fix(deps): update packages with security advisories (#2567)

- server: @nestjs/* 11.2.7, @modelcontextprotocol/sdk 1.32.1,
  @fastify/multipart 10.1.2, pino-pretty 13.2.0, socket.io 4.8.4
- client: axios 1.20.0, katex 0.19.0, i18next-http-backend 4.0.2
- root: nx 23.3.0, concurrently 10.0.6, dompurify 3.4.16
- overrides: fastify 5.12.5, fast-uri 3.1.8, ip-address 10.7.3,
  brace-expansion@^5 5.0.12, smol-toml 1.9.0, katex 0.19.0
- re-resolve handlebars, proxy-addr, engine.io, @fastify/busboy,
  source-map-js, fast-copy, brace-expansion@1 to patched versions

apps/client/package.json

@@ -37,18 +37,18 @@
     "@tanstack/react-table": "8.21.3",
     "@tanstack/react-virtual": "3.14.3",
     "alfaaz": "1.1.0",
-    "axios": "1.18.1",
+    "axios": "1.20.0",
     "blueimp-load-image": "5.16.0",
     "clsx": "2.1.1",
     "file-saver": "2.0.5",
     "highlightjs-sap-abap": "0.3.0",
     "i18next": "25.10.1",
-    "i18next-http-backend": "3.0.6",
+    "i18next-http-backend": "4.0.2",
     "jotai": "2.20.1",
     "jotai-optics": "0.4.0",
     "js-cookie": "3.0.7",
     "jwt-decode": "4.0.0",
-    "katex": "0.16.40",
+    "katex": "0.19.0",
     "lowlight": "3.3.0",
     "mantine-form-zod-resolver": "1.3.0",
     "mermaid": "11.16.1",

apps/server/package.json

@@ -41,30 +41,30 @@
     "@docmost/base-formula": "workspace:*",
     "@docmost/pdf-inspector": "1.9.6",
     "@fastify/cookie": "11.1.2",
-    "@fastify/multipart": "10.1.1",
+    "@fastify/multipart": "10.1.2",
     "@fastify/static": "10.1.3",
     "@jmondi/oauth2-server": "^4.3.7",
     "@keyv/redis": "5.1.6",
     "@langchain/core": "1.1.46",
     "@langchain/textsplitters": "1.0.1",
-    "@modelcontextprotocol/sdk": "1.30.0",
+    "@modelcontextprotocol/sdk": "1.32.1",
     "@nest-lab/throttler-storage-redis": "1.2.0",
     "@nestjs-labs/nestjs-ioredis": "11.0.4",
     "@nestjs/bullmq": "11.0.5",
     "@nestjs/cache-manager": "3.1.3",
-    "@nestjs/common": "11.2.1",
+    "@nestjs/common": "11.2.7",
     "@nestjs/config": "4.0.4",
-    "@nestjs/core": "11.2.1",
+    "@nestjs/core": "11.2.7",
     "@nestjs/event-emitter": "3.1.0",
     "@nestjs/jwt": "11.0.2",
     "@nestjs/mapped-types": "2.1.1",
     "@nestjs/passport": "11.0.5",
-    "@nestjs/platform-fastify": "11.2.1",
-    "@nestjs/platform-socket.io": "11.2.1",
+    "@nestjs/platform-fastify": "11.2.7",
+    "@nestjs/platform-socket.io": "11.2.7",
     "@nestjs/schedule": "6.1.3",
     "@nestjs/terminus": "11.1.1",
     "@nestjs/throttler": "6.5.0",
-    "@nestjs/websockets": "11.2.1",
+    "@nestjs/websockets": "11.2.7",
     "@node-saml/passport-saml": "5.1.0",
     "@socket.io/redis-adapter": "8.3.0",
     "@turbopuffer/turbopuffer": "^2.8.0",
@@ -106,7 +106,7 @@
     "pg-tsquery": "8.4.2",
     "pgvector": "0.2.1",
     "pino-http": "11.0.0",
-    "pino-pretty": "13.1.3",
+    "pino-pretty": "13.2.0",
     "postgres": "3.4.8",
     "postmark": "4.0.7",
     "react": "19.2.7",
@@ -115,7 +115,7 @@
     "rxjs": "^7.8.2",
     "sanitize-filename": "1.6.3",
     "scimmy": "1.3.5",
-    "socket.io": "4.8.3",
+    "socket.io": "4.8.4",
     "stripe": "^17.7.0",
     "tlds": "1.261.0",
     "tmp-promise": "3.0.3",

package.json

@@ -65,7 +65,7 @@
     "date-fns": "4.1.0",
     "diff": "8.0.3",
     "docx": "9.7.1",
-    "dompurify": "3.4.13",
+    "dompurify": "3.4.16",
     "fractional-indexing-jittered": "1.0.0",
     "highlight.js": "11.11.1",
     "image-dimensions": "2.5.0",
@@ -81,12 +81,12 @@
     "yjs": "^13.6.30"
   },
   "devDependencies": {
-    "@nx/js": "23.1.1",
+    "@nx/js": "23.3.0",
     "@types/bytes": "3.1.5",
     "@types/qrcode": "1.5.6",
     "@types/turndown": "5.0.6",
-    "concurrently": "10.0.4",
-    "nx": "23.1.1",
+    "concurrently": "10.0.6",
+    "nx": "23.3.0",
     "tsx": "^4.21.0"
   },
   "workspaces": {

pnpm-workspace.yaml

@@ -7,8 +7,9 @@ overrides:
   prosemirror-changeset: 2.4.0
   glob: 13.0.6
   ws: 8.21.3
-  dompurify: 3.4.13
+  dompurify: 3.4.16
   mermaid: 11.16.1
+  katex: 0.19.0
   undici: 7.29.1
   tmp: 0.2.7
   nanoid@^3: 3.3.18
@@ -16,19 +17,19 @@ overrides:
   express-rate-limit: 8.2.2
   flatted: 3.4.2
   find-my-way: 9.7.0
-  fastify: 5.12.3
+  fastify: 5.12.5
   yaml@>=2.0.0 <2.8.3: 2.8.3
-  brace-expansion@^5: 5.0.9
-  axios: 1.18.1
-  ip-address: 10.5.1
-  fast-uri: 3.1.7
+  brace-expansion@^5: 5.0.12
+  axios: 1.20.0
+  ip-address: 10.7.3
+  fast-uri: 3.1.8
   form-data@>=4.0.0 <4.0.6: 4.0.6
   nanoid@>=4.0.0 <5.1.16: 5.1.16
   esbuild@>=0.27.3 <0.28.1: 0.28.1
   '@opentelemetry/core@>=2.0.0 <2.8.0': 2.9.0
   js-yaml@>=3.0.0 <3.15.2: 3.15.2
   js-yaml@>=4.0.0 <4.3.2: 4.3.2
-  smol-toml@<1.7.1: 1.7.1
+  smol-toml@<1.9.0: 1.9.0
 shamefullyHoist: true
 minimumReleaseAge: 4320
 allowBuilds: