chore: upgrade @humanfs/node to 0.16.8 to address GHSA-p498-v437-472g

[claude]

Fixes SOU-2142

Refreshes the yarn.lock entry for @humanfs/node from 0.16.7 to 0.16.8 to address GHSA-p498-v437-472g (Dependabot alert 334): recursive copy followed symlinked files, so copyAll()/copy() could read and copy data from outside the source tree.

Details

• @humanfs/node is a transitive dependency: eslint@9.39.3 → @humanfs/node@^0.16.6.
• The existing ^0.16.6 range already admits the patched 0.16.8, so this is a lockfile refresh only (yarn up -R @humanfs/node). No package.json change and no resolutions override is needed.
• The patched release pulls in @humanfs/core@0.19.2 and the new @humanfs/types@0.15.0 dependency.

Verification

• yarn why @humanfs/node reports only @humanfs/node@npm:0.16.8.
• yarn workspace @sourcebot/web lint passes (eslint is the consumer of this package).
• yarn test passes (2153 tests across queryLanguage, shared, backend, web).

🤖 Generated with Claude Code

---

Note

Low Risk
Lockfile-only dependency bump for a transitive ESLint package with no application code changes.

Overview
Addresses GHSA-p498-v437-472g by refreshing yarn.lock so the transitive ESLint dependency @humanfs/node resolves to 0.16.8 (from 0.16.7). There is no package.json change—the existing ^0.16.6 range already allows the patched release.

The lockfile update also bumps @humanfs/core to 0.19.2 and adds @humanfs/types@0.15.0. The unreleased CHANGELOG records the upgrade under Fixed.

^{Reviewed by Cursor Bugbot for commit 4d0a19e. Bugbot is set up for automated code reviews on this repo. Configure here.}

---

Summary by cubic

Upgrades @humanfs/node to 0.16.8 in yarn.lock to fix SOU-2142 (GHSA-p498-v437-472g), where copy() and copyAll() followed symlinks and could read data from outside the source tree. This is a lockfile-only refresh; the existing ^0.16.6 range already permits the patched version, so no package.json changes are needed.

• Pulls in @humanfs/core@0.19.2 and adds @humanfs/types@0.15.0 as a new dependency.
• Verified with yarn why @humanfs/node, yarn workspace @sourcebot/web lint, and yarn test (2153 tests pass).

^{Written for commit b77a9e2. Summary will update on new commits.}

[github-actions]

License Audit

❌ Audit failed to produce results. Check the workflow logs for details.