deps(frontend): bump immutable, postcss, fast-uri and rspack [security]

[Zaimwa9]

Thanks for submitting a PR! Please check the boxes below:

• I have read the Contributing Guide.
• I have added information to docs/ if required so people know about the feature.
• I have filled in the "Changes" section below.
• I have filled in the "How did you test this code" section below.

Changes

Clears five High advisories flagged against the flagsmith-frontend image on 2.256.0 and 2.257.0. All five were already open Trivy alerts on main — trivy.yaml sets exit-code: 0, so they never blocked a build.

Lockfile only: every range in package.json already permitted the patched versions, so no manifest changes are needed.

Advisory	The hole	Impact on Flagsmith	Fixed in
CVE-2026-59880 (immutable)	Hash collisions in Map/Set degrade insert/lookup to a CPU DoS when an attacker controls keys.	None reachable. immutable is a transitive dep of sass only, used to compile SCSS at build time; no app code imports it.	immutable 5.1.9
CVE-2026-59879 (immutable)	List indices between 2^30 and 2^31 cause infinite loops, unbounded allocation or silent wraparound.	None reachable. Same build-time-only path as above.	immutable 5.1.9
GHSA-r28c-9q8g-f849 (postcss)	sourceMappingURL comments are followed without sandboxing .., disclosing arbitrary .map files.	None reachable. postcss comes in via css-loader; it only ever processes our own CSS during npm run bundle, never untrusted input at runtime.	postcss 8.5.25
CVE-2026-16221 (fast-uri)	A literal backslash is not treated as an authority delimiter, so host allowlists and SSRF filters can be bypassed.	None reachable. fast-uri comes in via ajv, used by rspack/webpack/terser to validate their own config schemas — never for host decisions.	fast-uri 3.1.4
CVE-2026-13676 (fast-uri)	Failed IDN canonicalisation allows the same host confusion via Unicode hostnames. Not in the original scan, fixed by the same bump.	None reachable. Same build-time-only path as above.	fast-uri 3.1.4
CVE-2026-55603 (http-proxy-middleware)	Unescaped CRLF in fixRequestBody lets an attacker inject multipart/form-data fields, desynchronising the proxy from the backend.	Not our direct dependency — we pin 3.0.7, which is already patched. The hit is a vendored copy at @rspack/core/compiled/http-proxy-middleware@4.0.0, invisible to npm audit. Dev-server only; the runtime image never loads it.	@rspack/* 2.1.7, vendoring 4.2.0

Also picks up body-parser 1.20.6 (GHSA-v422-hmwv-36x6) and brace-expansion 2.1.3/5.0.8 (GHSA-3jxr-9vmj-r5cp).

So the exposure is nil in a deployed container — all six are build tooling that ships inside the image because oss-frontend copies the whole /build/frontend/ (including node_modules) and the build deps live in dependencies rather than devDependencies. Only flagsmith-frontend is affected; the API and unified images carry the compiled bundle only, no npm packages. Splitting build from runtime deps so the toolchain stops shipping is a follow-up.

Known remaining High in the production tree: brace-expansion via express-handlebars@6 → glob → minimatch. That line has no patch; clearing it needs express-handlebars@8, a breaking major, so it is left for a separate PR.

How did you test this code?

• npm audit --omit=dev no longer reports any of the six; the only High left is the express-handlebars chain noted above.
• Confirmed the fifth CVE at its real location: @rspack/core@2.0.5 vendors compiled/http-proxy-middleware@4.0.0, and 2.1.7 vendors 4.2.0.
• ENV=selfhosted npm run bundle compiles clean on rspack 2.1.7 — 0 errors, 24 pre-existing sass deprecation warnings.
• npm run test:unit — 25 suites, 284 tests, all passing.
• git diff frontend/package.json is empty, confirming the bumps sit inside the declared ranges.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
flagsmith-frontend-preview	Ready	Preview, Comment	Jul 29, 2026 3:01pm
flagsmith-frontend-staging	Ready	Preview, Comment	Jul 29, 2026 3:01pm

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Ignored	Preview	Jul 29, 2026 3:01pm

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (1)

• frontend/package-lock.json is excluded by !**/package-lock.json

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 719bd109-8acb-4af4-98fb-8d33d47f460d

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Docker builds report

Image	Build Status	Security report
ghcr.io/flagsmith/flagsmith-api-test:pr-8156	Finished ✅	Skipped
ghcr.io/flagsmith/flagsmith-api:pr-8156	Finished ✅	Results ✅
ghcr.io/flagsmith/flagsmith:pr-8156	Finished ✅	Results ✅
ghcr.io/flagsmith/flagsmith-private-cloud:pr-8156	Finished ✅	Results ✅
ghcr.io/flagsmith/flagsmith-frontend:pr-8156	Finished ✅	Results ✅
ghcr.io/flagsmith/flagsmith-e2e:pr-8156	Finished ✅	Skipped

[github-actions]

✅ private-cloud · depot-ubuntu-latest-arm-16 — run #18854 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-arm-16)

 2 passed

Details

 2 tests across 2 suites
 36.8 seconds
 2883bfb
 🔄 Run: #18854 (attempt 1)

🗂️ Previous results

✅ private-cloud · depot-ubuntu-latest-16 — run #18854 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-16)

 22 passed
 1 skipped

Details

 23 tests across 18 suites
 1 minute, 26 seconds
 2883bfb
 🔄 Run: #18854 (attempt 1)

Skipped tests

firefox › tests/onboarding-tests.pw.ts › Onboarding › New user connects via the single-page onboarding flow @oss

✅ oss · depot-ubuntu-latest-16 — run #18854 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-16)

 1 passed

Details

 1 test across 1 suite
 37.6 seconds
 2883bfb
 🔄 Run: #18854 (attempt 1)

✅ oss · depot-ubuntu-latest-arm-16 — run #18854 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-arm-16)

 2 passed

Details

 2 tests across 2 suites
 47.1 seconds
 2883bfb
 🔄 Run: #18854 (attempt 1)

[github-actions]

Visual Regression

19 screenshots compared. See report for details.
View full report