chore: fixed vulneribilities

[contentstackMridul]

Summary

• Upgraded fastify from ^4.21.0 to ^5.7.4 to address known vulnerabilities in the v4 release line
• Upgraded all companion @fastify/* plugins and fastify-plugin to their Fastify v5-compatible major versions, as the v4-era plugins declare fastify: '4.x' in their metadata and are rejected at startup by Fastify v5 (FST_ERR_PLUGIN_VERSION_MISMATCH)

Package	Before	After
fastify	^4.21.0	^5.7.4
@fastify/cors	^8.3.0	^11.0.0
@fastify/rate-limit	^9.1.0	^10.0.0
@fastify/swagger	^8.8.0	^9.0.0
@fastify/swagger-ui	^3.0.0	^5.0.0
fastify-plugin	^4.5.1	^5.0.0

No source code changes were required -- all existing API patterns (.listen() signature, JSON schemas, logger config, reply handling) were already compatible with Fastify v5.

Note: @fastify/cors v11 changed default allowed methods to GET,HEAD,POST (previously all methods). This has no impact on our current routes (all GET/POST), but any future PUT/PATCH/DELETE routes will require explicit methods configuration in the CORS options.

Test Plan

• Server boots without errors
• All existing endpoints respond correctly (/health, /health/views, /sync-github-repo, /get-preview-data)
• Swagger UI loads at /documentation
• All 15 unit tests pass
• npm audit reports 0 vulnerabilities

Updated Vulnerabilities Fixes 24-02-2026

What was vulnerable

Package	Severity	Issue
ajv < 6.14.0	Moderate	ReDoS via $data option 1
minimatch < 10.2.1	High	ReDoS via repeated wildcards 2

The minimatch vulnerability cascaded through 31 transitive paths across eslint, jest, glob, rimraf, test-exclude, and their related packages --- all devDependencies.

Fix applied

Added an overrides block to package.json:

"overrides": {
  "eslint": {
    "ajv": "^6.14.0"
  },
  "minimatch": "^10.2.2"
}

• ajv --- Scoped only to eslint's dependency subtree. eslint and @eslint/eslintrc both required ^6.12.4 and resolved to the vulnerable 6.12.6; the override pins them to the patched 6.14.0. Fastify's production dependencies (@fastify/ajv-compiler, fast-json-stringify, ajv-formats) continue to use their required ajv@8.18.0 --- untouched.

• minimatch --- Applied globally. All affected packages (glob@7.2.3 copies used by jest/eslint, @eslint/eslintrc, @humanwhocodes/config-array, test-exclude, etc.) resolve to the patched 10.2.2. Verified API compatibility: the five APIs glob@7.x uses (minimatch(), .Minimatch, .GLOBSTAR, .set, .negate) are all present and compatible in 10.x.

[KANE-99]

Since we are upgrading some major versions here, it is advised to check if there are some migration changes related to how the options are passed or any change in their default nature

[contentstackMridul]

Mainly, the version update was in fastify but because there are other packages that depend on that, I've updated the other packages too. I've also verified if any other code is required after these major bumps in packages

[KANE-99]

LGTM but check one comment