chore(web): bump @aws-sdk/credential-providers to ^3.1036.0 (CVE-2026-41650) (#1148)

* chore(web): bump @aws-sdk/credential-providers to ^3.1036.0 to patch CVE-2026-41650

Fixes SOU-982

Bumps `@aws-sdk/credential-providers` from `^3.1023.0` to `^3.1036.0`,
which transitively pulls in `@aws-sdk/xml-builder@3.972.19` and
`fast-xml-parser@5.7.1`, resolving CVE-2026-41650 (GHSA-gh4j-gqv2-49f6).

CVE-2026-41650 describes missing escaping of `-->` and `]]>` sequences
in `XMLBuilder`'s comment and CDATA serialization. The AWS SDK only
uses `XMLParser` (not `XMLBuilder`), so the vulnerable code path is
not reachable in this tree — this bump is an SCA-alert cleanup.

Preferred over a yarn resolution override so we follow AWS SDK's own
dependency ranges instead of bypassing them.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* docs: add CHANGELOG entry for fast-xml-parser fix

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* changelog

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: brendan-kellam

CHANGELOG.md

@@ -13,6 +13,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Fixed
 - Fixed a missing error boundary in `getFileSourceForRepo` introduced in v4.16.14: the function was extracted outside `sew()` but still re-threw unrecognised git exceptions, causing fatal Next.js task-runner errors. All error paths now return a `ServiceError`. Also tightened the error message for unresolved git refs (e.g. an unfetched `head_sha`) to distinguish them from syntactically invalid refs. [#1145](https://github.com/sourcebot-dev/sourcebot/pull/1145)
 - Bumped transitive `uuid` dependency to `^14.0.0`. [#1147](https://github.com/sourcebot-dev/sourcebot/pull/1147)
+- Bumped `@aws-sdk/credential-providers` to `^3.1036.0`. [#1148](https://github.com/sourcebot-dev/sourcebot/pull/1148)
 
 ## [4.16.14] - 2026-04-21
 

packages/web/package.json

@@ -26,7 +26,7 @@
     "@ai-sdk/react": "^3.0.169",
     "@ai-sdk/xai": "^3.0.83",
     "@auth/prisma-adapter": "^2.11.1",
-    "@aws-sdk/credential-providers": "^3.1023.0",
+    "@aws-sdk/credential-providers": "^3.1036.0",
     "@codemirror/commands": "^6.6.0",
     "@codemirror/lang-cpp": "^6.0.2",
     "@codemirror/lang-css": "^6.3.0",