From 661134eb0866cf7a3c7ba7df965bc67d4bdb6e03 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 30 Jul 2026 05:09:36 +0000
Subject: [PATCH] deps(server): bump @fastify/helmet from 12.0.1 to 13.1.0 in
 /server

Bumps [@fastify/helmet](https://github.com/fastify/fastify-helmet) from 12.0.1 to 13.1.0.
- [Release notes](https://github.com/fastify/fastify-helmet/releases)
- [Commits](https://github.com/fastify/fastify-helmet/compare/v12.0.1...v13.1.0)

---
updated-dependencies:
- dependency-name: "@fastify/helmet"
  dependency-version: 13.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 server/package-lock.json | 49 ++++++++++++++++++++++++++++++++--------
 server/package.json      |  2 +-
 2 files changed, 40 insertions(+), 11 deletions(-)

diff --git a/server/package-lock.json b/server/package-lock.json
index b9d1523..de96086 100644
--- a/server/package-lock.json
+++ b/server/package-lock.json
@@ -12,7 +12,7 @@
         "@fastify/cookie": "^11.0.2",
         "@fastify/cors": "^10.0.2",
         "@fastify/formbody": "^8.0.2",
-        "@fastify/helmet": "^12.0.1",
+        "@fastify/helmet": "^13.1.0",
         "@fastify/rate-limit": "^11.2.0",
         "@fastify/sensible": "^6.0.2",
         "@node-saml/node-saml": "^5.0.0",
@@ -409,15 +409,41 @@
       "license": "MIT"
     },
     "node_modules/@fastify/helmet": {
-      "version": "12.0.1",
-      "resolved": "https://registry.npmjs.org/@fastify/helmet/-/helmet-12.0.1.tgz",
-      "integrity": "sha512-kkjBcedWwdflRThovGuvN9jB2QQLytBqArCFPdMIb7o2Fp0l/H3xxYi/6x/SSRuH/FFt9qpTGIfJz2bfnMrLqA==",
+      "version": "13.1.0",
+      "resolved": "https://registry.npmjs.org/@fastify/helmet/-/helmet-13.1.0.tgz",
+      "integrity": "sha512-SvVOU0IrzYJW1BvSkfq9G1WUdW3dnaRUvg6m0BtgGMBmML62No0VmSu087jecH58SFbicbREgZTPJ89mAguupA==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/fastify"
+        },
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/fastify"
+        }
+      ],
       "license": "MIT",
       "dependencies": {
-        "fastify-plugin": "^5.0.0",
-        "helmet": "^7.1.0"
+        "fastify-plugin": "^6.0.0",
+        "helmet": "^8.0.0"
       }
     },
+    "node_modules/@fastify/helmet/node_modules/fastify-plugin": {
+      "version": "6.0.0",
+      "resolved": "https://registry.npmjs.org/fastify-plugin/-/fastify-plugin-6.0.0.tgz",
+      "integrity": "sha512-fZOty7z3O7vOliF6d8bHE3wiEh1KcNnKEQensSgTk9C1DvN6nRLS++XVd86v33Hw/8u9Un8A1zDrQ8ujcQDHEg==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/fastify"
+        },
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/fastify"
+        }
+      ],
+      "license": "MIT"
+    },
     "node_modules/@fastify/merge-json-schemas": {
       "version": "0.2.1",
       "resolved": "https://registry.npmjs.org/@fastify/merge-json-schemas/-/merge-json-schemas-0.2.1.tgz",
@@ -2428,12 +2454,15 @@
       }
     },
     "node_modules/helmet": {
-      "version": "7.2.0",
-      "resolved": "https://registry.npmjs.org/helmet/-/helmet-7.2.0.tgz",
-      "integrity": "sha512-ZRiwvN089JfMXokizgqEPXsl2Guk094yExfoDXR0cBYWxtBbaSww/w+vT4WEJsBW2iTUi1GgZ6swmoug3Oy4Xw==",
+      "version": "8.3.0",
+      "resolved": "https://registry.npmjs.org/helmet/-/helmet-8.3.0.tgz",
+      "integrity": "sha512-Qgpiaws3Sm30Av8Eah6sjMCZZwjlBu+E68rhpCWBshY1lb09HtLwj5GviX0OyQIn+ulUS0iX0AxN5n3tLZzz1w==",
       "license": "MIT",
       "engines": {
-        "node": ">=16.0.0"
+        "node": ">=18.0.0"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/EvanHahn"
       }
     },
     "node_modules/help-me": {
diff --git a/server/package.json b/server/package.json
index 00c03d1..5e3d82c 100644
--- a/server/package.json
+++ b/server/package.json
@@ -26,7 +26,7 @@
     "@fastify/cookie": "^11.0.2",
     "@fastify/cors": "^10.0.2",
     "@fastify/formbody": "^8.0.2",
-    "@fastify/helmet": "^12.0.1",
+    "@fastify/helmet": "^13.1.0",
     "@fastify/rate-limit": "^11.2.0",
     "@fastify/sensible": "^6.0.2",
     "@node-saml/node-saml": "^5.0.0",