fastify transitive vulnerability with repack

[deepmohan]

Describe the bug

The dependency of repack, @callstack/repack-dev-server, has in turn, dependency with fastify version 4.29.1. New HIGH vulnerability(CVE-2026-25223) has been identified with fastify and has to be upgraded to the version 5.7.2 or beyond.

System Info

Node:
    version: 22.14.0
   
  npm:
    version: 11.3.0

Re.Pack Version

5.2.1

Reproduction

https://github.com/callstack/repack

Steps to reproduce

Install node, pnpm

execute pnpm why fastify should produce output as below

@callstack/repack 5.2.1
└─┬ @callstack/repack-dev-server 5.2.1
└── fastify 4.29.1