chore: upgrade JavaScript dependencies to address 22 CVEs and 6 GHSAs

[jsourcebot]

Fixes SOU-1556
Fixes SOU-1564
Fixes SOU-1565
Fixes SOU-1566
Fixes SOU-1568
Fixes SOU-1570
Fixes SOU-1571
Fixes SOU-1572
Fixes SOU-1573
Fixes SOU-1574
Fixes SOU-1575
Fixes SOU-1576
Fixes SOU-1577
Fixes SOU-1578
Fixes SOU-1579
Fixes SOU-1580
Fixes SOU-1581
Fixes SOU-1582
Fixes SOU-1583
Fixes SOU-1584
Fixes SOU-1590
Fixes SOU-1591
Fixes SOU-1592
Fixes SOU-1593
Fixes SOU-1594

Summary

• Upgrades Auth.js to next-auth@5.0.0-beta.32 and @auth/core@0.41.3, Next.js to 16.2.11, PostCSS to 8.5.22, and Sharp to 0.35.3.
• Refreshes or upgrades linkify-it, fast-uri, protobufjs, Express/body-parser, Hono, @hono/node-server, and DOMPurify to patched releases.
• Uses qualified Yarn resolutions only where an exact or incompatible transitive range would otherwise retain a vulnerable version.
• Updates the Sharp metadata type import for Sharp 0.35 compatibility.
• Removes every finding reported by yarn npm audit --all --recursive --no-deprecations.

Advisories

This resolves:

• CVE-2026-59877
• CVE-2026-13676 and CVE-2026-16221
• CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, and CVE-2026-35591
• CVE-2026-12590
• CVE-2026-64641 through CVE-2026-64649
• CVE-2026-59887
• CVE-2026-59895, CVE-2026-59896, and CVE-2026-59897
• CVE-2026-45623
• GHSA-c2j3-45gr-mqc4
• GHSA-frvp-7c67-39w9
• GHSA-7rqj-j65f-68wh
• GHSA-8fpg-xm3f-6cx3
• GHSA-x445-f3h2-j279
• GHSA-xmf8-cvqr-rfgj

SOU-1561 is excluded because it belongs to sourcebot-dev/lighthouse. SOU-1567 is excluded because the vulnerable gRPC-Go dependency belongs to the sourcebot-dev/zoekt submodule repository. Neither advisory is claimed by this PR or its changelog entry.

Verification

• yarn npm audit --all --recursive --no-deprecations --json — no findings
• make
• yarn build
• yarn lint — zero errors
• yarn test — 120 test files and 1,789 tests passed
• git diff --check

Supersedes

This consolidated PR supersedes the overlapping per-package CVE PRs #1467, #1477, #1478, #1479, #1480, #1486, #1487, #1488, #1489, #1490, #1491, #1492, #1493, #1494, #1495, #1496, #1497, #1498, #1499, and #1500.

---

Note

Medium Risk
Touches authentication (next-auth), the Next.js app shell, Express, and Sharp-based upload validation; risk is mostly regression from version bumps rather than new logic, but those surfaces are security-sensitive.

Overview
This PR bumps vulnerable JavaScript dependencies across the monorepo so yarn npm audit reports no findings, and documents the fix in CHANGELOG.

Web upgrades include next 16.2.11, next-auth 5.0.0-beta.32 (with @auth/core / @auth/prisma-adapter), sharp 0.35.3, and postcss 8.5.12. Backend moves express to 4.22.2. The root package.json adds Yarn resolutions (e.g. @hono/node-server, pinned next, postcss, sharp) so transitive trees pick patched versions.

Transitive refreshes in the lockfile cover hono, dompurify, fast-uri, linkify-it, protobufjs, body-parser, and related Express stack packages. The only application code change is in chat attachment validation: import Metadata from sharp instead of sharp.Metadata for Sharp 0.35 typing.

^{Reviewed by Cursor Bugbot for commit f4999ef. Bugbot is set up for automated code reviews on this repo. Configure here.}

Summary by CodeRabbit

• Bug Fixes

  • Updated dependencies to address multiple security vulnerabilities and resolve all reported Yarn audit findings.
  • Improved security and stability across authentication, web framework, image processing, request handling, and content sanitization components.

• Maintenance

  • Updated backend and web application dependencies, including authentication, framework, styling, and image-processing packages.
  • Documented the security updates in the changelog.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 0304706f-2753-4a2f-b705-fb67e368a79d

📥 Commits

Reviewing files that changed from the base of the PR and between a536249 and f4999ef.

⛔ Files ignored due to path filters (1)

• yarn.lock is excluded by !**/yarn.lock, !**/*.lock

📒 Files selected for processing (5)

• CHANGELOG.md
• package.json
• packages/backend/package.json
• packages/web/package.json
• packages/web/src/features/chat/attachments/validation.ts

---

Walkthrough

Dependency resolutions and workspace package versions were updated for security fixes, with a changelog entry added. Image attachment validation now uses an explicit sharp metadata type import without runtime behavior changes.

Changes

Dependency security updates

Layer / File(s)	Summary
Dependency version and resolution updates package.json, packages/backend/package.json, packages/web/package.json, CHANGELOG.md	Root resolutions and backend/web dependencies were upgraded across framework, authentication, image, CSS, server, and related packages, with the fixes recorded in the changelog.
Sharp metadata type import packages/web/src/features/chat/attachments/validation.ts	The attachment validator now imports Metadata as a named type and uses it for decoded image metadata; runtime validation remains unchanged.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• sourcebot-dev/sourcebot#970: Updates the Next.js dependency.
• sourcebot-dev/sourcebot#1121: Updates dependency resolutions and the changelog for audit-related fixes.
• sourcebot-dev/sourcebot#1203: Updates Next.js for CVE-related fixes.

Suggested reviewers: brendan-kellam, whoisthey

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: upgrading JavaScript dependencies to fix security advisories.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch cursor/cve/security-dependencies

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

License Audit

⚠️ Status: PASS

Metric	Count
Total packages	2200
Resolved (non-standard)	8
Unresolved	0
Strong copyleft	0
Weak copyleft	28

Weak Copyleft Packages (informational)

Package	Version	License
@img/sharp-libvips-darwin-arm64	1.3.2	LGPL-3.0-or-later
@img/sharp-libvips-darwin-x64	1.3.2	LGPL-3.0-or-later
@img/sharp-libvips-linux-arm	1.3.2	LGPL-3.0-or-later
@img/sharp-libvips-linux-arm64	1.3.2	LGPL-3.0-or-later
@img/sharp-libvips-linux-ppc64	1.3.2	LGPL-3.0-or-later
@img/sharp-libvips-linux-riscv64	1.3.2	LGPL-3.0-or-later
@img/sharp-libvips-linux-s390x	1.3.2	LGPL-3.0-or-later
@img/sharp-libvips-linux-x64	1.3.2	LGPL-3.0-or-later
@img/sharp-libvips-linuxmusl-arm64	1.3.2	LGPL-3.0-or-later
@img/sharp-libvips-linuxmusl-x64	1.3.2	LGPL-3.0-or-later
@img/sharp-wasm32	0.35.3	Apache-2.0 AND LGPL-3.0-or-later AND MIT
@img/sharp-win32-arm64	0.35.3	Apache-2.0 AND LGPL-3.0-or-later
@img/sharp-win32-ia32	0.35.3	Apache-2.0 AND LGPL-3.0-or-later
@img/sharp-win32-x64	0.35.3	Apache-2.0 AND LGPL-3.0-or-later
axe-core	4.10.3	MPL-2.0
dompurify	3.4.12	(MPL-2.0 OR Apache-2.0)
lightningcss	1.32.0	MPL-2.0
lightningcss-android-arm64	1.32.0	MPL-2.0
lightningcss-darwin-arm64	1.32.0	MPL-2.0
lightningcss-darwin-x64	1.32.0	MPL-2.0
lightningcss-freebsd-x64	1.32.0	MPL-2.0
lightningcss-linux-arm-gnueabihf	1.32.0	MPL-2.0
lightningcss-linux-arm64-gnu	1.32.0	MPL-2.0
lightningcss-linux-arm64-musl	1.32.0	MPL-2.0
lightningcss-linux-x64-gnu	1.32.0	MPL-2.0
lightningcss-linux-x64-musl	1.32.0	MPL-2.0
lightningcss-win32-arm64-msvc	1.32.0	MPL-2.0
lightningcss-win32-x64-msvc	1.32.0	MPL-2.0

Resolved Packages (8)

Package	Version	Original	Resolved	Source
codemirror-lang-elixir	4.0.0	UNKNOWN	Apache-2.0	npm page (registry metadata: license field = Apache-2.0)
khroma	2.1.0	UNKNOWN	MIT	npm page (registry metadata: license field = MIT)
lezer-elixir	1.1.2	UNKNOWN	Apache-2.0	npm page (registry metadata: license field = Apache-2.0)
map-stream	0.1.0	UNKNOWN	MIT	npm page (registry metadata: license field = MIT)
memorystream	0.3.1	UNKNOWN	MIT	npm page (registry metadata: licenses array = [{"type":"MIT"}])
pause-stream	0.0.11	["MIT","Apache2"]	(MIT OR Apache-2.0)	extracted from object (license array in oss-licenses.json lists MIT and Apache2)
posthog-js	1.369.0	SEE LICENSE IN LICENSE	Apache-2.0	GitHub repo (LICENSE file: Apache-2.0 primary license; MIT applies only to some vendored third-party files)
valid-url	1.0.9	UNKNOWN	MIT	GitHub repo (LICENSE file: MIT)