chore(deps): OSV batch — clear all 21 known vulnerabilities across 8 packages

.changeset/osv-batch-2026-07-dep-bumps.md

@@ -0,0 +1,14 @@
+---
+"@objectstack/create-objectstack": patch
+"@objectstack/metadata": patch
+---
+
+chore(deps): OSV security batch — bump tar to ^7.5.21 (GHSA-r292-9mhp-454m) and
+js-yaml to ^5.2.2 (GHSA-pm4m-ph32-ghv5)
+
+Both are declared-range bumps to the patched releases, so downstream installs
+resolve the fixed versions from the published manifests, not just this
+workspace's lockfile. The same batch clears the remaining transitive advisories
+(next 16.2.11 in apps/docs; workspace overrides for brace-expansion, sharp,
+react-router, @sveltejs/kit, @hono/node-server) — those live in pnpm-workspace.yaml
+and the private docs app, which do not ship.

apps/docs/package.json

@@ -18,7 +18,7 @@
     "fumadocs-ui": "16.11.5",
     "lucide-react": "^1.25.0",
     "mermaid": "^11.16.0",
-    "next": "16.2.10",
+    "next": "16.2.11",
     "next-themes": "^0.4.6",
     "react": "^19.2.7",
     "react-dom": "^19.2.7",

packages/create-objectstack/package.json

@@ -22,7 +22,7 @@
   "dependencies": {
     "chalk": "^5.6.2",
     "commander": "^15.0.0",
-    "tar": "^7.5.20"
+    "tar": "^7.5.21"
   },
   "devDependencies": {
     "@types/node": "^26.1.1",

packages/metadata/package.json

@@ -51,7 +51,7 @@
     "@objectstack/types": "workspace:*",
     "chokidar": "^5.0.0",
     "glob": "^13.0.6",
-    "js-yaml": "^5.2.1",
+    "js-yaml": "^5.2.2",
     "zod": "^4.4.3"
   },
   "devDependencies": {