fix(deps): resolve all open npm audit high/moderate advisories

[thewrz]

This was written agentically; verify its assertions:

Why

main fails its own CI audit job (npm audit --audit-level=high). Branch protection requires that check plus an up-to-date branch, so none of the open per-package dependabot/renovate PRs can land alone: each one inherits the red audit from the advisories the others fix. One consolidated bump breaks the deadlock.

What

Bumps in server/ so every open advisory is closed and audit goes green:

Package	From → To	Scope	Advisories
fastify	5.11.0 → 5.12.3	prod, direct	GHSA-w2qp-rph6-63g4, GHSA-3m5p-2c4r-xxw2
@fastify/rate-limit	10.3.0 → 11.2.0	prod, direct	GHSA-grpc-p53c-r64v (high, rate-limit bypass via IPv6 rotation; only fixed on the 11.x major, whose sole breaking change is removed deprecated type aliases this code never imported)
fast-uri	3.1.5 / 4.1.2 → 3.1.7 / 4.1.4	prod, transitive	GHSA-5jgf-p345-68v8, GHSA-f65p-4m7j-42xc, GHSA-fph4-wmhf-6fwf, GHSA-jqff-g426-hqxp
vitest, @vitest/coverage-v8	4.1.10 → 4.1.11	dev	@vitest/mocker path traversal
puppeteer	24.43.1 → 25.10.0	dev (UI tests, not in CI)	drops extract-zip (GHSA-jmr9-qjv8-65gv, GHSA-7pqw-9j4j-h8q3)
js-yaml, nanoid	lockfile refresh	dev, transitive	js-yaml CPU exhaustion, nanoid infinite loop

Every version chosen is at least 7 days old, matching the minimumReleaseAge gate in renovate.json; where the newest release was younger, the newest patched release older than 7 days was pinned instead.

No source changes. Supersedes #146, #147, #148, #149, #150, #151, #136 and #135, which are closed as superseded.

Testing

• npm run typecheck and npm run typecheck:scripts pass
• npm run check:node-pin consistent (Node 24)
• npm run build and shellcheck on server scripts pass
• npm run test:coverage: 106 files, 1670 passed, 11 skipped
• npm audit --audit-level=high: 0 vulnerabilities
• rate-limit smoke via app.inject with max: 2: responses 200, 200, 429
• Puppeteer 25 smoke: npm run test:ui 21/23 pass; the 2 visual-snapshot failures reproduce byte-identically on main with puppeteer 24 (pre-existing baseline/environment diff, not a regression)
• CI green (typecheck, test, audit, node-pin, CodeQL, dependency-review)

Closes #152.

🤖 Co-authored by Claude Fable 5.1.
🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: 9404d020-95a6-43ea-810e-8c4d5a744312

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[thewrz]

This was written agentically; verify its assertions:

Adversarial review receipt

• Reviewer: provider=codex; model=gpt-5.6-sol; effort=xhigh; mode=cross-provider (reason: n/a)
• Counts: P1=0; P2=0; total=0
• Reviewed head: 443f4e1
• Confirmed finding: none confirmed
• Verified-skip rationale: Manifest+lockfile-only dependency bump with no source changes; the change is mechanically verifiable rather than a judgment call, and the user-specified verification standard for this triage is smoke tests plus local CI.; mechanical oracle=git diff origin/main..HEAD --stat touches only server/package.json and server/package-lock.json; clean npm ci reproduces the lock (integrity verified); npm audit --audit-level=high = 0 vulnerabilities; npm run typecheck, typecheck:scripts, build, check:node-pin pass; npm run test:coverage = 1670 passed / 11 skipped; every changed lock entry published >= 7 days before 2026-09-15; rate-limit inject smoke max=2 -> 200,200,429; puppeteer 25 UI suite 21/23 with the 2 failures reproduced byte-identically on main.

🤖 Co-authored by Claude Fable 5.1.

[thewrz]

This was written agentically; verify its assertions:

Review ledger

Machine-readable record of every review already performed on this PR.

{
  "version": 1,
  "pr": 153,
  "repo": "wrzonance/DMXr",
  "reviews": [
    {
      "kind": "adversarial",
      "provider": "codex",
      "model": "gpt-5.6-sol",
      "effort": "xhigh",
      "mode": "cross-provider",
      "harness": "claude",
      "head_sha": "443f4e11b62efd3e39f8759fc38b1c7cd140e9ae",
      "covered_heads": [
        "443f4e11b62efd3e39f8759fc38b1c7cd140e9ae"
      ],
      "counts": {
        "p1": 0,
        "p2": 0
      },
      "reviewed_at": "2026-09-15T17:20:54Z"
    }
  ]
}

🤖 Co-authored by Claude Fable 5.1.