[dependabot]

Bumps the production-patches group with 2 updates: bullmq and fastify.

Updates bullmq from 6.3.2 to 6.3.7

Release notes

Sourced from bullmq's releases.

v6.3.7

6.3.7 (2026-09-18)

Bug Fixes

• deduplication: remove deduplication key if job key does not longer exist (python) (elixir) (php) (rust) (dotnet) (#4768) (75bb3a0)

v6.3.6

6.3.6 (2026-09-14)

Bug Fixes

• bun: allow nested duplicate() on lazy Bun adapter (#4723) (438a1d8)

v6.3.5

6.3.5 (2026-09-14)

Bug Fixes

• deps: update dependency cron-parser to v5.10.1 (#4738) (d4b0414)

v6.3.4

6.3.4 (2026-09-01)

Bug Fixes

• deps: update rust crate croner to v4 [security] (#4666) (fd33926)

v6.3.3

6.3.3 (2026-08-31)

Bug Fixes

• bun: duplicate() and reconnect target the correct server (#4591) (e9b5679)
• worker: keep blocking client alive when parked in reconnecting (#4586) (8fd4850)

Commits

• 75bb3a0 fix(deduplication): remove deduplication key if job key does not longer exist...
• 4350843 chore(deps): update dependency virtualenv to v21.7.13 [python] (#4773)
• e2bb352 chore(deps): lock file maintenance [rust] (#4772)
• 6d73cf2 chore(deps): update dependency virtualenv to v21.7.12 [python] (#4770)
• 83fc3cf chore(deps): update dependency prettier to v3.9.8 [security] (#4769)
• 2aa4c39 chore(deps): lock file maintenance [rust] (#4764)
• 0813962 chore(deps): update dependency prettier to v3.9.7 [security] (#4766)
• cc3d1f8 chore(deps): update security dev patches [security] (#4758)
• 440c93c chore(deps): update dependency virtualenv to v21.7.10 [python] (#4759)
• 2843dc6 chore(deps): update dependency moment to v2.31.0 [security] (#4752)
• Additional commits viewable in compare view

Updates fastify from 5.12.1 to 5.12.5

Release notes

Sourced from fastify's releases.

v5.12.5

⚠️ Security release

• Fix for GHSA-4mh8-r7rc-xpvc

What's Changed

• [Backport 5.x] perf: reduce content-type parser overhead by @​github-actions[bot] in fastify/fastify#7019
• [Backport 5.x] perf: avoid redundant request-part reads during validation by @​github-actions[bot] in fastify/fastify#7020

Full Changelog: fastify/fastify@v5.12.4...v5.12.5

v5.12.4

Fixed the fastify.js version mismatch.

Full Changelog: fastify/fastify@v5.12.2...v5.12.4

v5.12.2

⚠️ Security release

• Fix for GHSA-9q9j-q6p8-xq58
• Fix for GHSA-hwr6-493r-vm6h
• Fix for GHSA-p68q-wchp-6fh7
• Fix for GHSA-667r-xxjv-c9mm

What's Changed

• [Backport 5.x] fix: callNotFound should run not-found preHandler regardless of registration order by @​github-actions[bot] in fastify/fastify#6973
• [Backport 5.x] chore: npm ignore remaining agent files by @​github-actions[bot] in fastify/fastify#7003

Full Changelog: fastify/fastify@v5.12.1...v5.12.2

Commits

• ba235fd Bumped v5.12.5
• ad06a4c Merge commit from fork
• 7af0d77 [Backport 5.x] perf: avoid redundant request-part reads during validation (#7...
• 990ebef [Backport 5.x] perf: reduce content-type parser overhead (#7019)
• 1690e35 Bumped v5.12.4
• 1c991c4 Bumped v5.12.3
• 942a2be Bumped v5.12.2
• 853f6e2 test(validation): cover normalization and async branches
• f02d8d4 fix(validation): do not unwrap async validator results
• 93c239a fix: reject malformed URLs before custom 404 handlers
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.