From 4fe192a818b57a0ad03213bf0c025bd53b9cce68 Mon Sep 17 00:00:00 2001 From: Joob1n Date: Thu, 3 Sep 2026 02:12:55 +0800 Subject: [PATCH] chore(deps): bump qs and fast-uri to clear the production dependency audit `npm audit --omit=dev` reports two advisories against production dependencies: qs 6.15.3 (moderate: array-limit bypass via bracket-key comma parsing; DoS via attacker-controlled isBuffer), reached through @larksuiteoapi/node-sdk in @maka/runtime, and fast-uri 3.1.x (high: host confusion and SSRF via IDN, IPv6 and percent-decoding normalization). The "Build CLI release candidate" CI step and the Dependency audit workflow fail on any such advisory, so every PR on main is red until the lockfile moves. qs resolves to 6.16.0 and fast-uri to 3.1.7; the production dependency notices are regenerated for the new versions. Generated-by: Claude Code Claude-Session: https://claude.ai/code/session_014ajaRxC4jydavY9nYUFj5J --- .../resources/licenses/npm/THIRD_PARTY_NOTICES.txt | 4 ++-- package-lock.json | 12 ++++++------ packages/cli/THIRD_PARTY_NOTICES.txt | 4 ++-- 3 files changed, 10 insertions(+), 10 deletions(-) diff --git a/apps/desktop/resources/licenses/npm/THIRD_PARTY_NOTICES.txt b/apps/desktop/resources/licenses/npm/THIRD_PARTY_NOTICES.txt index d0d2e2fbc9..e2183dfbac 100644 --- a/apps/desktop/resources/licenses/npm/THIRD_PARTY_NOTICES.txt +++ b/apps/desktop/resources/licenses/npm/THIRD_PARTY_NOTICES.txt @@ -9253,7 +9253,7 @@ SOFTWARE. ================================================================================ -Package: fast-uri@3.1.5 +Package: fast-uri@3.1.7 Declared license: BSD-3-Clause Selected license: BSD-3-Clause Repository: git+https://github.com/fastify/fast-uri.git @@ -12590,7 +12590,7 @@ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLI ================================================================================ -Package: qs@6.15.3 +Package: qs@6.16.0 Declared license: BSD-3-Clause Selected license: BSD-3-Clause Repository: https://github.com/ljharb/qs.git diff --git a/package-lock.json b/package-lock.json index 1f8d76d718..647306ec13 100644 --- a/package-lock.json +++ b/package-lock.json @@ -8114,9 +8114,9 @@ "license": "MIT" }, "node_modules/fast-uri": { - "version": "3.1.5", - "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.5.tgz", - "integrity": "sha512-gHwA1O9LDIcKunMKhObS/HimwtehO1nPUECKAu5TpKgaO19fcWEl4bliWe1jWxVFvIXztJjjQ4L8XQ1EU9f7Jw==", + "version": "3.1.7", + "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.7.tgz", + "integrity": "sha512-dOvZVzjdZdz7phd9v6jCbwxrBW3fK6n8Rc0CtdmM4bumzMnxywBYhuph6J819RRw/ku+rLbelwfMunktuzVVHg==", "funding": [ { "type": "github", @@ -11896,9 +11896,9 @@ } }, "node_modules/qs": { - "version": "6.15.3", - "resolved": "https://registry.npmjs.org/qs/-/qs-6.15.3.tgz", - "integrity": "sha512-O9gl3zCl5h5blw1KGUzQKhA5oUXSl8rwUIM5o0S3nCXMliSvy5Dzx7/DJcI+SwgICv+IneSZwhBh1oSyEHA71A==", + "version": "6.16.0", + "resolved": "https://registry.npmjs.org/qs/-/qs-6.16.0.tgz", + "integrity": "sha512-h6fhOIaRrID2CbEY2fqs+7t+UXZo+MLAnU5gRIq85uFtdiUPCdsApMlHhXogKVM4HM2DVbIjGNTTYH2OcmP1vA==", "license": "BSD-3-Clause", "dependencies": { "es-define-property": "^1.0.1", diff --git a/packages/cli/THIRD_PARTY_NOTICES.txt b/packages/cli/THIRD_PARTY_NOTICES.txt index f1950bb8bd..7e16844036 100644 --- a/packages/cli/THIRD_PARTY_NOTICES.txt +++ b/packages/cli/THIRD_PARTY_NOTICES.txt @@ -4108,7 +4108,7 @@ SOFTWARE. ================================================================================ -Package: fast-uri@3.1.5 +Package: fast-uri@3.1.7 Declared license: BSD-3-Clause Selected license: BSD-3-Clause Repository: git+https://github.com/fastify/fast-uri.git @@ -6483,7 +6483,7 @@ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLI ================================================================================ -Package: qs@6.15.3 +Package: qs@6.16.0 Declared license: BSD-3-Clause Selected license: BSD-3-Clause Repository: https://github.com/ljharb/qs.git