From 19f9139797e45a0750888dcd45e6819077e6fbfa Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Mon, 26 Oct 2026 14:22:29 +0000 Subject: [PATCH] fix: security - upgrade body-parser to 2.4.0 and zod to 4.6.7 body-parser 2.4.0 closes GHSA-27r3-jxmh-p828. zod 4.6.7 closes GHSA-mrhx-c7xc-m3w5. The release-age exclude lists body-parser 2.4.0 only. Co-authored-by: Jared Wray --- packages/cacheable-request/package.json | 2 +- pnpm-lock.yaml | 96 ++++++++++++------------- pnpm-workspace.yaml | 2 + 3 files changed, 50 insertions(+), 50 deletions(-) diff --git a/packages/cacheable-request/package.json b/packages/cacheable-request/package.json index 0d91bd7d..7a173274 100644 --- a/packages/cacheable-request/package.json +++ b/packages/cacheable-request/package.json @@ -54,7 +54,7 @@ "devDependencies": { "@types/express": "^5.0.6", "@types/responselike": "^1.0.3", - "body-parser": "^2.3.0", + "body-parser": "^2.4.0", "delay": "^7.0.0", "express": "^5.2.1", "pify": "^6.1.0", diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 00b785d4..d785c57a 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -343,8 +343,8 @@ importers: specifier: ^1.0.3 version: 1.0.3 body-parser: - specifier: ^2.3.0 - version: 2.3.0(supports-color@10.2.2) + specifier: ^2.4.0 + version: 2.4.0(supports-color@10.2.2) delay: specifier: ^7.0.0 version: 7.0.0 @@ -485,7 +485,7 @@ importers: devDependencies: docula: specifier: ^3.0.1 - version: 3.0.1(chokidar@4.0.1)(supports-color@10.2.2)(zod@4.6.5) + version: 3.0.1(chokidar@4.0.1)(supports-color@10.2.2)(zod@4.6.7) tsx: specifier: 4.23.15 version: 4.23.15 @@ -2147,8 +2147,8 @@ packages: blake3-wasm@2.1.5: resolution: {integrity: sha512-F1+K8EbfOZE49dtoPtmxUQrpXaBIl3ICvasLh+nJta0xkz+9kF/7uet9fLnwKqhDrmj6g+6K3Tw9yQPUg2ka5g==} - body-parser@2.3.0: - resolution: {integrity: sha512-2cGmJupaNgg+QUwVLAucDuWuoMZ6EX9iHDRswZ5lsNYEmwPaRknMPCLZz07yTzVq/83p4o/wzbDZbBrTvGGTIw==} + body-parser@2.4.0: + resolution: {integrity: sha512-Ifk1KcLrxaGt1occQagQNFNNOqRt1LFuehEnHHzB8Z6cRgIxRU1TBaiIsUiCdA+gy5PL7Y1IX31DNKkRmxtXjQ==} engines: {node: '>=18'} boxen@8.0.1: @@ -2354,6 +2354,10 @@ packages: resolution: {integrity: sha512-j/O/d7GcZCyNl7/hwZAb606rzqkyvaDctLmckbxLzHvFBzTJHuGEdodATcP3yIRoDrLHkIATJuvzbFlp/ki2cQ==} engines: {node: '>=18'} + content-type@2.1.0: + resolution: {integrity: sha512-mj7UPXE0jaqaOsukNZRUEfEi2AcL7C/vwmwcHV0O97eO1E1pxBZuyjlZrx5seTaNBg1U6+o35wpa35Qfcc+7ag==} + engines: {node: '>=18'} + cookie-signature@1.2.2: resolution: {integrity: sha512-D76uU73ulSXrD1UXF4KE2TMxVVwhsnCgfAyTg9k8P6KGZjlXKrOLe4dJQKI3Bxi5wjesZoFXJWElNWBjPZMbhg==} engines: {node: '>=6.6.0'} @@ -2789,10 +2793,6 @@ packages: resolution: {integrity: sha512-4FbRdAX+bSdmo4AUFuS0WNiPz8NgFt+r8ThgNWmlrjQjt1Q7ZR9+zTlce2859x4KSXrwIsaeTqDoKQmtP8pLmQ==} engines: {node: '>= 0.8'} - iconv-lite@0.7.0: - resolution: {integrity: sha512-cf6L2Ds3h57VVmkZe+Pn+5APsT7FpqJtEhhieDCvrE2MK5Qk9MyffgQyuxQTm6BChfeZNtcOLHp9IcWRVcIcBQ==} - engines: {node: '>=0.10.0'} - iconv-lite@0.7.3: resolution: {integrity: sha512-IKXpvIzjnC9XTAUbVBcMfGS0EPaIXtW6v+zr+RRp+hqULEpo0owZax6wyRwPOJbWbzjYspQwusTsfVr0ifh4uQ==} engines: {node: '>=0.10.0'} @@ -3510,8 +3510,8 @@ packages: resolution: {integrity: sha512-YWWTjgABSKcvs/nWBi9PycY/JiPJqOD4JA6o9Sej2AtvSGarXxKC3OQSk4pAarbdQlKAh5D4FCQkJNkW+GAn3w==} engines: {node: '>=0.6'} - qs@6.15.3: - resolution: {integrity: sha512-O9gl3zCl5h5blw1KGUzQKhA5oUXSl8rwUIM5o0S3nCXMliSvy5Dzx7/DJcI+SwgICv+IneSZwhBh1oSyEHA71A==} + qs@6.16.1: + resolution: {integrity: sha512-5Px6J7rfHBAGUhNQ3es4YzcOdBBw0SDcVtThJml4RdnKw4tKs2epA0kPZ+K8X+WiHktT93RHVcQ/3ym5aTCgtg==} engines: {node: '>=0.6'} quansync@1.0.0: @@ -4282,47 +4282,47 @@ packages: yuku-parser@0.10.2: resolution: {integrity: sha512-CgaU0/PPjCAIEZ3WQroosOxTY3eeKldAN3h+vk8pMNz4+jl1CZzBR4pW+K/rRPF112VooCL5FdjJoiMNjDrL2A==} - zod@4.6.5: - resolution: {integrity: sha512-v5l/aFXZQeai4awLbOpSoHecE9UiMrnfx75tEXLjNonXVARxQ5mOeipTjROUchszUNCqnE+hqAMujRsRHsut2Q==} + zod@4.6.7: + resolution: {integrity: sha512-g8W2D2kU6a8untc053fX1uVBKzM7yqAxW/3zwk83+6RyF2+SKOuV+c0wBDhUwzV1PaGapmZH+rmcUzPf+3CGwg==} zwitch@2.0.4: resolution: {integrity: sha512-bXE4cR/kVZhKZX/RjPEflHaKVhUVl85noU3v6b8apfQEc1x4A+zBxjZ4lN8LqGd6WZ3dl98pY4o717VFmoPp+A==} snapshots: - '@ai-sdk/anthropic@4.0.67(zod@4.6.5)': + '@ai-sdk/anthropic@4.0.67(zod@4.6.7)': dependencies: '@ai-sdk/provider': 4.0.19 - '@ai-sdk/provider-utils': 5.0.50(zod@4.6.5) - zod: 4.6.5 + '@ai-sdk/provider-utils': 5.0.50(zod@4.6.7) + zod: 4.6.7 - '@ai-sdk/gateway@4.0.98(zod@4.6.5)': + '@ai-sdk/gateway@4.0.98(zod@4.6.7)': dependencies: '@ai-sdk/provider': 4.0.19 - '@ai-sdk/provider-utils': 5.0.50(zod@4.6.5) + '@ai-sdk/provider-utils': 5.0.50(zod@4.6.7) '@vercel/oidc': 3.2.0 - zod: 4.6.5 + zod: 4.6.7 - '@ai-sdk/google@4.0.84(zod@4.6.5)': + '@ai-sdk/google@4.0.84(zod@4.6.7)': dependencies: '@ai-sdk/provider': 4.0.19 - '@ai-sdk/provider-utils': 5.0.50(zod@4.6.5) - zod: 4.6.5 + '@ai-sdk/provider-utils': 5.0.50(zod@4.6.7) + zod: 4.6.7 - '@ai-sdk/openai@4.0.79(zod@4.6.5)': + '@ai-sdk/openai@4.0.79(zod@4.6.7)': dependencies: '@ai-sdk/provider': 4.0.19 - '@ai-sdk/provider-utils': 5.0.50(zod@4.6.5) - zod: 4.6.5 + '@ai-sdk/provider-utils': 5.0.50(zod@4.6.7) + zod: 4.6.7 - '@ai-sdk/provider-utils@5.0.50(zod@4.6.5)': + '@ai-sdk/provider-utils@5.0.50(zod@4.6.7)': dependencies: '@ai-sdk/provider': 4.0.19 '@standard-schema/spec': 1.1.0 '@workflow/serde': 4.1.0 eventsource-parser: 3.0.8 undici: 7.30.1 - zod: 4.6.5 + zod: 4.6.7 '@ai-sdk/provider@4.0.19': dependencies: @@ -5343,12 +5343,12 @@ snapshots: acorn@8.16.0: {} - ai@7.0.120(zod@4.6.5): + ai@7.0.120(zod@4.6.7): dependencies: - '@ai-sdk/gateway': 4.0.98(zod@4.6.5) + '@ai-sdk/gateway': 4.0.98(zod@4.6.7) '@ai-sdk/provider': 4.0.19 - '@ai-sdk/provider-utils': 5.0.50(zod@4.6.5) - zod: 4.6.5 + '@ai-sdk/provider-utils': 5.0.50(zod@4.6.7) + zod: 4.6.7 ansi-align@3.0.1: dependencies: @@ -5420,15 +5420,15 @@ snapshots: blake3-wasm@2.1.5: {} - body-parser@2.3.0(supports-color@10.2.2): + body-parser@2.4.0(supports-color@10.2.2): dependencies: bytes: 3.1.2 - content-type: 2.0.0 + content-type: 2.1.0 debug: 4.4.3(supports-color@10.2.2) http-errors: 2.0.1 iconv-lite: 0.7.3 on-finished: 2.4.1 - qs: 6.15.3 + qs: 6.16.1 raw-body: 3.0.2 type-is: 2.1.0 transitivePeerDependencies: @@ -5627,6 +5627,8 @@ snapshots: content-type@2.0.0: {} + content-type@2.1.0: {} + cookie-signature@1.2.2: {} cookie@0.7.1: {} @@ -5668,13 +5670,13 @@ snapshots: doctypes@1.1.0: {} - docula@3.0.1(chokidar@4.0.1)(supports-color@10.2.2)(zod@4.6.5): + docula@3.0.1(chokidar@4.0.1)(supports-color@10.2.2)(zod@4.6.7): dependencies: - '@ai-sdk/anthropic': 4.0.67(zod@4.6.5) - '@ai-sdk/google': 4.0.84(zod@4.6.5) - '@ai-sdk/openai': 4.0.79(zod@4.6.5) + '@ai-sdk/anthropic': 4.0.67(zod@4.6.7) + '@ai-sdk/google': 4.0.84(zod@4.6.7) + '@ai-sdk/openai': 4.0.79(zod@4.6.7) '@cacheable/net': 2.1.0 - ai: 7.0.120(zod@4.6.5) + ai: 7.0.120(zod@4.6.7) colorette: 2.0.20 ecto: 5.1.1(chokidar@4.0.1)(supports-color@10.2.2) hashery: 3.0.2 @@ -5859,7 +5861,7 @@ snapshots: express@5.2.1(supports-color@10.2.2): dependencies: accepts: 2.0.0 - body-parser: 2.3.0(supports-color@10.2.2) + body-parser: 2.4.0(supports-color@10.2.2) content-disposition: 1.0.0 content-type: 1.0.5 cookie: 0.7.1 @@ -6175,10 +6177,6 @@ snapshots: statuses: 2.0.2 toidentifier: 1.0.1 - iconv-lite@0.7.0: - dependencies: - safer-buffer: 2.1.2 - iconv-lite@0.7.3: dependencies: safer-buffer: 2.1.2 @@ -7166,7 +7164,7 @@ snapshots: dependencies: side-channel: 1.1.0 - qs@6.15.3: + qs@6.16.1: dependencies: es-define-property: 1.0.1 side-channel: 1.1.1 @@ -7187,7 +7185,7 @@ snapshots: dependencies: bytes: 3.1.2 http-errors: 2.0.1 - iconv-lite: 0.7.0 + iconv-lite: 0.7.3 unpipe: 1.0.0 rc@1.2.8: @@ -8024,7 +8022,7 @@ snapshots: writr@6.1.6(supports-color@10.2.2): dependencies: - ai: 7.0.120(zod@4.6.5) + ai: 7.0.120(zod@4.6.7) cacheable: 2.5.0 hashery: 3.0.2 hookified: 3.0.4 @@ -8045,7 +8043,7 @@ snapshots: remark-rehype: 11.1.2 remark-toc: 9.0.0 unified: 11.0.5 - zod: 4.6.5 + zod: 4.6.7 transitivePeerDependencies: - '@types/react' - supports-color @@ -8122,6 +8120,6 @@ snapshots: '@yuku-parser/binding-win32-arm64': 0.10.2 '@yuku-parser/binding-win32-x64': 0.10.2 - zod@4.6.5: {} + zod@4.6.7: {} zwitch@2.0.4: {} diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index bfe36b96..67be4bc2 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -11,6 +11,8 @@ minimumReleaseAgeExclude: - '@babel/*' # undici 7.30.1 and 8.12.2 fix the High advisories. Both releases are younger than 7 days. - 'undici@7.30.1 || 8.12.2' + # body-parser 2.4.0 fixes GHSA-27r3-jxmh-p828. The release is younger than 7 days. + - 'body-parser@2.4.0' allowBuilds: esbuild: true protobufjs: true