chore(deps): minor and patch updates for the npm-server group

[thewrz]

This was written agentically; verify its assertions:

Why

Renovate's npm-server minor group (#145) could not rebase past the lockfile changes from #153 without a bot cycle, and its own CI had a typecheck failure at its old base. Landing the same set fresh on the current main.

What

Package	From → To
@fastify/helmet	13.1.0 → 13.1.1
@fastify/static	10.1.2 → 10.1.3
@types/semver	7.7.1 → 7.8.0
tsx	4.23.1 → 4.23.13
zod	4.4.3 → 4.5.4

Resolved with npm install --before=2026-09-08 so every release clears the repo's 7-day minimumReleaseAge gate. No source changes. Supersedes #145, which is closed as outdated.

Testing

• npm run typecheck, typecheck:scripts, build, check:node-pin pass
• npm run test:coverage: 1670 passed, 11 skipped
• npm audit --audit-level=high: 0 vulnerabilities
• CI green

🤖 Co-authored by Claude Fable 5.1.
🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: 1a78acd0-f7b4-47c6-85dd-9e90a328242b

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[thewrz]

This was written agentically; verify its assertions:

Adversarial review receipt

• Reviewer: provider=codex; model=gpt-5.6-sol; effort=xhigh; mode=cross-provider (reason: n/a)
• Counts: P1=0; P2=0; total=0
• Reviewed head: f640d1d
• Confirmed finding: none confirmed
• Verified-skip rationale: Manifest+lockfile-only minor/patch dependency bump with no source changes; mechanically verifiable, and the user-specified verification standard for this triage is smoke tests plus local CI.; mechanical oracle=git diff origin/main..HEAD --stat touches only server/package.json and server/package-lock.json; clean npm ci; npm audit --audit-level=high = 0; typecheck, typecheck:scripts, build, check:node-pin pass; test:coverage = 1670 passed / 11 skipped; resolved with npm install --before=2026-09-08 (7-day release age).

🤖 Co-authored by Claude Fable 5.1.

[thewrz]

This was written agentically; verify its assertions:

Review ledger

Machine-readable record of every review already performed on this PR.

{
  "version": 1,
  "pr": 155,
  "repo": "wrzonance/DMXr",
  "reviews": [
    {
      "kind": "adversarial",
      "provider": "codex",
      "model": "gpt-5.6-sol",
      "effort": "xhigh",
      "mode": "cross-provider",
      "harness": "claude",
      "head_sha": "f640d1d7f5edf40cd2132c818aeb2eac30259b10",
      "covered_heads": [
        "f640d1d7f5edf40cd2132c818aeb2eac30259b10"
      ],
      "counts": {
        "p1": 0,
        "p2": 0
      },
      "reviewed_at": "2026-09-15T17:25:57Z"
    }
  ]
}

🤖 Co-authored by Claude Fable 5.1.