chore(deps): bump fastify from 5.11.0 to 5.12.1 in /server

[dependabot]

Bumps fastify from 5.11.0 to 5.12.1.

Release notes

Sourced from fastify's releases.

v5.12.1

⚠️ Security release

• Fix for GHSA-w2qp-rph6-63g4
• Fix for GHSA-3m5p-2c4r-xxw2

What's Changed

• [Backport 5.x] test: fix reply.mediaType by @​github-actions[bot] in fastify/fastify#6950
• [Backport 5.x] ci: allow backport in pr title by @​github-actions[bot] in fastify/fastify#6952
• [Backport 5.x] fix: run preClose hook exactly once per declaring instance by @​github-actions[bot] in fastify/fastify#6954
• [Backport 5.x] fix: report canonical route url for hidden prefix slash route by @​github-actions[bot] in fastify/fastify#6961

Full Changelog: fastify/fastify@v5.12.0...v5.12.1

v5.12.0

What's Changed

• chore(sponsor): add testmu ai by @​Eomm in fastify/fastify#6922
• docs: add per-route logging for Google Cloud Functions by @​slegarraga in fastify/fastify#6907
• test: remove @​sinonjs/fake-timers by @​climba03003 in fastify/fastify#6934
• [Backport 5.x] fix: remove raw response headers by @​github-actions[bot] in fastify/fastify#6939
• [Backport 5.x] test: use process-warning spyWarning for testing by @​github-actions[bot] in fastify/fastify#6945
• [Backport 5.x] feat: add Reply.prototype.mediaType by @​github-actions[bot] in fastify/fastify#6946
• [Backport 5.x] fix(content-type): return undefined for invalid media types by @​github-actions[bot] in fastify/fastify#6947

Full Changelog: fastify/fastify@v5.11.3...v5.12.0

v5.11.3

What's Changed

• fix: clear trailer state when removing all trailers by @​Ram-blip in fastify/fastify#6845
• docs: document percent-decoded route params as untrusted input by @​mcollina in fastify/fastify#6903
• docs(errors): document what the default error handler sends by @​basteez in fastify/fastify#6894
• docs(readme): fix grammar and cjs capitalization by @​minirang in fastify/fastify#6899
• fix: pass null instead of undefined to requestCompleted on success by @​lazerg in fastify/fastify#6837
• docs(encapsulation): clarify nested plugin scopes by @​jean-michelet in fastify/fastify#6893
• chore: Bump fastify/workflows/.github/workflows/lock-threads.yml from 6.0.0 to 7.0.0 by @​dependabot[bot] in fastify/fastify#6916
• chore: Bump fastify/workflows/.github/workflows/nested-quality.yml from 6.0.0 to 7.0.0 by @​dependabot[bot] in fastify/fastify#6917
• fix: recognize constructor-assigned built-in properties as decorator … by @​aquie00t in fastify/fastify#6892
• fix: reset lastIndex before testing global/sticky content-type RegExp parsers by @​zelinewang in fastify/fastify#6846

New Contributors

• @​minirang made their first contribution in fastify/fastify#6899
• @​lazerg made their first contribution in fastify/fastify#6837
• @​zelinewang made their first contribution in fastify/fastify#6846

Full Changelog: fastify/fastify@v5.11.2...v5.11.3

v5.11.2

What's Changed

... (truncated)

Commits

• 7d196a9 Bumped v5.12.1
• 1ef8a60 fix(validation): preserve coerced root values
• 8acfea7 fix: disable numeric trustProxy hop-count trust
• 268e439 fix: report canonical route url for hidden prefix slash route (#6719) (#6961)
• b3b8be1 fix: run preClose hook exactly once per declaring instance (#6940) (#6954)
• 4708a98 ci: allow backport in pr title (#6948) (#6952)
• 65d12da test: fix reply.mediaType (#6949) (#6950)
• 27d1fec Bumped v5.12.0
• 430dd4e fix(content-type): return undefined for invalid media types (#6942) (#6947)
• fd5fe53 feat: add Reply.prototype.mediaType (#6932) (#6946)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[thewrz]

This was written agentically; verify its assertions:

Closing as superseded by #153 (merged as 4bc264f), which landed this bump together with every other open advisory fix. The per-package PRs could not merge individually: branch protection requires the audit check green and an up-to-date branch, and each bot PR inherited the red audit from the advisories the others fixed. #153 resolves all of them in one step (npm audit --audit-level=high → 0 vulnerabilities on main).

🤖 Co-authored by Claude Fable 5.1.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.