chore: upgrade fflate to 0.4.9 to address CVE-2026-45820

[claude]

Fixes SOU-2141

Refreshes the yarn.lock entry for fflate from 0.4.8 to 0.4.9 to address CVE-2026-45820 (GHSA reported via Dependabot alert 335): unzipSync() can enter an infinite loop when parsing a malformed ZIP64 archive whose central directory entry declares compressed_size=0xFFFFFFFF without the required ZIP64 extra field.

Details

• fflate is a transitive dependency: posthog-js@1.369.0 → fflate@^0.4.8.
• The existing ^0.4.8 range already admits the patched 0.4.9, so this is a lockfile refresh only (yarn up -R fflate). No package.json change and no resolutions override is needed.

Verification

• yarn why fflate now reports a single instance, fflate@npm:0.4.9.
• yarn test passes (2153 tests across queryLanguage, shared, backend, web).

🤖 Generated with Claude Code

---

Note

Low Risk
Lockfile-only security patch for a transitive dependency; no application code or direct API surface changes.

Overview
Bumps the transitive fflate dependency from 0.4.8 to 0.4.9 via a yarn.lock refresh (no package.json changes), addressing CVE-2026-45820 where malformed ZIP64 archives could cause unzipSync() to hang.

Documents the upgrade under Unreleased → Fixed in CHANGELOG.md.

^{Reviewed by Cursor Bugbot for commit 010c068. Bugbot is set up for automated code reviews on this repo. Configure here.}

---

Summary by cubic

Fixes SOU-2141 by upgrading fflate from 0.4.8 to 0.4.9 to address CVE-2026-45820, where unzipSync() could loop indefinitely on a malformed ZIP64 archive. fflate is a transitive dependency of posthog-js, and the existing ^0.4.8 range already allows 0.4.9, so no package.json change is needed. Updates yarn.lock and the changelog; yarn why fflate reports a single 0.4.9 instance and the test suite passes.

^{Written for commit 010c068. Summary will update on new commits.}

[github-actions]

License Audit

⚠️ Status: PASS

Metric	Count
Total packages	2173
Resolved (non-standard)	8
Unresolved	0
Strong copyleft	0
Weak copyleft	28

Weak Copyleft Packages (informational)

Package	Version	License
@img/sharp-libvips-darwin-arm64	1.3.2	LGPL-3.0-or-later
@img/sharp-libvips-darwin-x64	1.3.2	LGPL-3.0-or-later
@img/sharp-libvips-linux-arm	1.3.2	LGPL-3.0-or-later
@img/sharp-libvips-linux-arm64	1.3.2	LGPL-3.0-or-later
@img/sharp-libvips-linux-ppc64	1.3.2	LGPL-3.0-or-later
@img/sharp-libvips-linux-riscv64	1.3.2	LGPL-3.0-or-later
@img/sharp-libvips-linux-s390x	1.3.2	LGPL-3.0-or-later
@img/sharp-libvips-linux-x64	1.3.2	LGPL-3.0-or-later
@img/sharp-libvips-linuxmusl-arm64	1.3.2	LGPL-3.0-or-later
@img/sharp-libvips-linuxmusl-x64	1.3.2	LGPL-3.0-or-later
@img/sharp-wasm32	0.35.3	Apache-2.0 AND LGPL-3.0-or-later AND MIT
@img/sharp-win32-arm64	0.35.3	Apache-2.0 AND LGPL-3.0-or-later
@img/sharp-win32-ia32	0.35.3	Apache-2.0 AND LGPL-3.0-or-later
@img/sharp-win32-x64	0.35.3	Apache-2.0 AND LGPL-3.0-or-later
axe-core	4.10.3	MPL-2.0
dompurify	3.4.13	(MPL-2.0 OR Apache-2.0)
lightningcss	1.32.0	MPL-2.0
lightningcss-android-arm64	1.32.0	MPL-2.0
lightningcss-darwin-arm64	1.32.0	MPL-2.0
lightningcss-darwin-x64	1.32.0	MPL-2.0
lightningcss-freebsd-x64	1.32.0	MPL-2.0
lightningcss-linux-arm-gnueabihf	1.32.0	MPL-2.0
lightningcss-linux-arm64-gnu	1.32.0	MPL-2.0
lightningcss-linux-arm64-musl	1.32.0	MPL-2.0
lightningcss-linux-x64-gnu	1.32.0	MPL-2.0
lightningcss-linux-x64-musl	1.32.0	MPL-2.0
lightningcss-win32-arm64-msvc	1.32.0	MPL-2.0
lightningcss-win32-x64-msvc	1.32.0	MPL-2.0

Resolved Packages (8)

Package	Version	Original	Resolved	Source
codemirror-lang-elixir	4.0.0	UNKNOWN	Apache-2.0	GitHub repo (livebook-dev/codemirror-lang-elixir LICENSE); npm registry reports Apache-2.0 for 4.0.1
khroma	2.1.0	UNKNOWN	MIT	GitHub repo (fabiospampinato/khroma license file)
lezer-elixir	1.1.2	UNKNOWN	Apache-2.0	GitHub repo (livebook-dev/lezer-elixir LICENSE); npm registry reports Apache-2.0 for 1.1.3
map-stream	0.1.0	UNKNOWN	MIT	GitHub repo (dominictarr/map-stream LICENCE); npm registry package-level license is MIT
memorystream	0.3.1	UNKNOWN	MIT	extracted from object (npm registry legacy "licenses":[{"type":"MIT"}]); confirmed by GitHub repo LICENSE
pause-stream	0.0.11	MIT,Apache2	(MIT OR Apache-2.0)	extracted from object/array license field; confirmed by GitHub repo LICENSE ("Dual Licensed MIT and Apache 2")
posthog-js	1.369.0	SEE LICENSE IN LICENSE	(Apache-2.0 AND MIT)	GitHub repo (PostHog/posthog-js LICENSE: Apache-2.0 with MIT-licensed bundled components); npm registry reports "(Apache-2.0 AND MIT)" for later versions
valid-url	1.0.9	UNKNOWN	MIT	GitHub repo (ogt/valid-url LICENSE text: "released under the MIT license")