chore: dependency maintenance (minor/patch + @fastify/static 10)

[jaredwray]

Please check if the PR fulfills these requirements

• Followed the Contributing and Code of Conduct guidelines.
• Tests for the changes have been added (for bug fixes/features) with 100% code coverage. (Dependency-only change — no new tests required; the existing suite exercises the updated packages and coverage is unchanged at 100% lines/functions.)

What kind of change does this PR introduce?

Chore — automated dependency maintenance. No source or public API changes; only version bumps in package.json and pnpm-lock.yaml.

---

Dependency updates

Minor / patch (within existing semver ranges)

Package	From	To
@biomejs/biome	2.4.16	2.5.3
@swc/core	1.15.41	1.15.43
@vitest/coverage-v8	4.1.8	4.1.10
vitest	4.1.8	4.1.10
tsdown	0.22.2	0.22.4
tsx	4.22.4	4.23.0
@fastify/cookie	11.0.2	11.1.1
@fastify/helmet	13.0.2	13.1.0
@fastify/rate-limit	11.0.0	11.1.0
@fastify/swagger	9.7.0	9.8.0
@fastify/swagger-ui	6.0.0	6.1.0
@scalar/api-reference	1.59.3	1.62.5
fastify	5.8.5	5.10.0
hookified	3.0.0	3.0.1

Major

Package	From	To	Notes
@fastify/static	9.1.3	10.1.0	Loads cleanly under the project's Fastify 5.x (no fastify-plugin version warning); static-file, Swagger UI and Scalar routes all pass.

Deferred to a future run

• typescript 6.0.3 → 7.0.2 — held back. tsdown only declares TypeScript 7 peer support from 0.22.5 onward (typescript: ^5.0.0 || ^6.0.0 || ^7.0.0), and 0.22.5 is still inside this repo's 7-day minimumReleaseAge window (published 2026-07-11). Pairing TS 7 with the in-policy tsdown 0.22.4 (peer ^5.0.0 || ^6.0.0) is an undeclared-support combination — thanks to the Codex review for flagging it. Rather than ship that mismatch or override the release-age policy, TS stays at 6.0.3; the TypeScript 7 upgrade will land in a later run once tsdown 0.22.5+ has aged past the 7-day window.
• Also held by minimumReleaseAge (published < 7 days ago): @biomejs/biome 2.5.4, @scalar/api-reference 1.62.9, @fastify/swagger 9.8.1, tsdown 0.22.9, tsx 4.23.1.

Verification

• pnpm build — passing
• pnpm test (Biome lint + Vitest with coverage) — 473 tests passing across 43 files
• Coverage — 100% lines / 100% functions (Statements 99.91%, Branches 97.69%), unchanged from base
• Peer dependencies clean: tsdown 0.22.4 + typescript 6.0.3 satisfies tsdown's declared peer range
• Frozen-lockfile install verified so pnpm-lock.yaml stays consistent with package.json

---

🤖 Generated with Claude Code

https://claude.ai/code/session_01FjTirhzhuv9RYiVwgjjf3x

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	vitest@​4.1.10
	@​vitest/​coverage-v8@​4.1.10
	tsx@​4.23.0
	tsdown@​0.22.4
	@​scalar/​api-reference@​1.62.5
	@​swc/​core@​1.15.43
	@​fastify/​helmet@​13.1.0
	hookified@​3.0.1
	@​fastify/​swagger@​9.8.0
	@​fastify/​rate-limit@​11.1.0
	@​fastify/​cookie@​11.1.1
	@​fastify/​swagger-ui@​6.1.0
	fastify@​5.10.0
	@​fastify/​static@​10.1.0
	@​biomejs/​biome@​2.5.3

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: npm @emnapi/runtime is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: pnpm-lock.yaml → npm/tsdown@0.22.4 → npm/@emnapi/runtime@1.11.1 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@emnapi/runtime@1.11.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm @internationalized/date is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: pnpm-lock.yaml → npm/@scalar/api-reference@1.62.5 → npm/@internationalized/date@3.12.2 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@internationalized/date@3.12.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

[gemini-code-assist]

Code Review

This pull request updates several dependencies and devDependencies in package.json to their latest versions, including upgrading TypeScript to version 7.0.2 and Fastify to version 5.10.0. There are no review comments, and I have no feedback to provide.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (556fad6) to head (d7ab1e2).

Additional details and impacted files

@@            Coverage Diff            @@
##              main      #165   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files           41        41           
  Lines         1310      1310           
  Branches       259       259           
=========================================
  Hits          1310      1310           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: d7ab1e2f39

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".