Bump the npm-production group across 1 directory with 22 updates

[dependabot]

Bumps the npm-production group with 22 updates in the / directory:

Package	From	To
react	19.2.7	19.2.8
react-dom	19.2.7	19.2.8
@codemirror/commands	6.10.4	6.11.0
@codemirror/lang-markdown	6.5.1	6.5.2
@codemirror/search	6.7.1	6.7.2
@codemirror/state	6.7.1	6.7.4
@codemirror/view	6.43.7	6.43.11
@tanstack/react-virtual	3.14.9	3.14.11
@noble/hashes	2.2.0	2.4.0
@fastify/formbody	8.0.2	9.0.0
@fastify/helmet	13.1.0	13.1.1
@fastify/rate-limit	11.1.0	11.2.0
@modelcontextprotocol/sdk	1.29.0	1.30.0
fastify	5.12.1	5.12.3
pg	8.22.0	8.23.0
zod	4.4.3	4.5.4
@fastify/static	10.1.2	10.1.3
@node-rs/argon2	2.0.2	2.2.0
fastify-raw-body	5.0.0	6.0.1
google-auth-library	10.9.0	11.0.2
svix	1.99.1	2.3.0
ws	8.21.1	8.21.3

Updates react from 19.2.7 to 19.2.8

Release notes

Sourced from react's releases.

19.2.8 (July 21st, 2026)

React Server Components

• Performance improvements when decoding (#37087 by @​eps1lon)

Changelog

Sourced from react's changelog.

19.3.0 (September 9, 2026)

New React Features

• <ViewTransition />: Adds <ViewTransition /> and addTransitionType APIs to power View Transition animations in React (@​sebmarkbage, @​jackpope, @​gaearon: #31975, #31987, #31996, #31999, #32001, #32002, #32028, #32029, #32031, #32034, #32038, #32041, #32050, #32090, #32105, #32254, #32379, #32422, #32462, #32540, #32545, #32585, #32599, #32611, #32612, #32617, #32651, #32653, #32656, #32664, #32699, #32723, #32734, #32751, #32752, #32760, #32761, #32764, #32772, #32790, #32819, #32820, #32822, #32833, #32849, #33094, #33191, #33200, #33206, #33293, #33330, #33331, #33332, #33357, #33362, #33433, #33576, #34374, #34450, #34481, #34500, #34502, #34510, #34511, #34539, #35567, #35564, #35485, #35380, #35063, #35060, #34676, #36917, #35337, #35520)
• Fragment Refs: Add Refs to <Fragment /> to support composable platform behavior (@​jackpope, @​sebmarkbage, @​eps1lon, @​Dhakshin2007, @​chirokas, @​teamleaderleo, @​fallintoplace: #32465, #32613, #32619, #32654, #32660, #32682, #32722, #32813, #32814, #33056, #33058, #33093, #34069, #34103, #34544, #34545, #37062, #37061, #37060, #36047, #36010, #35642, #35641, #35637, #35630, #34935, #37457, #37408, #37326, #37251, #37171, #37169, #37168, #37167, #37166, #37165, #37164, #37163, #37162, #37161, #37160, #37125, #37063)

New React DOM Features

• browser(): a new react-dom API that returns a usable which errors during server rendering and resolves in the browser. use(browser()) inside a <Suspense> boundary marks a subtree as browser-only without reporting a recoverable error (@​gnoff: #37143, #37241)
  • Added an onBrowserBailout option to the react-dom/server APIs to observe when a subtree defers to the browser (@​gnoff #37193)

Notable changes

• Enable Trusted Types API integration (@​rickhanlonii #35816)
• Transitions now render independently instead of being entangled into a single render, so a slow transition no longer holds up unrelated ones (@​acdlite #37290)
• Added a DEV-only warning when a component appears to have been unblocked by calling use() conditionally (@​hoxyq, @​eps1lon: #37104, #37203, #37491)

All Changes

React

• Fast Refresh Fixes
  • Fix Fast Refresh to find and remount edits to components wrapped behind lazy() (@​sophiebits #36965)
  • Fix Fast Refresh so edits to a memo() comparison function take effect (@​sophiebits #36964)
  • Fix Fast Refresh crash when an edit changes the kind of a component's type (@​sophiebits #36963)
  • Unify hot reload type resolution for Fast Refresh (@​sophiebits #36962)
  • Fix Fast Refresh to remount correctly when an edit changes the component kind (@​sophiebits #36950)
  • Double invoke effects in StrictMode after Fast Refresh (@​eps1lon #35962)
• Performance Track Fixes
  • Prevent crash when accessing $$typeof in Performance Tracks (@​eps1lon #35679)
  • Handle non-string function names in Performance Tracks (@​eps1lon #35659)
  • Use minus (-) instead of en dash for removed props in Performance Tracks (@​eps1lon #35649)
  • Handle arrays with bigints in deep objects in Performance Tracks (@​eps1lon #35648)
  • Don't enumerate typed array props in Performance Tracks in DEV (@​UditDewan #36913)
  • Bail out of diffing wide objects and arrays in Performance Tracks (@​eps1lon #34742)
  • Clear potentially large performance measures in DEV (@​hoxyq #34803)
  • Fix missing else branch for renders with no props change in Performance Tracks (@​hoxyq #34837)
• Activity Fixes
  • Fix useSyncExternalStore missing store mutations that happened while an Activity tree was hidden (@​sophiebits #36947)
  • Hide portal contents when an Activity is hidden (@​acdlite #35091)
  • Prevent metadata hoisting in hidden <Activity> trees (@​ronnakamoto #34983)
  • Prevent errors thrown inside a hidden Activity from escaping to the visible UI (@​acdlite #35074)
  • Don't unhide a node if a direct parent Offscreen is still hidden (@​sebmarkbage #34821)
  • Don't show internal <Offscreen> component in error messages (@​rickhanlonii #35763)
• Warn in DEV when a component appears to have been unblocked by a conditional use() (@​hoxyq, @​eps1lon: #37104, #37203, #37491)
• Render transitions independently instead of entangling them into a single render (@​acdlite #37290)
• Fix hang when updating a dehydrated boundary inside a hidden tree (@​gaearon #37135)
• Don't reacquire Host Singletons during dev effect validation (@​gnoff #37113)
• Only remove properties from Host Singletons on release (@​gnoff #37112)

... (truncated)

Commits

• 1dd4ecb [FlightReply] Performance improvements when decoding (#37087)
• b0d2fdb [19.2.x] Update required references to GitHub repo (#36753)
• See full diff in compare view

Updates react-dom from 19.2.7 to 19.2.8

Release notes

Sourced from react-dom's releases.

19.2.8 (July 21st, 2026)

React Server Components

• Performance improvements when decoding (#37087 by @​eps1lon)

Changelog

Sourced from react-dom's changelog.

19.3.0 (September 9, 2026)

New React Features

• <ViewTransition />: Adds <ViewTransition /> and addTransitionType APIs to power View Transition animations in React (@​sebmarkbage, @​jackpope, @​gaearon: #31975, #31987, #31996, #31999, #32001, #32002, #32028, #32029, #32031, #32034, #32038, #32041, #32050, #32090, #32105, #32254, #32379, #32422, #32462, #32540, #32545, #32585, #32599, #32611, #32612, #32617, #32651, #32653, #32656, #32664, #32699, #32723, #32734, #32751, #32752, #32760, #32761, #32764, #32772, #32790, #32819, #32820, #32822, #32833, #32849, #33094, #33191, #33200, #33206, #33293, #33330, #33331, #33332, #33357, #33362, #33433, #33576, #34374, #34450, #34481, #34500, #34502, #34510, #34511, #34539, #35567, #35564, #35485, #35380, #35063, #35060, #34676, #36917, #35337, #35520)
• Fragment Refs: Add Refs to <Fragment /> to support composable platform behavior (@​jackpope, @​sebmarkbage, @​eps1lon, @​Dhakshin2007, @​chirokas, @​teamleaderleo, @​fallintoplace: #32465, #32613, #32619, #32654, #32660, #32682, #32722, #32813, #32814, #33056, #33058, #33093, #34069, #34103, #34544, #34545, #37062, #37061, #37060, #36047, #36010, #35642, #35641, #35637, #35630, #34935, #37457, #37408, #37326, #37251, #37171, #37169, #37168, #37167, #37166, #37165, #37164, #37163, #37162, #37161, #37160, #37125, #37063)

New React DOM Features

• browser(): a new react-dom API that returns a usable which errors during server rendering and resolves in the browser. use(browser()) inside a <Suspense> boundary marks a subtree as browser-only without reporting a recoverable error (@​gnoff: #37143, #37241)
  • Added an onBrowserBailout option to the react-dom/server APIs to observe when a subtree defers to the browser (@​gnoff #37193)

Notable changes

• Enable Trusted Types API integration (@​rickhanlonii #35816)
• Transitions now render independently instead of being entangled into a single render, so a slow transition no longer holds up unrelated ones (@​acdlite #37290)
• Added a DEV-only warning when a component appears to have been unblocked by calling use() conditionally (@​hoxyq, @​eps1lon: #37104, #37203, #37491)

All Changes

React

• Fast Refresh Fixes
  • Fix Fast Refresh to find and remount edits to components wrapped behind lazy() (@​sophiebits #36965)
  • Fix Fast Refresh so edits to a memo() comparison function take effect (@​sophiebits #36964)
  • Fix Fast Refresh crash when an edit changes the kind of a component's type (@​sophiebits #36963)
  • Unify hot reload type resolution for Fast Refresh (@​sophiebits #36962)
  • Fix Fast Refresh to remount correctly when an edit changes the component kind (@​sophiebits #36950)
  • Double invoke effects in StrictMode after Fast Refresh (@​eps1lon #35962)
• Performance Track Fixes
  • Prevent crash when accessing $$typeof in Performance Tracks (@​eps1lon #35679)
  • Handle non-string function names in Performance Tracks (@​eps1lon #35659)
  • Use minus (-) instead of en dash for removed props in Performance Tracks (@​eps1lon #35649)
  • Handle arrays with bigints in deep objects in Performance Tracks (@​eps1lon #35648)
  • Don't enumerate typed array props in Performance Tracks in DEV (@​UditDewan #36913)
  • Bail out of diffing wide objects and arrays in Performance Tracks (@​eps1lon #34742)
  • Clear potentially large performance measures in DEV (@​hoxyq #34803)
  • Fix missing else branch for renders with no props change in Performance Tracks (@​hoxyq #34837)
• Activity Fixes
  • Fix useSyncExternalStore missing store mutations that happened while an Activity tree was hidden (@​sophiebits #36947)
  • Hide portal contents when an Activity is hidden (@​acdlite #35091)
  • Prevent metadata hoisting in hidden <Activity> trees (@​ronnakamoto #34983)
  • Prevent errors thrown inside a hidden Activity from escaping to the visible UI (@​acdlite #35074)
  • Don't unhide a node if a direct parent Offscreen is still hidden (@​sebmarkbage #34821)
  • Don't show internal <Offscreen> component in error messages (@​rickhanlonii #35763)
• Warn in DEV when a component appears to have been unblocked by a conditional use() (@​hoxyq, @​eps1lon: #37104, #37203, #37491)
• Render transitions independently instead of entangling them into a single render (@​acdlite #37290)
• Fix hang when updating a dehydrated boundary inside a hidden tree (@​gaearon #37135)
• Don't reacquire Host Singletons during dev effect validation (@​gnoff #37113)
• Only remove properties from Host Singletons on release (@​gnoff #37112)

... (truncated)

Commits

• 1dd4ecb [FlightReply] Performance improvements when decoding (#37087)
• b0d2fdb [19.2.x] Update required references to GitHub repo (#36753)
• See full diff in compare view

Updates @codemirror/commands from 6.10.4 to 6.11.0

Commits

• See full diff in compare view

Updates @codemirror/lang-markdown from 6.5.1 to 6.5.2

Commits

• See full diff in compare view

Updates @codemirror/search from 6.7.1 to 6.7.2

Commits

• See full diff in compare view

Updates @codemirror/state from 6.7.1 to 6.7.4

Commits

• See full diff in compare view

Updates @codemirror/view from 6.43.7 to 6.43.11

Commits

• See full diff in compare view

Updates @tanstack/react-virtual from 3.14.9 to 3.14.11

Release notes

Sourced from @​tanstack/react-virtual's releases.

@​tanstack/react-virtual@​3.14.11

Patch Changes

• Updated dependencies [4a0adf3]:
  • @​tanstack/virtual-core@​3.17.9

@​tanstack/react-virtual@​3.14.10

Patch Changes

• Updated dependencies [a0a411e, d2cf98b]:
  • @​tanstack/virtual-core@​3.17.8

Changelog

Sourced from @​tanstack/react-virtual's changelog.

3.14.11

Patch Changes

• Updated dependencies [4a0adf3]:
  • @​tanstack/virtual-core@​3.17.9

3.14.10

Patch Changes

• Updated dependencies [a0a411e, d2cf98b]:
  • @​tanstack/virtual-core@​3.17.8

Commits

• 171029d ci: Version Packages (#1269)
• 4a0adf3 fix(virtual-core): re-issue clamped end-anchor compensation once the sizer gr...
• e9874f0 ci: Version Packages (#1247)
• See full diff in compare view

Updates @noble/hashes from 2.2.0 to 2.4.0

Release notes

Sourced from @​noble/hashes's releases.

2.4.0

Security and correctness

• Protect passed options against mutation / pollution
• keccakprg: fail until entropy is added
• webcrypto: reject output sizes which crashed engine
• blake3: fix tree merging for multi-terabyte streams
• Improve zeroization

Misc

• Speed-up Argon2 by 20%
• Argon2 cost options are now optional. The defaults are t: 3, m: 1024 ** 2 KiB (1 GiB), p: 1, dkLen: 32, and a 1 GiB maxmem limit; larger-memory calls must set maxmem explicitly.
• Corrected scrypt's default maxmem to work for N: 2 ** 20, r: 8, and p: 1
• nextTick and asyncLoop now yield through scheduler.yield() when available or setTimeout otherwise, allowing timers, I/O, and rendering to progress. They also accept optional rejection cleanup; async Argon2, PBKDF2, and scrypt use it to wipe work state if scheduling is aborted.

Full Changelog: paulmillr/noble-hashes@2.3.0...2.4.0

2.3.0

Improve speed:

• +10-45% 32b inputs across all hashes
• +40% SHA-3 / SHAKE, +50% 1mb KT128 / KT256 / TurboSHAKE, +20% kmac
• 2.2x argon
• +20% pbkdf2 and hkdf

Other changes:

• Better error messages and stricter type checks everywhere
• Bugfix: HMAC _cloneInto now preserves canXOF (#134, ChALkeR); Argon2d typo rename (#135).
• blake2.compress renamed to _compress (marked internal).
• Reduce on-disk unpacked size 869kb → 665kb (-204kb) by disabling source maps (they became less relevant).

Full Changelog: paulmillr/noble-hashes@2.2.0...2.3.0

Changelog

Sourced from @​noble/hashes's changelog.

2.4.0 (2026-08-27)

Security and correctness

• Protect passed options against mutation / pollution
• keccakprg: fail until entropy is added
• webcrypto: reject output sizes which crashed engine
• blake3: fix tree merging for multi-terabyte streams
• Improve zeroization

Misc

• Speed-up Argon2 by 20%
• Argon2 cost options are now optional. The defaults are t: 3, m: 1024 ** 2 KiB (1 GiB), p: 1, dkLen: 32, and a 1 GiB maxmem limit; larger-memory calls must set maxmem explicitly.
• Corrected scrypt's default maxmem to work for N: 2 ** 20, r: 8, and p: 1
• nextTick and asyncLoop now yield through scheduler.yield() when available or setTimeout otherwise, allowing timers, I/O, and rendering to progress. They also accept optional rejection cleanup; async Argon2, PBKDF2, and scrypt use it to wipe work state if scheduling is aborted.

2.3.0 (2026-08-06)

Performance

• Improved 32-byte input performance across all hashes by 10–45%.
• Improved SHA-3 and SHAKE by 40%, one-megabyte KangarooTwelve, MarsupilamiFourteen, and TurboSHAKE by 50%, and KMAC by 20%.
• Improved Argon2 performance by 2.2×.
• Improved PBKDF2 and HKDF performance by 20%.

Other changes

• Added better error messages and stricter type checks throughout the package.
• Fixed HMAC._cloneInto so it preserves canXOF in issue #134, reported by @​ChALkeR, and corrected an Argon2d typo in issue #135.
• Renamed blake2.compress to the internal _compress method.
• Reduced unpacked on-disk size from 869 KB to 665 KB by disabling less-relevant source maps.

Commits

• 663c2ae Release 2.4.0.
• a6f7519 Add changelog
• 1bbc433 webcrypto: snapshot opts
• 5bd2e15 Remove unused files
• a3bc7ff Bump vectors
• fcb6cb6 README
• 64f3033 readme
• 9ac6165 Bump ci workflows
• 6587b51 Fix test on bun
• 91ecf91 Fix tests
• Additional commits viewable in compare view

Updates @fastify/formbody from 8.0.2 to 9.0.0

Release notes

Sourced from @​fastify/formbody's releases.

v9.0.0

What's Changed

• build(dependabot): reduce npm updates to monthly by @​Fdawgs in fastify/fastify-formbody#172
• chore: rename master to main by @​Fdawgs in fastify/fastify-formbody#173
• ci(ci): set job permissions by @​Fdawgs in fastify/fastify-formbody#174
• ci: set permissions at workflow level by @​Fdawgs in fastify/fastify-formbody#175
• ci: restore job level permissions by @​Fdawgs in fastify/fastify-formbody#176
• build(deps-dev): bump tsd from 0.31.2 to 0.32.0 by @​dependabot[bot] in fastify/fastify-formbody#177
• chore(license): update date ranges; standardise style by @​Fdawgs in fastify/fastify-formbody#178
• build(deps-dev): bump @​types/node from 22.15.34 to 24.0.8 by @​dependabot[bot] in fastify/fastify-formbody#179
• build(deps-dev): bump tsd from 0.32.0 to 0.33.0 by @​dependabot[bot] in fastify/fastify-formbody#180
• chore(.npmrc): ignore scripts by @​Fdawgs in fastify/fastify-formbody#181
• build(deps-dev): remove @​fastify/pre-commit by @​Fdawgs in fastify/fastify-formbody#182
• ci(ci): add concurrency config by @​Fdawgs in fastify/fastify-formbody#183
• build(deps-dev): bump @​types/node from 24.10.4 to 25.0.3 by @​dependabot[bot] in fastify/fastify-formbody#184
• ci: remove stale.yml by @​Tony133 in fastify/fastify-formbody#185
• chore(license): standardise license notice by @​Fdawgs in fastify/fastify-formbody#186
• build(deps-dev): bump c8 from 10.1.3 to 11.0.0 by @​dependabot[bot] in fastify/fastify-formbody#188
• build(deps-dev): bump neostandard from 0.12.2 to 0.13.0 by @​dependabot[bot] in fastify/fastify-formbody#190
• build(deps): bump fastify/workflows/.github/workflows/plugins-ci.yml from 5 to 6 by @​dependabot[bot] in fastify/fastify-formbody#191
• ci: add lock-threads workflow by @​Fdawgs in fastify/fastify-formbody#192
• refactor(types): migrate from tsd to tstyche and others updated by @​Tony133 in fastify/fastify-formbody#193
• chore: update depedabot setting by @​climba03003 in fastify/fastify-formbody#195
• chore: bump fastify-plugin from 5.1.0 to 6.0.0 in the dependencies group by @​dependabot[bot] in fastify/fastify-formbody#197
• chore(package.json): use https for repo url by @​Fdawgs in fastify/fastify-formbody#199
• chore: bump @​types/node from 25.9.4 to 26.0.1 in the dev-dependencies-typescript group by @​dependabot[bot] in fastify/fastify-formbody#200
• ci: pin actions to commit-hash by @​Fdawgs in fastify/fastify-formbody#201
• chore: bump c8 from 11.0.0 to 12.0.0 by @​dependabot[bot] in fastify/fastify-formbody#202
• chore(.npmrc): add min-release-age by @​Fdawgs in fastify/fastify-formbody#203

New Contributors

• @​Tony133 made their first contribution in fastify/fastify-formbody#185
• @​climba03003 made their first contribution in fastify/fastify-formbody#195

Full Changelog: fastify/fastify-formbody@v8.0.2...v9.0.0

Commits

• b65c99c Bumped v9.0.0
• 911d7dc chore(.npmrc): add min-release-age
• da419bd chore: bump c8 from 11.0.0 to 12.0.0 (#202)
• a6e08a5 ci: pin actions to commit-hash
• 09adf4d chore: bump @​types/node in the dev-dependencies-typescript group (#200)
• 591e569 chore(package.json): use https for repo url
• 6dc5d47 chore: bump fastify-plugin from 5.1.0 to 6.0.0 in the dependencies group (#197)
• 0452500 chore: update depedabot setting
• 83d0bc0 refactor(types): migrate from tsd to tstyche and others updated
• d4e232e ci: add lock-threads workflow (#192)
• Additional commits viewable in compare view

Updates @fastify/helmet from 13.1.0 to 13.1.1

Release notes

Sourced from @​fastify/helmet's releases.

v13.1.1

What's Changed

• test: fix CSP header order assertions for helmet@8.3.x by @​Tony133 in fastify/fastify-helmet#318
• ci: pin actions to commit-hash by @​Fdawgs in fastify/fastify-helmet#316
• chore: bump c8 from 11.0.0 to 12.0.0 by @​dependabot[bot] in fastify/fastify-helmet#317
• chore: bump fastify/workflows/.github/workflows/lock-threads.yml from 6.0.0 to 7.0.0 by @​dependabot[bot] in fastify/fastify-helmet#320
• chore: bump fastify/workflows/.github/workflows/plugins-ci.yml from 6.0.0 to 7.0.0 by @​dependabot[bot] in fastify/fastify-helmet#321
• chore(.npmrc): add min-release-age by @​Fdawgs in fastify/fastify-helmet#319

Full Changelog: fastify/fastify-helmet@v13.1.0...v13.1.1

Commits

• 8854d49 Bumped v13.1.1
• c4bbcb2 chore(.npmrc): add min-release-age (#319)
• 8406fa8 chore: bump fastify/workflows/.github/workflows/plugins-ci.yml (#321)
• d8da457 chore: bump fastify/workflows/.github/workflows/lock-threads.yml (#320)
• 655cd3a chore: bump c8 from 11.0.0 to 12.0.0 (#317)
• 928d9b5 ci: pin actions to commit-hash
• 7c9cda3 test: fix CSP header order assertions for helmet@8.3.x
• See full diff in compare view

Maintainer changes

This version was pushed to npm by tony133, a new releaser for @​fastify/helmet since your current version.

Updates @fastify/rate-limit from 11.1.0 to 11.2.0

Release notes

Sourced from @​fastify/rate-limit's releases.

v11.2.0

⚠️ Security Release

• Fix for