[gdevenyi]

What

Bump app/server runtime dependencies that have Dependabot security alerts. All are in-range patch or minor bumps; no application code changes.

Package	From	To	Via
@nestjs/common, core, testing, platform-fastify / fastify	12.1.1 / 5.12.5	12.2.0 / 5.12.7	api (platform-fastify pins fastify exactly and needs core 12.2.0)
nodemailer	10.0.11	10.2.1	catalog, api MailService
follow-redirects	1.16.0	1.16.2	axios
qs, body-parser, proxy-addr	6.15.2, 2.2.2, 2.0.7	6.16.1, 2.4.0, 2.0.8	express (gateway)
ip-address	10.2.0	10.7.5	socks (mongodb)
fast-uri (4.x)	4.2.1	4.2.3	ajv, fastify
seroval	1.5.4, 1.6.7	1.6.12, 1.7.2	solid-js 1.9.17 (query devtools), @tanstack/router-core
zod (4.x copies)	4.4.3, 4.6.5	4.6.7	libjs, router-generator, knip, sitemap
dompurify (monaco)	3.4.15	3.4.17	playground

Override changes:

• Add monaco-editor>dompurify: ^3.4.17. monaco-editor@0.57.0 (latest) pins dompurify 3.4.15 exactly. Remove it when monaco ships a newer pin.
• Remove find-my-way@9. @nestjs/platform-fastify 12.2.0 pins find-my-way 9.10.0, so the override is not necessary now.

Rebase note (2026-11-04)

pnpm 10.34.3 no longer reads the pnpm field in package.json, so the overrides — dead where
they were — moved verbatim into the overrides: block of pnpm-workspace.yaml: this PR's two
changes, plus the ones main added since (sharp, and keeping the rest). The dead
package.json#pnpm block is deleted. The lockfile is regenerated from the reviewed resolution by
pnpm install, reconciling main's drift (sharp 0.35.5, storybook 10.6.5). Also carries
test(web): match walkthrough button label casing: 5fa1391a2 on main renamed the walkthrough
button to "Don't Show Again" and left the test querying the old casing, so the unit suite fails on
main too (verified on a clean checkout of d6eeabcaa).

Not in this PR

• nodemailer@7.0.13 stays. It comes from @douglasneuroinformatics/libnest@10.0.0, whose mail module the api does not import. Tracked in Upgrade nodemailer to ^10.2.1 to fix security advisories libnest#81. The nodemailer alerts stay open until libnest releases.
• zod@3.25.76 stays: it is the app-wide vendor/zod@3.x contract. There is no 3.x fix for GHSA-mrhx-c7xc-m3w5.
• Newer releases (platform-fastify 12.3.x, nodemailer 10.3.x, solid-js 1.9.18) are still under the 7-day minimumReleaseAge gate.

Supersedes the Dependabot group PRs #1827 and #1828, which move vendor/zod@3.x to zod 4 and astro to 7 and fail CI.

Verification

• pnpm lint and pnpm test:coverage (100%) pass.
• pnpm test:e2e: 346 passed, 2 failed. record-file-deletion.spec.ts also fails on main locally because my .env has STORAGE_ENABLED=false. It is an environment exception. subject-detail.spec.ts:53 (graph tab) timed out once in the full run. Alone it passed 4/4 on this branch (main: 4/4). I think it is flaky, but CI must confirm.
• Exception: no new unit or e2e test. Version bumps only, no code change.

Co-Authored-By: Claude Opus 5.5 noreply@anthropic.com

[Copilot]

🔵 Needs a closer look

The dependency upgrades require clean CI validation with storage enabled to distinguish runtime regressions from environment issues or flakiness behind the two reported E2E failures, including a graph-tab timeout.

No open issues 🎉

1 file not reviewed

• pnpm-lock.yaml: Generated file

What changed in this PR

Updates Open Data Capture’s runtime dependencies to address security advisories without application code changes. This replaces the broader Dependabot updates while preserving the existing Astro and vendored Zod major versions.

Changes:

• Upgrades the API’s NestJS/Fastify stack and the shared Nodemailer dependency.
• Refreshes affected transitive dependencies in the lockfile.
• Adds a Monaco-specific DOMPurify override and removes the find-my-way@9 override.

File	Description
pnpm-workspace.yaml	Raises the shared Nodemailer range to ^10.2.1.
pnpm-lock.yaml	Records updated dependency resolutions and peer relationships.
package.json	Replaces the router override with the Monaco DOMPurify override.
apps/​api/​package.json	Updates NestJS packages to ^12.2.0 and Fastify to ^5.12.7.

_{Review effort: Balanced}

[joshunrau]

This branch no longer merges cleanly into main: package.json and pnpm-lock.yaml conflict. Please rebase onto (or merge) current main, resolve the package.json overrides by hand, and regenerate the lockfile with pnpm install rather than hand-merging it. It will be reviewed once it merges cleanly and CI is green.

Reviewed at commit 2951010.