build(deps): bump @fastify/static from 9.1.3 to 10.1.0

[dependabot]

Bumps @fastify/static from 9.1.3 to 10.1.0.

Release notes

Sourced from @​fastify/static's releases.

v10.1.0

What's Changed

• fix: set Vary: Accept-Encoding for preCompressed responses by @​LeSingh1 in fastify/fastify-static#586
• feat: use @fastify/error for errors and add option suppressWarning by @​climba03003 in fastify/fastify-static#599

New Contributors

• @​LeSingh1 made their first contribution in fastify/fastify-static#586

Full Changelog: fastify/fastify-static@v10.0.0...v10.1.0

v10.0.0

Breaking Changes

• setHeaders now using FastifyReply instead of Response.

You should refactor your code to use the reply helpers. For example,

// Before
const fastify = require('fastify')({logger: true})
const path = require('node:path')
fastify.register(require('@​fastify/static'), {
root: path.join(__dirname, 'public'),
prefix: '/public/', // optional: default '/',
setHeaders(res) {
res.setHeader('X-Test', 'Foo')
}
})
// After
const fastify = require('fastify')({logger: true})
const path = require('node:path')
fastify.register(require('@​fastify/static'), {
root: path.join(__dirname, 'public'),
prefix: '/public/', // optional: default '/',
setHeaders(reply) {
reply.header('X-Test', 'Foo')
}
})

What's Changed

• chore!: bump content-disposition fom 1.0.1 to 2.0.1 by @​climba03003 in fastify/fastify-static#597
• fix: ignore unsupported deflate for precompressed assets by @​jibin7jose in fastify/fastify-static#596
• fix!: allow setHeaders to override send headers by @​climba03003 in fastify/fastify-static#598

New Contributors

• @​jibin7jose made their first contribution in fastify/fastify-static#596

Full Changelog: fastify/fastify-static@v9.3.0...v10.0.0

... (truncated)

Commits

• 36c939d Bumped v10.1.0
• 7c1121a feat: use @fastify/error for errors and add option suppressWarning (#599)
• c57d8bc fix: set Vary: Accept-Encoding for preCompressed responses (#586)
• babf6df Bumped v10.0.0
• 08ed461 fix!: allow setHeaders to override send headers (#598)
• 99f0193 fix: ignore unsupported deflate for precompressed assets (#596)
• a6e5f4d chore!: bump content-disposition fom 1.0.1 to 2.0.1 (#597)
• ad05a27 Bumped v9.3.0
• 58811db chore: update fastify-plugin dependency to version 6.0.0 (#594)
• a343813 Bumped v9.2.0
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
⚠️ Please upload report for BASE (main@788ccef). Learn more about missing BASE report.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #7799   +/-   ##
=======================================
  Coverage        ?   75.12%           
=======================================
  Files           ?      430           
  Lines           ?    22863           
  Branches        ?     6063           
=======================================
  Hits            ?    17176           
  Misses          ?     5687           
  Partials        ?        0           

Flag	Coverage Δ
backend	75.12% <ø> (?)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[n-lark]

Dependabot triage — major bump, verified ✅

Package: @fastify/static 9.1.3 → 10.1.0 (major; package.json range ^9.1.2 → ^10.1.0)

Standard checks

• Publish window: 10.1.0 published 2026-07-11, ≥12h elapsed ✅
• Advisories: none against @fastify/static 10.1.0 or content-disposition 2.0.1 ✅
• Integrity: lockfile hash matches the npm registry ✅

Breaking-change impact — none on our code

• v10 breaking changes: setHeaders(res) → setHeaders(reply); content-disposition 1.0.1 → 2.0.1; setHeaders may override send headers.
• Our only registration is forge/routes/ui/index.js using { index: false, root }. No setHeaders, sendFile, or download anywhere in forge/. No source changes required.

Lockfile note

• @fastify/swagger-ui now nests its own @fastify/static@9.3.0 (top-level is 10.1.0). Both resolve cleanly; accounts for the larger-than-usual lockfile diff.

Verification (Node 24, npm ci from this branch's lockfile → @fastify/static@10.1.0 on disk)

• In-process (fastify inject):
  • Static serve with our exact { index: false, root } → 200 + correct body ✅
  • index: false does not auto-serve / (explicit / route + notFoundHandler handle it) ✅
  • Swagger UI loads via nested @fastify/static@9.3.0; GET /api/ → 200 text/html; GET /api/static/swagger-ui.css → 200 text/css ✅
• Booted app:
  • UI loads; JS/CSS assets serve ✅
  • Deep-link reload on a client route returns index.html (notFoundHandler) ✅
  • GET /api/ renders Swagger UI with CSS/JS ✅

Decision: approving for merge once CI is green.