vulnerabilities 2026-07-23 Episode I (#8250)

Author: n1ru4l

.changeset/calm-suits-thank.md

@@ -0,0 +1,6 @@
+---
+'hive': patch
+---
+
+Address vulnerability [GHSA-4c8g-83qw-93j6](https://github.com/advisories/GHSA-4c8g-83qw-93j6) and
+[GHSA-v2hh-gcrm-f6hx](https://github.com/advisories/GHSA-v2hh-gcrm-f6hx).

.changeset/giant-fans-type.md

@@ -0,0 +1,5 @@
+---
+'hive': patch
+---
+
+Address vulnerability [GHSA-hrxh-6v49-42gf](https://github.com/advisories/GHSA-hrxh-6v49-42gf).

.changeset/many-rocks-show.md

@@ -0,0 +1,5 @@
+---
+'hive': patch
+---
+
+Address vulnerability [GHSA-c2j3-45gr-mqc4](https://github.com/advisories/GHSA-c2j3-45gr-mqc4).

.changeset/tired-days-invite.md

@@ -0,0 +1,5 @@
+---
+'hive': patch
+---
+
+Address vulnerability [GHSA-v245-v573-v5vm](https://github.com/advisories/GHSA-v245-v573-v5vm).

docker/configs/otel-collector/extension-hiveauth/go.mod

@@ -48,7 +48,7 @@ require (
 	go.yaml.in/yaml/v3 v3.0.4 // indirect
 	golang.org/x/net v0.55.0 // indirect
 	golang.org/x/sys v0.45.0 // indirect
-	google.golang.org/grpc v1.79.3 // indirect
+	google.golang.org/grpc v1.82.1 // indirect
 	google.golang.org/protobuf v1.36.11 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 )

docker/configs/otel-collector/extension-hiveauth/go.sum

@@ -109,10 +109,10 @@ golang.org/x/sys v0.45.0 h1:dO4czNzziLiiXplLQgBCEpCvXQ3dnkn0SdaZSYdQ+FY=
 golang.org/x/sys v0.45.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
 golang.org/x/text v0.37.0 h1:Cqjiwd9eSg8e0QAkyCaQTNHFIIzWtidPahFWR83rTrc=
 golang.org/x/text v0.37.0/go.mod h1:a5sjxXGs9hsn/AJVwuElvCAo9v8QYLzvavO5z2PiM38=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20251222181119-0a764e51fe1b h1:Mv8VFug0MP9e5vUxfBcE3vUkV6CImK3cMNMIDFjmzxU=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20251222181119-0a764e51fe1b/go.mod h1:j9x/tPzZkyxcgEFkiKEEGxfvyumM01BEtsW8xzOahRQ=
-google.golang.org/grpc v1.79.3 h1:sybAEdRIEtvcD68Gx7dmnwjZKlyfuc61Dyo9pGXXkKE=
-google.golang.org/grpc v1.79.3/go.mod h1:KmT0Kjez+0dde/v2j9vzwoAScgEPx/Bw1CYChhHLrHQ=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260414002931-afd174a4e478 h1:RmoJA1ujG+/lRGNfUnOMfhCy5EipVMyvUE+KNbPbTlw=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260414002931-afd174a4e478/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
+google.golang.org/grpc v1.82.1 h1:NnAxzGRA0677vCa4BUkOAnO5+FfQqVl9iUXeD0IqcGE=
+google.golang.org/grpc v1.82.1/go.mod h1:yzTZ1TB1Z3SG+LIYaI+WiE8D5+PZ3ArnrSp8zF3+/ZA=
 google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
 google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=

package.json

@@ -164,7 +164,6 @@
       "yauzl@2.x.x": "^3.2.1",
       "glob@10.x.x": "^10.5.0",
       "path-to-regexp@0.x.x": "^0.1.13",
-      "fast-uri@2.x.x": "3.x.x",
       "ioredis": "5.10.1",
       "protobufjs@8.x.x": "8.6.4",
       "protobufjs@7.x.x": "7.6.5",
@@ -174,9 +173,18 @@
       "@babel/core": "7.29.7",
       "sha.js@<=2.4.11": ">=2.4.12",
       "brace-expansion@>=5.0.0 <5.0.6": ">=5.0.6",
+      "brace-expansion@>=2.0.0 <2.1.2": "^2.1.2",
+      "brace-expansion@<1.1.16": "^1.1.16",
       "@sigstore/core@<=3.2.0": ">=3.2.1",
       "js-yaml@<3.15.0": "3.15.0",
-      "sigstore@<=4.1.0": ">=4.1.1"
+      "js-yaml@>=4.0.0 <4.3.0": "4.3.0",
+      "sigstore@<=4.1.0": ">=4.1.1",
+      "tar@<=7.5.18": "7.5.21",
+      "fast-uri@2.x.x": "3.1.4",
+      "fast-uri@3.x.x": "3.1.4",
+      "@opentelemetry/propagator-jaeger@2.x.x": "2.9.0",
+      "sharp@<0.35.0": "0.35.0",
+      "body-parser@1.x.x": "1.20.6"
     },
     "patchedDependencies": {
       "mjml-core@4.14.0": "patches/mjml-core@4.14.0.patch",

packages/libraries/apollo/package.json

@@ -55,7 +55,7 @@
     "@as-integrations/express4": "1.1.2",
     "@graphql-tools/schema": "10.0.25",
     "@types/express": "4.17.21",
-    "body-parser": "2.2.1",
+    "body-parser": "2.3.0",
     "express": "4.21.2",
     "graphql": "16.9.0",
     "graphql-ws": "5.16.1",

packages/web/app/package.json

@@ -98,7 +98,7 @@
     "crypto-js": "^4.2.0",
     "date-fns": "4.1.0",
     "date-fns-tz": "3.2.0",
-    "dompurify": "3.4.11",
+    "dompurify": "3.4.12",
     "dotenv": "16.4.7",
     "echarts": "6.1.0",
     "echarts-for-react": "3.0.6",