fix: address vulnerabilities 2026-04-17

[n1ru4l]

Background

See changesets

Reuntime deps

• https://github.com/graphql-hive/console/security/dependabot/664
• https://github.com/graphql-hive/console/security/dependabot/658
• https://github.com/graphql-hive/console/security/dependabot/657
• https://github.com/graphql-hive/console/security/dependabot/660
• https://github.com/graphql-hive/console/security/dependabot/662
  Dev deps:
• https://github.com/graphql-hive/console/security/dependabot/663

Description

[gemini-code-assist]

Code Review

This pull request updates @fastify/static to version 9.1.1 and adds several changeset files addressing various security vulnerabilities. The review feedback highlights the need to update the pnpm-lock.yaml file to ensure transitive vulnerabilities are properly resolved and suggests a capitalization fix in one of the changeset files for consistency.

[gemini-code-assist]

The pnpm-lock.yaml file is not updated in this pull request. This prevents the resolution of transitive vulnerabilities mentioned in the changesets (such as GHSA-72c6-fx6q-fr5w and GHSA-v9ww-2j6r-98q6), as they require a lockfile update to pin the secure versions.

[github-actions]

🚀 Snapshot Release (alpha)

The latest changes of this PR are available as alpha on npm (based on the declared changesets):

Package	Version	Info
@graphql-hive/laboratory	0.1.4-alpha-20260417063516-268532b6d757964032f0a3bf76ce5c2215357e61	npm ↗︎ unpkg ↗︎
@graphql-hive/render-laboratory	0.1.4-alpha-20260417063516-268532b6d757964032f0a3bf76ce5c2215357e61	npm ↗︎ unpkg ↗︎
hive	11.0.3-alpha-20260417063516-268532b6d757964032f0a3bf76ce5c2215357e61	npm ↗︎ unpkg ↗︎

[github-actions]

🐋 This PR was built and pushed to the following Docker images:

Targets: build

Platforms: linux/amd64

Image Tag: 268532b6d757964032f0a3bf76ce5c2215357e61