chore(deps): bump the patch group across 1 directory with 9 updates

[dependabot]

Bumps the patch group with 9 updates in the / directory:

Package	From	To
@types/node	22.20.1	22.20.2
fastify	5.12.1	5.12.3
jose	6.2.10	6.2.12
@types/ssh2	1.15.5	1.15.6
mysql2	3.24.2	3.24.4
otpauth	9.5.1	9.5.2
dotenv	17.4.1	17.4.2
@material-symbols/svg-400	0.47.0	0.47.2
eslint-plugin-react-refresh	0.5.5	0.5.6

Updates @types/node from 22.20.1 to 22.20.2

Commits

• See full diff in compare view

Updates fastify from 5.12.1 to 5.12.3

Release notes

Sourced from fastify's releases.

v5.12.2

⚠️ Security release

• Fix for GHSA-9q9j-q6p8-xq58
• Fix for GHSA-hwr6-493r-vm6h
• Fix for GHSA-p68q-wchp-6fh7
• Fix for GHSA-667r-xxjv-c9mm

What's Changed

• [Backport 5.x] fix: callNotFound should run not-found preHandler regardless of registration order by @​github-actions[bot] in fastify/fastify#6973
• [Backport 5.x] chore: npm ignore remaining agent files by @​github-actions[bot] in fastify/fastify#7003

Full Changelog: fastify/fastify@v5.12.1...v5.12.2

Commits

• See full diff in compare view

Updates jose from 6.2.10 to 6.2.12

Release notes

Sourced from jose's releases.

v6.2.12

Documentation

• clarify and shorten public API guidance (be62530)

Refactor

• simplify JWS and JWE operation cores (92e9640)

Performance

• avoid copying AES-GCM output (6925d43)
• deduplicate pending jwks key imports (bf5138b)
• encode single-signature JWS input once (7bc9a33)
• normalize General JWE shared headers once (78637bd)
• normalize jwks selection metadata once (fd3ae3f)
• use native encoding for larger ASCII strings (b23a6f3)

v6.2.11

Documentation

• render subpath indexes as tables (94589ee)
• shorten API index descriptions (681482f)

Refactor

• model JWE key management modes (e01dda6)
• types: reduce declaration repetition (55b970f)

Changelog

Sourced from jose's changelog.

6.2.12 (2026-09-05)

Documentation

• clarify and shorten public API guidance (be62530)

Refactor

• simplify JWS and JWE operation cores (92e9640)

Performance

• avoid copying AES-GCM output (6925d43)
• deduplicate pending jwks key imports (bf5138b)
• encode single-signature JWS input once (7bc9a33)
• normalize General JWE shared headers once (78637bd)
• normalize jwks selection metadata once (fd3ae3f)
• use native encoding for larger ASCII strings (b23a6f3)

6.2.11 (2026-09-04)

Documentation

• render subpath indexes as tables (94589ee)
• shorten API index descriptions (681482f)

Refactor

• model JWE key management modes (e01dda6)
• types: reduce declaration repetition (55b970f)

Commits

• 505a55b chore(release): 6.2.12
• 7bc9a33 perf: encode single-signature JWS input once
• 78637bd perf: normalize General JWE shared headers once
• bf5138b perf: deduplicate pending jwks key imports
• b23a6f3 perf: use native encoding for larger ASCII strings
• fd3ae3f perf: normalize jwks selection metadata once
• 6925d43 perf: avoid copying AES-GCM output
• be62530 docs: clarify and shorten public API guidance
• 1b41312 build: preserve README when generation fails
• 0b51829 build: check tree-shaking for every public binding
• Additional commits viewable in compare view

Updates @types/ssh2 from 1.15.5 to 1.15.6

Commits

• See full diff in compare view

Updates mysql2 from 3.24.2 to 3.24.4

Release notes

Sourced from mysql2's releases.

v3.24.4

3.24.4 (2026-09-07)

Performance Improvements

• per-query overhead, local dates, short strings, TLS context and compression (#4522) (2387daf)
• reuse TLS sessions across connections to the same server (#4529) (9178c82)

v3.24.3

3.24.3 (2026-09-01)

Bug Fixes

• typings: PoolCluster node events emit a string nodeId (#4513) (1281e1e)

Changelog

Sourced from mysql2's changelog.

3.24.4 (2026-09-07)

Performance Improvements

• per-query overhead, local dates, short strings, TLS context and compression (#4522) (2387daf)
• reuse TLS sessions across connections to the same server (#4529) (9178c82)

3.24.3 (2026-09-01)

Bug Fixes

• typings: PoolCluster node events emit a string nodeId (#4513) (1281e1e)

Commits

• a87208a chore(master): release 3.24.4 (#4530)
• e5833be chore: prepare src for parallel TypeScript transcription (#4538)
• 5f6482f build(deps): bump sass from 1.103.1 to 1.104.0 in /website (#4537)
• 8e0bd84 build(deps): bump lucide-react from 1.38.0 to 1.41.0 in /website (#4536)
• 8b8a9cb build(deps-dev): bump @​types/node from 26.4.0 to 26.4.1 in /website (#4535)
• 83854a6 build(deps): bump docusaurus-plugin-sass (#4534)
• 2e9d75a build(deps-dev): bump @​biomejs/biome from 2.5.11 to 2.5.12 (#4533)
• d6f4172 build(deps-dev): bump @​types/node from 26.4.0 to 26.4.1 (#4532)
• 2e1c9e0 build(deps): bump lru.min from 1.1.4 to 1.1.5 (#4531)
• 2387daf perf: per-query overhead, local dates, short strings, TLS context and compres...
• Additional commits viewable in compare view

Updates otpauth from 9.5.1 to 9.5.2

Release notes

Sourced from otpauth's releases.

v9.5.2

What's Changed

• Bump the github-actions-all group across 1 directory with 7 updates by @​dependabot[bot] in hectorm/otpauth#711

Full Changelog: hectorm/otpauth@v9.5.1...v9.5.2

Commits

• 5a0cb60 9.5.2
• 94f1fcc Update QuickJS version to 2026-06-04
• fac0c5c Update hectorm/ghaction-setup-quickjs
• 88bdce0 Harden and align hex/base32 secret decoding
• c431143 Bump the github-actions-all group across 1 directory with 7 updates (#711)
• b6e3a62 Update dependencies
• See full diff in compare view

Updates dotenv from 17.4.1 to 17.4.2

Changelog

Sourced from dotenv's changelog.

17.4.2 (2026-04-12)

Changed

• Improved skill files - tightened up details (#1009)

Commits

• f116f70 17.4.2
• 3a81612 fix visual order of faq
• 13f55a8 Merge branch 'skill'
• 4bbbf73 reorganize faq
• c3da64b Merge pull request #1009 from motdotla/skill
• 6f743b1 update source
• fc2c624 update skill
• 972315b Tighten up skill
• 2795fce reorganize faq
• d5495d4 adjust skill
• Additional commits viewable in compare view

Updates @material-symbols/svg-400 from 0.47.0 to 0.47.2

Commits

• af93fdc 0.47.2
• 1f04888 Auto Update
• 20d9ea0 0.47.1
• 219c841 Auto Update
• See full diff in compare view

Updates eslint-plugin-react-refresh from 0.5.5 to 0.5.6

Release notes

Sourced from eslint-plugin-react-refresh's releases.

v0.5.6

• Support re-exporting namespace components (fixes #116)

Changelog

Sourced from eslint-plugin-react-refresh's changelog.

0.5.6

• Support re-exporting namespace components (fixes #116)

Commits

• 620568a Support re-exporting namespace components (fixes #116) [publish]
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.