fix(deps): patch fast-uri and qs Dependabot advisories - #43
Merged
Merged
Conversation
- Bump transitive fast-uri 3.1.5 -> 3.1.7 (GHSA-jqff-g426-hqxp, GHSA-f65p-4m7j-42xc, GHSA-fph4-wmhf-6fwf, GHSA-5jgf-p345-68v8). ajv already allows ^3.0.1, so this is a lockfile-only change. - Add scoped overrides forcing express>qs and body-parser>qs to ^6.16.0 (GHSA-x5fp-wj9c-mxmx). express 4.22.2 and body-parser 1.20.6 pin ~6.15; body-parser 1.20.8 already moved to 6.16 upstream. image-size (GHSA-w3rx-r6r6-pgpr, GHSA-5p2g-fcmc-qvqq) is left as-is: no patched release exists and @docusaurus/mdx-loader requires ^2.0.2. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Devon-White
requested review from
Manny-r31,
briankwest,
hey-august and
niravcodes
as code owners
September 9, 2026 13:36
hey-august
approved these changes
Sep 9, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Resolves 5 of the 7 open Dependabot alerts. All affected packages are transitive devDependencies of the Docusaurus website build; neither published package under
packages/depends on them.ajv@8already allows^3.0.1.express>qsandbody-parser>qsinpnpm-workspace.yaml.express@4.22.2andbody-parser@1.20.6pin~6.15.1;body-parser@1.20.8already moved to~6.16.0upstream, so 6.16 is API-compatible.Not fixed: image-size (#167, #168)
No patched release exists. The advisories cover every version through 2.0.2, which is the latest on npm, and the upstream fix is an unmerged PR.
@docusaurus/mdx-loader@3.10.2(current latest) requires^2.0.2. Exposure is low: the parser only runs at build time on images referenced from this repo's own markdown. These alerts should be dismissed as "no fix available" until image-size ships a release.Verification
pnpm install --frozen-lockfilesucceedspnpm run build:packagessucceedspnpm run test:ci: 7 suites, 35 tests passpnpm run build:website:onlysucceedsThe lockfile diff contains only the two version changes plus peer-suffix key renames from pnpm re-normalizing.
🤖 Generated with Claude Code