[dependabot]

Bumps the production-patches group with 4 updates in the / directory: @fastify/basic-auth, @fastify/helmet, bullmq and fastify.

Updates @fastify/basic-auth from 6.3.0 to 6.3.1

Release notes

Sourced from @​fastify/basic-auth's releases.

v6.3.1

What's Changed

• ci: enable trusted publishing releases by @​Puppo in fastify/fastify-basic-auth#202

New Contributors

• @​Puppo made their first contribution in fastify/fastify-basic-auth#202

Full Changelog: fastify/fastify-basic-auth@v6.3.0...v6.3.1

Commits

• 1c34cd5 Bumped v6.3.1
• 3c2927c ci: enable trusted publishing releases
• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​fastify/basic-auth since your current version.

Updates @fastify/helmet from 13.1.1 to 13.1.2

Release notes

Sourced from @​fastify/helmet's releases.

v13.1.2

What's Changed

• ci: enable trusted publishing releases by @​Puppo in fastify/fastify-helmet#322

New Contributors

• @​Puppo made their first contribution in fastify/fastify-helmet#322

Full Changelog: fastify/fastify-helmet@v13.1.1...v13.1.2

Commits

• 6e3234f Bumped v13.1.2
• 4b0aac4 ci: enable trusted publishing releases
• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​fastify/helmet since your current version.

Updates bullmq from 6.3.2 to 6.3.12

Release notes

Sourced from bullmq's releases.

v6.3.12

6.3.12 (2026-10-09)

Bug Fixes

• postgres: inline SQL at build time to restore single-file bundler support (#4822) (c6bc9a4), closes #4603

v6.3.11

6.3.11 (2026-10-01)

Bug Fixes

• worker: detach stalled checker from telemetry context to prevent trace leak (#4812) fixes #4731 (01b8b14)

v6.3.10

6.3.10 (2026-09-29)

Bug Fixes

• worker: stop infinite connection-error retries during shutdown (#4833) (96e0a96)

v6.3.9

6.3.9 (2026-09-25)

Bug Fixes

• connection: infer backend-specific connection options instead of hiding mismatches with casts (#4796) (10dc93c)

v6.3.8

6.3.8 (2026-09-18)

Bug Fixes

• postgres: retry the LISTEN connection after a failed connect (#4781) (48a550b), closes #4729

v6.3.7

6.3.7 (2026-09-18)

Bug Fixes

• deduplication: remove deduplication key if job key does not longer exist (python) (elixir) (php) (rust) (dotnet) (#4768) (75bb3a0)

v6.3.6

6.3.6 (2026-09-14)

... (truncated)

Commits

• c6bc9a4 fix(postgres): inline SQL at build time to restore single-file bundler suppor...
• 9b7b293 chore(release): vex2.3.0 (#4900)
• 6dcd0fa chore(release): vpy3.3.2 (#4899)
• 4bb572c feat(connection): allow injecting redis username [elixir] (#4854)
• ab38089 fix(deps): accept a compatible redis-py range instead of an exact pin [python...
• f82ca81 chore(release): vrs1.3.5 (#4897)
• 0e07ef6 fix(deps): update security patches [rust] [security] (#4893)
• 71307f7 chore(deps): update security dev patches [security] (#4892)
• 1b8841a chore(release): vpy3.3.1 (#4895)
• b1d410e fix(lock-manager): renew locks with the atomic extendLocks script [python] (#...
• Additional commits viewable in compare view

Updates fastify from 5.12.1 to 5.12.5

Release notes

Sourced from fastify's releases.

v5.12.5

⚠️ Security release

• Fix for GHSA-4mh8-r7rc-xpvc

What's Changed

• [Backport 5.x] perf: reduce content-type parser overhead by @​github-actions[bot] in fastify/fastify#7019
• [Backport 5.x] perf: avoid redundant request-part reads during validation by @​github-actions[bot] in fastify/fastify#7020

Full Changelog: fastify/fastify@v5.12.4...v5.12.5

v5.12.4

Fixed the fastify.js version mismatch.

Full Changelog: fastify/fastify@v5.12.2...v5.12.4

v5.12.2

⚠️ Security release

• Fix for GHSA-9q9j-q6p8-xq58
• Fix for GHSA-hwr6-493r-vm6h
• Fix for GHSA-p68q-wchp-6fh7
• Fix for GHSA-667r-xxjv-c9mm

What's Changed

• [Backport 5.x] fix: callNotFound should run not-found preHandler regardless of registration order by @​github-actions[bot] in fastify/fastify#6973
• [Backport 5.x] chore: npm ignore remaining agent files by @​github-actions[bot] in fastify/fastify#7003

Full Changelog: fastify/fastify@v5.12.1...v5.12.2

Commits

• ba235fd Bumped v5.12.5
• ad06a4c Merge commit from fork
• 7af0d77 [Backport 5.x] perf: avoid redundant request-part reads during validation (#7...
• 990ebef [Backport 5.x] perf: reduce content-type parser overhead (#7019)
• 1690e35 Bumped v5.12.4
• 1c991c4 Bumped v5.12.3
• 942a2be Bumped v5.12.2
• 853f6e2 test(validation): cover normalization and async branches
• f02d8d4 fix(validation): do not unwrap async validator results
• 93c239a fix: reject malformed URLs before custom 404 handlers
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.