[agammann]

Summary

• Override vulnerable transitive glob and minimatch releases with the patched versions (glob 14.0.2 and minimatch 11.0.1) and update the lockfile.
• Add a focused Fastify static-file test because this moves glob across a major version used by @fastify/static.

This change leaves the direct @fastify/static version untouched. Open Dependabot PR #13 updates that package to 10.1.7 but still resolves glob 13.0.6, so it does not clear these two advisories.

Validation

• pnpm install --frozen-lockfile and pnpm audit --audit-level=low passed; the audit reports no known vulnerabilities.
• pnpm lint, pnpm typecheck, pnpm build:local, and pnpm build passed.
• The full test suite passed with a disposable PostgreSQL fixture (30 passed, 1 skipped). The new nested static-asset test passed separately after the final edit.
• GitHub Actions run 41260340928 passed the verify, recovery, and committed source-package jobs.

Advisories: glob GHSA-3g3m-2fjr-6pw4 and minimatch GHSA-g3hv-75wg-m249.