fix(deps): backport security fixes to 1.2 for 1.2.1

Merged
RE
2d ago
+91-50

Context & Requests for Reviewers

Instead of cutting the patch release directly from main, I'm creating a patch branch off of the 1.2.0 release tag, and cherry-picking just the security PRs. This is more work up front, but it makes the patch release a true patch release (lot of changes in main this week!), and when we move to regular security releases, this is the 'right' way (please, debate me!).

Each commit is a cherry-pick of a merged PR from main, except where noted:

  • body-parser 2.4.0 through a pnpm override (be861dbf), for CVE-2026-111181
  • HMA base image moved from ghcr.io/facebook to ghcr.io/meta/threatexchange/hma:1.2.1, pinned by digest (#1452, #1498, #1503)
  • follow-redirects 1.16.1 and markdown-it 14.3.3 (#1457, #1467)
  • storybook 9.1.21, dev only (#1458)
  • undici 7.30.1: only pulled the undici update #1464, not the other non-security updates. Not a cherry-pick.
  • CHANGELOG.md: ## [1.2.1] section and compare links

Every package version this changes from 1.2.0 is the version main has. The only lockfile conflict was express's dependency list in be861dbf, which was resolved to keep 1.2.0's express 5.2.1 with body-parser 2.4.0. pnpm install leaves the result unchanged. The @storybook/react bumps in #1463 aren't included; the storybook fix is in #1458.

Not backported: the @tiptap/core 2.x advisory. There's no patched 2.x release, and main fixed it with the TipTap v3 migration (#1400), which is more than I'm comfortable pulling into a patch release ATM.

Tests

  • pnpm install --frozen-lockfile && pnpm run prettier: pass
  • pnpm run generate leaves the tree clean: pass
  • server typecheck, lint, build: pass
  • client lint, build: pass
  • pnpm --filter client test: 307 passed, 2 skipped
  • docker compose run --rm --build test: 129 files, 1294 tests passed, 7 skipped, 1 todo
  • docker build hma/ pulls the pinned digest and builds
  • pnpm audit: no advisories that main has fixed remain, apart from tiptap as explained above

(Optional) Rollout Plan

After merge, tag 1.2.1 from release/1.2 and publish the release. Then forward-port the ## [1.2.1] changelog section to main.

Checklist

Only check items that apply to this PR; leave the rest unchecked.

  • If you changed anything user-facing (i.e. user interface or APIs):
    Did you update related docs?

  • If the change is notable (refer to Keep a Changelog conventions):
    Did you update CHANGELOG.md?

  • If you changed db/src/scripts/** and used CREATE TABLE, ADD COLUMN, or ALTER COLUMN:
    Are as many columns marked NOT NULL as possible? If some columns can sometimes be null depending on other columns, are there CHECK constraints capturing those relationships, and are these also reflected using unions in the associated Kysely types?

  • If you added a new signal in server/services/signalsService/signals/**:
    Did you classify every error case as a permanent error (SignalPermanentError, no retry) or a normal error (retryable)? Any case where the signal can't determine a score should be a SignalPermanentError.