address vulnerabilities 2026-07-27 Episode I (#8268)

Author: n1ru4l

.changeset/happy-showers-cough.md

@@ -0,0 +1,5 @@
+---
+'hive': patch
+---
+
+Address vulnerability [GHSA-mv8w-475r-vwqw](https://github.com/advisories/GHSA-mv8w-475r-vwqw).

.changeset/lovely-maps-work.md

@@ -0,0 +1,6 @@
+---
+'hive': patch
+---
+
+Address vulnerability [GHSA-8pvw-jcv7-9cmj](https://github.com/advisories/GHSA-8pvw-jcv7-9cmj) and
+[GHSA-83w8-p2f5-377r](https://github.com/advisories/GHSA-83w8-p2f5-377r).

package.json

@@ -133,7 +133,6 @@
       "csstype": "3.1.2",
       "mjml-core@4.14.0>html-minifier": "-",
       "mjml-cli@4.14.0>html-minifier": "-",
-      "@fastify/vite@6>vite": "-",
       "ws@^8.0.0": "^8.21.0",
       "ws@*": ">=8.21.0 || >=7.5.10 || >=6.2.3 || >=5.2.4",
       "cookie@<0.7.0": "0.7.2",
@@ -152,7 +151,7 @@
       "diff@<8.0.3": "^8.0.3",
       "lodash-es@4.x.x": "^4.17.23",
       "lodash@4.x.x": "^4.17.23",
-      "seroval@<1.4.1": "^1.4.1",
+      "seroval@<1.5.3": "1.5.3",
       "fast-xml-parser@<5.7.0": "^5.7.2",
       "minimatch@10.x.x": "^10.2.2",
       "amqplib": "^0.8.0",
@@ -172,7 +171,7 @@
       "tmp@<0.2.7": "0.2.7",
       "@babel/core": "7.29.7",
       "sha.js@<=2.4.11": ">=2.4.12",
-      "brace-expansion@>=5.0.0 <5.0.6": ">=5.0.6",
+      "brace-expansion@>=5.0.0 <5.0.8": "5.0.8",
       "brace-expansion@>=2.0.0 <2.1.2": "^2.1.2",
       "brace-expansion@<1.1.16": "^1.1.16",
       "@sigstore/core@<=3.2.0": ">=3.2.1",

packages/libraries/external-composition/package.json

@@ -63,7 +63,7 @@
     "@apollo/composition": "2.14.0",
     "@types/node": "24.13.3",
     "esbuild": "0.28.1",
-    "fastify": "5.8.5",
+    "fastify": "5.10.0",
     "graphql": "16.9.0"
   },
   "publishConfig": {

packages/libraries/laboratory/package.json

@@ -107,7 +107,7 @@
     "monaco-graphql": "^1.7.3",
     "monacopilot": "^1.2.12",
     "next-themes": "^0.4.6",
-    "postcss": "^8.5.12",
+    "postcss": "8.5.18",
     "postcss-prefixwrap": "^1.57.2",
     "react": "18.3.1",
     "react-dom": "18.3.1",

packages/services/cdn-worker/package.json

@@ -24,7 +24,7 @@
     "bcryptjs": "2.4.3",
     "dotenv": "16.4.7",
     "esbuild": "0.28.1",
-    "fastify": "5.8.5",
+    "fastify": "5.10.0",
     "graphql": "16.9.0",
     "itty-router": "4.2.2",
     "itty-router-extras": "0.4.6",

packages/services/commerce/package.json

@@ -19,7 +19,7 @@
     "@trpc/server": "10.45.3",
     "date-fns": "4.1.0",
     "dotenv": "16.4.7",
-    "fastify": "5.8.5",
+    "fastify": "5.10.0",
     "pino-pretty": "11.3.0",
     "reflect-metadata": "0.2.2",
     "stripe": "17.5.0",

packages/services/policy/package.json

@@ -18,7 +18,7 @@
     "ajv": "8.18.0",
     "dotenv": "16.4.7",
     "eslint": "8.57.1",
-    "fastify": "5.8.5",
+    "fastify": "5.10.0",
     "graphql": "16.9.0",
     "pino-pretty": "11.3.0",
     "zod": "3.25.76",

packages/services/schema/package.json

@@ -22,7 +22,7 @@
     "@types/ioredis-mock": "8.2.5",
     "dotenv": "16.4.7",
     "fast-json-stable-stringify": "2.1.0",
-    "fastify": "5.8.5",
+    "fastify": "5.10.0",
     "fastq": "1.19.1",
     "got": "14.4.7",
     "graphql": "16.9.0",

packages/services/server/package.json

@@ -20,8 +20,8 @@
     "@escape.tech/graphql-armor-max-depth": "2.4.2",
     "@escape.tech/graphql-armor-max-directives": "2.3.1",
     "@escape.tech/graphql-armor-max-tokens": "2.5.1",
-    "@fastify/cookie": "11.0.2",
-    "@fastify/cors": "11.2.0",
+    "@fastify/cookie": "11.1.2",
+    "@fastify/cors": "11.3.0",
     "@fastify/formbody": "8.0.2",
     "@graphql-hive/plugin-opentelemetry": "1.4.35",
     "@graphql-hive/yoga": "workspace:*",
@@ -43,7 +43,7 @@
     "@trpc/server": "10.45.3",
     "@whatwg-node/server": "0.10.17",
     "dotenv": "16.4.7",
-    "fastify": "5.8.5",
+    "fastify": "5.10.0",
     "got": "14.4.7",
     "graphql": "16.9.0",
     "graphql-yoga": "5.13.3",