Skip to content

SRE-938: Fix npm vulnerabilities from the 2026-08-10 scan #9182

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
TimDiekmann merged 1 commit into from
Aug 10, 2026
Merged

SRE-938: Fix npm vulnerabilities from the 2026-08-10 scan #9182

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions apps/hash-api/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -96,14 +96,14 @@
"http-terminator": "3.2.0",
"immer": "10.1.3",
"install": "0.13.0",
"js-yaml": "4.3.0",
"js-yaml": "4.3.1",
"jsonpath": "1.3.0",
"keyv": "5.6.0",
"lodash": "4.18.1",
"long": "5.3.2",
"md5": "2.3.0",
"mime-types": "2.1.35",
"nanoid": "3.3.11",
"nanoid": "3.3.17",
"nodemailer": "9.0.1",
"oembed-providers": "1.0.20250926",
"openai": "6.6.0",
Expand Down
2 changes: 1 addition & 1 deletion apps/hash-frontend/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -85,7 +85,7 @@
"buffer": "6.0.3",
"clsx": "2.1.1",
"date-fns": "4.1.0",
"dompurify": "3.4.12",
"dompurify": "3.4.13",
"dotenv-flow": "3.3.0",
"echarts": "6.1.0",
"elkjs": "0.11.0",
Expand Down
2 changes: 1 addition & 1 deletion libs/@local/repo-chores/node/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,7 +24,7 @@
"fs-extra": "11.3.2",
"globby": "15.0.0",
"ignore": "7.0.5",
"js-yaml": "4.3.0",
"js-yaml": "4.3.1",
"regex-parser": "2.3.1",
"tsx": "4.20.6",
"typescript": "5.9.3",
Expand Down
8 changes: 4 additions & 4 deletions package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -84,21 +84,21 @@
"@blockprotocol/core": "0.1.5",
"@changesets/assemble-release-plan@npm:^6.0.9": "patch:@changesets/assemble-release-plan@npm%3A6.0.9#~/.yarn/patches/@changesets-assemble-release-plan-npm-6.0.9-e01af97ef4.patch",
"@playwright/test": "1.58.2",
"@redocly/openapi-core/js-yaml": "4.3.0",
"@redocly/openapi-core/js-yaml": "4.3.1",
"@temporalio/proto/protobufjs": "^7.5.8",
"@tldraw/editor@npm:2.0.0-alpha.12": "patch:@tldraw/editor@npm%3A2.0.0-alpha.12#~/.yarn/patches/@tldraw-editor-npm-2.0.0-alpha.12-ba59bf001c.patch",
"@tldraw/tlschema@npm:2.0.0-alpha.12": "patch:@tldraw/tlschema@npm%3A2.0.0-alpha.12#~/.yarn/patches/@tldraw-tlschema-npm-2.0.0-alpha.12-13bf88407b.patch",
"blockprotocol@npm:0.0.10": "patch:blockprotocol@npm%3A0.0.12#~/.yarn/patches/blockprotocol-npm-0.0.12-2558a31f0a.patch",
"bull/uuid": "11.1.0",
"canvas": "3.2.0",
"dompurify": "3.4.12",
"dompurify": "3.4.13",
"fast-xml-parser": "5.7.0",
"http-proxy-middleware@npm:^2.0.9": "patch:http-proxy-middleware@npm%3A3.0.7#~/.yarn/patches/http-proxy-middleware-npm-3.0.7-89cd070ac6.patch",
"jsondiffpatch": "0.7.2",
"lodash": "4.18.1",
"next/postcss": "8.5.18",
"next/postcss": "8.5.25",
"next/sharp": "0.35.3",
"postcss@npm:8.5.14": "8.5.18",
"postcss@npm:8.5.14": "8.5.25",
"prosemirror-model@npm:>=1.0.0": "patch:prosemirror-model@npm%3A1.18.2#~/.yarn/patches/prosemirror-model-npm-1.18.2-479d845b52.patch",
"prosemirror-model@npm:^1.0.0": "patch:prosemirror-model@npm%3A1.18.2#~/.yarn/patches/prosemirror-model-npm-1.18.2-479d845b52.patch",
"prosemirror-model@npm:^1.16.0": "patch:prosemirror-model@npm%3A1.18.2#~/.yarn/patches/prosemirror-model-npm-1.18.2-479d845b52.patch",
Expand Down
2 changes: 1 addition & 1 deletion tests/hash-playwright/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,7 @@
"@playwright/test": "1.58.2",
"execa": "9.6.0",
"graphql": "16.11.0",
"js-yaml": "4.3.0"
"js-yaml": "4.3.1"
},
"devDependencies": {
"@apps/hash-api": "workspace:*",
Expand Down
116 changes: 48 additions & 68 deletions yarn.lock
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -587,14 +587,14 @@ __metadata:
http-terminator: "npm:3.2.0"
immer: "npm:10.1.3"
install: "npm:0.13.0"
js-yaml: "npm:4.3.0"
js-yaml: "npm:4.3.1"
jsonpath: "npm:1.3.0"
keyv: "npm:5.6.0"
lodash: "npm:4.18.1"
long: "npm:5.3.2"
md5: "npm:2.3.0"
mime-types: "npm:2.1.35"
nanoid: "npm:3.3.11"
nanoid: "npm:3.3.17"
nodemailer: "npm:9.0.1"
oembed-providers: "npm:1.0.20250926"
openai: "npm:6.6.0"
Expand Down Expand Up @@ -704,7 +704,7 @@ __metadata:
buffer: "npm:6.0.3"
clsx: "npm:2.1.1"
date-fns: "npm:4.1.0"
dompurify: "npm:3.4.12"
dompurify: "npm:3.4.13"
dotenv-flow: "npm:3.3.0"
echarts: "npm:6.1.0"
elkjs: "npm:0.11.0"
Expand Down Expand Up @@ -8771,7 +8771,7 @@ __metadata:
fs-extra: "npm:11.3.2"
globby: "npm:15.0.0"
ignore: "npm:7.0.5"
js-yaml: "npm:4.3.0"
js-yaml: "npm:4.3.1"
regex-parser: "npm:2.3.1"
tsx: "npm:4.20.6"
typescript: "npm:5.9.3"
Expand Down Expand Up @@ -16099,7 +16099,7 @@ __metadata:
eslint: "npm:9.39.4"
execa: "npm:9.6.0"
graphql: "npm:16.11.0"
js-yaml: "npm:4.3.0"
js-yaml: "npm:4.3.1"
rimraf: "npm:6.1.3"
typescript: "npm:5.9.3"
languageName: unknown
Expand Down Expand Up @@ -21440,30 +21440,30 @@ __metadata:
linkType: hard

"brace-expansion@npm:^1.1.7":
version: 1.1.17
resolution: "brace-expansion@npm:1.1.17"
version: 1.1.18
resolution: "brace-expansion@npm:1.1.18"
dependencies:
balanced-match: "npm:^1.0.0"
concat-map: "npm:0.0.1"
checksum: 10c0/0bc6fe7e757999d3a2a9f26b9d60087643c055de8cc81a69d52ab256c1695a9d719b61731e19892281c6cf865700238d6328ffb98b6e2628b997227530a5ca54
checksum: 10c0/3432c18a9e2ebf94162d4effb62198bd0adea06a9f332b2c0188df5d5e30b1e51ea3c848b6608e47d0b857ebe1ea5b3888ed3326dd3c4f6f9645c94153cf9c14
languageName: node
linkType: hard

"brace-expansion@npm:^2.0.1, brace-expansion@npm:^2.0.2":
version: 2.1.3
resolution: "brace-expansion@npm:2.1.3"
version: 2.1.4
resolution: "brace-expansion@npm:2.1.4"
dependencies:
balanced-match: "npm:^1.0.0"
checksum: 10c0/62bef43c5755b4978662d66d0844635cc171610644da7d0266db8c0180c21c6e8ff7b969a27d2f2ec7893b6efd9c33dc73383d84a467669832f2da1fd3771f99
checksum: 10c0/6c0a0e2573eac1dc565b52b1e1bfbeba39bf1830d106ebbc61ff1eaefcf610e9111cd3baa091addd18e33292135c99e019d3184d966389d85dc958fdcdc1449f
languageName: node
linkType: hard

"brace-expansion@npm:^5.0.2":
version: 5.0.8
resolution: "brace-expansion@npm:5.0.8"
version: 5.0.9
resolution: "brace-expansion@npm:5.0.9"
dependencies:
balanced-match: "npm:^4.0.2"
checksum: 10c0/73304caafd00fdc5b0168e693ac15bf25b6357dec76d1195fcd628fe2cf99c46f9c889a7ecfa3cfe236dbd2d5ce3e27a6ccc4370b46d475d0d19081e11f86019
checksum: 10c0/3dea38884a1c3c8b1c9c44a7402a0c76fca460f70cffb3127242b0b4cbf4472019e022ade021eec44838ff19f1dac2625dfd11dd459d7e1e055b0698a8d52fec
languageName: node
linkType: hard

Expand Down Expand Up @@ -23983,15 +23983,15 @@ __metadata:
languageName: node
linkType: hard

"dompurify@npm:3.4.12":
version: 3.4.12
resolution: "dompurify@npm:3.4.12"
"dompurify@npm:3.4.13":
version: 3.4.13
resolution: "dompurify@npm:3.4.13"
dependencies:
"@types/trusted-types": "npm:^2.0.7"
dependenciesMeta:
"@types/trusted-types":
optional: true
checksum: 10c0/127a13817353d4e20e75a991a9022a04c3af12af7479f68e2b8bee6dbc7330a96edfb8f4ebff96f4f0f24cd43e8dbba46214131f510c3aa87a843bd8b610d0ab
checksum: 10c0/9c2a1a71e1a1d8b77953db7a39ffc935ef4ed4f10fe40770232128c2cbfd4c3dc677d3d7bae51eb24cc52d9ff3548612dc540ecb4343e89b26e809d2be2e0cfe
languageName: node
linkType: hard

Expand Down Expand Up @@ -26355,9 +26355,9 @@ __metadata:
linkType: hard

"fast-uri@npm:^3.0.1":
version: 3.1.4
resolution: "fast-uri@npm:3.1.4"
checksum: 10c0/f90948821ceb49980f64f89b8216ba498f5957f26035be813526a55b6145d26cbd63ef5618d5205a3292b31edc9c08589749350cd72bd86c7095eb434dceb757
version: 3.1.5
resolution: "fast-uri@npm:3.1.5"
checksum: 10c0/2bf60eb800dd610c65e17be436425dcb21c92aff3a87d442a8bccab0b7b071e88cf1a5d7d1ea946370b937e6fc0375c405c0296c10587e57de4f78be4646d1d0
languageName: node
linkType: hard

Expand Down Expand Up @@ -28229,9 +28229,9 @@ __metadata:
linkType: hard

"hono@npm:^4.11.4":
version: 4.12.29
resolution: "hono@npm:4.12.29"
checksum: 10c0/ee56efba993e765088c8e160e3e6fbe28138e0ae84a9f0e810917ef7cbb4dff2c50c947cabad1ec4852a5baf0225354a9e6dc8da9da66af0b0827e842a1870f7
version: 4.13.0
resolution: "hono@npm:4.13.0"
checksum: 10c0/d7cfb4d1063be19bea1982ea2a6b3cfa1840e8403a03203e86d17278e76fed11e7483974738345257543e183a935ea73ffc6d4a1e6ad7f0008451f55cdf8be7b
languageName: node
linkType: hard

Expand Down Expand Up @@ -29104,9 +29104,9 @@ __metadata:
linkType: hard

"ip-address@npm:^10.1.1, ip-address@npm:^10.2.0":
version: 10.2.0
resolution: "ip-address@npm:10.2.0"
checksum: 10c0/5a00aada6e922c9c69dfc800ed5d0fa3348675ebdeed0e1575f503f27ca385b5f534363c9af7ad1daf64c1f1409388cdd3cc2e9b9b0fe1c924a431378d55075a
version: 10.4.0
resolution: "ip-address@npm:10.4.0"
checksum: 10c0/d7b0bd2624fd861afbae6e49036a9b56f9506eaff7ff38592b7b4492dd5c272b53f5356dc8cc019e318acf29a96c90a3d1af1df761960267d23efa96858270fa
languageName: node
linkType: hard

Expand Down Expand Up @@ -30306,26 +30306,26 @@ __metadata:
languageName: node
linkType: hard

"js-yaml@npm:4.3.0, js-yaml@npm:^4.1.0, js-yaml@npm:^4.1.1":
version: 4.3.0
resolution: "js-yaml@npm:4.3.0"
"js-yaml@npm:4.3.1, js-yaml@npm:^4.1.0, js-yaml@npm:^4.1.1":
version: 4.3.1
resolution: "js-yaml@npm:4.3.1"
dependencies:
argparse: "npm:^2.0.1"
bin:
js-yaml: bin/js-yaml.js
checksum: 10c0/058b30473d6915ca5b4feb11e2f7d4d97242f98d00a798ed48dd90b46b7c640398afe9128c5db22c5300f8c6528fe2a174b9a93f351a70ebc28c6203938d8bff
checksum: 10c0/13c500ca322e0c3f8c81686e6ecda96d2ea37b45247a420c17c7db36932d6965cc27391abc2d1a104501600e7f0d947a5f8b7be6db619c4fefa87901b3512807
languageName: node
linkType: hard

"js-yaml@npm:^3.6.1":
version: 3.15.0
resolution: "js-yaml@npm:3.15.0"
version: 3.15.1
resolution: "js-yaml@npm:3.15.1"
dependencies:
argparse: "npm:^1.0.7"
esprima: "npm:^4.0.0"
bin:
js-yaml: bin/js-yaml.js
checksum: 10c0/ca966bd354ac5b1b7a4694ebdba46526796aa3a6a99529fa540af2abf85918bd155a50ccc0166b413130a00622999973754458ec01e7095bc902177bfdbd5b64
checksum: 10c0/6c693b8c59ffe12021df3b36994b090df19d920826dd810baab81652b40861e1974509dd11fe92225ab4c00cc14de053300c94db015c2c0e211edea39b118737
languageName: node
linkType: hard

Expand Down Expand Up @@ -33452,30 +33452,21 @@ __metadata:
languageName: node
linkType: hard

"nanoid@npm:3.3.11":
version: 3.3.11
resolution: "nanoid@npm:3.3.11"
bin:
nanoid: bin/nanoid.cjs
checksum: 10c0/40e7f70b3d15f725ca072dfc4f74e81fcf1fbb02e491cf58ac0c79093adc9b0a73b152bcde57df4b79cd097e13023d7504acb38404a4da7bc1cd8e887b82fe0b
languageName: node
linkType: hard

"nanoid@npm:^3.0.0, nanoid@npm:^3.3.12, nanoid@npm:^3.3.16":
version: 3.3.16
resolution: "nanoid@npm:3.3.16"
"nanoid@npm:3.3.17, nanoid@npm:^3.0.0, nanoid@npm:^3.3.16":
version: 3.3.17
resolution: "nanoid@npm:3.3.17"
bin:
nanoid: bin/nanoid.cjs
checksum: 10c0/bbf2dcffe22d2b62d16de2711752070b539c0f644c7916f823ad6521986b2078cbe524f2d6240f58c46e9141ea0c7b87a029e100c0f7f175228cacaf30e41bba
checksum: 10c0/06f7949c7cce5c92c6aea66022f29a1eae7f56e05acbfddf1e049e819b4bf234c44a765cc44da7163482b111677948514012e27acdfa56f95309295768bdae32
languageName: node
linkType: hard

"nanoid@npm:^5.1.6":
version: 5.1.6
resolution: "nanoid@npm:5.1.6"
version: 5.1.16
resolution: "nanoid@npm:5.1.16"
bin:
nanoid: bin/nanoid.js
checksum: 10c0/27b5b055ad8332cf4f0f9f6e2a494aa7e5ded89df4cab8c8490d4eabefe72c4423971d2745d22002868b1d50576a5e42b7b05214733b19f576382323282dd26e
checksum: 10c0/04b4f96237f5639716da0e98f453361b313bebaf458bb67dea2d384724fc8b3340a28f032a4373052150bcf3b801d122e291d81ae4fc522969f55c134f4401a3
languageName: node
linkType: hard

Expand Down Expand Up @@ -35735,25 +35726,14 @@ __metadata:
languageName: node
linkType: hard

"postcss@npm:8.5.18":
version: 8.5.18
resolution: "postcss@npm:8.5.18"
dependencies:
nanoid: "npm:^3.3.12"
picocolors: "npm:^1.1.1"
source-map-js: "npm:^1.2.1"
checksum: 10c0/6fbab24a457ca5b90d423c333d0bab13e6646fda646e83235eed892f9e4f2dc6c50689ddc5ac1632fc085be2e096d2e8e03779ac092de6353e1cfcbbc3681685
languageName: node
linkType: hard

"postcss@npm:^8.3.11, postcss@npm:^8.4.14, postcss@npm:^8.4.33, postcss@npm:^8.5.15, postcss@npm:^8.5.16, postcss@npm:^8.5.3, postcss@npm:^8.5.6":
version: 8.5.22
resolution: "postcss@npm:8.5.22"
"postcss@npm:8.5.25, postcss@npm:^8.3.11, postcss@npm:^8.4.14, postcss@npm:^8.4.33, postcss@npm:^8.5.15, postcss@npm:^8.5.16, postcss@npm:^8.5.3, postcss@npm:^8.5.6":
version: 8.5.25
resolution: "postcss@npm:8.5.25"
dependencies:
nanoid: "npm:^3.3.16"
picocolors: "npm:^1.1.1"
source-map-js: "npm:^1.2.1"
checksum: 10c0/9e143ee457988049d5f187116fd37f2750ae9d8d71cc99eae690b776e549e134b34086cbaa2f0360ecd1729b15d918227bd0fc3a2ffbe341f7212d0827080793
checksum: 10c0/0a12c1e74b456c57122e81f684e02fd98ff4d57526f794d10c996df1147158808f5ae373ac82b988c8de6cbbaa82dbd7b13803b14f5dd3cf7cc6a42ccad5c9f2
languageName: node
linkType: hard

Expand Down Expand Up @@ -41620,9 +41600,9 @@ __metadata:
linkType: hard

"undici@npm:^7.10.0, undici@npm:^7.28.0":
version: 7.28.0
resolution: "undici@npm:7.28.0"
checksum: 10c0/fe781983a26098795e99bb1f64906cbb7d0bcaa029a26baade007b53ea67f2631d189b8f9671a31f4c8d0cb3773b7559608628ba54452fef51fec90e7c78bb0d
version: 7.29.0
resolution: "undici@npm:7.29.0"
checksum: 10c0/85ea96e91e7f3de24de678cbbc54230fdd641a3b0643005f2aef044af1f1a2db8fbecb88b28e6fa78bb41ffeafda4479b57075b6b6ab92beac4b7b5ab53f9b10
languageName: node
linkType: hard

Expand Down
Loading