chore(deps): sweep 2026-09-08

[vvillait88]

Summary

Routine dependency sweep, dev-only. The peer ranges (fastify >=4, hono >=4, jose >=6) are unchanged, so no consumer must act and no release is needed.

• Dev bumps: fastify 5.12.1 to 5.12.3, hono 4.13.5 to 4.13.7, jose 6.2.10 to 6.2.12, @types/node 26.4.1 to 26.5.0.
• Drop the nanoid override. With every override removed and the lock re-resolved, nanoid still lands on 3.3.18, the fixed release for GHSA-2v37-7h3g-55p8, so the floor was inert.
• Keep the axios and esbuild overrides: the same drill showed the lock falling to axios 1.16.0 (cdp-sdk's exact pin, ten advisories) and esbuild 0.27.7 without them. viem stays as the coupled-set single-version pin.
• Remove @x402/core from knip's ignoreDependencies: knip has flagged it as a stale ignore on main since the package became a real import.
• packageManager to bun 1.4.2.

Held on purpose: eslint 9 and TypeScript 6 (org-wide holds), typescript-eslint 8.70.0 (inside the 24h release soak at sweep time). Not touched: the viem/mppx/@Solana coupled set (already at the versions settled live on 2026-09-05). GitHub Actions pins audited and current. OSV scan over the lock: no issues.

Supersedes the dependabot PR carrying the same three dev bumps.

Worked with Varun.

Type of change

• Bug fix (no breaking change)
• New feature (no breaking change)
• Breaking change (existing callers must update)
• Docs, tests, or internal maintenance only

Public API

none

Test plan

Ran locally on the branch: bun run lint, bun run typecheck (src and examples), bun run knip (clean, no configuration hints), bun run test (coverage 96.6% statements), bun run build, all exit 0. osv-scanner scan --lockfile bun.lock: 893 packages, no issues.

Checklist

• Tests cover the new behavior, and the suite passes locally
• Lint, format, and type checks pass
• Docs and README examples updated if the public surface changed
• No secrets, credentials, or personal data in the diff or the tests