Update npm package jsonpath to v1.2.0 [SECURITY]

[hash-worker]

This PR contains the following updates:

Package	Change	Age	Confidence
jsonpath	1.1.1 -> 1.2.0

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

GitHub Vulnerability Alerts

CVE-2025-61140

The value function in jsonpath 1.1.1 lib/index.js is vulnerable to Prototype Pollution.

---

Release Notes

dchester/jsonpath (jsonpath)

v1.2.0

Compare Source

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
hash	Ready	Preview, Comment	Feb 5, 2026 4:41pm

3 Skipped Deployments

Project	Deployment	Actions	Updated (UTC)
hashdotdesign	Ignored	Preview	Feb 5, 2026 4:41pm
hashdotdesign-tokens	Ignored	Preview	Feb 5, 2026 4:41pm
petrinaut	Skipped		Feb 5, 2026 4:41pm

[cursor]

PR Summary

Low Risk
Dependency-only change; main risk is runtime behavior differences in jsonpath queries, with no app code modifications.

Overview
Updates the jsonpath dependency from 1.1.1 to 1.2.0 in both hash-api and hash-frontend.

Refreshes yarn.lock accordingly, pulling newer transitive versions (notably esprima, static-eval, and underscore) as part of the jsonpath upgrade to address the reported security issue.

^{Written by Cursor Bugbot for commit 0992959. This will update automatically on new commits. Configure here.}

[augmentcode]

🤖 Augment PR Summary

Summary: Updates the jsonpath dependency to address a reported prototype-pollution vulnerability.

Changes:

• Bumped jsonpath from 1.1.1 to 1.2.0 in apps/hash-api
• Bumped jsonpath from 1.1.1 to 1.2.0 in apps/hash-frontend

Technical Notes: This is a dependency-only change; runtime behavior should remain the same aside from incorporating upstream security fixes.

_{🤖 Was this summary useful? React with 👍 or 👎}

[augmentcode]

Review completed. No suggestions at this time.

Comment augment review to trigger a new review at any time.