From 896b57585e6ad29792a8bfdb49d62f437076d9dc Mon Sep 17 00:00:00 2001 From: qnbs <155236708+qnbs@users.noreply.github.com> Date: Wed, 2 Sep 2026 20:38:33 +0200 Subject: [PATCH 1/8] fix(deps): bump stale xmldom and fast-uri override floors past newly-published CVEs MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Both overrides had gone stale in the same way: a floor that no longer excludes the currently-resolved vulnerable version. @xmldom/xmldom: resolved 0.9.10 is within the vulnerable range for GHSA-6gmq-8vp8-gcm6 (XML fragment injection via invalid EntityReference.nodeName), fixed in 0.9.12. Ships via mammoth (.docx export), a production dependency, unlike this repo's other recent stale- floor case. 0.9.12 was published 2026-08-21, well clear of this repo's 7-day minimumReleaseAge quarantine. fast-uri: resolved 3.1.5 is within the vulnerable range for four related 2026-08 advisories (host confusion / SSRF via percent-encoding and IPv6 normalization), fixed in 3.1.6, published 2026-08-23 — also clear of quarantine. Dev-only transitive (stryker, workbox-build), never shipped. pnpm audit --audit-level=high now reports only the two already-documented, unfixable-by-override findings (extract-zip, accepted risk per AUDIT.md; qs, deferred pending its own quarantine clearance ~2026-09-05). Verified with a full production build + smoke:prod (0 CSP violations, wasm ok). --- AUDIT.md | 2 +- pnpm-lock.yaml | 23 +++++++++++------------ pnpm-workspace.yaml | 8 ++++---- 3 files changed, 16 insertions(+), 17 deletions(-) diff --git a/AUDIT.md b/AUDIT.md index 0f4a68517..74b0065ca 100644 --- a/AUDIT.md +++ b/AUDIT.md @@ -1837,7 +1837,7 @@ several apply only to dev/test transitive deps and are never shipped to users. | esbuild | >=0.28.1 | GHSA-67mh-4wv8-2f99 | Dev-server CORS let any website send requests to the esbuild dev server and read the response (≤0.24.2; fixed 0.25.0). Build-tool only, never shipped. Pinned in the 2026-06 security merge. | | serialize-javascript | >=7.0.3 | GHSA-76p7-773f-r4q5 / CVE-2024-11831 | Regex XSS in serialized output (<6.0.2). | | tmp | ^0.2.6 | GHSA-52f5-9888-hmc6 / CVE-2025-54798 | Arbitrary temp file/dir write via symlink `dir` parameter (≤0.2.3; fixed 0.2.4). | -| @xmldom/xmldom | >=0.8.13 | GHSA-5fg8-2547-mr8q / CVE-2022-39353 | Misinterpretation of malicious XML input; floor sits above the 0.8.x fixes. | +| @xmldom/xmldom | >=0.9.12 | GHSA-6gmq-8vp8-gcm6 / CVE-2026-83610 (supersedes GHSA-5fg8-2547-mr8q / CVE-2022-39353) | XML fragment injection via invalid `EntityReference.nodeName` during `requireWellFormed` serialization (≥0.9.0 ≤0.9.11; fixed 0.9.12). The prior `>=0.8.13` floor no longer excluded this — Dependabot alert #79, 2026-09-02. Ships via `mammoth` (`.docx` export), a production dependency. | | protobufjs | >=7.5.6 | GHSA-h755-8qp9-cq85 / CVE-2023-36665 | Prototype pollution (6.10.0–7.2.3; fixed 7.2.4). | | axios | >=1.15.2 | GHSA-jr5f-v2jv-69x6 / CVE-2025-27152 | SSRF + credential leak via absolute URL. | | basic-ftp | >=5.3.1 | GHSA-5rq4-664w-9x2c / CVE-2026-27699 | Path traversal in `downloadToDir()` (<5.2.0). Dev/test transitive. | diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 912783801..51e28ead7 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -13,11 +13,11 @@ overrides: serialize-javascript: '>=7.0.3' chrome-launcher: ^1.2.1 tmp: '>=0.2.7' - '@xmldom/xmldom': '>=0.8.13' + '@xmldom/xmldom': '>=0.9.12' protobufjs: '>=8.6.6' axios: '>=1.18.0' basic-ftp: '>=5.3.1' - fast-uri: '>=3.1.5 <4' + fast-uri: '>=3.1.6 <4' ip-address: 10.3.1 ws: '>=8.21.0' form-data: '>=4.0.6' @@ -3490,10 +3490,9 @@ packages: '@workflow/serde@4.1.0': resolution: {integrity: sha512-pav4F2BoirECWR7Nf1TKt+2eETcBj7jj4cBefQ8VXQCA6NPkaKeLfj/zMgi+3zYV5ZIBT4GuUiphsj0/b9hPQQ==} - '@xmldom/xmldom@0.9.10': - resolution: {integrity: sha512-A9gOqLdi6cV4ibazAjcQufGj0B1y/vDqYrcuP6d/6x8P27gRS8643Dj9o1dEKtB6O7fwxb2FgBmJS2mX7gpvdw==} + '@xmldom/xmldom@0.9.12': + resolution: {integrity: sha512-5AXjrcMClTryPe9LgZrygpB1lj7s0S9E0+W+AHaVKAVyHanafK86iPSvG5xHVSp/jC+VH1UXu0TAEmY279xH7A==} engines: {node: '>=14.6'} - deprecated: this version has critical issues, please update to the latest version '@xstate/react@6.1.0': resolution: {integrity: sha512-ep9F0jGTI63B/jE8GHdMpUqtuz7yRebNaKv8EMUaiSi29NOglywc2X2YSOV/ygbIK+LtmgZ0q9anoEA2iBSEOw==} @@ -4634,8 +4633,8 @@ packages: fast-string-width@3.0.2: resolution: {integrity: sha512-gX8LrtNEI5hq8DVUfRQMbr5lpaS4nMIWV+7XEbXk2b8kiQIizgnlr12B4dA3ZEx3308ze0O4Q1R+cHts8kyUJg==} - fast-uri@3.1.5: - resolution: {integrity: sha512-gHwA1O9LDIcKunMKhObS/HimwtehO1nPUECKAu5TpKgaO19fcWEl4bliWe1jWxVFvIXztJjjQ4L8XQ1EU9f7Jw==} + fast-uri@3.1.6: + resolution: {integrity: sha512-7Ical1vFEMr0onbVzEDIreM22I4khW+fzyQPwvAFWBp1iwdshSZRsL4jjRvPG9JP1uiqMHRto+YU6R2/CzDz5Q==} fast-wrap-ansi@0.2.0: resolution: {integrity: sha512-rLV8JHxTyhVmFYhBJuMujcrHqOT2cnO5Zxj37qROj23CP39GXubJRBUFF0z8KFK77Uc0SukZUf7JZhsVEQ6n8w==} @@ -10802,7 +10801,7 @@ snapshots: '@workflow/serde@4.1.0': {} - '@xmldom/xmldom@0.9.10': {} + '@xmldom/xmldom@0.9.12': {} '@xstate/react@6.1.0(@types/react@19.2.18)(react@19.2.8)(xstate@5.32.5)': dependencies: @@ -10849,14 +10848,14 @@ snapshots: ajv@8.18.0: dependencies: fast-deep-equal: 3.1.3 - fast-uri: 3.1.5 + fast-uri: 3.1.6 json-schema-traverse: 1.0.0 require-from-string: 2.0.2 ajv@8.20.0: dependencies: fast-deep-equal: 3.1.3 - fast-uri: 3.1.5 + fast-uri: 3.1.6 json-schema-traverse: 1.0.0 require-from-string: 2.0.2 @@ -12044,7 +12043,7 @@ snapshots: dependencies: fast-string-truncated-width: 3.0.3 - fast-uri@3.1.5: {} + fast-uri@3.1.6: {} fast-wrap-ansi@0.2.0: dependencies: @@ -13555,7 +13554,7 @@ snapshots: mammoth@1.12.1: dependencies: - '@xmldom/xmldom': 0.9.10 + '@xmldom/xmldom': 0.9.12 argparse: 1.0.10 base64-js: 1.5.1 bluebird: 3.4.7 diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index a773878e9..58afca111 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -24,12 +24,12 @@ minimumReleaseAgeExclude: # - serialize-javascript: CVE-2024-XXXX - prototype pollution fix # - chrome-launcher: CVE-2024-XXXX - command injection fix # - tmp: GHSA-7c78-jf6q-g5cm - type-confusion _assertPath bypass (fixed 0.2.7) -# - @xmldom/xmldom: CVE-2024-XXXX - XSS fix +# - @xmldom/xmldom: GHSA-6gmq-8vp8-gcm6 - XML fragment injection via invalid EntityReference.nodeName (fixed 0.9.12) # - protobufjs: GHSA-wcpc-wj8m-hjx6 - DoS via unbounded Any expansion in JSON conversion (fixed 8.4.1); # raised to >=8.6.6 for GHSA-j3f2-48v5-ccww / GHSA-jfj6-75fj-8934 (2026-07) # - axios: CVE-2024-XXXX - SSRF fix # - basic-ftp: CVE-2024-XXXX - path traversal fix -# - fast-uri: GHSA-7p8r-x3mc-p8w7 - host confusion via backslash authority parsing (fixed 3.1.5) +# - fast-uri: GHSA-7p8r-x3mc-p8w7 - host confusion via backslash authority parsing (fixed 3.1.5); superseded by GHSA-5jgf-p345-68v8/GHSA-f65p-4m7j-42xc/GHSA-fph4-wmhf-6fwf/GHSA-jqff-g426-hqxp - host confusion / SSRF via percent-encoding and IPv6 normalization (fixed 3.1.6) # - ip-address: GHSA-mwp4-54f8-5fhr - leading-zero parsing mismatch enabling SSRF / trust-boundary bypass (fixed 10.3.1) # - ws: GHSA-96hv-2xvq-fx4p - memory-exhaustion DoS from tiny fragments (fixed 8.21.0) # - form-data: CRLF injection via unescaped boundary (fixed 4.0.6) @@ -69,11 +69,11 @@ overrides: serialize-javascript: ">=7.0.3" chrome-launcher: "^1.2.1" tmp: ">=0.2.7" - "@xmldom/xmldom": ">=0.8.13" + "@xmldom/xmldom": ">=0.9.12" protobufjs: ">=8.6.6" axios: ">=1.18.0" basic-ftp: ">=5.3.1" - fast-uri: ">=3.1.5 <4" + fast-uri: ">=3.1.6 <4" ip-address: "10.3.1" ws: ">=8.21.0" form-data: ">=4.0.6" From a869e197cd9524b2ca0b3f5297e8caeb4b89a212 Mon Sep 17 00:00:00 2001 From: qnbs <155236708+qnbs@users.noreply.github.com> Date: Wed, 2 Sep 2026 20:53:15 +0200 Subject: [PATCH 2/8] fix(deps): update the fast-uri AUDIT.md row and scope the table's verification date The fast-uri override bump was missing its AUDIT.md Known Overrides Table update (only xmldom's row was updated), contradicting this PR's own test- plan claim. Updates the row to >=3.1.6 with the four superseding advisory IDs. Also scopes the table's blanket "re-verified 2026-06-13" statement, which was inconsistent with the newly-dated xmldom and fast-uri rows. --- AUDIT.md | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/AUDIT.md b/AUDIT.md index 74b0065ca..4d46f3c62 100644 --- a/AUDIT.md +++ b/AUDIT.md @@ -1828,9 +1828,12 @@ WorldScript Studio was assessed as a strong, modern React/TypeScript application ## Known Overrides Table (Supply-Chain Hardening) Source of truth for the override floors is `pnpm-workspace.yaml` (`overrides:`). Advisory -IDs below were re-verified against the GitHub Advisory Database on 2026-06-13. Floors are -intentionally conservative (set above the patched version) as preventive supply-chain pins; -several apply only to dev/test transitive deps and are never shipped to users. +IDs below were re-verified against the GitHub Advisory Database on 2026-06-13, except the +`@xmldom/xmldom` and `fast-uri` rows, re-verified 2026-09-02 (Dependabot alert #79 and a +`pnpm audit` sweep, respectively) after both floors were found to no longer exclude the +then-currently-resolved vulnerable version. Floors are intentionally conservative (set above +the patched version) as preventive supply-chain pins; several apply only to dev/test +transitive deps and are never shipped to users. | Package | Override | Advisory | Justification | |---------|----------|----------|---------------| @@ -1841,7 +1844,7 @@ several apply only to dev/test transitive deps and are never shipped to users. | protobufjs | >=7.5.6 | GHSA-h755-8qp9-cq85 / CVE-2023-36665 | Prototype pollution (6.10.0–7.2.3; fixed 7.2.4). | | axios | >=1.15.2 | GHSA-jr5f-v2jv-69x6 / CVE-2025-27152 | SSRF + credential leak via absolute URL. | | basic-ftp | >=5.3.1 | GHSA-5rq4-664w-9x2c / CVE-2026-27699 | Path traversal in `downloadToDir()` (<5.2.0). Dev/test transitive. | -| fast-uri | >=3.1.2 | GHSA-q3j6-qgpj-74h6 / CVE-2026-6321 | Path traversal via percent-encoded dot segments (≤3.1.0). | +| fast-uri | >=3.1.6 | GHSA-5jgf-p345-68v8 / GHSA-f65p-4m7j-42xc / GHSA-fph4-wmhf-6fwf / GHSA-jqff-g426-hqxp (supersedes GHSA-q3j6-qgpj-74h6 / CVE-2026-6321) | Host confusion / SSRF via percent-encoding and IPv6 normalization (resolved 3.1.5 vulnerable; fixed 3.1.6). The prior `>=3.1.2` floor no longer excluded this — found via a routine `pnpm audit` sweep, 2026-09-02. Dev-only transitive (`@stryker-mutator/core`, `workbox-build`), never shipped. | | ws | >=8.20.1 | GHSA-3h5v-q93c-6h6q / CVE-2024-37890 | DoS when handling a request with many HTTP headers (fixed 8.17.1). | | brace-expansion | >=5.0.6 | GHSA-v6h2-p8h4-qcjw / CVE-2025-5889 | ReDoS in `expand()` (fixed 1.1.12 / 2.0.2 / 3.0.1 / 4.0.1). | | qs | >=6.15.2 | GHSA-hrpp-h998-j3pp / CVE-2022-24999 | Prototype pollution / DoS via crafted query strings (fixed in the ≥6.2.4 line). | From be1ef5d64dea38940db568b1103b0cf87f9f3b1d Mon Sep 17 00:00:00 2001 From: qnbs <155236708+qnbs@users.noreply.github.com> Date: Wed, 2 Sep 2026 21:06:56 +0200 Subject: [PATCH 3/8] docs: correct override-floor wording to match the new exact-patched-version pins The Known Overrides Table said floors are "set above the patched version", but the new xmldom (0.9.12) and fast-uri (3.1.6) floors are set exactly AT their first patched version, not above it. Corrects to "set at or above the patched version" for accuracy. --- AUDIT.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/AUDIT.md b/AUDIT.md index 4d46f3c62..9aca53644 100644 --- a/AUDIT.md +++ b/AUDIT.md @@ -1831,8 +1831,8 @@ Source of truth for the override floors is `pnpm-workspace.yaml` (`overrides:`). IDs below were re-verified against the GitHub Advisory Database on 2026-06-13, except the `@xmldom/xmldom` and `fast-uri` rows, re-verified 2026-09-02 (Dependabot alert #79 and a `pnpm audit` sweep, respectively) after both floors were found to no longer exclude the -then-currently-resolved vulnerable version. Floors are intentionally conservative (set above -the patched version) as preventive supply-chain pins; several apply only to dev/test +then-currently-resolved vulnerable version. Floors are intentionally conservative (set at or +above the patched version) as preventive supply-chain pins; several apply only to dev/test transitive deps and are never shipped to users. | Package | Override | Advisory | Justification | From 23b6dfc31ab9c23f892bbb1bff2c6a924f52ce5c Mon Sep 17 00:00:00 2001 From: qnbs <155236708+qnbs@users.noreply.github.com> Date: Wed, 2 Sep 2026 21:49:11 +0200 Subject: [PATCH 4/8] fix(deps): bump qs override floor to 6.16.0, admit via version-scoped release-age exception Resolved qs 6.15.2 is vulnerable to GHSA-4mjr-xmp4-gh2g and GHSA-x5fp-wj9c-mxmx (array-limit bypass; isBuffer DoS), dev-only transitive via @lhci/cli, @stryker-mutator/core, and http-server. Fixed in 6.16.0, published 2026-08-29T23:50:15.803Z -- inside this repo's 7-day minimumReleaseAge quarantine at the time of this fix. Admits exactly qs@6.16.0 (not qs broadly, not a range) via minimumReleaseAgeExclude, the same mechanism and precedent already used for nanoid@3.3.18 (PR #362). minimumReleaseAge itself (10080) is unchanged; any future qs release remains governed by the normal quarantine. Compensating verification before admission: registry identity/integrity, no new install-time lifecycle scripts vs 6.15.2, and the one dependency delta (es-define-property, side-channel bump) traced to the same qs maintainer and already present elsewhere in the resolved tree. AUDIT.md's override table documents the qs row and the exception rationale; the exclusion is scheduled for removal once 6.16.0 naturally clears quarantine at 2026-09-05T23:50:15Z UTC. --- AUDIT.md | 6 +++--- pnpm-lock.yaml | 17 +++++++++-------- pnpm-workspace.yaml | 6 ++++-- 3 files changed, 16 insertions(+), 13 deletions(-) diff --git a/AUDIT.md b/AUDIT.md index 9aca53644..31330ef32 100644 --- a/AUDIT.md +++ b/AUDIT.md @@ -1829,8 +1829,8 @@ WorldScript Studio was assessed as a strong, modern React/TypeScript application Source of truth for the override floors is `pnpm-workspace.yaml` (`overrides:`). Advisory IDs below were re-verified against the GitHub Advisory Database on 2026-06-13, except the -`@xmldom/xmldom` and `fast-uri` rows, re-verified 2026-09-02 (Dependabot alert #79 and a -`pnpm audit` sweep, respectively) after both floors were found to no longer exclude the +`@xmldom/xmldom`, `fast-uri`, and `qs` rows, re-verified 2026-09-02 (Dependabot alert #79 +and two `pnpm audit` sweeps) after all three floors were found to no longer exclude the then-currently-resolved vulnerable version. Floors are intentionally conservative (set at or above the patched version) as preventive supply-chain pins; several apply only to dev/test transitive deps and are never shipped to users. @@ -1847,7 +1847,7 @@ transitive deps and are never shipped to users. | fast-uri | >=3.1.6 | GHSA-5jgf-p345-68v8 / GHSA-f65p-4m7j-42xc / GHSA-fph4-wmhf-6fwf / GHSA-jqff-g426-hqxp (supersedes GHSA-q3j6-qgpj-74h6 / CVE-2026-6321) | Host confusion / SSRF via percent-encoding and IPv6 normalization (resolved 3.1.5 vulnerable; fixed 3.1.6). The prior `>=3.1.2` floor no longer excluded this — found via a routine `pnpm audit` sweep, 2026-09-02. Dev-only transitive (`@stryker-mutator/core`, `workbox-build`), never shipped. | | ws | >=8.20.1 | GHSA-3h5v-q93c-6h6q / CVE-2024-37890 | DoS when handling a request with many HTTP headers (fixed 8.17.1). | | brace-expansion | >=5.0.6 | GHSA-v6h2-p8h4-qcjw / CVE-2025-5889 | ReDoS in `expand()` (fixed 1.1.12 / 2.0.2 / 3.0.1 / 4.0.1). | -| qs | >=6.15.2 | GHSA-hrpp-h998-j3pp / CVE-2022-24999 | Prototype pollution / DoS via crafted query strings (fixed in the ≥6.2.4 line). | +| qs | >=6.16.0 | GHSA-4mjr-xmp4-gh2g / GHSA-x5fp-wj9c-mxmx (supersedes GHSA-hrpp-h998-j3pp / CVE-2022-24999) | Array-limit bypass via bracket-key comma parsing, and a DoS via attacker-controlled `isBuffer` (resolved 6.15.2 vulnerable; fixed 6.16.0). Dev-only transitive (`@lhci/cli`, `@stryker-mutator/core`, `http-server`), never shipped. `6.16.0` was published 2026-08-29, inside this repo's 7-day `minimumReleaseAge` quarantine at the time of this fix — admitted via a version-scoped `minimumReleaseAgeExclude: qs@6.16.0` entry (same mechanism/precedent as `nanoid@3.3.18`, PR #362), **not** a reduction of the 10080-minute quarantine itself. Compensating verification before admission: registry identity/integrity confirmed via `npm view`; no new install/preinstall/postinstall/prepare lifecycle scripts versus 6.15.2 (identical script set); the one dependency delta (`es-define-property@^1.0.1` added, `side-channel` bumped to `^1.1.1`) is maintained by the same author (`ljharb`) as `qs` itself and was already present elsewhere in the resolved tree. Remove the exclusion once 6.16.0 naturally ages past 2026-09-05T23:50:15Z UTC and a frozen install still resolves it — future qs releases remain governed by the normal quarantine. | | chrome-launcher | ^1.2.1 | preventive pin — no direct advisory | Lighthouse-CI dev transitive; conservative floor, dev-only. | | ip-address | >=10.1.1 | preventive pin — no direct advisory | Dev/test transitive hardening; no advisory matches this floor. | | uuid | >=11.1.1 | preventive pin — no direct advisory | Conservative version floor; no security advisory applies (the prior "collision" note was inaccurate). | diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 51e28ead7..3e2a20c8e 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -23,7 +23,7 @@ overrides: form-data: '>=4.0.6' brace-expansion: '>=5.0.9' uuid: '>=11.1.1 <12.0.0 || >=12.0.1 <13.0.0 || >=13.0.1' - qs: '>=6.15.2' + qs: '>=6.16.0' dompurify: '>=3.4.13' '@babel/core': '>=7.29.6 <8' undici: '>=7.29.0 <8' @@ -6402,8 +6402,8 @@ packages: pure-rand@7.0.1: resolution: {integrity: sha512-oTUZM/NAZS8p7ANR3SHh30kXB+zK2r2BPcEn/awJIbOvq82WoMN4p62AWWp3Hhw50G0xMsw1mhIBLqHw64EcNQ==} - qs@6.15.2: - resolution: {integrity: sha512-Rzq0KEyX/w/tEybncDgdkZrJgVUsUMk3xjh3t5bv3S1HTAtg+uOYt72+ZfwiQwKdysThkTBdL/rTi6HDmX9Ddw==} + qs@6.16.0: + resolution: {integrity: sha512-h6fhOIaRrID2CbEY2fqs+7t+UXZo+MLAnU5gRIq85uFtdiUPCdsApMlHhXogKVM4HM2DVbIjGNTTYH2OcmP1vA==} engines: {node: '>=0.6'} queue-microtask@1.2.3: @@ -11136,7 +11136,7 @@ snapshots: http-errors: 2.0.1 iconv-lite: 0.4.24 on-finished: 2.4.1 - qs: 6.15.2 + qs: 6.16.0 raw-body: 2.5.3 type-is: 1.6.18 unpipe: 1.0.0 @@ -11992,7 +11992,7 @@ snapshots: parseurl: 1.3.3 path-to-regexp: 0.1.13 proxy-addr: 2.0.7 - qs: 6.15.2 + qs: 6.16.0 range-parser: 1.2.1 safe-buffer: 5.2.1 send: 0.19.2(supports-color@10.2.2) @@ -14148,8 +14148,9 @@ snapshots: pure-rand@7.0.1: {} - qs@6.15.2: + qs@6.16.0: dependencies: + es-define-property: 1.0.1 side-channel: 1.1.1 queue-microtask@1.2.3: {} @@ -15154,7 +15155,7 @@ snapshots: dependencies: des.js: 1.1.0 js-md4: 0.3.2 - qs: 6.15.2 + qs: 6.16.0 tunnel: 0.0.6 underscore: 1.13.8 @@ -15202,7 +15203,7 @@ snapshots: union@0.5.0: dependencies: - qs: 6.15.2 + qs: 6.16.0 unique-string@2.0.0: dependencies: diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index 58afca111..16c1915f2 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -16,6 +16,8 @@ blockExoticSubdeps: true minimumReleaseAge: 10080 minimumReleaseAgeExclude: - nanoid@3.3.18 + # QNBS-v3: version-scoped security-fix exception (same mechanism/precedent as nanoid@3.3.18, PR #362) -- exempts ONLY this exact qs release from the 7-day quarantine so GHSA-4mjr-xmp4-gh2g/GHSA-x5fp-wj9c-mxmx can be remediated now; qs 6.16.1+ remain governed by the normal minimumReleaseAge. Remove once 6.16.0 naturally ages past 2026-09-05T23:50:15Z UTC and frozen install still resolves it. + - qs@6.16.0 # QNBS-v3: Migrated from package.json "pnpm" field (deprecated in pnpm v10+) # Overrides with security justifications: @@ -37,7 +39,7 @@ minimumReleaseAgeExclude: # - uuid: GHSA-w5hq-g745-h8pq / CVE-2026-41907 - missing buffer bounds check in v3/v5/v6 API methods, # allows silent partial writes with an insufficient output buffer or wrong offset (fixed 11.1.1 / # 12.0.1 / 13.0.1 per major line; lockfile converges on 14.0.1, which the override floor now pins) -# - qs: GHSA-q8mj-m7cp-5q26 / CVE-2026-8723 - prototype pollution fix +# - qs: GHSA-q8mj-m7cp-5q26 / CVE-2026-8723 - prototype pollution fix; superseded by GHSA-4mjr-xmp4-gh2g / GHSA-x5fp-wj9c-mxmx - array-limit bypass / isBuffer DoS (fixed 6.16.0; see minimumReleaseAgeExclude above for the release-age exception this specific version needed) # - esbuild: GHSA-67mh-4wv8-2f99 - dev-server CORS allowed any origin to read responses; # GHSA-gv7w-rqvm-qjhr - missing binary integrity verification (Deno module); # GHSA-g7r4-m6w7-qqqr - Windows path traversal in the dev-server file handler (all fixed 0.28.1) @@ -80,7 +82,7 @@ overrides: brace-expansion: ">=5.0.9" # QNBS-v3: excludes the two exact unpatched releases (12.0.0, 13.0.0) a bare ">=11.1.1" floor would still permit; the resolved 14.0.1 already satisfies this. uuid: ">=11.1.1 <12.0.0 || >=12.0.1 <13.0.0 || >=13.0.1" - qs: ">=6.15.2" + qs: ">=6.16.0" dompurify: ">=3.4.13" "@babel/core": ">=7.29.6 <8" undici: ">=7.29.0 <8" From e91f8bf0cd5d8f337e288eae572b24d37fc9060a Mon Sep 17 00:00:00 2001 From: qnbs <155236708+qnbs@users.noreply.github.com> Date: Wed, 2 Sep 2026 22:01:34 +0200 Subject: [PATCH 5/8] fix(deps): drop inline QNBS-v3 comment from pnpm-workspace.yaml exclude entry pnpm-workspace.yaml is pure YAML config; the repo convention explains such overrides in the commit message and AUDIT.md, not with an inline comment on the entry itself. The sibling nanoid@3.3.18 exclude entry it sits beside carries no comment either. The full qs@6.16.0 release-age exception rationale already lives in AUDIT.md's override table and this PR's description; this removes the duplicate inline copy, no information lost. --- pnpm-workspace.yaml | 1 - 1 file changed, 1 deletion(-) diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index 16c1915f2..ec87791f3 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -16,7 +16,6 @@ blockExoticSubdeps: true minimumReleaseAge: 10080 minimumReleaseAgeExclude: - nanoid@3.3.18 - # QNBS-v3: version-scoped security-fix exception (same mechanism/precedent as nanoid@3.3.18, PR #362) -- exempts ONLY this exact qs release from the 7-day quarantine so GHSA-4mjr-xmp4-gh2g/GHSA-x5fp-wj9c-mxmx can be remediated now; qs 6.16.1+ remain governed by the normal minimumReleaseAge. Remove once 6.16.0 naturally ages past 2026-09-05T23:50:15Z UTC and frozen install still resolves it. - qs@6.16.0 # QNBS-v3: Migrated from package.json "pnpm" field (deprecated in pnpm v10+) From 73a169447a0c2baf83f1a83cfcaed1bf0daa0944 Mon Sep 17 00:00:00 2001 From: qnbs <155236708+qnbs@users.noreply.github.com> Date: Wed, 2 Sep 2026 22:13:45 +0200 Subject: [PATCH 6/8] fix(deps): correct qs advisory ID in pnpm-workspace.yaml comment Verified against the GitHub Advisory Database: GHSA-q8mj-m7cp-5q26 (fixed 6.15.2) is a distinct, already-resolved qs.stringify DoS via null/undefined comma-format array entries with encodeValuesOnly, not the prototype-pollution advisory this override historically tracked, and it was never fixed by the 6.16.0 bump this PR makes. The actual prototype-pollution advisory superseded here is GHSA-hrpp-h998-j3pp / CVE-2022-24999 (fixed 6.10.3) -- AUDIT.md's override table already had this right; this corrects the workspace comment to match. --- pnpm-workspace.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index ec87791f3..625865b05 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -38,7 +38,7 @@ minimumReleaseAgeExclude: # - uuid: GHSA-w5hq-g745-h8pq / CVE-2026-41907 - missing buffer bounds check in v3/v5/v6 API methods, # allows silent partial writes with an insufficient output buffer or wrong offset (fixed 11.1.1 / # 12.0.1 / 13.0.1 per major line; lockfile converges on 14.0.1, which the override floor now pins) -# - qs: GHSA-q8mj-m7cp-5q26 / CVE-2026-8723 - prototype pollution fix; superseded by GHSA-4mjr-xmp4-gh2g / GHSA-x5fp-wj9c-mxmx - array-limit bypass / isBuffer DoS (fixed 6.16.0; see minimumReleaseAgeExclude above for the release-age exception this specific version needed) +# - qs: GHSA-hrpp-h998-j3pp / CVE-2022-24999 - prototype pollution fix; superseded by GHSA-4mjr-xmp4-gh2g / GHSA-x5fp-wj9c-mxmx - array-limit bypass / isBuffer DoS (fixed 6.16.0; see minimumReleaseAgeExclude above for the release-age exception this specific version needed) # - esbuild: GHSA-67mh-4wv8-2f99 - dev-server CORS allowed any origin to read responses; # GHSA-gv7w-rqvm-qjhr - missing binary integrity verification (Deno module); # GHSA-g7r4-m6w7-qqqr - Windows path traversal in the dev-server file handler (all fixed 0.28.1) From 2964060947c9f98192b1c8c9d1a0c79887a64d9a Mon Sep 17 00:00:00 2001 From: qnbs <155236708+qnbs@users.noreply.github.com> Date: Wed, 2 Sep 2026 22:26:04 +0200 Subject: [PATCH 7/8] docs: correct fast-uri's prior-floor claim in AUDIT.md AUDIT.md's fast-uri row said the prior floor was >=3.1.2, but that value was already stale drift from an earlier uncorrected edit -- pnpm-workspace.yaml (the documented source of truth for these floors) actually enforced >=3.1.5 <4 immediately before this PR's bump to >=3.1.6, confirmed via the exact override diff in 896b5758. >=3.1.5 is the floor that genuinely no longer excluded the vulnerable 3.1.5 release; corrects the row to say so. --- AUDIT.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/AUDIT.md b/AUDIT.md index 31330ef32..9ea263500 100644 --- a/AUDIT.md +++ b/AUDIT.md @@ -1844,7 +1844,7 @@ transitive deps and are never shipped to users. | protobufjs | >=7.5.6 | GHSA-h755-8qp9-cq85 / CVE-2023-36665 | Prototype pollution (6.10.0–7.2.3; fixed 7.2.4). | | axios | >=1.15.2 | GHSA-jr5f-v2jv-69x6 / CVE-2025-27152 | SSRF + credential leak via absolute URL. | | basic-ftp | >=5.3.1 | GHSA-5rq4-664w-9x2c / CVE-2026-27699 | Path traversal in `downloadToDir()` (<5.2.0). Dev/test transitive. | -| fast-uri | >=3.1.6 | GHSA-5jgf-p345-68v8 / GHSA-f65p-4m7j-42xc / GHSA-fph4-wmhf-6fwf / GHSA-jqff-g426-hqxp (supersedes GHSA-q3j6-qgpj-74h6 / CVE-2026-6321) | Host confusion / SSRF via percent-encoding and IPv6 normalization (resolved 3.1.5 vulnerable; fixed 3.1.6). The prior `>=3.1.2` floor no longer excluded this — found via a routine `pnpm audit` sweep, 2026-09-02. Dev-only transitive (`@stryker-mutator/core`, `workbox-build`), never shipped. | +| fast-uri | >=3.1.6 | GHSA-5jgf-p345-68v8 / GHSA-f65p-4m7j-42xc / GHSA-fph4-wmhf-6fwf / GHSA-jqff-g426-hqxp (supersedes GHSA-q3j6-qgpj-74h6 / CVE-2026-6321) | Host confusion / SSRF via percent-encoding and IPv6 normalization (resolved 3.1.5 vulnerable; fixed 3.1.6). The prior `>=3.1.5` floor no longer excluded this — found via a routine `pnpm audit` sweep, 2026-09-02. Dev-only transitive (`@stryker-mutator/core`, `workbox-build`), never shipped. | | ws | >=8.20.1 | GHSA-3h5v-q93c-6h6q / CVE-2024-37890 | DoS when handling a request with many HTTP headers (fixed 8.17.1). | | brace-expansion | >=5.0.6 | GHSA-v6h2-p8h4-qcjw / CVE-2025-5889 | ReDoS in `expand()` (fixed 1.1.12 / 2.0.2 / 3.0.1 / 4.0.1). | | qs | >=6.16.0 | GHSA-4mjr-xmp4-gh2g / GHSA-x5fp-wj9c-mxmx (supersedes GHSA-hrpp-h998-j3pp / CVE-2022-24999) | Array-limit bypass via bracket-key comma parsing, and a DoS via attacker-controlled `isBuffer` (resolved 6.15.2 vulnerable; fixed 6.16.0). Dev-only transitive (`@lhci/cli`, `@stryker-mutator/core`, `http-server`), never shipped. `6.16.0` was published 2026-08-29, inside this repo's 7-day `minimumReleaseAge` quarantine at the time of this fix — admitted via a version-scoped `minimumReleaseAgeExclude: qs@6.16.0` entry (same mechanism/precedent as `nanoid@3.3.18`, PR #362), **not** a reduction of the 10080-minute quarantine itself. Compensating verification before admission: registry identity/integrity confirmed via `npm view`; no new install/preinstall/postinstall/prepare lifecycle scripts versus 6.15.2 (identical script set); the one dependency delta (`es-define-property@^1.0.1` added, `side-channel` bumped to `^1.1.1`) is maintained by the same author (`ljharb`) as `qs` itself and was already present elsewhere in the resolved tree. Remove the exclusion once 6.16.0 naturally ages past 2026-09-05T23:50:15Z UTC and a frozen install still resolves it — future qs releases remain governed by the normal quarantine. | From d1193e17ff7d54d18f5680979aed27b7f5933658 Mon Sep 17 00:00:00 2001 From: qnbs <155236708+qnbs@users.noreply.github.com> Date: Wed, 2 Sep 2026 22:35:38 +0200 Subject: [PATCH 8/8] docs: clarify fast-uri floor wording matches at-or-above convention Same precision fix already applied to this table's header sentence (set at or above the patched version): the fast-uri floor equals its first patched release exactly, so fixed 3.1.6 alone doesn't state that later releases are also safe. Says fixed at or above 3.1.6 instead. --- AUDIT.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/AUDIT.md b/AUDIT.md index 9ea263500..e7a4a9e0b 100644 --- a/AUDIT.md +++ b/AUDIT.md @@ -1844,7 +1844,7 @@ transitive deps and are never shipped to users. | protobufjs | >=7.5.6 | GHSA-h755-8qp9-cq85 / CVE-2023-36665 | Prototype pollution (6.10.0–7.2.3; fixed 7.2.4). | | axios | >=1.15.2 | GHSA-jr5f-v2jv-69x6 / CVE-2025-27152 | SSRF + credential leak via absolute URL. | | basic-ftp | >=5.3.1 | GHSA-5rq4-664w-9x2c / CVE-2026-27699 | Path traversal in `downloadToDir()` (<5.2.0). Dev/test transitive. | -| fast-uri | >=3.1.6 | GHSA-5jgf-p345-68v8 / GHSA-f65p-4m7j-42xc / GHSA-fph4-wmhf-6fwf / GHSA-jqff-g426-hqxp (supersedes GHSA-q3j6-qgpj-74h6 / CVE-2026-6321) | Host confusion / SSRF via percent-encoding and IPv6 normalization (resolved 3.1.5 vulnerable; fixed 3.1.6). The prior `>=3.1.5` floor no longer excluded this — found via a routine `pnpm audit` sweep, 2026-09-02. Dev-only transitive (`@stryker-mutator/core`, `workbox-build`), never shipped. | +| fast-uri | >=3.1.6 | GHSA-5jgf-p345-68v8 / GHSA-f65p-4m7j-42xc / GHSA-fph4-wmhf-6fwf / GHSA-jqff-g426-hqxp (supersedes GHSA-q3j6-qgpj-74h6 / CVE-2026-6321) | Host confusion / SSRF via percent-encoding and IPv6 normalization (resolved 3.1.5 vulnerable; fixed at or above 3.1.6). The prior `>=3.1.5` floor no longer excluded this — found via a routine `pnpm audit` sweep, 2026-09-02. Dev-only transitive (`@stryker-mutator/core`, `workbox-build`), never shipped. | | ws | >=8.20.1 | GHSA-3h5v-q93c-6h6q / CVE-2024-37890 | DoS when handling a request with many HTTP headers (fixed 8.17.1). | | brace-expansion | >=5.0.6 | GHSA-v6h2-p8h4-qcjw / CVE-2025-5889 | ReDoS in `expand()` (fixed 1.1.12 / 2.0.2 / 3.0.1 / 4.0.1). | | qs | >=6.16.0 | GHSA-4mjr-xmp4-gh2g / GHSA-x5fp-wj9c-mxmx (supersedes GHSA-hrpp-h998-j3pp / CVE-2022-24999) | Array-limit bypass via bracket-key comma parsing, and a DoS via attacker-controlled `isBuffer` (resolved 6.15.2 vulnerable; fixed 6.16.0). Dev-only transitive (`@lhci/cli`, `@stryker-mutator/core`, `http-server`), never shipped. `6.16.0` was published 2026-08-29, inside this repo's 7-day `minimumReleaseAge` quarantine at the time of this fix — admitted via a version-scoped `minimumReleaseAgeExclude: qs@6.16.0` entry (same mechanism/precedent as `nanoid@3.3.18`, PR #362), **not** a reduction of the 10080-minute quarantine itself. Compensating verification before admission: registry identity/integrity confirmed via `npm view`; no new install/preinstall/postinstall/prepare lifecycle scripts versus 6.15.2 (identical script set); the one dependency delta (`es-define-property@^1.0.1` added, `side-channel` bumped to `^1.1.1`) is maintained by the same author (`ljharb`) as `qs` itself and was already present elsewhere in the resolved tree. Remove the exclusion once 6.16.0 naturally ages past 2026-09-05T23:50:15Z UTC and a frozen install still resolves it — future qs releases remain governed by the normal quarantine. |