From 9f62ffa015604bcf67648929a98a0bc486b6092b Mon Sep 17 00:00:00 2001
From: Stefan Steiner <ssteiner@tableau.com>
Date: Thu, 13 Aug 2026 22:52:49 -0700
Subject: [PATCH] chore(deps): bump vulnerable npm deps to clear Dependabot
 alerts
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Update npm dependencies flagged by Dependabot security alerts. The
Apache Thrift Rust alert (#16) is intentionally left out — the patched
0.23.0 cannot yet be adopted without breaking other dependencies.

hyperdb-api-node/package-lock.json:
- js-yaml 4.2.0 -> 4.3.1  (GHSA-5p4m-2wfm-xmqj high, GHSA-52cp-r559-cp3m high)

hyperdb-api-node/examples/hyper-explorer/package-lock.json:
- postcss     8.5.15 -> 8.5.26  (GHSA-r28c-9q8g-f849 high, GHSA-fxqj-rqcc-2cmp med)
- shell-quote 1.8.4  -> 1.10.0  (GHSA-395f-4hp3-45gv high)
- body-parser 1.20.5 -> 1.20.6  (GHSA-v422-hmwv-36x6 low)
- nanoid      3.3.12 -> 3.3.17  (pulled forward transitively by postcss)

Lockfile-only changes; node_modules is gitignored and no package.json
manifests changed. All four alerted packages are patched.
---
 .../examples/hyper-explorer/package-lock.json | 32 +++++++++----------
 hyperdb-api-node/package-lock.json            |  6 ++--
 2 files changed, 19 insertions(+), 19 deletions(-)

diff --git a/hyperdb-api-node/examples/hyper-explorer/package-lock.json b/hyperdb-api-node/examples/hyper-explorer/package-lock.json
index 2063de5..8cf7579 100644
--- a/hyperdb-api-node/examples/hyper-explorer/package-lock.json
+++ b/hyperdb-api-node/examples/hyper-explorer/package-lock.json
@@ -34,9 +34,9 @@
     "../..": {
       "license": "MIT OR Apache-2.0",
       "devDependencies": {
-        "@napi-rs/cli": "^3.7.2",
-        "apache-arrow": "^21.1.0",
-        "tsx": "^4.22.4"
+        "@napi-rs/cli": "^3.8.2",
+        "apache-arrow": "^21.2.0",
+        "tsx": "^4.23.11"
       },
       "engines": {
         "node": ">= 21"
@@ -1606,9 +1606,9 @@
       }
     },
     "node_modules/body-parser": {
-      "version": "1.20.5",
-      "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-1.20.5.tgz",
-      "integrity": "sha512-3grm+/2tUOvu2cjJkvsIxrv/wVpfXQW4PsQHYm7yk4vfpu7Ekl6nEsYBoJUL6qDwZUx8wUhQ8tR2qz+ad9c9OA==",
+      "version": "1.20.6",
+      "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-1.20.6.tgz",
+      "integrity": "sha512-p5tAzS57i5MV9fZFDj9LeIiTZEufbSe2eDozP+ElheSUq1m74CRq1jI4mYNDdVs9vQztXFLuk/Gd6BWTdwRJ5g==",
       "license": "MIT",
       "dependencies": {
         "bytes": "~3.1.2",
@@ -3137,9 +3137,9 @@
       }
     },
     "node_modules/nanoid": {
-      "version": "3.3.12",
-      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.12.tgz",
-      "integrity": "sha512-ZB9RH/39qpq5Vu6Y+NmUaFhQR6pp+M2Xt76XBnEwDaGcVAqhlvxrl3B2bKS5D3NH3QR76v3aSrKaF/Kiy7lEtQ==",
+      "version": "3.3.17",
+      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.17.tgz",
+      "integrity": "sha512-xQLf0A3HOMlgHq0n247/LRuAOYmB7dXJ/DvAxGvsSBij45XtBSmQycu+F8ODbHwns/XyFZagyL1+J0Offw1E0g==",
       "dev": true,
       "funding": [
         {
@@ -3309,9 +3309,9 @@
       }
     },
     "node_modules/postcss": {
-      "version": "8.5.15",
-      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.15.tgz",
-      "integrity": "sha512-FfR8sjd4em2T6fb3I2MwAJU7HWVMr9zba+enmQeeWFfCbm+UOC/0X4DS8XtpUTMwWMGbjKYP7xjfNekzyGmB3A==",
+      "version": "8.5.26",
+      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.26.tgz",
+      "integrity": "sha512-u82N74LFzG8ca+dD8puPnplTXoGH4fTPpVGuIbt36G3qvNlkvfD0lEAZSxaly3KX8TS/L1A1gsCEmvKmBcVbkQ==",
       "dev": true,
       "funding": [
         {
@@ -3329,7 +3329,7 @@
       ],
       "license": "MIT",
       "dependencies": {
-        "nanoid": "^3.3.12",
+        "nanoid": "^3.3.17",
         "picocolors": "^1.1.1",
         "source-map-js": "^1.2.1"
       },
@@ -3857,9 +3857,9 @@
       "license": "ISC"
     },
     "node_modules/shell-quote": {
-      "version": "1.8.4",
-      "resolved": "https://registry.npmjs.org/shell-quote/-/shell-quote-1.8.4.tgz",
-      "integrity": "sha512-VsC6n6vz1ihYYyZZwX7YZSF5l5x36ca17OC+a69h94YqB7X6XLwf+5MOgynYir2SLFUbl8gIYvBo8K8RoNQ6bQ==",
+      "version": "1.10.0",
+      "resolved": "https://registry.npmjs.org/shell-quote/-/shell-quote-1.10.0.tgz",
+      "integrity": "sha512-w1aiOKwKuRgtwAReIIj89puqg+I7GvX4IbLrvmhXbzQsj1+Zwi4VO3+fa6ZF91TWSjIxoEkKnMeHcLEODK5ZXA==",
       "dev": true,
       "license": "MIT",
       "engines": {
diff --git a/hyperdb-api-node/package-lock.json b/hyperdb-api-node/package-lock.json
index f8761e4..9a6ff2b 100644
--- a/hyperdb-api-node/package-lock.json
+++ b/hyperdb-api-node/package-lock.json
@@ -2267,9 +2267,9 @@
       }
     },
     "node_modules/js-yaml": {
-      "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.2.0.tgz",
-      "integrity": "sha512-ePWsvanv0DWuDRsW8dnt+R4jQ31SCRCQ7hhNcPXZPsoBZiemuZNYGf7adZdqX2D86j6rvKp3RpCxVTSb8WQlOw==",
+      "version": "4.3.1",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.1.tgz",
+      "integrity": "sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==",
       "dev": true,
       "funding": [
         {