Skip to content

Commit a1cb1bb

Browse files
antonisclaude
andcommitted
chore(deps): bump qs to ^6.14.2
Adds a yarn resolution to force qs to >=6.14.2, patching two DoS vulnerabilities: arrayLimit bypass via bracket notation (>= 4.0.0, <= 6.14.1) and arrayLimit bypass via comma parsing (<= 6.14.1). Consolidates 6.11.0 and 6.13.0 consumers onto 6.15.0. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
1 parent cb7404a commit a1cb1bb

2 files changed

Lines changed: 6 additions & 14 deletions

File tree

package.json

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -61,6 +61,7 @@
6161
"resolutions": {
6262
"appium-chromedriver@npm:5.6.73/@xmldom/xmldom": "0.8.10",
6363
"form-data": "4.0.4",
64+
"qs": "^6.14.2",
6465
"tar-fs": "^3.1.1",
6566
"tar": "^7.5.7"
6667
},

yarn.lock

Lines changed: 5 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -28975,21 +28975,12 @@ __metadata:
2897528975
languageName: node
2897628976
linkType: hard
2897728977

28978-
"qs@npm:6.11.0":
28979-
version: 6.11.0
28980-
resolution: "qs@npm:6.11.0"
28981-
dependencies:
28982-
side-channel: ^1.0.4
28983-
checksum: 6e1f29dd5385f7488ec74ac7b6c92f4d09a90408882d0c208414a34dd33badc1a621019d4c799a3df15ab9b1d0292f97c1dd71dc7c045e69f81a8064e5af7297
28984-
languageName: node
28985-
linkType: hard
28986-
28987-
"qs@npm:6.13.0":
28988-
version: 6.13.0
28989-
resolution: "qs@npm:6.13.0"
28978+
"qs@npm:^6.14.2":
28979+
version: 6.15.0
28980+
resolution: "qs@npm:6.15.0"
2899028981
dependencies:
28991-
side-channel: ^1.0.6
28992-
checksum: e9404dc0fc2849245107108ce9ec2766cde3be1b271de0bf1021d049dc5b98d1a2901e67b431ac5509f865420a7ed80b7acb3980099fe1c118a1c5d2e1432ad8
28982+
side-channel: ^1.1.0
28983+
checksum: 65e797e3747fa1092e062da7b3e0684a9194e07ccab3a9467d416d2579d2feab0adf3aa4b94446e9f69ba7426589a8728f78a10a549308c97563a79d1c0d8595
2899328984
languageName: node
2899428985
linkType: hard
2899528986

0 commit comments

Comments
 (0)