Add addContentTypeParser, drop after and ready, and date the change note in UTC

`addContentTypeParser` returns the server, so it belongs in the list. Its type
declaration says `void`, which is why it was missed: it is declared as a
property of an interface type rather than as a method, so it did not look like
the `set*` family.

Checking the rest of the instance against the runtime rather than against the
declarations then showed that `ready` never returns the server, in either of
its call forms, despite the declaration saying it does, and that `after`
returns it only when given a callback. Both are now excluded, which also makes
the predicate exactly what its name says. `onClose` returns the server too,
but it registers a hook, so it is excluded for the same reason as `addHook`.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: dtorres-fgf

…9-11-fastify-chainable-config-methods.md …9-10-fastify-chainable-config-methods.mdjavascript/ql/lib/change-notes/2026-09-11-fastify-chainable-config-methods.md renamed to javascript/ql/lib/change-notes/2026-09-10-fastify-chainable-config-methods.md javascript/ql/lib/change-notes/2026-09-11-fastify-chainable-config-methods.md renamed to javascript/ql/lib/change-notes/2026-09-10-fastify-chainable-config-methods.md

@@ -22,21 +22,23 @@ module Fastify {
   }
 
   /**
-   * Gets the name of a chainable Fastify server method, that is, a configuration or
-   * lifecycle method that returns the same server instance it was called on, so that a
-   * call to it still refers to that server.
+   * Gets the name of a chainable Fastify configuration method, that is, a method that
+   * configures the server instance and returns that same instance, so that a call to it
+   * still refers to the server.
    *
-   * Route-registering methods such as `register`, `addHook`, and the shorthand route
-   * methods return the server as well, but they are deliberately excluded here because
-   * they already have a meaning in the routing model for Fastify.
+   * Plugin, hook and route registration (`register`, `addHook`, `onClose`, and the
+   * shorthand route methods) returns the server as well, but is deliberately excluded
+   * here, because it already has a meaning in the routing model for Fastify. The
+   * lifecycle methods `after` and `ready` are excluded too: `after` returns the server
+   * only when it is given a callback, and `ready` never does.
    */
-  private string chainableServerMethodName() {
+  private string chainableConfigMethodName() {
     result =
       [
-        "withTypeProvider", "addSchema", "addHttpMethod", "decorate", "decorateRequest",
-        "decorateReply", "setValidatorCompiler", "setSerializerCompiler", "setSchemaController",
-        "setReplySerializer", "setSchemaErrorFormatter", "setErrorHandler", "setNotFoundHandler",
-        "setGenReqId", "setChildLoggerFactory", "after", "ready"
+        "withTypeProvider", "addSchema", "addHttpMethod", "addContentTypeParser", "decorate",
+        "decorateRequest", "decorateReply", "setValidatorCompiler", "setSerializerCompiler",
+        "setSchemaController", "setReplySerializer", "setSchemaErrorFormatter", "setErrorHandler",
+        "setNotFoundHandler", "setGenReqId", "setChildLoggerFactory"
       ]
   }
 
@@ -53,7 +55,7 @@ module Fastify {
     // server.withTypeProvider<T>(), server.setValidatorCompiler(...), and friends return
     // the server itself, so the result of such a call still refers to it.
     t.start() and
-    result = server(creation).getAMethodCall(chainableServerMethodName())
+    result = server(creation).getAMethodCall(chainableConfigMethodName())
     or
     exists(DataFlow::TypeTracker t2 | result = server(creation, t2).track(t2, t))
   }

javascript/ql/lib/semmle/javascript/frameworks/Fastify.qll

@@ -12,4 +12,4 @@
 | tst.js:111:28:111:44 | expensiveHandler1 | This route handler performs $@, but is not rate-limited. | tst.js:14:40:14:46 | login() | authorization |
 | tst.js:116:39:116:55 | expensiveHandler1 | This route handler performs $@, but is not rate-limited. | tst.js:14:40:14:46 | login() | authorization |
 | tst.js:130:35:130:51 | expensiveHandler1 | This route handler performs $@, but is not rate-limited. | tst.js:14:40:14:46 | login() | authorization |
-| tst.js:160:35:160:51 | expensiveHandler1 | This route handler performs $@, but is not rate-limited. | tst.js:14:40:14:46 | login() | authorization |
+| tst.js:161:35:161:51 | expensiveHandler1 | This route handler performs $@, but is not rate-limited. | tst.js:14:40:14:46 | login() | authorization |

javascript/ql/test/query-tests/Security/CWE-770/MissingRateLimit/MissingRateLimiting.expected

@@ -133,6 +133,7 @@ fastifyApp5.get('/no-rate-limit', expensiveHandler1); // $ Alert
 const fastifyApp6 = require('fastify')()
   .withTypeProvider()
   .setValidatorCompiler(compiler)
+  .addContentTypeParser('application/json', parser)
   .decorate('answer', 42);
 
 fastifyApp6.register(require('@fastify/rate-limit'));