[V3]: bump non core transitive deps (#2845)

# what changed
bumped non-core dependencies and transitive resolutions with fixes
identified by `pnpm audit`:
- refreshed range-compatible transitive dependencies:
  - `fast-uri` `3.1.2` -> `3.1.6`
  - `find-my-way` `9.3.0` -> `9.9.0`
  - `js-yaml` `3.14.2` -> `3.15.2` for evals
  - `js-yaml` `4.2.0` -> `4.3.2` for root tooling
  - `body-parser` `1.20.5` -> `1.20.6`
- removed the stale `js-yaml@4.1.1` -> `4.2.0` workspace override so
root tooling can resolve the current patched `4.x` release
- updated the server-v3 Swagger integration:
  - `@fastify/swagger-ui` `5.2.6` -> `6.1.1`
- `fastify-zod-openapi` `5.5.0` -> `5.7.0` to retain a valid Swagger UI
peer dependency
  - `@fastify/static` `9.1.3` -> `10.1.3` transitively
- updated eval image processing:
  - `sharp` `0.34.5` -> `0.35.4`

# test plan
verified the changes with:
  - server-v3 and evals builds and typechecks
  - 64 server-v3 unit tests
  - Swagger documentation-route smoke test
  - Sharp resize, PNG, grayscale, metadata, and raw-buffer smoke test

<!-- This is an auto-generated description by cubic. -->
---
## Summary by cubic
Bumps non-core dependencies and transitive resolutions that `pnpm audit`
flagged, without changing behavior.

- Updates `sharp` to `0.35.4`, `fast-uri` to `3.1.6`, `find-my-way` to
`9.9.0`, `js-yaml` to `3.15.2`/`4.3.2`, and `body-parser` to `1.20.6`.
- Updates Swagger routing deps: `@fastify/swagger-ui` to `6.1.1`,
`fastify-zod-openapi` to `5.7.0`, and `@fastify/static` to `10.1.3`.
- `sharp` now requires Node `>=20.9.0`; eval image processing is
otherwise unchanged.
- Removes the stale `js-yaml@4.1.1` override so root tooling resolves
the current patched `4.x` release.
- Adds a patch changeset covering the server-v3 routing and OpenAPI
dependency refresh.
- Verified with server-v3 and evals builds, typechecks, and Swagger and
Sharp smoke tests.

<sup>Written for commit bd92ab1.
Summary will update on new commits.</sup>

<a
href="https://cubic.dev/pr/browserbase/stagehand/pull/2845?utm_source=github"
target="_blank" rel="noopener noreferrer"
data-no-image-dialog="true"><picture><source
media="(prefers-color-scheme: dark)"
srcset="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"><source
media="(prefers-color-scheme: light)"
srcset="https://www.cubic.dev/buttons/review-in-cubic-light.svg"><img
alt="Review in cubic"
src="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"></picture></a>

<!-- End of auto-generated description by cubic. -->

Author: seanmcguire12

.changeset/lazy-pumas-buy.md

@@ -0,0 +1,5 @@
+---
+"@browserbasehq/stagehand-server-v3": patch
+---
+
+refresh server routing and OpenAPI dependencies

package.json

@@ -85,7 +85,6 @@
       "esbuild": "0.28.1",
       "form-data": "^4.0.6",
       "tar": "^7.5.16",
-      "js-yaml@4.1.1": "4.2.0",
       "read-yaml-file": "2.1.0",
       "undici": "^7.29.0"
     }

packages/evals/package.json

@@ -30,7 +30,7 @@
     "dotenv": "^17.3.1",
     "openai": "^4.104.0",
     "playwright": ">=1.55.1 <1.57.0",
-    "sharp": "^0.34.5",
+    "sharp": "^0.35.4",
     "tsx": "*",
     "zod": "^4.2.1"
   },

packages/server-v3/package.json

@@ -26,12 +26,12 @@
     "@browserbasehq/stagehand": "workspace:*",
     "@fastify/cors": "^11.0.1",
     "@fastify/swagger": "^9.6.1",
-    "@fastify/swagger-ui": "^5.2.6",
+    "@fastify/swagger-ui": "^6.1.1",
     "@t3-oss/env-core": "^0.13.8",
     "fastify": "^5.8.5",
     "fastify-metrics": "^12.1.0",
     "fastify-plugin": "^4.5.1",
-    "fastify-zod-openapi": "^5.5.0",
+    "fastify-zod-openapi": "^5.7.0",
     "http-status-codes": "^2.3.0",
     "pino": "^9.7.0",
     "pino-pretty": "^11.3.0",