Package upgrades for security vulnerability (#8200)

Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>

Author: jdolle

.changeset/giant-games-move.md

@@ -0,0 +1,6 @@
+---
+'hive': patch
+---
+
+Security upgrades for dependencies (including ws, protobufjs, js-yaml, and others) to address security vulnerabilities.
+Upgrade nodejs from 24.14.1 to 24.17.0

.github/workflows/pr.yaml

@@ -93,7 +93,7 @@ jobs:
       restoreDeletedChangesets: true
       buildScript: build:libraries
       packageManager: pnpm
-      nodeVersion: '24.14'
+      nodeVersion: '24.17'
     secrets:
       githubToken: ${{ secrets.GITHUB_TOKEN }}
       npmToken: ${{ secrets.NPM_TOKEN }}

.github/workflows/release-alpha.yaml

@@ -13,7 +13,7 @@ jobs:
       npmTag: alpha
       buildScript: build:libraries
       packageManager: pnpm
-      nodeVersion: '24.14'
+      nodeVersion: '24.17'
     secrets:
       githubToken: ${{ secrets.GITHUB_TOKEN }}
       npmToken: ${{ secrets.NPM_TOKEN }}

.node-version

@@ -1 +1 @@
-24.14.1
+24.17.0

docker/cli.dockerfile

@@ -1,4 +1,4 @@
-FROM node:24.14.1-slim
+FROM node:24.17.0-slim
 
 RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates git && rm -rf /var/lib/apt/lists/*
 

docker/migrations.dockerfile

@@ -1,4 +1,4 @@
-FROM node:24.14.1-slim
+FROM node:24.17.0-slim
 
 RUN apt-get update && apt-get install -y ca-certificates
 

docker/services.dockerfile

@@ -1,4 +1,4 @@
-FROM node:24.14.1-slim
+FROM node:24.17.0-slim
 
 RUN apt-get update && apt-get install -y wget ca-certificates && rm -rf /var/lib/apt/lists/*
 

integration-tests/docker-compose.integration.yaml

@@ -11,7 +11,7 @@ networks:
 
 services:
   local_cdn:
-    image: node:24.14.1-alpine3.23
+    image: node:24.17.0-alpine3.23
     working_dir: /app
     command: ['node', 'index.js']
     networks:
@@ -37,7 +37,7 @@ services:
       S3_BUCKET_NAME: artifacts
 
   local_broker:
-    image: node:24.14.1-alpine3.23
+    image: node:24.17.0-alpine3.23
     working_dir: /app
     command: ['node', 'broker.js']
     networks:
@@ -89,7 +89,7 @@ services:
       SECRET: '${EXTERNAL_COMPOSITION_SECRET}'
 
   external_composition:
-    image: node:24.14.1-alpine3.23
+    image: node:24.17.0-alpine3.23
     working_dir: /app
     command: ['node', 'example.mjs']
     networks:
@@ -291,10 +291,10 @@ services:
 
   # It's not part of integration tests
   app:
-    image: node:24.14.1-alpine3.23
+    image: node:24.17.0-alpine3.23
     command: ['npx', 'http-server']
 
   # Redpand is used for integration tests, instead of Kafka. Zookeeper is no longer needed
   zookeeper:
-    image: node:24.14.1-alpine3.23
+    image: node:24.17.0-alpine3.23
     command: ['npx', 'http-server']

integration-tests/package.json

@@ -12,7 +12,7 @@
     "typecheck": "tsc --noEmit"
   },
   "devDependencies": {
-    "@apollo/gateway": "2.14.0",
+    "@apollo/gateway": "2.14.2",
     "@apollo/server": "5.5.1",
     "@apollo/subgraph": "2.14.0",
     "@aws-sdk/client-s3": "3.1035.0",

package.json

@@ -14,7 +14,7 @@
   "private": true,
   "packageManager": "pnpm@10.33.2+sha512.a90faf6feeab71ad6c6e57f94e0fe1a12f5dcc22cd754db40ae9593eb6a3e0b6b12e3540218bb37ae083404b1f2ce6db2a4121e979829b4aff94b99f49da1cf8",
   "engines": {
-    "node": ">=24.14.1",
+    "node": ">=24.17.0",
     "pnpm": ">=10.33.2"
   },
   "scripts": {
@@ -82,7 +82,7 @@
     "@graphql-tools/load": "8.1.2",
     "@manypkg/get-packages": "2.2.2",
     "@parcel/watcher": "2.5.1",
-    "@playwright/test": "1.59.1",
+    "@playwright/test": "1.60.0",
     "@sentry/cli": "2.40.0",
     "@swc/core": "1.13.5",
     "@theguild/eslint-config": "0.12.1",
@@ -134,8 +134,8 @@
       "mjml-core@4.14.0>html-minifier": "-",
       "mjml-cli@4.14.0>html-minifier": "-",
       "@fastify/vite@6>vite": "-",
-      "ws@^8.0.0": "^8.18.0",
-      "ws@*": ">=8.18.0 || >=7.5.10 || >=6.2.3 || >=5.2.4",
+      "ws@^8.0.0": "^8.21.0",
+      "ws@*": ">=8.21.0 || >=7.5.10 || >=6.2.3 || >=5.2.4",
       "cookie@<0.7.0": "0.7.2",
       "tar-fs": "2.1.4",
       "ip": "npm:neoip@2.1.0",
@@ -167,11 +167,17 @@
       "fast-uri@2.x.x": "3.x.x",
       "ioredis": "5.10.1",
       "protobufjs@8.x.x": "8.6.4",
-      "protobufjs@7.x.x": "7.6.1",
+      "protobufjs@7.x.x": "7.6.3",
       "@opentelemetry/exporter-jaeger": "-",
       "uuid@<14.x.x": "^14.0.0",
       "tmp@<0.2.7": "0.2.7",
-      "@babel/core": "7.29.7"
+      "@babel/core": "7.29.7",
+      "sha.js@<=2.4.11": ">=2.4.12",
+      "brace-expansion@>=5.0.0 <5.0.6": ">=5.0.6",
+      "@sigstore/core@<=3.2.0": ">=3.2.1",
+      "js-yaml@<3.15.0": "3.15.0",
+      "echarts@<6.1.0": ">=6.1.0",
+      "sigstore@<=4.1.0": ">=4.1.1"
     },
     "patchedDependencies": {
       "mjml-core@4.14.0": "patches/mjml-core@4.14.0.patch",