fix(deps) sbom: qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion [security] #32102
Conversation
… DoS via memory exhaustion [security]
There was a problem hiding this comment.
Pull request overview
This PR addresses a security vulnerability in the qs library by updating it from version 6.14.0 to 6.14.1. The vulnerability (CVE) involves a bypass of the arrayLimit setting in bracket notation that can lead to Denial of Service (DoS) through memory exhaustion.
Key Changes:
- Added pnpm override to enforce
qs >= 6.14.1across all dependencies - Updated lockfile to reflect the
qsversion bump from 6.14.0 to 6.14.1
Reviewed changes
Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| packages/sbom/package.json | Added pnpm override for qs package to enforce minimum version 6.14.1 |
| packages/sbom/pnpm-lock.yaml | Updated all references to qs from 6.14.0 to 6.14.1 including package definitions, snapshots, and override settings |
The changes look good and properly address the security vulnerability. All references to the qs package have been consistently updated throughout the lockfile, the override is correctly specified in both package.json and reflected in the lockfile settings, and the integrity hash has been updated appropriately. No issues were identified with this security update.
Files not reviewed (1)
- packages/sbom/pnpm-lock.yaml: Language not supported
3 participants
No description provided.