chore(deps): patch the audited advisories and prepare the fastify release

[Bccorb]

Dependency audit

pnpm audit reported ten advisories. Every one is transitive through dev tooling (jest, supertest, tsup, changesets) or through express, which adopters supply themselves as a peer dependency. The published packages were never affected: pnpm audit --prod, which is what adopters actually install, was clean before this change and stays clean after it.

The direct devDependencies were already at their latest versions, so the vulnerable transitives were pinned by upstream ranges and needed pnpm.overrides. Every override is a patch within the same major line:

Package	From	To	Cleared
form-data	4.0.5	4.0.6	1 high
js-yaml	3.14.2 / 4.1.1	3.15.0 / 4.3.0	2 high, 2 moderate
brace-expansion	1.1.14	1.1.17	1 high
esbuild	0.27.7	0.28.1	1 low
@babel/core	7.29.0	7.29.7	1 low
body-parser	2.2.2	2.3.0	1 low

The advisory left open

One high remains: the brace-expansion out-of-memory advisory on the jest chain. Its vulnerable range is <=5.0.7, which covers every earlier major, so 5.0.8 is the only clearing version. That line is a relaunch with a breaking API, exporting a named expand instead of the callable module its consumers require, so require('brace-expansion') returns a non-callable object and minimatch@3 throws. Upgrading jest does not help either: jest 30 still resolves 2.1.3 and 1.1.17, both in range, and minimatch@10 sidesteps the problem only by depending on a differently named fork.

It is dev-only and never reaches adopters. Worth revisiting once the ecosystem migrates.

@seamless-auth/types 0.4.0

Bumped from ^0.3.0, which the caret would not have crossed on its own across a 0.x minor. I diffed the published tarballs: 0.4.0 only adds a z.infer alias for each of the 43 exported schemas that lacked one. No existing export changed name or shape, so no import in core needed touching. Carries a core patch changeset.

Fastify release prep

@seamless-auth/fastify was already configured to publish (publishConfig.access: public, plus an existing minor changeset), so nothing here unblocks the release. These are the gaps around it:

• AGENTS.md lists it among the published packages and in the architecture map.
• The core security policy enumerates the packages it covers, and a public adapter missing from that list would read as out of scope for vulnerability reports.
• CONTRIBUTING.md and SECURITY.md match the express adapter's copies. Neither is in files, so they stay out of the published tarball.

It versions independently of core and express, so linked is untouched.

Verified release plan

Dry run of changeset version on a throwaway copy:

Package	Version
@seamless-auth/core	0.11.0
@seamless-auth/express	0.11.0
@seamless-auth/fastify	0.1.0 (first publish)

Core and express land on 0.11.0 rather than 0.10.1 because pre-existing changesets already carry minor bumps; the types patch is absorbed into that. npm pack --dry-run confirms the fastify tarball carries dist/, LICENSE, LICENSE.md, and README.md (31 files, 14.8 kB).

Two notes for whoever cuts the release:

1. The npm token needs publish rights for a brand new package name, not just existing ones. @seamless-auth/fastify is a 404 on the registry today.
2. createSeamlessConsoleProxy still has no Fastify equivalent. The existing changeset documents this, so it is a known gap rather than an oversight.

Checks

• pnpm build passes all three packages, including tsup on esbuild 0.28.1.
• pnpm test passes 387 tests (core 214, express 150, fastify 23).
• pnpm install --frozen-lockfile succeeds, so the lockfile is CI ready.
• pnpm audit --prod: no known vulnerabilities.