUjB+PVHfu1UqcB76Sqtpyp7bnL+FYojhjygvOPA9ctiD/JDKsyD9Xgu4hUhCSJBPig/w7duNajw==}

+  '@fastify/rate-limit@10.3.0':
+    resolution: {integrity: sha512-eIGkG9XKQs0nyynatApA3EVrojHOuq4l6fhB4eeCk4PIOeadvOJz9/4w3vGI44Go17uaXOWEcPkaD8kuKm7g6Q==}
+
  '@fastify/send@4.1.0':
    resolution: {integrity: sha512-TMYeQLCBSy2TOFmV95hQWkiTYgC/SEx7vMdV+wnZVX4tt8VBLKzmH8vV9OzJehV0+XBfg+WxPMt5wp+JBUKsVw==}

@@ -5378,8 +5405,8 @@ packages:
  fastify-plugin@5.0.1:
    resolution: {integrity: sha512-HCxs+YnRaWzCl+cWRYFnHmeRFyR5GVnJTAaCJQiYzQSDwK9MgJdyAsuL3nh0EWRCYMgQ5MeziymvmAhUHYHDUQ==}

-  fastify@5.2.2:
-    resolution: {integrity: sha512-22T/PnhquWozuFXg3Ish4md5ipsF1Nx1mJ9ulLdZPXSk14WFj/wMlyNB/yll9sQOojKRgOIxT2inK3Xpjg5hyw==}
+  fastify@5.7.3:
+    resolution: {integrity: sha512-QHzWSmTNUg9Ba8tNXzb92FTH77K+c8yeQPH80EeSIc9wyZj85jbPisMP0rwmyKv8oJwUFPe1UpN8HkNIXwCnUQ==}

  fastparallel@2.4.1:
    resolution: {integrity: sha512-qUmhxPgNHmvRjZKBFUNI0oZuuH9OlSIOXmJ98lhKPxMZZ7zS/Fi0wRHOihDSz0R1YiIOjxzOY4bq65YTcdBi2Q==}
@@ -5745,6 +5772,10 @@ packages:
    resolution: {integrity: sha512-F/1DnUGPopORZi0ni+CvrCgHQ5FyEAHRLSApuYWMmrbSwoN2Mn/7k+Gl38gJnR7yyDZk6WLXwiGod1JOWNDKGw==}
    hasBin: true

+  helmet@8.1.0:
+    resolution: {integrity: sha512-jOiHyAZsmnr8LqoPGmCjYAaiuWwjAPLgY8ZX2XrmHawt99/u1y6RgrZMTeoPfpUbV96HOalYgz1qzkRbw54Pmg==}
+    engines: {node: '>=18.0.0'}
+
  homedir-polyfill@1.0.3:
    resolution: {integrity: sha512-eSmmWE5bZTK2Nou4g0AI3zZ9rswp7GRKoKXS1BLUkvPviOqs4YTN1djQIqrXy9k5gEtdLPy86JjRwsNM9tnDcA==}
    engines: {node: '>=0.10.0'}
@@ -7298,14 +7329,14 @@ packages:
    resolution: {integrity: sha512-uB80kBFb/tfd68bVleG9T5GGsGPjJrLAUpR5PZIrhBnIaRTQRjqdJSsIKkOP6OAIFbj7GOrcudc5pNjZ+geV2g==}
    engines: {node: '>=6'}

-  pino-abstract-transport@2.0.0:
-    resolution: {integrity: sha512-F63x5tizV6WCh4R6RHyi2Ml+M70DNRXt/+HANowMflpgGFMAym/VKm6G7ZOQRjqN7XbGxK1Lg9t6ZrtzOaivMw==}
+  pino-abstract-transport@3.0.0:
+    resolution: {integrity: sha512-wlfUczU+n7Hy/Ha5j9a/gZNy7We5+cXp8YL+X+PG8S0KXxw7n/JXA3c46Y0zQznIJ83URJiwy7Lh56WLokNuxg==}

  pino-std-serializers@7.1.0:
    resolution: {integrity: sha512-BndPH67/JxGExRgiX1dX0w1FvZck5Wa4aal9198SrRhZjH3GxKQUKIBnYJTdj2HDN3UQAS06HlfcSbQj2OHmaw==}

-  pino@9.14.0:
-    resolution: {integrity: sha512-8OEwKp5juEvb/MjpIc4hjqfgCNysrS94RIOMXYvpYCdm/jglrKEiAYmiumbmGhCvs+IcInsphYDFwqrjr7398w==}
+  pino@10.3.0:
+    resolution: {integrity: sha512-0GNPNzHXBKw6U/InGe79A3Crzyk9bcSyObF9/Gfo9DLEf5qj5RF50RSjsu0W1rZ6ZqRGdzDFCRBQvi9/rSGPtA==}
    hasBin: true

  pirates@4.0.7:
@@ -8090,8 +8121,8 @@ packages:
  secure-compare@3.0.1:
    resolution: {integrity: sha512-AckIIV90rPDcBcglUwXPF3kg0P0qmPsPXAj6BBEENQE1p5yA1xfmDJzfi1Tappj37Pv2mVbKpL3Z1T+Nn7k1Qw==}

-  secure-json-parse@3.0.2:
-    resolution: {integrity: sha512-H6nS2o8bWfpFEV6U38sOSjS7bTbdgbCGU9wEM6W14P5H0QOsz94KCusifV44GpHDTu2nqZbuDNhTzu+mjDSw1w==}
+  secure-json-parse@4.1.0:
+    resolution: {integrity: sha512-l4KnYfEyqYJxDwlNVyRfO2E4NTHfMKAWdUuA8J0yve2Dz/E/PdBepY03RvyJpssIpRFwJoCD55wA+mEDs6ByWA==}

  select-hose@2.0.0:
    resolution: {integrity: sha512-mEugaLK+YfkijB4fx0e6kImuJdCIt2LxCRcbEYPqRGCs4F2ogyfZU5IAZRdjCP8JPq2AtdNoC/Dux63d9Kiryg==}
@@ -8538,8 +8569,9 @@ packages:
    peerDependencies:
      tslib: ^2

-  thread-stream@3.1.0:
-    resolution: {integrity: sha512-OqyPZ9u96VohAyMfJykzmivOrY2wfMSf3C5TtFJVgN+Hm6aj+voFhlK+kZEIv2FBh1X6Xp3DlnCOfEQ3B2J86A==}
+  thread-stream@4.0.0:
+    resolution: {integrity: sha512-4iMVL6HAINXWf1ZKZjIPcz5wYaOdPhtO8ATvZ+Xqp3BTdaqtAwQkNmKORqcIo5YkQqGXq5cwfswDwMqqQNrpJA==}
+    engines: {node: '>=20'}

  throttleit@1.0.1:
    resolution: {integrity: sha512-vDZpf9Chs9mAdfY046mcPt8fg5QSZr37hEH4TXYBnDF+izxgrbRGUAAaBvIk/fJm9aOFCGFd1EsNg5AZCbnQCQ==}
@@ -11526,6 +11558,19 @@ snapshots:
      cookie: 1.1.1
      fastify-plugin: 5.0.1

+  '@fastify/cors@11.2.0':
+    dependencies:
+      fastify-plugin: 5.0.1
+      toad-cache: 3.7.0
+
+  '@fastify/csrf-protection@7.1.0':
+    dependencies:
+      '@fastify/csrf': 8.0.1
+      '@fastify/error': 4.2.0
+      fastify-plugin: 5.0.1
+
+  '@fastify/csrf@8.0.1': {}
+
  '@fastify/error@4.2.0': {}

  '@fastify/fast-json-stringify-compiler@5.0.3':
@@ -11534,6 +11579,11 @@ snapshots:

  '@fastify/forwarded@3.0.1': {}

+  '@fastify/helmet@13.0.2':
+    dependencies:
+      fastify-plugin: 5.0.1
+      helmet: 8.1.0
+
  '@fastify/jwt@10.0.0':
    dependencies:
      '@fastify/error': 4.2.0
@@ -11559,6 +11609,12 @@ snapshots:
      '@fastify/forwarded': 3.0.1
      ipaddr.js: 2.3.0

+  '@fastify/rate-limit@10.3.0':
+    dependencies:
+      '@lukeed/ms': 2.0.2
+      fastify-plugin: 5.0.1
+      toad-cache: 3.7.0
+
  '@fastify/send@4.1.0':
    dependencies:
      '@lukeed/ms': 2.0.2
@@ -16392,7 +16448,7 @@ snapshots:

  fastify-plugin@5.0.1: {}

-  fastify@5.2.2:
+  fastify@5.7.3:
    dependencies:
      '@fastify/ajv-compiler': 4.0.5
      '@fastify/error': 4.2.0
@@ -16403,10 +16459,10 @@ snapshots:
      fast-json-stringify: 6.2.0
      find-my-way: 9.4.0
      light-my-request: 6.6.0
-      pino: 9.14.0
-      process-warning: 4.0.1
+      pino: 10.3.0
+      process-warning: 5.0.0
      rfdc: 1.4.1
-      secure-json-parse: 3.0.2
+      secure-json-parse: 4.1.0
      semver: 7.7.3
      toad-cache: 3.7.0

@@ -16814,6 +16870,8 @@ snapshots:

  he@1.2.0: {}

+  helmet@8.1.0: {}
+
  homedir-polyfill@1.0.3:
    dependencies:
      parse-passwd: 1.0.0
@@ -18687,25 +18745,25 @@ snapshots:
  pify@4.0.1:
    optional: true

-  pino-abstract-transport@2.0.0:
+  pino-abstract-transport@3.0.0:
    dependencies:
      split2: 4.2.0

  pino-std-serializers@7.1.0: {}

-  pino@9.14.0:
+  pino@10.3.0:
    dependencies:
      '@pinojs/redact': 0.4.0
      atomic-sleep: 1.0.0
      on-exit-leak-free: 2.1.2
-      pino-abstract-transport: 2.0.0
+      pino-abstract-transport: 3.0.0
      pino-std-serializers: 7.1.0
      process-warning: 5.0.0
      quick-format-unescaped: 4.0.4
      real-require: 0.2.0
      safe-stable-stringify: 2.5.0
      sonic-boom: 4.2.0
-      thread-stream: 3.1.0
+      thread-stream: 4.0.0

  pirates@4.0.7: {}

@@ -19516,7 +19574,7 @@ snapshots:

  secure-compare@3.0.1: {}

-  secure-json-parse@3.0.2: {}
+  secure-json-parse@4.1.0: {}

  select-hose@2.0.0: {}

@@ -20102,7 +20160,7 @@ snapshots:
    dependencies:
      tslib: 2.8.1

-  thread-stream@3.1.0:
+  thread-stream@4.0.0:
    dependencies:
      real-require: 0.2.0