security(deps): upgrade busboy to fix multipart denial of service

Override Busboy to use a patched version and refresh the lockfile to resolve CVE-2026-19481 and CVE-2026-19484 in production images.

pnpm-lock.yaml

@@ -5,6 +5,7 @@ settings:
   excludeLinksFromLockfile: false
 
 overrides:
+  '@fastify/busboy': ^3.2.1
   '@xhmikosr/decompress': ^11.1.4
   '@esbuild-kit/core-utils>esbuild': ^0.25.12
   '@nestjs/swagger>js-yaml': ^5.3.0
@@ -1957,8 +1958,8 @@ packages:
   '@fastify/ajv-compiler@4.0.6':
     resolution: {integrity: sha512-NtuzM0SfaMJbGlnjr9LWQUN5LzgSrbB8tf/wRZNas+4E1O/Nmzl53e7ruT61HDZyRCJGC6FxIogmNZO1c5ETBA==}
 
-  '@fastify/busboy@3.2.0':
+  '@fastify/busboy@3.2.2':
-    resolution: {integrity: sha512-m9FVDXU3GT2ITSe0UaMA5rU3QkfC/UXtCU8y0gSN/GugTqtVldOBWIB5V6V3sbmenVZUIpU6f+mPEO2+m5iTaA==}
+    resolution: {integrity: sha512-yXSS27qPExaXeuLvMRMXOLtpipzfQYNjG3FkunDWKGfMYjKuhFXko9CVzqxm8jcF+lmtS9Fd89QNdh9XDjnbNg==}
 
   '@fastify/compress@9.2.0':
     resolution: {integrity: sha512-35VL33PIEt/UbD/ZMlRNaICd2BQz0IaG7en74Dv7tI+MHIQkedibS1+9JfekWH4I1g+Y8RbbZD4Zsk9h4XTItg==}
@@ -10482,7 +10483,7 @@ snapshots:
       ajv-formats: 3.0.1(ajv@8.20.0)
       fast-uri: 3.1.8
 
-  '@fastify/busboy@3.2.0': {}
+  '@fastify/busboy@3.2.2': {}
 
   '@fastify/compress@9.2.0':
     dependencies:
@@ -10536,7 +10537,7 @@ snapshots:
 
   '@fastify/multipart@10.1.2':
     dependencies:
-      '@fastify/busboy': 3.2.0
+      '@fastify/busboy': 3.2.2
       '@fastify/deepmerge': 3.2.1
       '@fastify/error': 4.2.0
       fastify-plugin: 6.0.0

pnpm-workspace.yaml

@@ -3,6 +3,7 @@ packages:
   - "server"
   - "packages/*"
 overrides:
+  "@fastify/busboy": ^3.2.1
   "@xhmikosr/decompress": ^11.1.4
   "@esbuild-kit/core-utils>esbuild": ^0.25.12
   "@nestjs/swagger>js-yaml": ^5.3.0