{"schemaVersion":1,"status":{"id":"0e20e3b6-40f8-420f-9cd3-0c0a55511b64","scanId":"4847ad2a-b6a9-40f0-bf18-36a8278d67c6","invalidatedAt":null,"invalidationReason":null,"replacedBy":null,"snapshotAvailable":true,"policyAllowed":true,"createdAt":"2026-10-09T10:11:23.884Z","observationRevision":0,"previousScanId":null,"previousReportId":null,"current":true},"report":{"schemaVersion":1,"id":"0e20e3b6-40f8-420f-9cd3-0c0a55511b64","scanId":"4847ad2a-b6a9-40f0-bf18-36a8278d67c6","classifierRevision":"classifier_v2","observedAt":"2026-10-09T10:11:19.373Z","classifiedAt":"2026-10-09T10:11:23.887Z","artifact":{"name":"fastify","version":"5.12.5","integrity":"sha512-OB2k1dlxs5/NAABqeKV2FUHkSD2BbENsCak8yULVcymn3fHIPDVa9TI3SDnJSWYSllZmSYuZXy2gTnsT+Sut1A==","tarballUrl":"https://registry.npmjs.org/fastify/-/fastify-5.12.5.tgz"},"preparation":{"id":"75518b3b-fe60-4cbf-b2ff-582043a7b1b2","outcome":"pass","failure":null,"profileRevision":"npm_11_19_0_linux_amd64_v2","snapshot":{"id":"890fb31a-4a57-4f40-8a52-39cb9e5b488c","generation":"8b68d40c-6ac9-491b-8d98-8ccef813e002","lockDigest":"9bdc41d1bbd4ff4826e76e5e42b1723b13c898f8bcc313cded2f6a1a3f456ba3","treeDigest":"6fc773ea2c1277e51ee9efabff611a5a635adebcd472afb37585bdfa73be59b7","profileRevision":"npm_11_19_0_linux_amd64_v2","installerImage":"node:24.21.0-bookworm-slim@sha256:5cbc7caba8c2c0f0bca675d1b61b9f2857e1cf1853c6164ee9dd409501a936e7"},"installedCount":48,"omittedOptionalCount":0,"staticObservations":{"native":{"count":0,"paths":[],"buildIndicators":[],"prerequisiteProven":false},"declared":{"main":"fastify.js","type":"commonjs","scripts":{"lint":"npm run lint:eslint","test":"npm run lint && npm run unit && npm run test:types","unit":"borp","bench":"branchcmp -r 2 -g -s \"npm run benchmark\"","citgm":"borp --reporter=@jsumners/line-reporter --coverage --check-coverage --concurrency=1","test:ci":"npm run unit && npm run test:types","coverage":"c8 --reporter html borp --reporter=@jsumners/line-reporter","lint:fix":"eslint --fix","benchmark":"concurrently -k -s first \"node ./examples/benchmark/simple.js\" \"autocannon -c 100 -d 30 -p 10 localhost:3000/\"","test:types":"tstyche","test:watch":"npm run unit -- --watch --coverage-report=none --reporter=terse","lint:eslint":"eslint","test:report":"npm run lint && npm run unit:report && npm run test:types","unit:report":"c8 --reporter html borp --reporter=@jsumners/line-reporter","lint:markdown":"markdownlint-cli2","prepublishOnly":"cross-env PREPUBLISH=true borp --reporter=@jsumners/line-reporter && npm run test:validator:integrity && npm run build:sync-version","benchmark:parser":"concurrently -k -s first \"node ./examples/benchmark/parser.js\" \"autocannon -c 100 -d 30 -p 10 -i ./examples/benchmark/body.json -H \"content-type:application/jsoff\" -m POST localhost:3000/\"","build:validation":"node build/build-error-serializer.js && node build/build-validation.js","build:sync-version":"node build/sync-version.js","benchmark:parser:error":"concurrently -k -s first \"node ./examples/benchmark/parser.js\" \"autocannon -c 100 -d 30 -p 10 -i ./examples/benchmark/body.json -H \"content-type:application/jsoff\" -H \"content-length:123\" -m POST localhost:3000/\"","test:validator:integrity":"npm run build:validation && git diff --quiet --ignore-all-space --ignore-blank-lines --ignore-cr-at-eol lib/error-serializer.js && git diff --quiet --ignore-all-space --ignore-blank-lines --ignore-cr-at-eol lib/config-validator.js","coverage:ci-check-coverage":"borp --reporter=@jsumners/line-reporter --coverage --check-coverage --lines 100"},"dependencies":{"pino":"^9.14.0 || ^10.1.0","rfdc":"^1.3.1","avvio":"^9.0.0","semver":"^7.6.0","toad-cache":"^3.7.0","find-my-way":"^9.6.0","@fastify/error":"^4.0.0","process-warning":"^5.1.0","abstract-logging":"^2.0.1","light-my-request":"^6.0.0","secure-json-parse":"^4.0.0","@fastify/proxy-addr":"^5.0.0","fast-json-stringify":"^7.0.0","@fastify/ajv-compiler":"^4.0.5","@fastify/fast-json-stringify-compiler":"^5.0.0"},"devDependencies":{"ajv":"^8.12.0","joi":"^18.0.1","yup":"^1.4.0","borp":"^1.0.0","vary":"^1.1.2","h2url":"^0.2.0","eslint":"^9.0.0","split2":"^4.2.0","undici":"^7.11.0","tstyche":"^7.0.0","typebox":"^1.0.81","ajv-i18n":"^4.2.0","cross-env":"^10.0.0","JSONStream":"^1.3.5","ajv-errors":"^3.0.0","autocannon":"^8.0.0","node-forge":"^1.3.1","proxyquire":"^2.1.3","typescript":"~6.0.2","@types/node":"^26.0.1","ajv-formats":"^3.0.1","http-errors":"^2.0.0","neostandard":"^0.12.0","concurrently":"^10.0.0","fast-json-body":"^1.1.0","fastify-plugin":"^6.0.0","ajv-merge-patch":"^5.0.1","branch-comparer":"^1.1.0","fastify-tsconfig":"^3.0.0","json-schema-to-ts":"^3.0.1","markdownlint-cli2":"^0.23.0","fluent-json-schema":"^6.0.0","@jsumners/line-reporter":"^1.0.1","@stylistic/eslint-plugin":"^5.1.0","@stylistic/eslint-plugin-js":"^4.1.0"}},"platform":{"os":true,"cpu":true,"libc":true},"evidenceLevel":"static_only","lifecycleScripts":[]}},"matrix":{"id":"4dc87b12-9092-4ebf-a963-709a77c15297","revision":"production_ce416e976d3b4c51b252859d31c1fa7c","platform":"linux_amd64_glibc","harnessRevision":"load_v2","planRevision":"explicit_exports_v1","policyRevision":"runtime_limits_v2","images":[{"profileId":"node_24_21_0","kind":"node","version":"24.21.0","imageId":"sha256:e3a5a41a242a766e69f326b91f9ed9280c5719ad3e9ab54f0ac28bfc71d77794","builtAt":"2026-10-04T15:20:38.392Z","sourceImage":"node:24.21.0-bookworm-slim@sha256:5cbc7caba8c2c0f0bca675d1b61b9f2857e1cf1853c6164ee9dd409501a936e7","baseImage":"gcr.io/distroless/cc-debian13:nonroot@sha256:20afe6a70f2565277b704cc17289cb557f353a3619f6350f52a2317106598df4","supportImage":"node:26.10.0-bookworm-slim@sha256:0a992e1420e2d70611578f1844a6f10a9d11fe6bb535aabf72efe3007f13d79b","platform":"linux_amd64_glibc","recipeRevision":"runtime_image_v1"},{"profileId":"node_26_10_0","kind":"node","version":"26.10.0","imageId":"sha256:5d2fa297021c7db25494856bb25e2cddecbb020722ce1e0f2101385a063c0611","builtAt":"2026-10-04T15:20:47.161Z","sourceImage":"node:26.10.0-bookworm-slim@sha256:0a992e1420e2d70611578f1844a6f10a9d11fe6bb535aabf72efe3007f13d79b","baseImage":"gcr.io/distroless/cc-debian13:nonroot@sha256:20afe6a70f2565277b704cc17289cb557f353a3619f6350f52a2317106598df4","supportImage":"node:26.10.0-bookworm-slim@sha256:0a992e1420e2d70611578f1844a6f10a9d11fe6bb535aabf72efe3007f13d79b","platform":"linux_amd64_glibc","recipeRevision":"runtime_image_v1"},{"profileId":"bun_1_4_2","kind":"bun","version":"1.4.2","imageId":"sha256:fd67412f5baad0c2b1038367df9cf2d4b33237d3815e16eedae16cfd94ab3182","builtAt":"2026-10-04T15:21:07.160Z","sourceImage":"oven/bun:1.4.2-debian@sha256:53710ce0f14eef8312521c586a7ae1d9aeab4011840f09f1966073b68fc2e2ab","baseImage":"gcr.io/distroless/cc-debian13:nonroot@sha256:20afe6a70f2565277b704cc17289cb557f353a3619f6350f52a2317106598df4","supportImage":"node:26.10.0-bookworm-slim@sha256:0a992e1420e2d70611578f1844a6f10a9d11fe6bb535aabf72efe3007f13d79b","platform":"linux_amd64_glibc","recipeRevision":"runtime_image_v1"},{"profileId":"deno_2_9_7","kind":"deno","version":"2.9.7","imageId":"sha256:3b0f993e5ec0b1d4e8e09bc50ae53f142f7347d0baf96cefe7a8cfe7a00f7958","builtAt":"2026-10-04T15:21:22.570Z","sourceImage":"denoland/deno:debian-2.9.7@sha256:869d374bdaddda4fde029c492d7219199b0e821c2c53cca5357b3a6f5b9336fc","baseImage":"gcr.io/distroless/cc-debian13:nonroot@sha256:20afe6a70f2565277b704cc17289cb557f353a3619f6350f52a2317106598df4","supportImage":"node:26.10.0-bookworm-slim@sha256:0a992e1420e2d70611578f1844a6f10a9d11fe6bb535aabf72efe3007f13d79b","platform":"linux_amd64_glibc","recipeRevision":"runtime_image_v1"}]},"omissions":{"counts":{"pattern":0,"non_executable":0,"not_exported":0,"invalid_subpath":0,"coverage_limit":0},"samples":[]},"outcome":"pass","evidenceLevel":"smoke_tested","coverageComplete":true,"cells":[{"runId":"9f859550-2cc4-45f7-b6cb-aac14147a8a9","profileId":"node_24_21_0","group":"root","mode":"esm","method":"fresh_root_v2","outcome":"pass","evidenceLevel":"smoke_tested","coverage":{"planned":1,"observed":1,"passed":1,"failed":0,"prerequisiteLimited":0,"interrupted":0,"untested":0,"complete":true},"durationMs":422.7188029999961,"failure":null,"entries":[{"index":0,"specifier":"fastify","displaySpecifier":"fastify","outcome":"pass","durationMs":128.535711,"resolvedTo":"file:///workspace/node_modules/fastify/fastify.js","failure":null}],"sessions":[{"probeId":"86cd5387-b48d-4c5d-bc82-4026ee536df2","startIndex":0,"stopReason":"completed","exitCode":0,"oomKilled":false,"durationMs":422.7188029999961}]},{"runId":"e290638d-f0d9-496c-9daa-30fdca1ba5a4","profileId":"node_24_21_0","group":"root","mode":"commonjs","method":"fresh_root_v2","outcome":"pass","evidenceLevel":"smoke_tested","coverage":{"planned":1,"observed":1,"passed":1,"failed":0,"prerequisiteLimited":0,"interrupted":0,"untested":0,"complete":true},"durationMs":436.23560099996394,"failure":null,"entries":[{"index":0,"specifier":"fastify","displaySpecifier":"fastify","outcome":"pass","durationMs":81.647733,"resolvedTo":"/workspace/node_modules/fastify/fastify.js","failure":null}],"sessions":[{"probeId":"e97fa9f0-a8b8-4339-bd13-e75594e05024","startIndex":0,"stopReason":"completed","exitCode":0,"oomKilled":false,"durationMs":436.23560099996394}]},{"runId":"61ee1d68-8d0c-4cf7-b863-8d5165f0961a","profileId":"node_24_21_0","group":"subpaths","mode":"esm","method":"sequential_batch_v2","outcome":"not_applicable","evidenceLevel":"static_only","coverage":{"planned":0,"observed":0,"passed":0,"failed":0,"prerequisiteLimited":0,"interrupted":0,"untested":0,"complete":true},"durationMs":0,"failure":null,"entries":[],"sessions":[]},{"runId":"5ec87e2e-a1e6-4d27-9732-7dc4f71b7824","profileId":"node_24_21_0","group":"subpaths","mode":"commonjs","method":"sequential_batch_v2","outcome":"not_applicable","evidenceLevel":"static_only","coverage":{"planned":0,"observed":0,"passed":0,"failed":0,"prerequisiteLimited":0,"interrupted":0,"untested":0,"complete":true},"durationMs":0,"failure":null,"entries":[],"sessions":[]},{"runId":"a21ea765-f8a6-46d9-8d2c-e07db89a572b","profileId":"node_26_10_0","group":"root","mode":"esm","method":"fresh_root_v2","outcome":"pass","evidenceLevel":"smoke_tested","coverage":{"planned":1,"observed":1,"passed":1,"failed":0,"prerequisiteLimited":0,"interrupted":0,"untested":0,"complete":true},"durationMs":474.3346090000123,"failure":null,"entries":[{"index":0,"specifier":"fastify","displaySpecifier":"fastify","outcome":"pass","durationMs":128.226694,"resolvedTo":"file:///workspace/node_modules/fastify/fastify.js","failure":null}],"sessions":[{"probeId":"ebef15eb-0002-466a-a707-8dfdbfa4beb2","startIndex":0,"stopReason":"completed","exitCode":0,"oomKilled":false,"durationMs":474.3346090000123}]},{"runId":"1b026104-b59c-4dd4-a061-e0532f38fcf2","profileId":"node_26_10_0","group":"root","mode":"commonjs","method":"fresh_root_v2","outcome":"pass","evidenceLevel":"smoke_tested","coverage":{"planned":1,"observed":1,"passed":1,"failed":0,"prerequisiteLimited":0,"interrupted":0,"untested":0,"complete":true},"durationMs":429.6825850000023,"failure":null,"entries":[{"index":0,"specifier":"fastify","displaySpecifier":"fastify","outcome":"pass","durationMs":88.171933,"resolvedTo":"/workspace/node_modules/fastify/fastify.js","failure":null}],"sessions":[{"probeId":"086966d1-2c1d-48e3-a6f0-23300ebe7974","startIndex":0,"stopReason":"completed","exitCode":0,"oomKilled":false,"durationMs":429.6825850000023}]},{"runId":"d7d91e41-6200-446f-81ae-e7fae823b347","profileId":"node_26_10_0","group":"subpaths","mode":"esm","method":"sequential_batch_v2","outcome":"not_applicable","evidenceLevel":"static_only","coverage":{"planned":0,"observed":0,"passed":0,"failed":0,"prerequisiteLimited":0,"interrupted":0,"untested":0,"complete":true},"durationMs":0,"failure":null,"entries":[],"sessions":[]},{"runId":"afae0336-146a-480f-ab6d-7ac211fdef6f","profileId":"node_26_10_0","group":"subpaths","mode":"commonjs","method":"sequential_batch_v2","outcome":"not_applicable","evidenceLevel":"static_only","coverage":{"planned":0,"observed":0,"passed":0,"failed":0,"prerequisiteLimited":0,"interrupted":0,"untested":0,"complete":true},"durationMs":0,"failure":null,"entries":[],"sessions":[]},{"runId":"3107393e-8fbd-41c9-9a23-d087a819e79c","profileId":"bun_1_4_2","group":"root","mode":"esm","method":"fresh_root_v2","outcome":"pass","evidenceLevel":"smoke_tested","coverage":{"planned":1,"observed":1,"passed":1,"failed":0,"prerequisiteLimited":0,"interrupted":0,"untested":0,"complete":true},"durationMs":424.37248299998464,"failure":null,"entries":[{"index":0,"specifier":"fastify","displaySpecifier":"fastify","outcome":"pass","durationMs":120.81257099999999,"resolvedTo":"file:///workspace/node_modules/fastify/fastify.js","failure":null}],"sessions":[{"probeId":"db6d5923-80b1-4796-ab8e-66b4fec363f3","startIndex":0,"stopReason":"completed","exitCode":0,"oomKilled":false,"durationMs":424.37248299998464}]},{"runId":"7a7f7172-9095-4527-9de7-50e615d0e3d6","profileId":"bun_1_4_2","group":"root","mode":"commonjs","method":"fresh_root_v2","outcome":"pass","evidenceLevel":"smoke_tested","coverage":{"planned":1,"observed":1,"passed":1,"failed":0,"prerequisiteLimited":0,"interrupted":0,"untested":0,"complete":true},"durationMs":437.89332700002706,"failure":null,"entries":[{"index":0,"specifier":"fastify","displaySpecifier":"fastify","outcome":"pass","durationMs":85.061862,"resolvedTo":"/workspace/node_modules/fastify/fastify.js","failure":null}],"sessions":[{"probeId":"88560ebf-dd0d-440c-aec5-f29789d7854e","startIndex":0,"stopReason":"completed","exitCode":0,"oomKilled":false,"durationMs":437.89332700002706}]},{"runId":"ce8959ea-b88a-460f-b144-9bc60f2aebf1","profileId":"bun_1_4_2","group":"subpaths","mode":"esm","method":"sequential_batch_v2","outcome":"not_applicable","evidenceLevel":"static_only","coverage":{"planned":0,"observed":0,"passed":0,"failed":0,"prerequisiteLimited":0,"interrupted":0,"untested":0,"complete":true},"durationMs":0,"failure":null,"entries":[],"sessions":[]},{"runId":"7cb3b97a-1b1e-4d9a-9a7b-b5d3efd393a7","profileId":"bun_1_4_2","group":"subpaths","mode":"commonjs","method":"sequential_batch_v2","outcome":"not_applicable","evidenceLevel":"static_only","coverage":{"planned":0,"observed":0,"passed":0,"failed":0,"prerequisiteLimited":0,"interrupted":0,"untested":0,"complete":true},"durationMs":0,"failure":null,"entries":[],"sessions":[]},{"runId":"6da8f859-b0f0-4a44-b64e-4b39be351d95","profileId":"deno_2_9_7","group":"root","mode":"esm","method":"fresh_root_v2","outcome":"pass","evidenceLevel":"smoke_tested","coverage":{"planned":1,"observed":1,"passed":1,"failed":0,"prerequisiteLimited":0,"interrupted":0,"untested":0,"complete":true},"durationMs":628.3447980000055,"failure":null,"entries":[{"index":0,"specifier":"fastify","displaySpecifier":"fastify","outcome":"pass","durationMs":200.443117,"resolvedTo":"file:///workspace/node_modules/fastify/fastify.js","failure":null}],"sessions":[{"probeId":"5a87354e-8a76-4308-ad1b-3c59cb8fc527","startIndex":0,"stopReason":"completed","exitCode":0,"oomKilled":false,"durationMs":628.3447980000055}]},{"runId":"637c5d1d-2b1c-4651-9465-c1df2d168a01","profileId":"deno_2_9_7","group":"root","mode":"commonjs","method":"fresh_root_v2","outcome":"pass","evidenceLevel":"smoke_tested","coverage":{"planned":1,"observed":1,"passed":1,"failed":0,"prerequisiteLimited":0,"interrupted":0,"untested":0,"complete":true},"durationMs":533.9480619999813,"failure":null,"entries":[{"index":0,"specifier":"fastify","displaySpecifier":"fastify","outcome":"pass","durationMs":193.455228,"resolvedTo":"/workspace/node_modules/fastify/fastify.js","failure":null}],"sessions":[{"probeId":"4a900711-6f6d-4eea-b345-c9924bb45b2f","startIndex":0,"stopReason":"completed","exitCode":0,"oomKilled":false,"durationMs":533.9480619999813}]},{"runId":"92bf8bdd-f3e2-4fd7-bdb9-ddb3dd5fdd1e","profileId":"deno_2_9_7","group":"subpaths","mode":"esm","method":"sequential_batch_v2","outcome":"not_applicable","evidenceLevel":"static_only","coverage":{"planned":0,"observed":0,"passed":0,"failed":0,"prerequisiteLimited":0,"interrupted":0,"untested":0,"complete":true},"durationMs":0,"failure":null,"entries":[],"sessions":[]},{"runId":"a361e7a0-9986-4208-b23a-af3c1e25d505","profileId":"deno_2_9_7","group":"subpaths","mode":"commonjs","method":"sequential_batch_v2","outcome":"not_applicable","evidenceLevel":"static_only","coverage":{"planned":0,"observed":0,"passed":0,"failed":0,"prerequisiteLimited":0,"interrupted":0,"untested":0,"complete":true},"durationMs":0,"failure":null,"entries":[],"sessions":[]}],"limitations":["Only installation and loading were observed; functional correctness and package safety are not established.","Subpath batches share module caches and globals; root modes use separate fresh sandboxes.","Package-visible harness observations can be tampered with. They are not adversarial attestation.","Evidence applies to these exact artifacts, dependency snapshot, runtime images and Linux amd64/glibc policy.","Runtime error codes are captured observations and can also be thrown by package code."]}}