[aversini]

Automated non-major dependency bump (deps-train).

package.json

• pnpm 11.19.0 → 11.20.0

packages/static-server/package.json

• fastify 5.11.0 → 5.11.2

---

What changed

pnpm 11.19.0 → 11.20.0

pnpm 11.20

Minor Changes

• Security fix. Affects projects using namedRegistries on pnpm 11.1.0–11.19.x. It is semi-breaking for those projects — see "If you use named registries" below.

  The lockfile recorded no marker for which registry a package came from. Packages were keyed by name@version alone, and entry lookup went through refToRelative(ref, name), so a dependency you declared against one registry could be satisfied by an entry that was actually resolved from another. When two registries served the same name and version, both collapsed onto a single packages: entry and whichever resolved first decided the tarball every consumer got.

  That is a package-substitution risk: a package you expect from your private registry could be installed from a different registry that publishes the same name and version, and the lockfile recorded nothing that would let you tell.

  Packages resolved from a named registry are now recorded under registry-qualified keys (<name>@<registryName>:<version>, e.g. foo@work:1.0.0), so each registry gets its own entry and the lockfile pins which one a dependency came from.

  The lockfile format version is unchanged. Registry-qualified keys appear only for packages resolved from a named registry, so a project that does not use namedRegistries sees no difference, and older pnpm versions keep reading the file.

  If you use named registries

  Your next non-frozen install re-keys those entries, which shows up as a

…notes truncated.

compare 11.19.0…11.20.0 · npm

fastify 5.11.0 → 5.11.2

v5.11.2

Full Changelog: fastify/fastify@v5.11.1...v5.11.2

v5.11.1

What's Changed

• fix: add http method override warning by @jean-michelet in fix: add http method override warning fastify/fastify#6879
• fix(types): allow explicit http2: false in server options by @Tony133 in fix(types): allow explicit http2: false in server options fastify/fastify#6888
• docs: clarify what attachValidation exposes on request.validationError by @basteez in docs: clarify what attachValidation exposes on request.validationError fastify/fastify#6891
• fix: do not force close in-flight connections when forceCloseConnections is 'idle' by @aquie00t in fix: do not force close in-flight connections when forceCloseConnections is 'idle' fastify/fastify#6889

New Contributors

• @basteez made their first contribution in docs: clarify what attachValidation exposes on request.validationError fastify/fastify#6891

Full Changelog: fastify/fastify@v5.11.0...v5.11.1

compare 5.11.0…5.11.2 · npm