feat: Fix msgscan Dependabot security alerts

package.json

@@ -7,5 +7,13 @@
     "start:web": "pnpm --filter @ringdao/msgscan-ui start",
     "build:web": "pnpm --filter @ringdao/msgscan-ui build",
     "build:all": "pnpm --filter @ringdao/* build"
+  },
+  "pnpm": {
+    "overrides": {
+      "esbuild": "0.28.1",
+      "lodash": "4.18.1",
+      "postcss": "8.5.16",
+      "vite": "7.3.6"
+    }
   }
-}
+}

packages/gripper/package.json

@@ -10,9 +10,9 @@
     "lint": "eslint . --ext .ts --fix"
   },
   "dependencies": {
-    "@fastify/express": "^4",
+    "@fastify/express": "^4.0.5",
     "@fastify/cors": "^10",
-    "@fastify/http-proxy": "^11",
+    "@fastify/http-proxy": "^11.4.4",
     "@joggr/fastify-prisma": "^5",
     "chalk": "^4",
     "commander": "^12",
@@ -22,7 +22,7 @@
     "typedi": "^0.10",
     "graphql-request": "^7.1.2",
     "@prisma/client": "6",
-    "fastify": "^5",
+    "fastify": "^5.8.3",
     "postgraphile": "^4.14.1",
     "@graphile-contrib/pg-simplify-inflector": "^6.1.0",
     "postgraphile-plugin-connection-filter": "^2.3.0"

packages/web/package.json

@@ -23,7 +23,7 @@
     "framer-motion": "^12.34.0",
     "graphql-request": "^7.4.0",
     "lucide-react": "^0.563.0",
-    "next": "16.1.6",
+    "next": "16.2.6",
     "next-themes": "0.4.6",
     "nuqs": "2.8.8",
     "react": "19.2.4",
@@ -45,7 +45,7 @@
     "@typescript-eslint/eslint-plugin": "8.55.0",
     "@typescript-eslint/parser": "8.55.0",
     "eslint": "9.39.2",
-    "eslint-config-next": "16.1.6",
+    "eslint-config-next": "16.2.6",
     "eslint-config-prettier": "^10.1.8",
     "eslint-import-resolver-typescript": "^4.4.4",
     "eslint-plugin-import": "^2.32.0",
@@ -55,7 +55,8 @@
     "prettier-plugin-tailwindcss": "^0.7.2",
     "tailwindcss": "4.1.18",
     "typescript": "5.9.3",
+    "vite": "^7.3.6",
     "vite-tsconfig-paths": "^6.1.1",
-    "vitest": "^4.0.18"
+    "vitest": "^4.1.0"
   }
 }

packages/web/src/hooks/services.ts

@@ -85,15 +85,13 @@ export function useMessages(
   );
 
   return useQuery({
-    // Keep query key stable by using serialized filter/paging snapshots.
-    // eslint-disable-next-line @tanstack/query/exhaustive-deps
     queryKey: ['messages', filtersKey, pagingKey, chainKey],
     enabled: options?.enabled ?? true,
-    queryFn: async ({ signal }) =>
+    queryFn: async ({ signal, queryKey: [, filtersSnapshot, pagingSnapshot, queryChainKey] }) =>
       fetchMessages({
-        filters,
-        paging,
-        chains: resolveChainsByKey(chainKey),
+        filters: JSON.parse(filtersSnapshot) as MessageFilters,
+        paging: JSON.parse(pagingSnapshot) as MessagePaging,
+        chains: resolveChainsByKey(queryChainKey),
         signal
       }),
     // Status filtering triggers expensive multi-step scanning. Avoid background polling,