chore: upgrade JavaScript dependencies to address 22 CVEs and 6 GHSAs (#1502)

* chore: upgrade dependencies to address security advisories

* docs: add security dependency changelog entry

* docs: link security changelog entry to PR

---------

Co-authored-by: Jack Minnetian <270441393+BlueBottleLatte@users.noreply.github.com>

Author: jsourcebot

CHANGELOG.md

@@ -15,6 +15,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Upgraded `brace-expansion` to `^1.1.16`/`^2.1.2`/`^5.0.7` to address CVE-2026-13149. [#1471](https://github.com/sourcebot-dev/sourcebot/pull/1471)
 - Upgraded `shell-quote` to `^1.10.0`. [#1469](https://github.com/sourcebot-dev/sourcebot/pull/1469)
 - Upgraded `js-yaml` to `^4.3.0`. [#1470](https://github.com/sourcebot-dev/sourcebot/pull/1470)
+- Fixed multiple CVEs in JavaScript dependencies by upgrading `next-auth`, `@auth/core`, `next`, `postcss`, `sharp`, `linkify-it`, `fast-uri`, `protobufjs`, `body-parser`, `hono`, `@hono/node-server`, and `dompurify` to patched versions, resolving all Yarn audit findings. [#1502](https://github.com/sourcebot-dev/sourcebot/pull/1502)
 
 ### Changed
 - Reduced Sentry span sampling to 10% outside development. [#1475](https://github.com/sourcebot-dev/sourcebot/pull/1475)

package.json

@@ -51,7 +51,10 @@
         "brace-expansion@npm:^2.0.2": "^2.0.3",
         "brace-expansion@npm:^5.0.2": "^5.0.5",
         "brace-expansion@npm:^1.1.7": "^1.1.13",
-        "@modelcontextprotocol/sdk/@hono/node-server": "^1.19.13",
+        "@modelcontextprotocol/sdk/@hono/node-server": "^2.0.5",
+        "next@npm:16.2.6": "^16.2.11",
+        "postcss@npm:8.4.31": "^8.5.12",
+        "sharp@npm:^0.34.5": "^0.35.3",
         "markdown-it@npm:^14.1.0": "^14.1.1",
         "yaml@npm:^2.3.4": "^2.8.3",
         "yaml@npm:^2.8.0": "^2.8.3",

packages/backend/package.json

@@ -39,7 +39,7 @@
         "chokidar": "^4.0.3",
         "cross-fetch": "^4.0.0",
         "dotenv": "^16.4.5",
-        "express": "^4.21.2",
+        "express": "^4.22.2",
         "express-async-errors": "^3.1.1",
         "fast-deep-equal": "^3.1.3",
         "git-url-parse": "^16.1.0",

packages/web/package.json

@@ -29,7 +29,7 @@
     "@ai-sdk/react": "^3.0.169",
     "@ai-sdk/xai": "^3.0.83",
     "@anthropic-ai/sdk": "^0.104.0",
-    "@auth/prisma-adapter": "^2.11.1",
+    "@auth/prisma-adapter": "^2.11.3",
     "@aws-sdk/credential-providers": "^3.1036.0",
     "@bprogress/next": "^3.2.12",
     "@codemirror/commands": "^6.6.0",
@@ -164,8 +164,8 @@
     "micromatch": "^4.0.8",
     "minidenticons": "^4.2.1",
     "motion": "^12.42.0",
-    "next": "^16.2.6",
-    "next-auth": "^5.0.0-beta.30",
+    "next": "^16.2.11",
+    "next-auth": "^5.0.0-beta.32",
     "next-navigation-guard": "^0.2.0",
     "next-themes": "^0.3.0",
     "nodemailer": "^9.0.1",
@@ -193,7 +193,7 @@
     "remark-gfm": "^4.0.1",
     "scroll-into-view-if-needed": "^3.1.0",
     "server-only": "^0.0.1",
-    "sharp": "^0.33.5",
+    "sharp": "^0.35.3",
     "simple-git": "^3.36.0",
     "slate": "^0.117.0",
     "slate-dom": "^0.116.0",
@@ -236,7 +236,7 @@
     "eslint-plugin-react-hooks": "^7.0.1",
     "jsdom": "^25.0.1",
     "npm-run-all": "^4.1.5",
-    "postcss": "^8.5.10",
+    "postcss": "^8.5.12",
     "raw-loader": "^4.0.2",
     "react-email": "^6.1.4",
     "react-grab": "^0.1.23",

packages/web/src/features/chat/attachments/validation.ts

@@ -1,6 +1,6 @@
 import 'server-only';
 
-import sharp from 'sharp';
+import sharp, { type Metadata } from 'sharp';
 import { ATTACHMENT_ALLOWED_IMAGE_MIME_TYPES, ATTACHMENT_MAX_IMAGE_DIMENSION } from '../constants';
 
 export type AllowedImageMediaType = typeof ATTACHMENT_ALLOWED_IMAGE_MIME_TYPES[number];
@@ -47,7 +47,7 @@ export const validateImageAttachment = async (
         return { ok: false, reason: `Image exceeds the ${Math.round(maxBytes / (1024 * 1024))}MB limit.` };
     }
 
-    let metadata: sharp.Metadata;
+    let metadata: Metadata;
     try {
         // `failOn: 'error'` makes sharp reject truncated/corrupt inputs instead
         // of best-effort decoding them.