From c36235184021e546ac9bca77320d914d1f4a346e Mon Sep 17 00:00:00 2001 From: Ilya Krasnov Date: Sun, 1 Nov 2026 15:10:15 +0200 Subject: [PATCH 1/2] fix: dependency security vulnerabilities (DELO-6764, DELO-6786, DELO-6721, DELO-6638, DELO-6639) Bump transitive qs 6.16.0 -> 6.17.1, body-parser 1.20.8 -> 1.20.9 and http-cache-semantics 4.2.0 -> 4.3.0, pinned via resolutions so parent ranges can't re-admit the vulnerable versions. Co-Authored-By: Claude Opus 5.5 --- package.json | 6 ++++-- yarn.lock | 20 ++++++++++---------- 2 files changed, 14 insertions(+), 12 deletions(-) diff --git a/package.json b/package.json index eb698a3..f2b8c45 100644 --- a/package.json +++ b/package.json @@ -45,8 +45,10 @@ "packageManager": "yarn@1.22.22+sha512.a6b2f7906b721bba3d67d4aff083df04dad64c399707841b7acf00f6b133b7ac24255f2652fa22ae3534329dc6180534e98d17432037ff6fd140556e2bb3137e", "resolutions": { "protobufjs": "^7.6.5", - "qs": "^6.16.0", + "qs": "^6.17.1", "proxy-addr": "^2.0.8", - "@grpc/grpc-js": "^1.14.5" + "@grpc/grpc-js": "^1.14.5", + "body-parser": "^1.20.9", + "http-cache-semantics": "^4.3.0" } } diff --git a/yarn.lock b/yarn.lock index cee571d..bddeb81 100644 --- a/yarn.lock +++ b/yarn.lock @@ -616,9 +616,9 @@ balanced-match@^1.0.0: integrity sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw== body-parser@~1.20.5: - version "1.20.8" - resolved "https://registry.yarnpkg.com/body-parser/-/body-parser-1.20.8.tgz#328d51ce46cb19c983f3d9661016df2765283a37" - integrity sha512-JNcyFQ64OiijEkPzUBTCe+hyPXUD/3LEldGQ6iF5LR1w00mx9o7xtDWHXBY2iItjdCFGoilOLNQbH943ut7pHA== + version "1.20.9" + resolved "https://registry.yarnpkg.com/body-parser/-/body-parser-1.20.9.tgz#b64358a113b4d200d7484752cd154b66933e2009" + integrity sha512-FISIQxV5u91Y9gvuFq3q/tA/qTqLJn3AhRcEvyozyhJTh5OBFFtv827AdHU7Rbyct4r+Ba1/99oFa1Y3yuFsdw== dependencies: bytes "~3.1.2" content-type "~1.0.5" @@ -1350,9 +1350,9 @@ he@^1.2.0: integrity sha512-F/1DnUGPopORZi0ni+CvrCgHQ5FyEAHRLSApuYWMmrbSwoN2Mn/7k+Gl38gJnR7yyDZk6WLXwiGod1JOWNDKGw== http-cache-semantics@^4.2.0: - version "4.2.0" - resolved "https://registry.yarnpkg.com/http-cache-semantics/-/http-cache-semantics-4.2.0.tgz#205f4db64f8562b76a4ff9235aa5279839a09dd5" - integrity sha512-dTxcvPXqPvXBQpq5dUr6mEMJX4oIEFv6bwom3FDwKRDsuIjjJGANqhBuoAn9c1RQJIdAKav33ED65E2ys+87QQ== + version "4.3.0" + resolved "https://registry.yarnpkg.com/http-cache-semantics/-/http-cache-semantics-4.3.0.tgz#09eead3b16c6d85552857cc3fbd888d8353a2aaf" + integrity sha512-M5t5LlJpS1UHMjvwRQVdFHvPISGeLAxNcrWuJkeGh0KxsqCHZ1O3NXZU/8x7cD0BDcGW8kapxMKTvwlqrNkHkA== http-errors@~2.0.0, http-errors@~2.0.1: version "2.0.1" @@ -1926,10 +1926,10 @@ proxy-addr@^2.0.8, proxy-addr@~2.0.7: forwarded "0.2.0" ipaddr.js "1.9.1" -qs@^6.11.0, qs@^6.11.2, qs@^6.16.0, qs@~6.16.0: - version "6.16.0" - resolved "https://registry.yarnpkg.com/qs/-/qs-6.16.0.tgz#c22c723a28a920f3aacdce8289fabd43eccb79fd" - integrity sha512-h6fhOIaRrID2CbEY2fqs+7t+UXZo+MLAnU5gRIq85uFtdiUPCdsApMlHhXogKVM4HM2DVbIjGNTTYH2OcmP1vA== +qs@^6.11.0, qs@^6.11.2, qs@^6.17.1, qs@~6.16.0: + version "6.17.1" + resolved "https://registry.yarnpkg.com/qs/-/qs-6.17.1.tgz#43ac71d29ca0e9d0eed16a218e35b6cde5628e81" + integrity sha512-jd3COkaKVgGUW+ZHyEHCG9bH7RoaaiWuMgzsIBjUMVjLAaWGWpoUAVwljVvBHxRu/2qEHnadLGZrkutYUBPQJA== dependencies: es-define-property "^1.0.1" side-channel "^1.1.1" From 197c30e75ebcd465d6852db6c8b91fc72e74744f Mon Sep 17 00:00:00 2001 From: Ilya Krasnov Date: Tue, 3 Nov 2026 09:58:41 +0200 Subject: [PATCH 2/2] fix: record body-parser/http-cache-semantics resolution patterns in yarn.lock The resolutions were added after the lock entries existed, so the ^1.20.9 / ^4.3.0 patterns were missing from the keys and `yarn outdated` failed with "Outdated lockfile". Versions are unchanged. Co-Authored-By: Claude Opus 5.5 --- yarn.lock | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/yarn.lock b/yarn.lock index bddeb81..fa8f2ac 100644 --- a/yarn.lock +++ b/yarn.lock @@ -615,7 +615,7 @@ balanced-match@^1.0.0: resolved "https://registry.yarnpkg.com/balanced-match/-/balanced-match-1.0.2.tgz#e83e3a7e3f300b34cb9d87f615fa0cbf357690ee" integrity sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw== -body-parser@~1.20.5: +body-parser@^1.20.9, body-parser@~1.20.5: version "1.20.9" resolved "https://registry.yarnpkg.com/body-parser/-/body-parser-1.20.9.tgz#b64358a113b4d200d7484752cd154b66933e2009" integrity sha512-FISIQxV5u91Y9gvuFq3q/tA/qTqLJn3AhRcEvyozyhJTh5OBFFtv827AdHU7Rbyct4r+Ba1/99oFa1Y3yuFsdw== @@ -1349,7 +1349,7 @@ he@^1.2.0: resolved "https://registry.yarnpkg.com/he/-/he-1.2.0.tgz#84ae65fa7eafb165fddb61566ae14baf05664f0f" integrity sha512-F/1DnUGPopORZi0ni+CvrCgHQ5FyEAHRLSApuYWMmrbSwoN2Mn/7k+Gl38gJnR7yyDZk6WLXwiGod1JOWNDKGw== -http-cache-semantics@^4.2.0: +http-cache-semantics@^4.2.0, http-cache-semantics@^4.3.0: version "4.3.0" resolved "https://registry.yarnpkg.com/http-cache-semantics/-/http-cache-semantics-4.3.0.tgz#09eead3b16c6d85552857cc3fbd888d8353a2aaf" integrity sha512-M5t5LlJpS1UHMjvwRQVdFHvPISGeLAxNcrWuJkeGh0KxsqCHZ1O3NXZU/8x7cD0BDcGW8kapxMKTvwlqrNkHkA==