chore: upgrade fflate to 0.4.9 to address CVE-2026-45820

[claude]

Fixes SOU-2141

Refreshes the yarn.lock entry for fflate from 0.4.8 to 0.4.9 to address CVE-2026-45820 (GHSA reported via Dependabot alert 335): unzipSync() can enter an infinite loop when parsing a malformed ZIP64 archive whose central directory entry declares compressed_size=0xFFFFFFFF without the required ZIP64 extra field.

Details

• fflate is a transitive dependency: posthog-js@1.369.0 → fflate@^0.4.8.
• The existing ^0.4.8 range already admits the patched 0.4.9, so this is a lockfile refresh only (yarn up -R fflate). No package.json change and no resolutions override is needed.

Verification

• yarn why fflate now reports a single instance, fflate@npm:0.4.9.
• yarn test passes (2153 tests across queryLanguage, shared, backend, web).

🤖 Generated with Claude Code

---

Note

Low Risk
Lockfile-only dependency patch for a known ZIP parsing DoS/hang; no application code changes.

Overview
Bumps the locked transitive fflate dependency from 0.4.8 to 0.4.9 (via posthog-js) to address CVE-2026-45820, where unzipSync() could hang on malformed ZIP64 archives. There is no package.json change—only yarn.lock and an Unreleased changelog entry under Fixed.

^{Reviewed by Cursor Bugbot for commit 8d4d946. Bugbot is set up for automated code reviews on this repo. Configure here.}

---

Summary by cubic

Fixes SOU-2141 by upgrading fflate from 0.4.8 to 0.4.9 in yarn.lock to address CVE-2026-45820, where unzipSync() could loop indefinitely on a malformed ZIP64 archive.

fflate is a transitive dependency of posthog-js, and the existing ^0.4.8 range already allows 0.4.9, so this is a lockfile-only change with no package.json updates. yarn why fflate reports a single 0.4.9 instance, and the test suite passes.

^{Written for commit ed93329. Summary will update on new commits.}

[github-actions]

@claude[bot] your pull request is missing a changelog!

[github-actions]

License Audit

❌ Audit failed to produce results. Check the workflow logs for details.