Skip to content

fix(deps): v2.3.0 release audit, raise the qs override to >=6.16.1 - #5427

Merged
cliffhall merged 1 commit into
v2/mainfrom
v2/chore/5425-release-audit
Nov 4, 2026
Merged

fix(deps): v2.3.0 release audit, raise the qs override to >=6.16.1#5427
cliffhall merged 1 commit into
v2/mainfrom
v2/chore/5425-release-audit

Conversation

@cliffhall

@cliffhall cliffhall commented Nov 4, 2026

Copy link
Copy Markdown
Member

Closes #5425

Description

The v2.3.0 release audit's one in-range fix: the root overrides floor for qs moves from >=6.16.0 to >=6.16.1, and the lock resolves qs 6.17.1. That clears GHSA-6pq8-jhm2-2vcw from npm audit. The full audit report is below and on #5425.

The audit report

Tree: origin/v2/main at 72ad22c6. Commands: the release skill, step 2a.

Lockfile Tool Result
package-lock.json (root + 4 TypeScript workspaces) npm audit --audit-level=high Nothing high or critical (exit 0). 2 moderate advisories, 12 affected paths
src/fetch/uv.lock pip-audit --require-hashes No known vulnerabilities found
src/git/uv.lock pip-audit --require-hashes No known vulnerabilities found
src/time/uv.lock pip-audit --require-hashes No known vulnerabilities found

All three Python servers were audited (the skill's EXIT=0).

Findings and outcomes

Advisory Package, path Reaches Outcome
GHSA-6pq8-jhm2-2vcw (moderate, DoS) qs <=6.16.0, lock held 6.16.0, via express everything (transitively). Downstream installs already resolve a fixed qs through express's own range Fix inside the range: the root override qs >=6.16.0 → >=6.16.1, relocked to 6.17.1. Audit PR, no changeset (no published manifest changes)
GHSA-g3hv-75wg-m249 (moderate, DoS) minimatch <11.0.1; filesystem declares ^10.0.1 (10.2.5) filesystem, from the client: search_files patterns and excludePatterns Fix needs a major: its own issue and PR, #5420 (outside report), triaged into v2.3.0. The release is held for it
same minimatch 10.2.5 under eslint / typescript-eslint Nothing published: root devDependencies (lint tooling) Not reachable from any server. Stays until eslint moves to minimatch 11

npm audit fix was not run.

Server Details

  • Server: none directly (repository-wide lockfile); qs reaches everything through express
  • Changes to: the root package.json override and package-lock.json (4 lines)

Motivation and Context

Release step 2a for #5425.

How Has This Been Tested?

Targeted probe. npm ls qs --all before shows qs@6.16.0, after shows qs@6.17.1 everywhere. npm audit --json | jq '.vulnerabilities | keys' before includes qs, after does not. The lockfile diff touches only the qs entry (version, resolved, integrity). No server behavior changes: the published everything manifest is untouched, and installs downstream resolve qs through express's own range, not this lockfile. npm run local:gate: EXIT=0, including the boot smoke of everything over each transport.

Breaking Changes

None.

Types of changes

  • Bug fix (non-breaking change which fixes an issue)
  • New feature
  • Breaking change
  • Documentation update

Checklist

  • I have read the MCP Protocol Documentation (not applicable: no protocol surface)
  • My changes follow MCP security best practices
  • I have updated the server's README accordingly (not applicable: no server change)
  • I have added a changeset (npm run changeset) if this changes what a TypeScript server publishes (not applicable: nothing published changes)
  • I have tested this with an LLM client (not applicable: lockfile only, no client-observable surface; targeted probe above)
  • My code follows the repository's style guidelines
  • New and existing tests pass locally
  • I have added appropriate error handling (not applicable: no code)
  • I have documented all environment variables and configuration options (not applicable: none added)

🤖 Generated with Claude Code

@cliffhall @claude
fix(deps): raise the qs override to >=6.16.1 for GHSA-6pq8-jhm2-2vcw
f20ce8e 
qs <=6.16.0 throws an uncaught TypeError from stringify with
arrayFormat 'comma' on an element carrying a non-callable own toString.
It reaches everything through express. The fix is inside the range the
root override already pins, so the override's floor moves up and the
lock resolves 6.17.1.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: cliffhall <cliff@futurescale.com>
@cliffhall cliffhall added the v2 label Nov 4, 2026
@changeset-bot

changeset-bot Bot commented Nov 4, 2026

Copy link
Copy Markdown

⚠️ No Changeset found

Latest commit: f20ce8e

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

@cliffhall cliffhall linked an issue Nov 4, 2026 that may be closed by this pull request
Release v2.3.0 #5425
Closed
@cliffhall
cliffhall requested a balanced review from Copilot November 4, 2026 15:38
@github-actions

github-actions Bot commented Nov 4, 2026

Copy link
Copy Markdown
Contributor

everything: MCP interface diff

Base: 72ad22c62bcf (Merge pull request #5411 from modelcontextprotocol/v2/docs/5334-advisory-public-pr)
Head: the build in this checkout, at 21bca7a5dbd8 (Merge f20ce8e into 72ad22c)

✅ No interface changes detected.

Tools Prompts Resources Resource templates
Base 22 4 8 5
Head 22 4 8 5

Updated by this run for f20ce8eaa66bf7a6a6c6294d1c4a4fa23f13c153.

Copilot AI reviewed Nov 4, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟢 Approval recommended

No active review issues are reported for the qs dependency override and lockfile update.

No open issues 🎉

What changed in this PR

Updates the root qs dependency override and lockfile as part of the v2.3.0 release audit, addressing GHSA-6pq8-jhm2-2vcw without changing published server manifests.

Changes:

  • Raises the qs override minimum from 6.16.0 to 6.16.1.
  • Locks qs to 6.17.1 with updated download URL and integrity hash.
File Description
package.json Raises the minimum allowed qs version to exclude affected releases.
package-lock.json Records qs 6.17.1 and its artifact metadata.

Review effort: Balanced

@cliffhall

cliffhall commented Nov 4, 2026

Copy link
Copy Markdown
Member Author

Copilot round 1: clean (no findings, no suppressed comments). Review loop ends on the first clean round.

@cliffhall cliffhall mentioned this pull request Nov 4, 2026
Open
@cliffhall
cliffhall merged commit b992756 into v2/main Nov 4, 2026
45 checks passed
@cliffhall
cliffhall deleted the v2/chore/5425-release-audit branch November 4, 2026 15:43
@cliffhall cliffhall mentioned this pull request Nov 5, 2026
Open
12 of 13 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot
Copilot review effort
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments

Assignees

No one assigned

Labels

v2

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Release v2.3.0

2 participants

@cliffhall