chore(deps): bump the npm_and_yarn group across 2 directories with 2 updates - #5828
Conversation
…updates Bumps the npm_and_yarn group with 1 update in the /integrations/feishu-bridge directory: [qs](https://github.com/ljharb/qs). Bumps the npm_and_yarn group with 2 updates in the /extensions/vscode directory: [qs](https://github.com/ljharb/qs) and [fast-uri](https://github.com/fastify/fast-uri). Updates `qs` from 6.15.2 to 6.16.0 - [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md) - [Commits](ljharb/qs@v6.15.2...v6.16.0) Updates `qs` from 6.15.2 to 6.16.0 - [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md) - [Commits](ljharb/qs@v6.15.2...v6.16.0) Updates `fast-uri` from 3.1.5 to 3.1.7 - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.1.5...v3.1.7) --- updated-dependencies: - dependency-name: qs dependency-version: 6.16.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: qs dependency-version: 6.16.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: fast-uri dependency-version: 3.1.7 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
dependabot
Bot
added
dependencies
|
Thanks @dependabot[bot] for taking the time to contribute. This repository is observing a maintainer-managed PR intake gate in dry-run mode, so this pull request is staying open. This note helps maintainers prepare the allowlist before any enforcement is considered. Please read |
…bridge/npm_and_yarn-1b50ef98aa
|
Claude finished @Hmbown's task in 25s —— View job Review: dependency bump (qs, fast-uri)
Summary: This is a mechanical dependabot lockfile bump, no application code is touched.
Findings: None. No provider/model/route code, no logic changes — just version/integrity hash updates in lockfiles and one override constraint. Safe to merge from a code-review perspective (subject to your normal CI/build checks passing). Note: per this repo's PR intake gate, this PR stays open in dry-run mode pending maintainer allowlisting (see the bot's comment above) — that's a repo policy matter, not something for me to act on. |
![codewhale-agent[bot]](https://avatars.githubusercontent.com/u/101357273?s=60&v=4){kind=small}
There was a problem hiding this comment.
Codewhale review
Dependabot bumps qs from 6.15.2 to 6.16.0 in extensions/vscode and integrations/feishu-bridge, and fast-uri from 3.1.5 to 3.1.7 in extensions/vscode. The fast-uri update addresses multiple high-severity security advisories; qs also includes parsing robustness fixes.
Findings
- [WARNING] Unbounded qs override in feishu-bridge may allow future breaking major versions (
integrations/feishu-bridge/package.json:19)
The override is changed to ">=6.16.0", which has no upper bound. If a future qs major version is released, npm may install it and break the integration. Consider constraining to a compatible major range such as ^6.16.0 unless transitive requirements demand broader semver. - [INFO] No tests added for dependency upgrades
Security-sensitive parsing and URI normalization behavior is changed in qs and fast-uri, but no tests are added or modified. Existing test suites for extensions/vscode and integrations/feishu-bridge should be run in CI to verify the upgrades do not alter expected behavior.
Assessment
Approve after CI passes. The fast-uri upgrade is an important security fix and qs includes parsing robustness improvements. The only concerns are the unbounded feishu qs override and test verification.
Advisory review by Codewhale (codewhale review --pr 5828 --post, head a80efe65e7261920467e103880bb13a9204d1579). Line-specific findings are also posted as inline review comments; mechanical fixes arrive as committable suggestions you can apply from the Files tab. CODEOWNERS approval still governs merge.
| "overrides": { | ||
| "axios": "^1.18.1", | ||
| "qs": ">=6.15.2" | ||
| "qs": ">=6.16.0" |
There was a problem hiding this comment.
[WARNING] Unbounded qs override in feishu-bridge may allow future breaking major versions
The override is changed to ">=6.16.0", which has no upper bound. If a future qs major version is released, npm may install it and break the integration. Consider constraining to a compatible major range such as ^6.16.0 unless transitive requirements demand broader semver.
1 participant
Bumps the npm_and_yarn group with 1 update in the /integrations/feishu-bridge directory: qs.
Bumps the npm_and_yarn group with 2 updates in the /extensions/vscode directory: qs and fast-uri.
Updates
qsfrom 6.15.2 to 6.16.0Changelog
Sourced from qs's changelog.
Commits
bb9379ev6.16.062fd254[Fix] stringify: serialize Date values when a filter is provided8859c37[Fix]parse: enforcearrayLimiton comma groups under[]=when `throwOn...8079adc[Tests]parse: remove a test that pinned[]=comma groups escaping `array...d56f48c[Fix]parse: flatten a collection appended to an overflowed arraye83d321[Fix]utils:isBuffer: do not invoke a non-callableconstructor.isBuffer7e87a07[Dev Deps] update@ljharb/eslint-config,eslint9a76af2[Dev Deps] updateeslint,evalmd3a890d4[Dev Deps] updateeslint,evalmdb433a9b[Fix]stringify: do not letallowEmptyArraysskip cycle detection (or dro...Updates
qsfrom 6.15.2 to 6.16.0Changelog
Sourced from qs's changelog.
Commits
bb9379ev6.16.062fd254[Fix] stringify: serialize Date values when a filter is provided8859c37[Fix]parse: enforcearrayLimiton comma groups under[]=when `throwOn...8079adc[Tests]parse: remove a test that pinned[]=comma groups escaping `array...d56f48c[Fix]parse: flatten a collection appended to an overflowed arraye83d321[Fix]utils:isBuffer: do not invoke a non-callableconstructor.isBuffer7e87a07[Dev Deps] update@ljharb/eslint-config,eslint9a76af2[Dev Deps] updateeslint,evalmd3a890d4[Dev Deps] updateeslint,evalmdb433a9b[Fix]stringify: do not letallowEmptyArraysskip cycle detection (or dro...Updates
fast-urifrom 3.1.5 to 3.1.7Release notes
Sourced from fast-uri's releases.
Commits
412e40aBumped v3.1.79f4c943fix: backport port and IP-literal validation to v3.x (#216)1eb3ce4fix: treat unterminated bracket hosts as reg-names again (#214)6f970b2Bumped v3.1.6d941579fix: never run IDN canonicalization on bracketed IP literalsc0f0279test: adapt decoded-scheme handler assertion to 3.x (no mailto scheme)37f3417Merge commit from fork607bfbeMerge commit from forkae92a4cMerge commit from fork444ecdaMerge commit from forkDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditionsYou can disable automated security fix PRs for this repo from the Security Alerts page.