fix(security): bump dependencies with critical advisories

[ArtyomSavchenko]

Summary

Updates transitive dependencies flagged with critical severity CVEs to their patched versions, across the six Rush pnpm lockfiles and the foundations/stream Go module.

Fixed versions

Package	From → To	Advisory
handlebars	4.7.8 → 4.7.9	JavaScript Injection via AST Type Confusion (GHSA-2w6w-674q-4c4q, GHSA-3mfm-83xf-c92r, GHSA-xhpv-hc6g-r9c6)
protobufjs	7.5.4 → 7.5.5	Arbitrary code execution (GHSA-xq3m-2v4x-88gg)
shell-quote	1.8.3 → 1.8.4	Command injection via unescaped newlines in object .op values (GHSA-w7jw-789q-3m8p)
fast-xml-parser	4.5.3 → 4.5.4, 5.2.5 → 5.3.5	Entity encoding bypass via regex injection in DOCTYPE entity names (GHSA-m7jm-9gc2-mpf2)
basic-ftp	5.0.5 → 5.2.0	Path traversal in downloadToDir() (GHSA-5rq4-664w-9x2c)
google.golang.org/grpc	1.75.0 → 1.79.3	Authorization bypass via missing leading slash in :path (GHSA-p77j-4mvh-x3m3)

Files changed

• npm (pnpm lockfiles): common/config/rush, foundations/{server,net,communication,core,utils}/common/config/rush
• Go: foundations/stream/go.mod + go.sum

Approach

All affected npm packages are transitive dependencies in Rush-managed lockfiles. The changes were applied as surgical lockfile edits — only the vulnerable package keys, integrity hashes, and internal references change — rather than a full rush update. This keeps the diff minimal (68 balanced insertions/deletions) and avoids unrelated churn.

Two reasons rush update was not used to regenerate the lockfiles:

1. Four of the repos cannot re-resolve standalone: their packages declare cross-repo dependencies (e.g. @hcengineering/platform-rig) with the workspace: protocol while the committed lockfiles resolve them from the registry — a pre-existing mismatch unrelated to this change.
2. Where it did run, it introduced incidental churn (e.g. typescript patch bumps) outside the scope of the security fix.

The fast-xml-parser 5.3.5 bump also nudges its strnum dependency 2.1.1 → 2.1.2 to satisfy the new ^2.1.2 range. Integrity hashes were taken from the npm registry.

For the Go module, go get google.golang.org/grpc@v1.79.3 + go mod tidy pulled the minimal required transitive updates (genproto, x/net, protobuf, otel).

Verification

• All six lockfiles: valid YAML, no stale versions remain, and every bumped version has matching packages: and snapshots: entries (graph is internally consistent).
• Go module: go build ./... passes and go mod verify reports all modules verified.
• Confirmed no other tracked lockfile still carries the vulnerable versions.

Note: a full frozen rush install could not be used as an end-to-end gate because the committed lockfiles already fail it independently, due to the pre-existing workspace:-vs-registry staleness described above — that failure is unrelated to and unaffected by these bumps.

🤖 Generated with Claude Code

---

Generated by Claude Code