Skip to content

chore: fixes CVE-2025-15284 by upgrading qs version to 6.14.1 #3993

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
alizard0 wants to merge 8 commits into from
Closed

chore: fixes CVE-2025-15284 by upgrading qs version to 6.14.1 #3993

Changes from all commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
916cef7
upgraded qs version
alizard0 Jan 13, 2026
7ee004f
remove resolution; dedupe and rebase main
alizard0 Jan 15, 2026
7bb2b88
Merge branch 'main' into CVE-2025-15284
alizard0 Jan 16, 2026
9307d6c
Merge branch 'main' into CVE-2025-15284
alizard0 Jan 16, 2026
3487283
Merge branch 'main' into CVE-2025-15284
alizard0 Jan 19, 2026
433c788
Merge branch 'main' into CVE-2025-15284
kim-tsao Jan 19, 2026
6797187
Merge branch 'main' into CVE-2025-15284
alizard0 Jan 20, 2026
b52660e
Merge branch 'main' into CVE-2025-15284
alizard0 Jan 21, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
155 changes: 54 additions & 101 deletions yarn.lock
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3451,7 +3451,7 @@ __metadata:
languageName: node
linkType: hard

"@backstage/backend-plugin-api@npm:1.5.0, @backstage/backend-plugin-api@npm:^1.3.1, @backstage/backend-plugin-api@npm:^1.4.2, @backstage/backend-plugin-api@npm:^1.5.0":
"@backstage/backend-plugin-api@npm:1.5.0":
version: 1.5.0
resolution: "@backstage/backend-plugin-api@npm:1.5.0"
dependencies:
Expand All @@ -3473,7 +3473,7 @@ __metadata:
languageName: node
linkType: hard

"@backstage/backend-plugin-api@npm:^1.6.0":
"@backstage/backend-plugin-api@npm:^1.3.1, @backstage/backend-plugin-api@npm:^1.4.2, @backstage/backend-plugin-api@npm:^1.5.0, @backstage/backend-plugin-api@npm:^1.6.0":
version: 1.6.0
resolution: "@backstage/backend-plugin-api@npm:1.6.0"
dependencies:
Expand Down Expand Up @@ -3559,14 +3559,7 @@ __metadata:
languageName: node
linkType: hard

"@backstage/cli-common@npm:^0.1.15":
version: 0.1.15
resolution: "@backstage/cli-common@npm:0.1.15"
checksum: fbfded2ff0122c28c2104fa40703486c0fe5c43acd68de2659533d46ebc11f296a06c45499d0ced1579a75ee6002739d2cb90f08fe2587e887d79b82d4f91515
languageName: node
linkType: hard

"@backstage/cli-common@npm:^0.1.16":
"@backstage/cli-common@npm:^0.1.15, @backstage/cli-common@npm:^0.1.16":
version: 0.1.16
resolution: "@backstage/cli-common@npm:0.1.16"
dependencies:
Expand Down Expand Up @@ -5034,25 +5027,7 @@ __metadata:
languageName: node
linkType: hard

"@backstage/plugin-permission-node@npm:^0.10.3, @backstage/plugin-permission-node@npm:^0.10.6":
version: 0.10.6
resolution: "@backstage/plugin-permission-node@npm:0.10.6"
dependencies:
"@backstage/backend-plugin-api": ^1.5.0
"@backstage/config": ^1.3.6
"@backstage/errors": ^1.2.7
"@backstage/plugin-auth-node": ^0.6.9
"@backstage/plugin-permission-common": ^0.9.3
"@types/express": ^4.17.6
express: ^4.17.1
express-promise-router: ^4.1.0
zod: ^3.22.4
zod-to-json-schema: ^3.20.4
checksum: b29c79b3d563fb2712767e50a8e0a026257df88acbeb260d666c7062fe007ea4174f142b305b6e63f159f85f20b6603bcf2df53fdd46573702df9e3b3174dcff
languageName: node
linkType: hard

"@backstage/plugin-permission-node@npm:^0.10.7":
"@backstage/plugin-permission-node@npm:^0.10.3, @backstage/plugin-permission-node@npm:^0.10.6, @backstage/plugin-permission-node@npm:^0.10.7":
version: 0.10.7
resolution: "@backstage/plugin-permission-node@npm:0.10.7"
dependencies:
Expand Down Expand Up @@ -19393,7 +19368,7 @@ __metadata:
languageName: node
linkType: hard

"body-parser@npm:1.20.3, body-parser@npm:^1.15.2":
"body-parser@npm:1.20.3":
version: 1.20.3
resolution: "body-parser@npm:1.20.3"
dependencies:
Expand All @@ -19413,24 +19388,7 @@ __metadata:
languageName: node
linkType: hard

"body-parser@npm:^2.2.0":
version: 2.2.0
resolution: "body-parser@npm:2.2.0"
dependencies:
bytes: ^3.1.2
content-type: ^1.0.5
debug: ^4.4.0
http-errors: ^2.0.0
iconv-lite: ^0.6.3
on-finished: ^2.4.1
qs: ^6.14.0
raw-body: ^3.0.0
type-is: ^2.0.0
checksum: 7fe3a2d288f0b632528d6ccb90052d1a9492c5b79d5716d32c8de1f5fb8237b0d31ee5050e1d0b7ff143a492ff151804612c6e2686a222a1d4c9e2e6531b8fb2
languageName: node
linkType: hard

"body-parser@npm:~1.20.3":
"body-parser@npm:^1.15.2, body-parser@npm:~1.20.3":
version: 1.20.4
resolution: "body-parser@npm:1.20.4"
dependencies:
Expand All @@ -19450,6 +19408,23 @@ __metadata:
languageName: node
linkType: hard

"body-parser@npm:^2.2.0":
version: 2.2.0
resolution: "body-parser@npm:2.2.0"
dependencies:
bytes: ^3.1.2
content-type: ^1.0.5
debug: ^4.4.0
http-errors: ^2.0.0
iconv-lite: ^0.6.3
on-finished: ^2.4.1
qs: ^6.14.0
raw-body: ^3.0.0
type-is: ^2.0.0
checksum: 7fe3a2d288f0b632528d6ccb90052d1a9492c5b79d5716d32c8de1f5fb8237b0d31ee5050e1d0b7ff143a492ff151804612c6e2686a222a1d4c9e2e6531b8fb2
languageName: node
linkType: hard

"bonjour-service@npm:^1.0.11, bonjour-service@npm:^1.2.1":
version: 1.2.1
resolution: "bonjour-service@npm:1.2.1"
Expand Down Expand Up @@ -23214,20 +23189,7 @@ __metadata:
languageName: node
linkType: hard

"eslint-plugin-unused-imports@npm:^4.1.4":
version: 4.1.4
resolution: "eslint-plugin-unused-imports@npm:4.1.4"
peerDependencies:
"@typescript-eslint/eslint-plugin": ^8.0.0-0 || ^7.0.0 || ^6.0.0 || ^5.0.0
eslint: ^9.0.0 || ^8.0.0
peerDependenciesMeta:
"@typescript-eslint/eslint-plugin":
optional: true
checksum: 1f4ce3e3972699345513840f3af1b783033dbc3a3e85b62ce12b3f6a89fd8c92afe46d0c00af40bacb14465445983ba0ccc326a6fd5132553061fb0e47bcba19
languageName: node
linkType: hard

"eslint-plugin-unused-imports@npm:^4.3.0":
"eslint-plugin-unused-imports@npm:^4.1.4, eslint-plugin-unused-imports@npm:^4.3.0":
version: 4.3.0
resolution: "eslint-plugin-unused-imports@npm:4.3.0"
peerDependencies:
Expand Down Expand Up @@ -23676,7 +23638,7 @@ __metadata:
languageName: node
linkType: hard

"express@npm:4.21.2, express@npm:^4.14.0, express@npm:^4.17.1, express@npm:^4.17.3, express@npm:^4.18.2, express@npm:^4.19.2, express@npm:^4.21.2":
"express@npm:4.21.2":
version: 4.21.2
resolution: "express@npm:4.21.2"
dependencies:
Expand Down Expand Up @@ -23715,7 +23677,7 @@ __metadata:
languageName: node
linkType: hard

"express@npm:4.22.1, express@npm:^4.22.0":
"express@npm:4.22.1, express@npm:^4.14.0, express@npm:^4.17.1, express@npm:^4.17.3, express@npm:^4.18.2, express@npm:^4.19.2, express@npm:^4.21.2, express@npm:^4.22.0":
version: 4.22.1
resolution: "express@npm:4.22.1"
dependencies:
Expand Down Expand Up @@ -25665,7 +25627,7 @@ __metadata:
languageName: node
linkType: hard

"http-errors@npm:2.0.0, http-errors@npm:^2.0.0":
"http-errors@npm:2.0.0":
version: 2.0.0
resolution: "http-errors@npm:2.0.0"
dependencies:
Expand All @@ -25691,19 +25653,7 @@ __metadata:
languageName: node
linkType: hard

"http-errors@npm:~1.6.2":
version: 1.6.3
resolution: "http-errors@npm:1.6.3"
dependencies:
depd: ~1.1.2
inherits: 2.0.3
setprototypeof: 1.1.0
statuses: ">= 1.4.0 < 2"
checksum: a9654ee027e3d5de305a56db1d1461f25709ac23267c6dc28cdab8323e3f96caa58a9a6a5e93ac15d7285cee0c2f019378c3ada9026e7fe19c872d695f27de7c
languageName: node
linkType: hard

"http-errors@npm:~2.0.0, http-errors@npm:~2.0.1":
"http-errors@npm:^2.0.0, http-errors@npm:~2.0.0, http-errors@npm:~2.0.1":
version: 2.0.1
resolution: "http-errors@npm:2.0.1"
dependencies:
Expand All @@ -25716,6 +25666,18 @@ __metadata:
languageName: node
linkType: hard

"http-errors@npm:~1.6.2":
version: 1.6.3
resolution: "http-errors@npm:1.6.3"
dependencies:
depd: ~1.1.2
inherits: 2.0.3
setprototypeof: 1.1.0
statuses: ">= 1.4.0 < 2"
checksum: a9654ee027e3d5de305a56db1d1461f25709ac23267c6dc28cdab8323e3f96caa58a9a6a5e93ac15d7285cee0c2f019378c3ada9026e7fe19c872d695f27de7c
languageName: node
linkType: hard

"http-parser-js@npm:>=0.5.1":
version: 0.5.8
resolution: "http-parser-js@npm:0.5.8"
Expand Down Expand Up @@ -32975,16 +32937,7 @@ __metadata:
languageName: node
linkType: hard

"qs@npm:^6.10.1, qs@npm:^6.10.3, qs@npm:^6.11.0, qs@npm:^6.11.2, qs@npm:^6.12.2, qs@npm:^6.12.3, qs@npm:^6.14.0, qs@npm:^6.9.4":
version: 6.14.0
resolution: "qs@npm:6.14.0"
dependencies:
side-channel: ^1.1.0
checksum: 189b52ad4e9a0da1a16aff4c58b2a554a8dad9bd7e287c7da7446059b49ca2e33a49e570480e8be406b87fccebf134f51c373cbce36c8c83859efa0c9b71d635
languageName: node
linkType: hard

"qs@npm:~6.14.0":
"qs@npm:^6.10.1, qs@npm:^6.10.3, qs@npm:^6.11.0, qs@npm:^6.11.2, qs@npm:^6.12.2, qs@npm:^6.12.3, qs@npm:^6.14.0, qs@npm:^6.9.4, qs@npm:~6.14.0":
version: 6.14.1
resolution: "qs@npm:6.14.1"
dependencies:
Expand Down Expand Up @@ -33127,7 +33080,7 @@ __metadata:
languageName: node
linkType: hard

"raw-body@npm:2.5.2, raw-body@npm:^2.4.1":
"raw-body@npm:2.5.2":
version: 2.5.2
resolution: "raw-body@npm:2.5.2"
dependencies:
Expand All @@ -33139,6 +33092,18 @@ __metadata:
languageName: node
linkType: hard

"raw-body@npm:^2.4.1, raw-body@npm:~2.5.3":
version: 2.5.3
resolution: "raw-body@npm:2.5.3"
dependencies:
bytes: ~3.1.2
http-errors: ~2.0.1
iconv-lite: ~0.4.24
unpipe: ~1.0.0
checksum: 16aa51e504318ebeef7f84a4d884c0f273cb0b7f3f14ea88788f92f5f488870617c97d4f886e84f119f21a2d6cdda3c4554821f8b18ed6be0d731ecb5a063d2a
languageName: node
linkType: hard

"raw-body@npm:^3.0.0":
version: 3.0.1
resolution: "raw-body@npm:3.0.1"
Expand All @@ -33151,18 +33116,6 @@ __metadata:
languageName: node
linkType: hard

"raw-body@npm:~2.5.3":
version: 2.5.3
resolution: "raw-body@npm:2.5.3"
dependencies:
bytes: ~3.1.2
http-errors: ~2.0.1
iconv-lite: ~0.4.24
unpipe: ~1.0.0
checksum: 16aa51e504318ebeef7f84a4d884c0f273cb0b7f3f14ea88788f92f5f488870617c97d4f886e84f119f21a2d6cdda3c4554821f8b18ed6be0d731ecb5a063d2a
languageName: node
linkType: hard

"raw-loader@npm:^4.0.2":
version: 4.0.2
resolution: "raw-loader@npm:4.0.2"
Expand Down
Loading