From 080c87bd7e9bca675d70701e9b0392de6559ccc6 Mon Sep 17 00:00:00 2001 From: finalerock44 Date: Wed, 28 Oct 2026 12:28:13 +0000 Subject: [PATCH] chore(deps): bump the qs override to 6.16.1 GHSA-6pq8-jhm2-2vcw (moderate, published 2026-10-28) covers qs up to 6.16.0, which is exactly where the override held it, so the CI audit fails on every branch. 6.16.1 is the lowest patched version in the major; the lockfile change is qs alone (it reaches us through @modelcontextprotocol/sdk > express). Dependabot cannot bump an overridden pin, hence by hand, as for hono. --- package.json | 2 +- pnpm-lock.yaml | 13 ++----------- 2 files changed, 3 insertions(+), 12 deletions(-) diff --git a/package.json b/package.json index 7460522..07f6c80 100644 --- a/package.json +++ b/package.json @@ -108,7 +108,7 @@ "brace-expansion@>=3.0.0 <5.0.12": "5.0.12", "ws@>=8.0.0 <8.21.0": "8.21.0", "esbuild@<0.28.1": ">=0.28.1", - "qs@<6.16.0": "6.16.0", + "qs@<6.16.1": "6.16.1", "fast-uri@>=3.0.0 <3.1.9": "3.1.9", "hono@>=4.0.0 <4.13.11": "4.13.11", "source-map-js@<1.2.2": "1.2.2", diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 9e4e3fe..566130e 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -29,7 +29,7 @@ overrides: brace-expansion@>=3.0.0 <5.0.12: 5.0.12 ws@>=8.0.0 <8.21.0: 8.21.0 esbuild@<0.28.1: '>=0.28.1' - qs@<6.16.0: 6.16.0 + qs@<6.16.1: 6.16.1 fast-uri@>=3.0.0 <3.1.9: 3.1.9 hono@>=4.0.0 <4.13.11: 4.13.11 source-map-js@<1.2.2: 1.2.2 @@ -1423,10 +1423,6 @@ packages: resolution: {integrity: sha512-+Owyggi9IxT1ePKGafcI87ubSmxol6smwJ+RAHDQlx9+9cPwFWDiKFFCPuWhr9ignlGpZ9vDQLw67N4dcTVFEA==} engines: {node: '>=20'} - qs@6.16.0: - resolution: {integrity: sha512-h6fhOIaRrID2CbEY2fqs+7t+UXZo+MLAnU5gRIq85uFtdiUPCdsApMlHhXogKVM4HM2DVbIjGNTTYH2OcmP1vA==} - engines: {node: '>=0.6'} - qs@6.16.1: resolution: {integrity: sha512-5Px6J7rfHBAGUhNQ3es4YzcOdBBw0SDcVtThJml4RdnKw4tKs2epA0kPZ+K8X+WiHktT93RHVcQ/3ym5aTCgtg==} engines: {node: '>=0.6'} @@ -2472,7 +2468,7 @@ snapshots: once: 1.4.0 parseurl: 1.3.3 proxy-addr: 2.0.8 - qs: 6.16.0 + qs: 6.16.1 range-parser: 1.3.0 router: 2.2.0 send: 1.2.1 @@ -3042,11 +3038,6 @@ snapshots: dependencies: hookified: 2.2.0 - qs@6.16.0: - dependencies: - es-define-property: 1.0.1 - side-channel: 1.1.1 - qs@6.16.1: dependencies: es-define-property: 1.0.1