From ccdbd9af390624969bb8e44f354a1960c435a193 Mon Sep 17 00:00:00 2001 From: Claude Date: Thu, 29 Oct 2026 19:04:54 +0000 Subject: [PATCH] fix(deps): patch body-parser to 2.4.0 Co-Authored-By: Claude Sonnet 5.5 Claude-Session: https://claude.ai/code/session_012Jmn7ng9L3hDYRnUZpQPbN --- pnpm-lock.yaml | 20 +++++++++++++++----- pnpm-workspace.yaml | 3 +++ 2 files changed, 18 insertions(+), 5 deletions(-) diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index f3566b63a..f32b9cb5d 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -45,6 +45,7 @@ overrides: js-yaml@>=4.0.0 <5: 4.3.2 fast-uri@<3.1.8: 3.1.8 sharp@<0.35.5: 0.35.5 + body-parser@>=2.0.0 <2.4.0: 2.4.0 importers: @@ -2317,8 +2318,8 @@ packages: resolution: {integrity: sha512-pbnl5XzGBdrFU/wT4jqmJVPn2B6UHPBOhzMQkY/SPUPB6QtUXtmBHBIwCbXJol93mOpGMnQyP/+BB19q04xj7g==} engines: {node: '>=4'} - body-parser@2.3.0: - resolution: {integrity: sha512-2cGmJupaNgg+QUwVLAucDuWuoMZ6EX9iHDRswZ5lsNYEmwPaRknMPCLZz07yTzVq/83p4o/wzbDZbBrTvGGTIw==} + body-parser@2.4.0: + resolution: {integrity: sha512-Ifk1KcLrxaGt1occQagQNFNNOqRt1LFuehEnHHzB8Z6cRgIxRU1TBaiIsUiCdA+gy5PL7Y1IX31DNKkRmxtXjQ==} engines: {node: '>=18'} brace-expansion@5.0.12: @@ -3452,6 +3453,10 @@ packages: resolution: {integrity: sha512-h6fhOIaRrID2CbEY2fqs+7t+UXZo+MLAnU5gRIq85uFtdiUPCdsApMlHhXogKVM4HM2DVbIjGNTTYH2OcmP1vA==} engines: {node: '>=0.6'} + qs@6.16.1: + resolution: {integrity: sha512-5Px6J7rfHBAGUhNQ3es4YzcOdBBw0SDcVtThJml4RdnKw4tKs2epA0kPZ+K8X+WiHktT93RHVcQ/3ym5aTCgtg==} + engines: {node: '>=0.6'} + quansync@0.2.11: resolution: {integrity: sha512-AifT7QEbW9Nri4tAwR5M/uzpBuqfZf+zwaEM/QkzEjj7NBuFD2rBuy0K3dE+8wltbezDV7JMA0WfnCPYRSYbXA==} @@ -5236,7 +5241,7 @@ snapshots: dependencies: is-windows: 1.0.2 - body-parser@2.3.0: + body-parser@2.4.0: dependencies: bytes: 3.1.2 content-type: 2.1.0 @@ -5244,7 +5249,7 @@ snapshots: http-errors: 2.0.1 iconv-lite: 0.7.3 on-finished: 2.4.1 - qs: 6.16.0 + qs: 6.16.1 raw-body: 3.0.2 type-is: 2.1.0 transitivePeerDependencies: @@ -5524,7 +5529,7 @@ snapshots: express@5.2.1: dependencies: accepts: 2.0.0 - body-parser: 2.3.0 + body-parser: 2.4.0 content-disposition: 1.1.0 content-type: 1.0.5 cookie: 0.7.2 @@ -6207,6 +6212,11 @@ snapshots: es-define-property: 1.0.1 side-channel: 1.1.1 + qs@6.16.1: + dependencies: + es-define-property: 1.0.1 + side-channel: 1.1.1 + quansync@0.2.11: {} queue-microtask@1.2.3: {} diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index e4b2eac01..62151d58c 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -169,6 +169,9 @@ overrides: # #246 GHSA-wq5f-xc86-pv6w / CVE-2026-96889 — bundled librsvg memory-safety # bug (possible RCE); raised to 0.35.5 (published 2026-09-27). 'sharp@<0.35.5': '0.35.5' + # #279 CVE-2026-111181 (GHSA-27r3-jxmh-p828, HIGH) — body-parser 2.x; fixed in + # 2.4.0. Reached through express 5 (`^2.2.1`) via @modelcontextprotocol/sdk. + 'body-parser@>=2.0.0 <2.4.0': '2.4.0' # Supply-chain hardening — see skills/stash-supply-chain-security/ # 7 days in minutes; mirrors the Dependabot cooldown so manual + automated