From e64c7331c462f2ad1d17eeafe8c486e7c1494de2 Mon Sep 17 00:00:00 2001 From: Joseph Mearman Date: Sun, 13 Sep 2026 06:27:21 +0100 Subject: [PATCH] fix(deps): pin qs to the patched release closing the null-array DoS @stryker-mutator/core pulls in qs 6.15.1 transitively (via typed-rest-client), which is in the vulnerable range for GHSA-q8mj-m7cp-5q26: qs.stringify throws synchronously on a null or undefined array element when arrayFormat is "comma" and encodeValuesOnly is set. Dev-only dependency, never shipped in the published package, but the fixed 6.15.2 release is well past the minimum-release-age gate, so there is no reason to stay on the vulnerable range. --- package.json | 3 ++- pnpm-lock.yaml | 9 +++++---- 2 files changed, 7 insertions(+), 5 deletions(-) diff --git a/package.json b/package.json index 4072b0b..7fdb787 100644 --- a/package.json +++ b/package.json @@ -72,7 +72,8 @@ ], "overrides": { "eslint-plugin-jsdoc": "64.3.6", - "conventional-changelog-writer": "9.2.1" + "conventional-changelog-writer": "9.2.1", + "qs": "6.15.2" } }, "devDependencies": { diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 637f5cf..f442f5a 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -7,6 +7,7 @@ settings: overrides: eslint-plugin-jsdoc: 64.3.6 conventional-changelog-writer: 9.2.1 + qs: 6.15.2 importers: @@ -2966,8 +2967,8 @@ packages: resolution: {integrity: sha512-+Owyggi9IxT1ePKGafcI87ubSmxol6smwJ+RAHDQlx9+9cPwFWDiKFFCPuWhr9ignlGpZ9vDQLw67N4dcTVFEA==} engines: {node: '>=20'} - qs@6.15.1: - resolution: {integrity: sha512-6YHEFRL9mfgcAvql/XhwTvf5jKcOiiupt2FiJxHkiX1z4j7WL8J/jRHYLluORvc1XxB5rV20KoeK00gVJamspg==} + qs@6.15.2: + resolution: {integrity: sha512-Rzq0KEyX/w/tEybncDgdkZrJgVUsUMk3xjh3t5bv3S1HTAtg+uOYt72+ZfwiQwKdysThkTBdL/rTi6HDmX9Ddw==} engines: {node: '>=0.6'} quansync@1.0.0: @@ -6318,7 +6319,7 @@ snapshots: dependencies: hookified: 2.2.0 - qs@6.15.1: + qs@6.15.2: dependencies: side-channel: 1.1.1 @@ -6750,7 +6751,7 @@ snapshots: dependencies: des.js: 1.1.0 js-md4: 0.3.2 - qs: 6.15.1 + qs: 6.15.2 tunnel: 0.0.6 underscore: 1.13.8