API : @fastify/rate-limit 11.2.0, limites d'essais non contournables en IPv6

Reprend la PR Dependabot #29. La 11.2.0 corrige GHSA-grpc-p53c-r64v : la clé par défaut était l'adresse IP telle quelle, un client IPv6 changeait d'adresse dans son /64 (ou réécrivait la même autrement) et repartait à zéro. La clé est maintenant l'adresse normalisée, IPv4 mappée ramenée en IPv4, IPv6 regroupée par /64. Rupture de la 11.0.0 : option whitelist retirée au profit d'allowList, que Parenthèse n'utilise pas. Aucun changement de code (global: false, limites par route dans config.rateLimit, clé par défaut sur request.ip calculée par Fastify avec TRUST_PROXY). 112 tests.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

backend/package-lock.json

@@ -10,7 +10,7 @@
       "dependencies": {
         "@fastify/cors": "^10.1.0",
         "@fastify/jwt": "^10.2.2",
-        "@fastify/rate-limit": "^10.3.0",
+        "@fastify/rate-limit": "^11.2.0",
         "@prisma/client": "^6.15.0",
         "bcryptjs": "^3.0.2",
         "dotenv": "^16.6.1",
@@ -635,7 +635,9 @@
       }
     },
     "node_modules/@fastify/rate-limit": {
-      "version": "10.3.0",
+      "version": "11.2.0",
+      "resolved": "https://registry.npmjs.org/@fastify/rate-limit/-/rate-limit-11.2.0.tgz",
+      "integrity": "sha512-X7osJd4XSvMoejYrnJkSZYYjY1eNYoBqhjlzf1RakC2204qExFqZFTKj5+T7VuzA/iUI9Z3UoSqQRkB2HpG0oQ==",
       "funding": [
         {
           "type": "github",
@@ -649,10 +651,27 @@
       "license": "MIT",
       "dependencies": {
         "@lukeed/ms": "^2.0.2",
-        "fastify-plugin": "^5.0.0",
+        "fastify-plugin": "^6.0.0",
+        "ip-address": "^10.2.0",
         "toad-cache": "^3.7.0"
       }
     },
+    "node_modules/@fastify/rate-limit/node_modules/fastify-plugin": {
+      "version": "6.0.0",
+      "resolved": "https://registry.npmjs.org/fastify-plugin/-/fastify-plugin-6.0.0.tgz",
+      "integrity": "sha512-fZOty7z3O7vOliF6d8bHE3wiEh1KcNnKEQensSgTk9C1DvN6nRLS++XVd86v33Hw/8u9Un8A1zDrQ8ujcQDHEg==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/fastify"
+        },
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/fastify"
+        }
+      ],
+      "license": "MIT"
+    },
     "node_modules/@img/colour": {
       "version": "1.1.0",
       "resolved": "https://registry.npmjs.org/@img/colour/-/colour-1.1.0.tgz",
@@ -2263,6 +2282,15 @@
       "integrity": "sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ==",
       "license": "ISC"
     },
+    "node_modules/ip-address": {
+      "version": "10.7.2",
+      "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.7.2.tgz",
+      "integrity": "sha512-7H/2gFSIitxc0hG3nOI1glS8QLo/EHBFFLk8vEUjXY/xu0AdL8jZ9U1IzO2PUm0d2D/ofQcAifb0g6OBkt8U7w==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 12"
+      }
+    },
     "node_modules/ipaddr.js": {
       "version": "2.3.0",
       "license": "MIT",

backend/package.json

@@ -19,7 +19,7 @@
   "dependencies": {
     "@fastify/cors": "^10.1.0",
     "@fastify/jwt": "^10.2.2",
-    "@fastify/rate-limit": "^10.3.0",
+    "@fastify/rate-limit": "^11.2.0",
     "@prisma/client": "^6.15.0",
     "bcryptjs": "^3.0.2",
     "dotenv": "^16.6.1",