Skip to content

Nhost

v@nhost/[email protected] Security

This release includes 7 security fixes for security teams reviewing exposed deployments.

Published 27d API Development
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 7 known CVEs

Topics

authentication backend backend-as-a-service database firebase flutter
+12 more
graphql hasura javascript nextjs nhost postgresql react serverless serverless-functions storage typescript vue

Affected surfaces

deps

Summary

AI summary

Broad release touches deps, 🐛 Bug Fixes, Chore, and ⚙️ Miscellaneous Tasks.

Full changelog

[@nhost/[email protected]] - 2026-06-29

🐛 Bug Fixes

  • (deps) Update lodash due to vulnerability (#4108)
  • (deps) Update vite due to CVE (#4122)
  • (docs) Downgrade to vite7 due to incompatibilities (#4134)
  • (deps) Bump up uuid, Astro and xmldom due to CVEs (#4187)
  • (deps) Fix postcss XSS advisory (GHSA-qx2v-qp2m-jg93) (#4197)
  • (ci) Make build and check work on NixOS (#4234)
  • (deps) Fix fast-uri advisory (GHSA-v39h-62p7-jpjc) (#4265)
  • (deps) Fix ws advisory (GHSA-58qx-3vcg-4xpx) (#4307)
  • (deps) Bump up shellquote due to CVE (#4499)

⚙️ Miscellaneous Tasks

  • (ci) Added a small wrapper around govulncheck to allow filtering some CVEs (#4112)
  • (nixops) Drop nix-filter input in favor of pkgs.lib.fileset (#4377)
  • (nixops) Scope pinned toolchain overlays (#4506)

Chore

  • (deps) Update various npm packages due to cves (#4073)
  • (deps) Update deps due to cve (#4091)
  • (deps) Update pnpm to v11 (#4275)
  • (deps) Update various packages due to CVEs (#4328)
  • (deps) Update vulnerable dependencies (#4338)
  • (deps) Update vulnerable dependencies (#4530)

Security Fixes

  • CVE — Update lodash due to vulnerability (#4108)
  • CVE — Update vite due to CVE (#4122)
  • CVE — Bump uuid, Astro and xmldom due to CVEs (#4187)
  • GHSA-qx2v-qp2m-jg93 — Fix postcss XSS advisory (#4197)
  • GHSA-v39h-62p7-jpjc — Fix fast-uri advisory (#4265)
  • GHSA-58qx-3vcg-4xpx — Fix ws advisory (#4307)
  • CVE — Bump shellquote due to CVE (#4499)
View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track Nhost

Get notified when new releases ship.

Sign up free

About Nhost

The Open Source Firebase Alternative with GraphQL.

All releases →

Related context

Beta — feedback welcome: [email protected]