chore(deps): bump @fastify/static from 9.1.3 to 10.1.2 in the npm_and_yarn group across 1 directory

[dependabot]

Bumps the npm_and_yarn group with 1 update in the / directory: @fastify/static.

Updates @fastify/static from 9.1.3 to 10.1.2

Release notes

Sourced from @​fastify/static's releases.

v10.1.2

⚠️ Security Release

• Fix for GHSA-8pvw-jcv7-9cmj

What's Changed

• ci: pin actions to commit-hash by @​Fdawgs in fastify/fastify-static#601

Full Changelog: fastify/fastify-static@v10.1.1...v10.1.2

v10.1.1

⚠️ Security Release

• Fix for GHSA-83w8-p2f5-377r

What's Changed

• docs(readme): fix typos by @​Fdawgs in fastify/fastify-static#600

Full Changelog: fastify/fastify-static@v10.1.0...v10.1.1

v10.1.0

What's Changed

• fix: set Vary: Accept-Encoding for preCompressed responses by @​LeSingh1 in fastify/fastify-static#586
• feat: use @fastify/error for errors and add option suppressWarning by @​climba03003 in fastify/fastify-static#599

New Contributors

• @​LeSingh1 made their first contribution in fastify/fastify-static#586

Full Changelog: fastify/fastify-static@v10.0.0...v10.1.0

v10.0.0

Breaking Changes

• setHeaders now using FastifyReply instead of Response.

You should refactor your code to use the reply helpers. For example,

// Before
const fastify = require('fastify')({logger: true})
const path = require('node:path')
fastify.register(require('@​fastify/static'), {
root: path.join(__dirname, 'public'),
prefix: '/public/', // optional: default '/',
setHeaders(res) {
res.setHeader('X-Test', 'Foo')
}
})
</tr></table>

... (truncated)

Commits

• 7a9d1c6 Bumped v10.1.2
• 878c72e Merge commit from fork
• aee1c2c ci: pin actions to commit-hash (#601)
• 3733059 Bumped 10.1.1
• db4276f Merge commit from fork
• c68224e docs(readme): fix typos (#600)
• 36c939d Bumped v10.1.0
• 7c1121a feat: use @fastify/error for errors and add option suppressWarning (#599)
• c57d8bc fix: set Vary: Accept-Encoding for preCompressed responses (#586)
• babf6df Bumped v10.0.0
• Additional commits viewable in compare view

[claude]

LGTM — routine dependency bump.

Extended reasoning...

Overview

This is a Dependabot-generated PR bumping @fastify/swagger-ui from 5.2.6 to 6.1.1 (which transitively bumps @fastify/static from 9.1.3 to 10.1.2, plus minor bumps to content-disposition, fastify-plugin, brace-expansion, and minimatch). Only package.json and package-lock.json are touched — no application source code is modified.

Security risks

The bump includes fixes for two GHSA security advisories in @fastify/static (GHSA-8pvw-jcv7-9cmj and GHSA-83w8-p2f5-377r), so this is a net security improvement rather than a risk. No new attack surface is introduced.

Level of scrutiny

Low. This is a mechanical, tool-generated dependency bump with no logic changes. I checked whether the codebase directly depends on @fastify/static or uses the setHeaders option that changed signature in v10.0.0 (from raw Response to fastify's reply helper) — it does not. @fastify/static is only pulled in transitively via @fastify/swagger-ui, and the only usage of fastifySwaggerUi in src/app.ts passes just routePrefix, with no setHeaders override, so the breaking change does not affect this repo.

Other factors

No outstanding review comments on this PR, and no bugs were reported by the bug-hunting system. This is a low-risk, well-scoped dependency update appropriate for auto-approval.

[coveralls]

Coverage Report for CI Build 30798170529

Coverage decreased (-0.005%) to 80.361%

Details

• Coverage decreased (-0.005%) from the base build.
• Patch coverage: No coverable lines changed in this PR.
• No coverage regressions found.

Uncovered Changes

No uncovered changes found.

Coverage Regressions

No coverage regressions found.

---

Coverage Stats

Relevant Lines:	12638
Covered Lines:	10577
Line Coverage:	83.69%
Relevant Branches:	7485
Covered Branches:	5594
Branch Coverage:	74.74%
Branches in Coverage %:	Yes
Coverage Strength:	432.05 hits per line

---

💛 - Coveralls