build(deps): bump dependencies

[FlandiaYingman]

No description provided.

[Copilot]

Pull request overview

This PR updates the project’s Node/Fastify toolchain by bumping a broad set of runtime and dev dependencies (Fastify ecosystem, MongoDB driver, ESLint, TypeScript ESLint, Prettier/plugins). It also changes the Yarn install strategy via .yarnrc.yml.

Changes:

• Bump various dependencies in package.json and refresh yarn.lock accordingly (Fastify plugins, auth libs, lint/format tooling).
• Update the example MongoDB type annotation in init-mongo.ts comments.
• Switch Yarn’s nodeLinker from node-modules to pnpm.

Reviewed changes

Copilot reviewed 3 out of 4 changed files in this pull request and generated 2 comments.

File	Description
yarn.lock	Large lockfile refresh to match dependency bumps and transitive changes.
package.json	Updates runtime/dev dependency versions (Fastify, MongoDB, ESLint, Prettier, etc.).
src/plugins/init-mongo.ts	Comment-only update to the example collection generic type.
.yarnrc.yml	Changes Yarn nodeLinker to pnpm, affecting install layout/behavior.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

@FlandiaYingman I've opened a new pull request, #63, to work on those changes. Once the pull request is ready, I'll request review from you.

[Copilot]

@FlandiaYingman I've opened a new pull request, #64, to work on those changes. Once the pull request is ready, I'll request review from you.

[Copilot]

Pull request overview

Copilot reviewed 9 out of 10 changed files in this pull request and generated 3 comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[polyipseity]

Let's sort out #59 before doing this. After #66 is merged, next time we can let dependabot do the dirty work instead.

[FlandiaYingman]

After #66 is merged, next time we can let dependabot do the dirty work instead.

Sometimes there will be breaking changes that require manual update

[polyipseity]

After #66 is merged, next time we can let dependabot do the dirty work instead.

Sometimes there will be breaking changes that require manual update

Yes. Dependabot does not directly commit to the repository, it opens a PR so you can fix anything needed in the PR and then merge it instead. It simply saves the work of having to look up versions yourself, changing the versions in package.json, and then running yarn install.

[FlandiaYingman]

Yes. Dependabot does not directly commit to the repository, it opens a PR so you can fix anything needed in the PR and then merge it instead. It simply saves the work of having to look up versions yourself, changing the versions in package.json, and then running yarn install.

Oh does it always update to the latest version or just the latest compatible version specified in package.json?

[polyipseity]

Yes. Dependabot does not directly commit to the repository, it opens a PR so you can fix anything needed in the PR and then merge it instead. It simply saves the work of having to look up versions yourself, changing the versions in package.json, and then running yarn install.

Oh does it always update to the latest version or just the latest compatible version specified in package.json?

It should be latest version by default. It looks like we can set versioning-strategy to lockfile-only to make it update to the lastest compatible version instead of latest version: https://docs.github.com/en/code-security/reference/supply-chain-security/dependabot-options-reference#versioning-strategy--.