chore(security): clear the qs DoS advisory - #82
Merged
Conversation
GHSA-q8mj-m7cp-5q26 (qs.stringify crashes on null/undefined entries in comma-format arrays with encodeValuesOnly) published against <=6.15.2. The tree already resolved qs 6.15.3 everywhere except under @stryker-mutator/core -> typed-rest-client, which pinned 6.15.1 — so an override to ^6.15.3 is what actually clears it. npm audit fix picks up fast-uri and js-yaml alongside. Lockfile plus one override line; no runtime dependency changed. The remaining four advisories are moderate and below the gate.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
A new advisory landed against
qs— GHSA-q8mj-m7cp-5q26, a remotely triggerable DoS whereqs.stringifycrashes on null/undefined entries in comma-format arrays withencodeValuesOnlyset. It affects<= 6.15.2.It surfaced on #79 rather than on
main, only because main hasn't re-run since the advisory published — it would have gone red on the next push either way.Most of the tree had already resolved
qs@6.15.3; the one holdout was@stryker-mutator/core → typed-rest-client → qs@6.15.1, which is why an override to^6.15.3is what actually clears it rather than a plain reinstall.npm audit fixpicked upfast-uriandjs-yamlin the same pass.Diff is the lockfile plus one override line — no runtime dependency changed. Four moderate advisories remain (drizzle-kit's legacy esbuild-kit chain and friends), all below the gate's
--audit-level=high.Verified locally:
security:auditexit 0, typecheck, lint, build, and the full suite (90 passing, unchanged).