build(deps): bump the production group across 1 directory with 11 updates

.github/workflows/ci.yml

@@ -46,7 +46,15 @@ jobs:
           cache: pnpm
       - run: pnpm install --frozen-lockfile
       - run: pnpm build
-      - run: pnpm test
+      - if: matrix.node-version != 18
+        run: pnpm test
+        env:
+          REDIS_URL: redis://localhost:6379
+      # @guardcore/fastify supports node 20+, like fastify v5 itself: fastify's
+      # inject() loads the ESM-only cookie 2 through require(), which node 18
+      # does not provide.
+      - if: matrix.node-version == 18
+        run: pnpm test --filter='!@guardcore/fastify'
         env:
           REDIS_URL: redis://localhost:6379
       # The coverage gate runs once on the newest node: vitest 5.x coverage

AGENTS.md

@@ -7,7 +7,7 @@ guardcore-ts is the TypeScript implementation of guard-core, the framework-agnos
 
 - Root package: `guardcore-ts` 1.0.0 (private, never published)
 - Published packages: `@guardcore/core`, `@guardcore/express`, `@guardcore/fastify`, `@guardcore/hono`, `@guardcore/nestjs` (all 1.0.0, MIT)
-- Node >= 18 (CI tests 18, 20, and 22), TypeScript ~5.9 in strict mode
+- Node >= 18 (CI tests 18, 20, and 22); `@guardcore/fastify` needs Node >= 20, like fastify v5. TypeScript ~5.9 in strict mode
 - pnpm 10 workspaces (packageManager pnpm@10.25.0) orchestrated by Turborepo
 - Targets ES2022; builds dual ESM + CJS output with tsup
 
@@ -99,7 +99,7 @@ docker compose -p guard-core-ts-live-smoke -f examples/express/docker-compose.ym
 ```
 - `make stop` / `make restart` - docker compose down / up -d (compose.yml)
 
-CI runs (verified in .github/workflows/ci.yml): pnpm install --frozen-lockfile, pnpm build, pnpm lint on node 22, and pnpm test on a node 18/20/22 matrix with a redis service (REDIS_URL=redis://localhost:6379). Other Actions: .github/workflows/issue-link.yml enforces a "Closes #N" link (or the no-issue label) on PRs, .github/workflows/live-smoke.yml runs dockerized compose smokes of the Express and advanced examples, and .github/workflows/ecosystem-gate.yml gates the monorepo (turbo build + test + conformance, plus a pnpm pack + install smoke of @guardcore/core into a scratch project).
+CI runs (verified in .github/workflows/ci.yml): pnpm install --frozen-lockfile, pnpm build, pnpm lint on node 22, and pnpm test on a node 18/20/22 matrix with a redis service (REDIS_URL=redis://localhost:6379); node 18 skips @guardcore/fastify, which needs node 20+. Other Actions: .github/workflows/issue-link.yml enforces a "Closes #N" link (or the no-issue label) on PRs, .github/workflows/live-smoke.yml runs dockerized compose smokes of the Express and advanced examples, and .github/workflows/ecosystem-gate.yml gates the monorepo (turbo build + test + conformance, plus a pnpm pack + install smoke of @guardcore/core into a scratch project).
 
 ## Project Structure
 
@@ -163,7 +163,7 @@ Toolchain:
 - typescript ~5.9, tsconfig.base.json: target ES2022, module ESNext, moduleResolution bundler, strict, exactOptionalPropertyTypes, declaration + declarationMap, isolatedModules
 - tsup ^8 - dual ESM/CJS builds (dist/index.js, dist/index.cjs, dist/index.d.ts)
 - vitest ^4 + @vitest/coverage-v8 - test runner and coverage
-- Node >= 18 (engines field on every package; CI matrix 18/20/22)
+- Node >= 18 (engines field on every package, >= 20 for @guardcore/fastify; CI matrix 18/20/22)
 
 ## Testing & Conformance
 
@@ -235,3 +235,14 @@ From tsconfig.base.json and CONTRIBUTING.md (both enforced by CI):
 - guard-core (https://github.com/Guard-Core/guard-core) - the Python engine this repo ports; upstream reference for behavior and patterns
 - In-repo adapters: @guardcore/express, @guardcore/fastify, @guardcore/hono, @guardcore/nestjs (each under packages/ with its own tests and examples/ apps)
 - examples/ contains a runnable app per adapter (express, fastify, hono, nestjs) plus examples/advanced/ (env-driven SecurityConfig, endpointRateLimits with a custom 429 body, admin header gate); each example is a pnpm workspace member with a Dockerfile and docker-compose.yml; adapter middleware does not populate request.state.guardRouteId yet, so per-route SecurityDecorator configs are not resolved through the middleware at runtime
+
+<!-- BEGIN:turborepo-agent-rules -->
+
+# This is NOT the Turborepo you know
+
+Turborepo configuration, task behavior, and CLI commands can vary between installed versions and may differ from your training data. Resolve the `turbo` package from this file's directory or relevant workspace; in monorepos, it may not be visible from the repository root. For example, run `node -p "require.resolve('turbo/package.json')"` from a workspace that depends on `turbo`.
+
+Read `docs/README.md` inside that installed package first, then read the relevant pages from its `docs/` directory before changing Turborepo configuration or commands. Heed deprecation notices. These bundled docs match the installed package version and are available without network access.
+
+This block is written and re-added by `turbo` before repository-scoped commands when an AI agent is detected. In the Turborepo source repository, its template is defined in `crates/turborepo-cli/src/cli/agent_guidance.rs`. Removing the managed block while updates are enabled means a later qualifying invocation will add it again. Set `"agentGuidance": false` in the root `turbo.json` or `turbo.jsonc` to opt out; this does not remove an existing block. Keep the block committed with your work to avoid an uncommitted change on the next agent invocation.
+<!-- END:turborepo-agent-rules -->

CLAUDE.md

@@ -7,7 +7,7 @@ guardcore-ts is the TypeScript implementation of guard-core, the framework-agnos
 
 - Root package: `guardcore-ts` 1.0.0 (private, never published)
 - Published packages: `@guardcore/core`, `@guardcore/express`, `@guardcore/fastify`, `@guardcore/hono`, `@guardcore/nestjs` (all 1.0.0, MIT)
-- Node >= 18 (CI tests 18, 20, and 22), TypeScript ~5.9 in strict mode
+- Node >= 18 (CI tests 18, 20, and 22); `@guardcore/fastify` needs Node >= 20, like fastify v5. TypeScript ~5.9 in strict mode
 - pnpm 10 workspaces (packageManager pnpm@10.25.0) orchestrated by Turborepo
 - Targets ES2022; builds dual ESM + CJS output with tsup
 
@@ -91,7 +91,7 @@ Makefile targets (verified in ./Makefile):
 - `make serve-docs` / `make build-docs` - run the Astro docs site in docs/ (astro dev / astro build)
 - `make stop` / `make restart` - docker compose down / up -d (compose.yml)
 
-CI runs (verified in .github/workflows/ci.yml): pnpm install --frozen-lockfile, pnpm build, pnpm lint on node 22, and pnpm test on a node 18/20/22 matrix with a redis service (REDIS_URL=redis://localhost:6379).
+CI runs (verified in .github/workflows/ci.yml): pnpm install --frozen-lockfile, pnpm build, pnpm lint on node 22, and pnpm test on a node 18/20/22 matrix with a redis service (REDIS_URL=redis://localhost:6379); node 18 skips @guardcore/fastify, which needs node 20+.
 
 ## Project Structure
 
@@ -155,7 +155,7 @@ Toolchain:
 - typescript ~5.9, tsconfig.base.json: target ES2022, module ESNext, moduleResolution bundler, strict, exactOptionalPropertyTypes, declaration + declarationMap, isolatedModules
 - tsup ^8 - dual ESM/CJS builds (dist/index.js, dist/index.cjs, dist/index.d.ts)
 - vitest ^4 + @vitest/coverage-v8 - test runner and coverage
-- Node >= 18 (engines field on every package; CI matrix 18/20/22)
+- Node >= 18 (engines field on every package, >= 20 for @guardcore/fastify; CI matrix 18/20/22)
 
 ## Testing & Conformance
 

CONTRIBUTING.md

@@ -54,7 +54,7 @@ pnpm test
 
 ### Prerequisites
 
-- Node.js 18+ (22 recommended)
+- Node.js 18+ (22 recommended); `@guardcore/fastify` needs 20+, like fastify v5
 - pnpm 10+
 - Redis (for integration tests)
 

examples/advanced/package.json

@@ -10,7 +10,7 @@
     "@guardcore/core": "workspace:*",
     "@guardcore/express": "workspace:*",
     "cors": "^2.8.5",
-    "express": "^5.1.0"
+    "express": "^5.3.0"
   },
   "devDependencies": {
     "tsx": "^4.20.6"

examples/express/package.json

@@ -10,7 +10,7 @@
     "@guardcore/core": "workspace:*",
     "@guardcore/express": "workspace:*",
     "cors": "^2.8.5",
-    "express": "^5.1.0"
+    "express": "^5.3.0"
   },
   "devDependencies": {
     "tsx": "^4.20.6"

examples/fastify/package.json

@@ -9,8 +9,8 @@
   "dependencies": {
     "@guardcore/core": "workspace:*",
     "@guardcore/fastify": "workspace:*",
-    "@fastify/cors": "^11.0.0",
-    "fastify": "^5.12.5"
+    "@fastify/cors": "^11.3.1",
+    "fastify": "^5.12.7"
   },
   "devDependencies": {
     "tsx": "^4.20.6"

examples/hono/package.json

@@ -9,8 +9,8 @@
   "dependencies": {
     "@guardcore/core": "workspace:*",
     "@guardcore/hono": "workspace:*",
-    "@hono/node-server": "^2.1.3",
-    "hono": "^4.13.11"
+    "@hono/node-server": "^2.1.5",
+    "hono": "^4.13.13"
   },
   "devDependencies": {
     "tsx": "^4.20.6"

examples/nestjs/package.json

@@ -9,9 +9,9 @@
   "dependencies": {
     "@guardcore/core": "workspace:*",
     "@guardcore/nestjs": "workspace:*",
-    "@nestjs/common": "^12.1.1",
-    "@nestjs/core": "^12.1.1",
-    "@nestjs/platform-express": "^12.1.1",
+    "@nestjs/common": "^12.1.3",
+    "@nestjs/core": "^12.1.3",
+    "@nestjs/platform-express": "^12.1.3",
     "reflect-metadata": "^0.2.2",
     "rxjs": "^7.8.1"
   },

packages/express/package.json

@@ -25,7 +25,7 @@
   },
   "dependencies": {
     "@guardcore/core": "workspace:^",
-    "guardagent": "^3.2.1"
+    "guardagent": "^3.2.3"
   },
   "devDependencies": {
     "@types/express": "^5",

packages/fastify/package.json

@@ -25,11 +25,11 @@
   },
   "dependencies": {
     "@guardcore/core": "workspace:^",
-    "fastify-plugin": "^6.0.0",
-    "guardagent": "^3.2.1"
+    "fastify-plugin": "^6.0.1",
+    "guardagent": "^3.2.3"
   },
   "devDependencies": {
-    "@fastify/cors": "^11.0.0",
+    "@fastify/cors": "^11.3.1",
     "@types/node": "^26.6.5",
     "fastify": "^5",
     "tsup": "^8",
@@ -48,7 +48,7 @@
   },
   "license": "MIT",
   "engines": {
-    "node": ">=18"
+    "node": ">=20"
   },
   "repository": {
     "type": "git",

packages/hono/package.json

@@ -25,7 +25,7 @@
   },
   "dependencies": {
     "@guardcore/core": "workspace:^",
-    "guardagent": "^3.2.1"
+    "guardagent": "^3.2.3"
   },
   "devDependencies": {
     "tsup": "^8",

packages/nestjs/package.json

@@ -25,15 +25,15 @@
   },
   "dependencies": {
     "@guardcore/core": "workspace:^",
-    "guardagent": "^3.2.1"
+    "guardagent": "^3.2.3"
   },
   "devDependencies": {
     "@nestjs/common": "^12",
     "@nestjs/core": "^12",
     "@types/express": "^5",
     "@types/cors": "^2",
     "@vitest/coverage-v8": "^5.0.4",
-    "express": "^4.21.2",
+    "express": "^5.3.0",
     "reflect-metadata": "^0.2",
     "rxjs": "^7",
     "tsup": "^8",