chore: dependency maintenance — minor/patch batch + @fastify/static v10

[jaredwray]

Please check if the PR fulfills these requirements

• Followed the Contributing and Code of Conduct guidelines.
• Tests for the changes have been added (for bug fixes/features) with 100% code coverage. — N/A (dependency-only change); the existing suite (473 tests) passes and coverage is unchanged (100% lines, per Codecov).

What kind of change does this PR introduce?

Chore — automated dependency maintenance. No source code changes.

---

Dependency Updates

Minor / patch (within existing semver ranges) — commit 9449fdc

Dependencies

Package	From	To
@fastify/cookie	11.0.2	11.1.1
@fastify/helmet	13.0.2	13.1.0
@fastify/rate-limit	11.0.0	11.1.0
@fastify/static	9.1.3	9.3.0
@fastify/swagger	9.7.0	9.8.0
@fastify/swagger-ui	6.0.0	6.1.0
@scalar/api-reference	1.59.3	1.62.5
fastify	5.8.5	5.10.0
hookified	3.0.0	3.0.1

Dev dependencies

Package	From	To
@biomejs/biome	2.4.16	2.5.3
@swc/core	1.15.41	1.15.43
tsx	4.22.4	4.23.0

Major — commit c150987

Package	From	To
@fastify/static	9.3.0	10.1.0

The only breaking change in @fastify/static v10 is that the setHeaders option now receives a FastifyReply instead of a Node.js response object. This project does not use setHeaders (it only registers the plugin with root, prefix, and decorateReply), so no code changes were required. Kept as a separate commit so it can be reviewed/reverted independently of the minor/patch batch.

Held back on purpose

Package	Latest	Kept at	Why
tsdown	0.22.4	0.22.2 (commit 19a7b7b)	tsdown 0.22.4 narrows its Node support to ^22.18.0 || >=24.11.0, dropping Node 24.0–24.10, whereas this package advertises engines.node: >=22.18.0. It is a build-only devDependency with no engine-strict, so it is only a warning — but holding at 0.22.2 (^22.18.0 || >=24.0.0) avoids narrowing the build toolchain's Node support surface for a negligible gain. (Addresses reviewer feedback on the initial push.)
typescript	7.0.2	6.0.3	Evaluated locally — build + full test suite pass, but the build toolchain warns: "TypeScript 7.0 does not yet have a stable API and is experimental. Some options will be unavailable." The dependency is also exact-pinned (no caret), signalling deliberate version control. Best handled in its own PR once TS 7 stabilizes.

Some even-newer releases were intentionally held back by the repo's minimumReleaseAge (7-day) policy in pnpm-workspace.yaml — expected supply-chain hygiene, not an error. (This same strict gate accepted tsdown 0.22.4 as ≥7 days old, so the lockfile is valid for --frozen-lockfile installs — CI's build jobs on Node 22/24/26 confirm this.)

Verification

Verified with the CI-equivalent commands (pnpm build + pnpm test:ci) after each change:

• Build: Passed
• Lint (Biome) + tests (Vitest w/ coverage): Passed
• 473 tests passing across 43 test files
• Coverage unchanged: 100% lines / 100% functions, 99.91% statements, 97.69% branches

---

Automated by the project-maintenance skill.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	tsx@​4.23.0
	@​scalar/​api-reference@​1.62.5
	@​swc/​core@​1.15.43
	@​fastify/​helmet@​13.1.0
	hookified@​3.0.1
	@​fastify/​swagger@​9.8.0
	@​fastify/​rate-limit@​11.1.0
	@​fastify/​cookie@​11.1.1
	@​fastify/​swagger-ui@​6.1.0
	fastify@​5.10.0
	@​fastify/​static@​10.1.0
	@​biomejs/​biome@​2.5.3

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: npm @emnapi/runtime is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: pnpm-lock.yaml → npm/tsdown@0.22.2 → npm/@emnapi/runtime@1.11.1 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@emnapi/runtime@1.11.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm @internationalized/date is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: pnpm-lock.yaml → npm/@scalar/api-reference@1.62.5 → npm/@internationalized/date@3.12.2 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@internationalized/date@3.12.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

[gemini-code-assist]

Code Review

This pull request updates several dependencies and devDependencies in package.json, including @biomejs/biome, @swc/core, tsdown, tsx, various @fastify ecosystem packages, @scalar/api-reference, fastify, hookified, and pino-pretty to their newer versions. There are no review comments, and I have no additional feedback to provide.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (a3543b0) to head (19a7b7b).

Additional details and impacted files

@@            Coverage Diff            @@
##              main      #173   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files           41        41           
  Lines         1310      1310           
  Branches       259       261    +2     
=========================================
  Hits          1310      1310           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: c15098773d

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Keep tsdown behind the release-age gate

This repo explicitly sets minimumReleaseAge: 10080 and minimumReleaseAgeStrict: true in pnpm-workspace.yaml, and pnpm 11 re-applies that supply-chain gate during installs. tsdown@0.22.4 was published only hours before this update, so a fresh install with the configured package manager can reject the lockfile or bypass the repo's 7-day maturity policy until the version ages; keep a mature 0.22.x version or add a deliberate exemption if this release must be used immediately.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Align the Node engine with tsdown

When users build or publish on Node 24.0 through 24.10, this package still advertises support via engines.node: >=22.18.0, but tsdown@0.22.4 declares support only for ^22.18.0 || >=24.11.0. That makes the build/prepublishOnly toolchain unsupported or rejected under engine-strict installs for a Node range the package claims is valid; either keep a tsdown version that supports all allowed Node 24 releases or tighten this package's engine range.

Useful? React with 👍 / 👎.