fix(deps): update dependency @fastify/static to v10 [security] (#8361)

This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [@fastify/static](https://redirect.github.com/fastify/fastify-static)
| [`^9.1.1` →
`^10.0.0`](https://renovatebot.com/diffs/npm/@fastify%2fstatic/9.1.3/10.1.2)
|
![age](https://developer.mend.io/api/mc/badges/age/npm/@fastify%2fstatic/10.1.2?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@fastify%2fstatic/9.1.3/10.1.2?slim=true)
|

---

### @​fastify/static vulnerable to route guard bypass via path
traversal
[CVE-2026-15074](https://nvd.nist.gov/vuln/detail/CVE-2026-15074) /
[GHSA-83w8-p2f5-377r](https://redirect.github.com/advisories/GHSA-83w8-p2f5-377r)

<details>
<summary>More information</summary>

#### Details
##### Impact

`@fastify/static` is vulnerable to a bypass of route-based middleware
and guards via non-leading `..` and `%2E%2E` path segments.
`find-my-way` does not normalize `..` when matching routes, so a request
such as `/foo/../deep/secret.txt` matches the static plugin's catch-all
instead of the guarded `/deep/*`. The `getPathnameForSend` helper
introduced by the fix for
[GHSA-x428-ghpx-8j92](https://redirect.github.com/fastify/fastify-static/security/advisories/GHSA-x428-ghpx-8j92)
only guards against the `%2F` variant; `..` and `%2E%2E` survive the
`decodeURI` + `encodeURI` round-trip and are then collapsed away by
`@fastify/send`'s `path.normalize` before its own traversal guard runs.

Applications that rely on route-based middleware or guards to protect
files served by `@fastify/static` can be bypassed with non-leading
dot-dot path segments.

##### Patches

Upgrade to `@fastify/static` 10.1.1.

##### Workarounds

Do not use route-based middlewares or guards to protect files served by
`@fastify/static`.

#### Severity
- CVSS Score: 7.5 / 10 (High)
- Vector String: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N`

#### References
-
[https://github.com/fastify/fastify-static/security/advisories/GHSA-83w8-p2f5-377r](https://redirect.github.com/fastify/fastify-static/security/advisories/GHSA-83w8-p2f5-377r)
-
[https://nvd.nist.gov/vuln/detail/CVE-2026-15074](https://nvd.nist.gov/vuln/detail/CVE-2026-15074)
-
[https://github.com/fastify/fastify-static/commit/db4276f846ba56b21f93768cd6636ee5e2fc58b1](https://redirect.github.com/fastify/fastify-static/commit/db4276f846ba56b21f93768cd6636ee5e2fc58b1)
-
[https://cna.openjsf.org/security-advisories.html](https://cna.openjsf.org/security-advisories.html)
-
[https://github.com/fastify/fastify-static/releases/tag/v10.1.1](https://redirect.github.com/fastify/fastify-static/releases/tag/v10.1.1)
-
[https://github.com/advisories/GHSA-83w8-p2f5-377r](https://redirect.github.com/advisories/GHSA-83w8-p2f5-377r)

This data is provided by the [GitHub Advisory
Database](https://redirect.github.com/advisories/GHSA-83w8-p2f5-377r)
([CC-BY
4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### @&#8203;fastify/static vulnerable to Authorization Bypass via
Non-Canonical URL Paths
[CVE-2026-7120](https://nvd.nist.gov/vuln/detail/CVE-2026-7120) /
[GHSA-8pvw-jcv7-9cmj](https://redirect.github.com/advisories/GHSA-8pvw-jcv7-9cmj)

<details>
<summary>More information</summary>

#### Details
##### Impact

`@fastify/static` evaluates the `allowedPath` callback before
normalizing dot segments and duplicate slashes in the pathname used for
file resolution. Non-canonical pathnames such as `//file`, `/./file`, or
`/public/../private/file` bypass `allowedPath` filtering while resolving
to the intended file on disk.

Applications that use `allowedPath` as a security boundary to restrict
access to specific static files or path subtrees may unintentionally
expose files that were intended to be denied.

##### Patches

Upgrade to `@fastify/static` >= 10.1.2.

##### Workarounds

None. Upgrade to the patched version.

#### Severity
- CVSS Score: 5.3 / 10 (Medium)
- Vector String: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N`

#### References
-
[https://github.com/fastify/fastify-static/security/advisories/GHSA-8pvw-jcv7-9cmj](https://redirect.github.com/fastify/fastify-static/security/advisories/GHSA-8pvw-jcv7-9cmj)
-
[https://nvd.nist.gov/vuln/detail/CVE-2026-7120](https://nvd.nist.gov/vuln/detail/CVE-2026-7120)
-
[https://github.com/fastify/fastify-static/commit/878c72e920fabacf7e37739bf78057044717bf63](https://redirect.github.com/fastify/fastify-static/commit/878c72e920fabacf7e37739bf78057044717bf63)
-
[https://cna.openjsf.org/security-advisories.html](https://cna.openjsf.org/security-advisories.html)
-
[https://github.com/fastify/fastify-static/releases/tag/v10.1.2](https://redirect.github.com/fastify/fastify-static/releases/tag/v10.1.2)
-
[https://github.com/advisories/GHSA-8pvw-jcv7-9cmj](https://redirect.github.com/advisories/GHSA-8pvw-jcv7-9cmj)

This data is provided by the [GitHub Advisory
Database](https://redirect.github.com/advisories/GHSA-8pvw-jcv7-9cmj)
([CC-BY
4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### Release Notes

<details>
<summary>fastify/fastify-static (@&#8203;fastify/static)</summary>

###
[`v10.1.2`](https://redirect.github.com/fastify/fastify-static/releases/tag/v10.1.2)

[Compare
Source](https://redirect.github.com/fastify/fastify-static/compare/v10.1.1...v10.1.2)

#### ⚠️ Security Release

- Fix for
<GHSA-8pvw-jcv7-9cmj>

#### What's Changed

- ci: pin actions to commit-hash by
[@&#8203;Fdawgs](https://redirect.github.com/Fdawgs) in
[#&#8203;601](https://redirect.github.com/fastify/fastify-static/pull/601)

**Full Changelog**:
<fastify/fastify-static@v10.1.1...v10.1.2>

###
[`v10.1.1`](https://redirect.github.com/fastify/fastify-static/releases/tag/v10.1.1)

[Compare
Source](https://redirect.github.com/fastify/fastify-static/compare/v10.1.0...v10.1.1)

#### ⚠️ Security Release

- Fix for
<GHSA-83w8-p2f5-377r>

#### What's Changed

- docs(readme): fix typos by
[@&#8203;Fdawgs](https://redirect.github.com/Fdawgs) in
[#&#8203;600](https://redirect.github.com/fastify/fastify-static/pull/600)

**Full Changelog**:
<fastify/fastify-static@v10.1.0...v10.1.1>

###
[`v10.1.0`](https://redirect.github.com/fastify/fastify-static/releases/tag/v10.1.0)

[Compare
Source](https://redirect.github.com/fastify/fastify-static/compare/v10.0.0...v10.1.0)

#### What's Changed

- fix: set Vary: Accept-Encoding for preCompressed responses by
[@&#8203;LeSingh1](https://redirect.github.com/LeSingh1) in
[#&#8203;586](https://redirect.github.com/fastify/fastify-static/pull/586)
- feat: use `@fastify/error` for errors and add option `suppressWarning`
by [@&#8203;climba03003](https://redirect.github.com/climba03003) in
[#&#8203;599](https://redirect.github.com/fastify/fastify-static/pull/599)

#### New Contributors

- [@&#8203;LeSingh1](https://redirect.github.com/LeSingh1) made their
first contribution in
[#&#8203;586](https://redirect.github.com/fastify/fastify-static/pull/586)

**Full Changelog**:
<fastify/fastify-static@v10.0.0...v10.1.0>

###
[`v10.0.0`](https://redirect.github.com/fastify/fastify-static/releases/tag/v10.0.0)

[Compare
Source](https://redirect.github.com/fastify/fastify-static/compare/v9.3.0...v10.0.0)

#### Breaking Changes

- `setHeaders` now using `FastifyReply` instead of `Response`.

You should refactor your code to use the `reply` helpers.
For example,

```js
// Before
const fastify = require('fastify')({logger: true})
const path = require('node:path')

fastify.register(require('@&#8203;fastify/static'), {
  root: path.join(__dirname, 'public'),
  prefix: '/public/', // optional: default '/',
  setHeaders(res) {
    res.setHeader('X-Test', 'Foo')
  }
})
// After
const fastify = require('fastify')({logger: true})
const path = require('node:path')

fastify.register(require('@&#8203;fastify/static'), {
  root: path.join(__dirname, 'public'),
  prefix: '/public/', // optional: default '/',
  setHeaders(reply) {
    reply.header('X-Test', 'Foo')
  }
})
```

#### What's Changed

- chore!: bump content-disposition fom 1.0.1 to 2.0.1 by
[@&#8203;climba03003](https://redirect.github.com/climba03003) in
[#&#8203;597](https://redirect.github.com/fastify/fastify-static/pull/597)
- fix: ignore unsupported deflate for precompressed assets by
[@&#8203;jibin7jose](https://redirect.github.com/jibin7jose) in
[#&#8203;596](https://redirect.github.com/fastify/fastify-static/pull/596)
- fix!: allow setHeaders to override send headers by
[@&#8203;climba03003](https://redirect.github.com/climba03003) in
[#&#8203;598](https://redirect.github.com/fastify/fastify-static/pull/598)

#### New Contributors

- [@&#8203;jibin7jose](https://redirect.github.com/jibin7jose) made
their first contribution in
[#&#8203;596](https://redirect.github.com/fastify/fastify-static/pull/596)

**Full Changelog**:
<fastify/fastify-static@v9.3.0...v10.0.0>

###
[`v9.3.0`](https://redirect.github.com/fastify/fastify-static/releases/tag/v9.3.0)

[Compare
Source](https://redirect.github.com/fastify/fastify-static/compare/v9.2.0...v9.3.0)

#### What's Changed

- chore: update fastify-plugin dependency to version 6.0.0 by
[@&#8203;Puppo](https://redirect.github.com/Puppo) in
[#&#8203;594](https://redirect.github.com/fastify/fastify-static/pull/594)

#### New Contributors

- [@&#8203;Puppo](https://redirect.github.com/Puppo) made their first
contribution in
[#&#8203;594](https://redirect.github.com/fastify/fastify-static/pull/594)

**Full Changelog**:
<fastify/fastify-static@v9.2.0...v9.3.0>

###
[`v9.2.0`](https://redirect.github.com/fastify/fastify-static/releases/tag/v9.2.0)

[Compare
Source](https://redirect.github.com/fastify/fastify-static/compare/v9.1.3...v9.2.0)

#### What's Changed

- chore(.gitattributes): retain binary file eol style by
[@&#8203;Fdawgs](https://redirect.github.com/Fdawgs) in
[#&#8203;577](https://redirect.github.com/fastify/fastify-static/pull/577)
- refactor(types): migrate from tsd to tstyche by
[@&#8203;Tony133](https://redirect.github.com/Tony133) in
[#&#8203;579](https://redirect.github.com/fastify/fastify-static/pull/579)
- fix: propagate return value from fastify.errorHandler by
[@&#8203;abdulmunimjemal](https://redirect.github.com/abdulmunimjemal)
in
[#&#8203;582](https://redirect.github.com/fastify/fastify-static/pull/582)
- chore: update depedabot setting by
[@&#8203;climba03003](https://redirect.github.com/climba03003) in
[#&#8203;583](https://redirect.github.com/fastify/fastify-static/pull/583)
- chore: bump
[@&#8203;fastify/compress](https://redirect.github.com/fastify/compress)
from 8.3.1 to 9.0.0 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[#&#8203;590](https://redirect.github.com/fastify/fastify-static/pull/590)
- chore: bump
[@&#8203;types/node](https://redirect.github.com/types/node) from 25.9.4
to 26.0.0 in the dev-dependencies-typescript group by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[#&#8203;592](https://redirect.github.com/fastify/fastify-static/pull/592)
- docs: fix broken links by
[@&#8203;Fdawgs](https://redirect.github.com/Fdawgs) in
[#&#8203;591](https://redirect.github.com/fastify/fastify-static/pull/591)
- docs: clarify precompressed allowedPath behavior by
[@&#8203;mcollina](https://redirect.github.com/mcollina) in
[#&#8203;593](https://redirect.github.com/fastify/fastify-static/pull/593)

#### New Contributors

- [@&#8203;abdulmunimjemal](https://redirect.github.com/abdulmunimjemal)
made their first contribution in
[#&#8203;582](https://redirect.github.com/fastify/fastify-static/pull/582)

**Full Changelog**:
<fastify/fastify-static@v9.1.3...v9.2.0>

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/netlify/cli).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yODAuMCIsInVwZGF0ZWRJblZlciI6IjQzLjI4MC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiLCJqYXZhc2NyaXB0Il19-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: Philippe Serhal <philippe.serhal@netlify.com>

Author: renovate[bot]

package-lock.json

@@ -55,7 +55,7 @@
     "typecheck:watch": "tsc --watch"
   },
   "dependencies": {
-    "@fastify/static": "^9.1.1",
+    "@fastify/static": "^10.0.0",
     "@netlify/ai": "^0.4.1",
     "@netlify/api": "^14.0.19",
     "@netlify/blobs": "^10.7.9",