fix: [parse-url] Upgrade parse-url from 5.0.1 to 6.0.1 to resolve CVE-2022-2216

[hannahhuh-cog]

Summary

Fixes Server-Side Request Forgery in parse-url, reported by the scheduled Snyk MCP scan.

• Vulnerability: Server-Side Request Forgery (SSRF) — SNYK-JS-PARSEURL-2936249
• CVE: CVE-2022-2216
• Severity: Critical, CVSS 9.4
• Affected: parse-url@5.0.1 (transitive)
• Fixed in: >=6.0.1; pinned to 6.0.1
• Risk: Malformed URLs are parsed into an unexpected host, so validation based on the parsed host can be bypassed and requests redirected to internal endpoints.

parse-url is transitive, so the fix is an npm overrides entry:

+  "overrides": {
+    "parse-url": "6.0.1"
+  }

package-lock.json regenerated with npm install --package-lock-only; resolved node_modules/parse-url is now 6.0.1.

Snyk scan reference: snyk test --all-projects --dev / snyk_sca_scan (unmanaged: true), Snyk org 9e26acce-22c7-4efc-b470-21d9587f49fe.

Devin-Org: engineering

Link to Devin session: https://app.devin.ai/sessions/fc1965e7d98f4966bea1c7aa64a929b0
Requested by: @hannahhuh-cog

---

Devin Review

Status	Commit
⚪ Not started	—

Run Devin Review

---

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[devin-ai-integration]

Devin Review found 2 potential issues.

[devin-ai-integration]

🟡 Lockfile omits overrides, out of sync with manifest

The new overrides block is not recorded in the regenerated lockfile's root packages[""] entry, which npm requires. The manifest and lockfile are out of sync, so npm ci fails with EUSAGE.

Prompt for agents

package.json now declares an overrides block (parse-url: 6.0.1), but the committed package-lock.json's root package entry (packages[""]) does not include a corresponding overrides field. In lockfileVersion 2/3, npm records the overrides object in the root of package-lock.json, and npm ci verifies the two files agree. Because the lockfile lacks the overrides marker, npm ci will error that package.json and package-lock.json are out of sync. Regenerate the lockfile with a modern npm (npm install, not a partial edit) so that the overrides object is written into package-lock.json's packages[""] entry, and commit the result.

---

Was this helpful? React with 👍 or 👎 to provide feedback.

[devin-ai-integration]

Verified locally — npm ci is not broken by this.

I regenerated the lockfile with npm install --package-lock-only on npm 10.8.2. This repo's lockfile is lockfileVersion: 2 (hybrid v1/v2), and npm did not write an overrides key into packages[""] — but it did resolve the overridden version in the tree, and npm only enforces the overrides-sync check when the lockfile records one.

Evidence, from a clean checkout of just package.json + package-lock.json on this branch:

$ npm ci --ignore-scripts
added 947 packages in 5s
$ node -e "console.log(require('parse-url/package.json').version)"
6.0.1

No EUSAGE error. Leaving the lockfile as npm generated it.

[devin-ai-integration]

📝 Info: parse-url is a dev-only transitive dependency

parse-url is pulled in only through git-url-parse under snyk, and all related packages are marked "dev": true. The override affects only the dev/CI toolchain, not production runtime.

---

Was this helpful? React with 👍 or 👎 to provide feedback.