Problem
npm audit in src/test/cypress reports a remaining moderate advisory for qs at 6.15.2:
- GHSA-x5fp-wj9c-mxmx: array-limit bypass via bracket-key comma parsing (CVSS 3.7, affects
>=6.14.2 <=6.15.3)
- GHSA-4mjr-xmp4-gh2g: denial of service via attacker controlled
isBuffer (CVSS 5.3, affects >=2.2.5 <6.16.0)
Both are fixed in qs 6.16.0.
Path
reminders-cypress-tests@1.0.0
`-- cypress@15.21.0
`-- @cypress/request@4.0.1
`-- qs@6.15.2
Dev-only, transitive under Cypress. qs is not a direct dependency, so package.json does not reference it.
Notes
Dependabot has no alert for this: it is not listed under gh api repos/kauereinbold/Reminders/dependabot/alerts. It surfaced only through npm audit while working #416, and was deliberately left out of scope of that pull request.
Options
- Wait for
@cypress/request to widen its qs range and pick it up through a normal Cypress bump.
- Or add a lockfile
overrides entry pinning qs to >=6.16.0 and confirm the Cypress suite still runs.
Impact is low: the parser only sees query strings the test suite itself produces, never attacker input.
Problem
npm auditinsrc/test/cypressreports a remaining moderate advisory forqsat 6.15.2:>=6.14.2 <=6.15.3)isBuffer(CVSS 5.3, affects>=2.2.5 <6.16.0)Both are fixed in
qs6.16.0.Path
Dev-only, transitive under Cypress.
qsis not a direct dependency, sopackage.jsondoes not reference it.Notes
Dependabot has no alert for this: it is not listed under
gh api repos/kauereinbold/Reminders/dependabot/alerts. It surfaced only throughnpm auditwhile working #416, and was deliberately left out of scope of that pull request.Options
@cypress/requestto widen itsqsrange and pick it up through a normal Cypress bump.overridesentry pinningqsto>=6.16.0and confirm the Cypress suite still runs.Impact is low: the parser only sees query strings the test suite itself produces, never attacker input.