chore(deps): npm audit fix — close qs DoS + 3 dev-chain advisories#100
Merged
Conversation
Lockfile-only transitive resolution refresh (no package.json changes, no semver ranges widened, no major boundaries crossed): - qs 6.15.1 → 6.15.2 (GHSA-q8mj-m7cp-5q26 — qs.stringify DoS on null/undefined comma-format array entries; primary target this sweep) - brace-expansion 5.0.5 → 5.0.6 (GHSA-jxxr-4gwj-5jf2) - js-cookie 3.0.5 → 3.0.7 (GHSA-qjx8-664m-686j) - ws 8.20.0 → 8.21.0 (GHSA-58qx-3vcg-4xpx) Mechanism for qs: npm audit fix re-resolved Stryker's transitive typed-rest-client 2.3.1 → 2.3.0 (both within @stryker-mutator/core's ~2.3.0 range). 2.3.1 pinned qs to an exact 6.15.1 (advisory-affected), 2.3.0 declares qs@^6.14.1 which resolves cleanly to the patched 6.15.2. No npm override required. npm audit now reports 0 vulnerabilities. All 8 CI gates verified locally (audit/format/lint/build/typecheck/lint:pkg/coverage 528 tests/mutation 11 packages ≥90%); npm ci clean-install confirms the peer-dep contract. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Deploying fs-packages with
|
| Latest commit: |
9c734aa
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://45871ddc.fs-packages.pages.dev |
| Branch Preview URL: | https://chore-audit-fix-qs-dos.fs-packages.pages.dev |
Contributor
Author
|
The Two are green and ready for a first review: #100 ( |
Contributor
PR Reviewer · claimed
|
Contributor
PR Reviewer · 9/10 · PASS
Findings
Actionmerge-ready |
jasperboerhof
approved these changes
May 29, 2026
Contributor
jasperboerhof
left a comment
jasperboerhof
left a comment
There was a problem hiding this comment.
Auto-approved by /review-open-prs — review verdict is PASS. See the verdict comment for the per-reviewer breakdown.
This was referenced May 29, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Closes the
qsDoS advisory (GHSA-q8mj-m7cp-5q26) that is currently failing thenpm auditCI gate (Gate 1 of 8) across multiple open branches. This is a newly-published advisory on a transitive devDependency that did not exist when the open branches last ran CI. Three sibling dev-chain advisories already present onmainare cleared in the same pass.Lockfile-only change —
package.jsonis untouched, no semver ranges widened, no major version boundaries crossed. Strict minor/patch posture, appropriate for a published@script-developmentlibrary monorepo.Advisories cleared (4)
qs.stringifyDoS (TypeError on null/undefined comma-format array entries withencodeValuesOnly)Fix mechanism — transitive lockfile resolution (not a direct bump, not an override)
qs@6.15.1was pulled deeply nested under Stryker:@stryker-mutator/core@9.6.1 → typed-rest-client@2.3.1 → qs@6.15.1typed-rest-client@2.3.1pinsqsto an exact version6.15.1(advisory-affected), so a naive in-range resolution could not advance it.npm audit fix(non---force) re-resolvedtyped-rest-client2.3.1 → 2.3.0 — both within@stryker-mutator/core's~2.3.0range — and2.3.0declaresqs@^6.14.1, which resolves cleanly to the patched6.15.2.No npm
overridewas required; no manifest edit was needed.Verification — all 8 CI gates green locally
npm audit→ 0 vulnerabilitiesformat:check→ passlint(oxlint) → 0 warnings / 0 errorsbuild(tsdown) → passtypecheck→ passlint:pkg(publint + attw) → 11 packages + root cleantest:coverage→ 528 tests passtest:mutation(Stryker) → all 11 packages ≥90% break thresholdrm -rf node_modules && npm ciclean-install confirms the peer-dependency contract is intact (noERESOLVE, 0 vulnerabilities). No--force/--legacy-peer-depsused anywhere.🤖 Generated with Claude Code