From f95a28d1fe046a6f46166fc64cbd49533850594c Mon Sep 17 00:00:00 2001 From: Michal Harakal Date: Mon, 7 Sep 2026 16:52:04 +0200 Subject: [PATCH] security: pin fast-uri to 3.1.6, pin qs to 6.16.0 fast-uri 3.1.5 (pinned for GHSA-7p8r-x3mc-p8w7/GHSA-v2hh-gcrm-f6hx) is below the fix floor for four newer advisories, all <3.1.6: GHSA-jqff-g426-hqxp, GHSA-f65p-4m7j-42xc, GHSA-fph4-wmhf-6fwf, GHSA-5jgf-p345-68v8 (host confusion / SSRF via scheme, IPv6 and IDN normalization bugs). qs was unpinned and pulled in transitively at ~6.15.1, vulnerable to GHSA-4mjr-xmp4-gh2g (DoS via attacker- controlled isBuffer) and GHSA-x5fp-wj9c-mxmx (array-limit bypass); 6.16.0 fixes both. Both packages exist only in the JS Yarn graph (kotlin-js-store/yarn.lock), not the Wasm one, so both pins are NpmPinTarget.JS-scoped like the existing fast-uri pin. kotlinUpgradeYarnLock + kotlinWasmUpgradeYarnLock regenerated the lockfiles; verifyNpmPins passes (9 pins verified). JS/wasmJs compile clean. Co-Authored-By: Claude Sonnet 5 Claude-Session: https://claude.ai/code/session_01PLfVvtURRYZETceamLi8kP --- build.gradle.kts | 1 + gradle/libs.versions.toml | 4 +++- kotlin-js-store/yarn.lock | 16 ++++++++-------- 3 files changed, 12 insertions(+), 9 deletions(-) diff --git a/build.gradle.kts b/build.gradle.kts index d6fa2d087..e8ba6b5f1 100644 --- a/build.gradle.kts +++ b/build.gradle.kts @@ -37,6 +37,7 @@ skainet { pin("socket.io-parser", libs.versions.npm.socketio.parser, NpmPinTarget.JS) pin("fast-uri", libs.versions.npm.fast.uri, NpmPinTarget.JS) pin("serialize-javascript", libs.versions.npm.serialize.javascript, NpmPinTarget.JS) + pin("qs", libs.versions.npm.qs, NpmPinTarget.JS) pin("brace-expansion", libs.versions.npm.brace.expansion, NpmPinTarget.JS) pin("diff", libs.versions.npm.diff, NpmPinTarget.JS) pin("webpack", libs.versions.npm.webpack, NpmPinTarget.JS) diff --git a/gradle/libs.versions.toml b/gradle/libs.versions.toml index eea4a0b87..bd1d97186 100644 --- a/gradle/libs.versions.toml +++ b/gradle/libs.versions.toml @@ -50,8 +50,10 @@ kotest = "6.2.4" npm-ws = "8.21.1" # GHSA-96hv-2xvq-fx4p npm-js-yaml = "4.3.1" # GHSA-5p4m-2wfm-xmqj npm-socketio-parser = "4.2.7" # GHSA-2m8v-j782-fhvr -npm-fast-uri = "3.1.5" # GHSA-7p8r-x3mc-p8w7, GHSA-v2hh-gcrm-f6hx +npm-fast-uri = "3.1.6" # GHSA-7p8r-x3mc-p8w7, GHSA-v2hh-gcrm-f6hx, GHSA-jqff-g426-hqxp, + # GHSA-f65p-4m7j-42xc, GHSA-fph4-wmhf-6fwf, GHSA-5jgf-p345-68v8 npm-serialize-javascript = "7.0.5" # GHSA-5c6j-r48x-rmvq, GHSA-qj8w-gfj5-8c6v +npm-qs = "6.16.0" # GHSA-4mjr-xmp4-gh2g, GHSA-x5fp-wj9c-mxmx # One pin covers both major lines in the graph: minimatch 3.x asks for ^1.1.7 and # minimatch 9.x for ^2.0.2, and a Yarn resolution is global. 2.1.4 clears the fixed # set of both advisories (<1.1.18 and >=2.0.0 <2.1.4); the exported API is unchanged diff --git a/kotlin-js-store/yarn.lock b/kotlin-js-store/yarn.lock index 508c036c5..0d502271d 100644 --- a/kotlin-js-store/yarn.lock +++ b/kotlin-js-store/yarn.lock @@ -792,10 +792,10 @@ fast-deep-equal@^3.1.3: resolved "https://registry.yarnpkg.com/fast-deep-equal/-/fast-deep-equal-3.1.3.tgz#3a7d56b559d6cbc3eb512325244e619a65c6c525" integrity sha512-f3qQ9oQy9j2AhBe/H9VC91wLmKBCCU/gDOnKNAYG5hswO7BLKj09Hc5HYNz9cGI++xlpDCIgDaitVs03ATR84Q== -fast-uri@3.1.5, fast-uri@^3.0.1: - version "3.1.5" - resolved "https://registry.yarnpkg.com/fast-uri/-/fast-uri-3.1.5.tgz#610f37419a030270430cecd68d74e3d4d96725d0" - integrity sha512-gHwA1O9LDIcKunMKhObS/HimwtehO1nPUECKAu5TpKgaO19fcWEl4bliWe1jWxVFvIXztJjjQ4L8XQ1EU9f7Jw== +fast-uri@3.1.6, fast-uri@^3.0.1: + version "3.1.6" + resolved "https://registry.yarnpkg.com/fast-uri/-/fast-uri-3.1.6.tgz#bfdd308ef763f835fed059f3c6c925f708e33e3a" + integrity sha512-7Ical1vFEMr0onbVzEDIreM22I4khW+fzyQPwvAFWBp1iwdshSZRsL4jjRvPG9JP1uiqMHRto+YU6R2/CzDz5Q== fastest-levenshtein@^1.0.12: version "1.0.16" @@ -1547,10 +1547,10 @@ qjobs@^1.2.0: resolved "https://registry.yarnpkg.com/qjobs/-/qjobs-1.2.0.tgz#c45e9c61800bd087ef88d7e256423bdd49e5d071" integrity sha512-8YOJEHtxpySA3fFDyCRxA+UUV+fA+rTWnuWvylOK/NCjhY+b4ocCtmu8TtsWb+mYeU+GCHf/S66KZF/AsteKHg== -qs@~6.15.1: - version "6.15.3" - resolved "https://registry.yarnpkg.com/qs/-/qs-6.15.3.tgz#76852132a58ed5c7c0ef67e4441b9bb5d6061b3b" - integrity sha512-O9gl3zCl5h5blw1KGUzQKhA5oUXSl8rwUIM5o0S3nCXMliSvy5Dzx7/DJcI+SwgICv+IneSZwhBh1oSyEHA71A== +qs@6.16.0, qs@~6.15.1: + version "6.16.0" + resolved "https://registry.yarnpkg.com/qs/-/qs-6.16.0.tgz#c22c723a28a920f3aacdce8289fabd43eccb79fd" + integrity sha512-h6fhOIaRrID2CbEY2fqs+7t+UXZo+MLAnU5gRIq85uFtdiUPCdsApMlHhXogKVM4HM2DVbIjGNTTYH2OcmP1vA== dependencies: es-define-property "^1.0.1" side-channel "^1.1.1"