chore(deps): update dependency qs to v6.9.7 [security]#438
Conversation
9229abc to
396bb3c
Compare
396bb3c to
90a52e8
Compare
Force the vulnerable express/body-parser qs copy without downgrading newer qs transitive dependencies. Co-authored-by: Cursor <cursoragent@cursor.com>
|
Triaged (continuous drain): synced with , added scoped overrides for and to , and
console.error console.error console.error console.error console.error console.error console.error console.error -----------------------------------------|---------|----------|---------|---------|------------------------------------------
|
Edited/Blocked NotificationRenovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR. You can manually request rebase by checking the rebase/retry box above. |
1 participant
This PR contains the following updates:
6.5.5→6.9.7qs vulnerable to Prototype Pollution
CVE-2022-24999 / GHSA-hrpp-h998-j3pp
More information
Details
qs before 6.10.3 allows attackers to cause a Node process hang because an
__ proto__key can be used. In many typical web framework use cases, an unauthenticated remote attacker can place the attack payload in the query string of the URL that is used to visit the application, such asa[__proto__]=b&a[__proto__]&a[length]=100000000. The fix was backported to qs 6.9.7, 6.8.3, 6.7.3, 6.6.1, 6.5.3, 6.4.1, 6.3.3, and 6.2.4.Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
ljharb/qs (qs)
v6.9.7Compare Source
parse: ignore__proto__keys (#428)stringify: avoid encoding arrayformat comma whenencodeValuesOnly = true(#424)stringify: avoid relying on a globalundefined(#427)v6.9.6Compare Source
distdir; mistakenly removed ind4f6c32v6.9.5Compare Source
stringify: do not encode parens for RFC1738stringify: fix arrayFormat comma with empty array/objects (#350)format: removeutil.assigncallpull_request_targeteventstringify: add tests for #378nycon all tests; usetaperunnereslint,@ljharb/eslint-config,browserify,mkdirp,object-inspect,tape; addaudv6.9.4Compare Source
stringify: whenarrayFormatiscomma, respectserializeDate(#364)stringify: reduce branching (part of #350)maybeMaptoutilsbrowserify,tapev6.9.3Compare Source
v6.9.2Compare Source
parse: Fix parsing array from object withcommatrue (#359)parse: throw a TypeError instead of an Error for bad charset (#349)eslint,@ljharb/eslint-config,object-inspect,has-symbols,tape,mkdirp,iconv-litev6.9.1Compare Source
parse: with comma true, handle field that holds an array of arrays (#335)parse: with comma true, do not split non-string values (#334)fundingfieldeslint,@ljharb/eslint-configv6.9.0Compare Source
parse/stringify: Pass extra key/value argument todecoder(#333)eslint,@ljharb/eslint-config,evalmdparse: add passingarrayFormattestsposttestusingnpx audto runnpm auditwithout a lockfilenodev12.10,v11.15,v10.16,v8.16Buffer.fromin node v5.0-v5.9 and v4.0-v4.4 requires a TypedArrayv6.8.5Compare Source
npmignoreto autogenerate an npmignore filev6.8.4Compare Source
.push, usevoidparseArraysandarrayLimitdocumentation (#543)addQueryPrefixdoes not add?to empty output (#418)v6.8.3Compare Source
parse: ignore__proto__keys (#428)stringify: avoid relying on a globalundefined(#427)stringify: avoid encoding arrayformat comma whenencodeValuesOnly = true(#424)stringify: reduce branchingv6.8.2Compare Source
v6.8.1Compare Source
parse: Fix parsing array from object withcommatrue (#359)parse: throw a TypeError instead of an Error for bad charset (#349)parse: with comma true, handle field that holds an array of arrays (#335)parse: with comma true, do not split non-string values (#334)fundingfieldeslint,@ljharb/eslint-config,tape,safe-publish-latest,evalmd,has-symbols,iconv-lite,mkdirp,object-inspectparse: add passingarrayFormattestsBuffer.fromin node v5.0-v5.9 and v4.0-v4.4 requires a TypedArrayv6.8.0Compare Source
depth=falseto preserve the original key; [Fix]depth=0should preserve the original key (#326)formats: tiny bit of cleanup.eslint,@ljharb/eslint-config,browserify,safe-publish-latest,iconv-lite,tapedepth=0anddepth=falsebehavior, both current and intuitive/intended (#326)eclintinstead ofeditorconfig-toolsv6.7.5Compare Source
npmignoreto autogenerate an npmignore filev6.7.4Compare Source
.push, usevoidparseArraysandarrayLimitdocumentation (#543)addQueryPrefixdoes not add?to empty output (#418)v6.7.3Compare Source
parse: ignore__proto__keys (#428)stringify: avoid encoding arrayformat comma whenencodeValuesOnly = true(#424)stringify: avoid relying on a globalundefined(#427)nycfor coveragev6.7.2Compare Source
v6.7.1Compare Source
parse: Fix parsing array from object withcommatrue (#359)parse: with comma true, handle field that holds an array of arrays (#335)parse: with comma true, do not split non-string values (#334)parse: throw a TypeError instead of an Error for bad charset (#349)formats: tiny bit of cleanup.fundingfieldeslint,@ljharb/eslint-config,tape,safe-publish-latest,evalmd,iconv-lite,mkdirp,object-inspect,browserifyparse: add passingarrayFormattestsBuffer.fromin node v5.0-v5.9 and v4.0-v4.4 requires a TypedArraydepth=0anddepth=falsebehavior, both current and intuitive/intendedeclintinstead ofeditorconfig-toolsConfiguration
📅 Schedule: (UTC)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.