Skip to content

chore(deps): bump qs to ^6.14.2#5707

Merged
lucas-zimerman merged 2 commits into
mainfrom
antonis/bump-qs
Feb 24, 2026
Merged

chore(deps): bump qs to ^6.14.2#5707
lucas-zimerman merged 2 commits into
mainfrom
antonis/bump-qs

Conversation

@antonis
Copy link
Copy Markdown
Contributor

@antonis antonis commented Feb 24, 2026

Summary

  • Adds a resolutions entry to force qs to >=6.14.2, resolves to 6.15.0
  • Fixes two DoS vulnerabilities: arrayLimit bypass via bracket notation and via comma parsing
  • Consolidates 6.11.0 and 6.13.0 consumers onto 6.15.0

Dependabot alerts

Test plan

  • yarn install resolves all qs consumers to 6.15.0
  • yarn build passes
  • yarn test passes

🤖 Generated with Claude Code

@antonis @claude
chore(deps): bump qs to ^6.14.2
a1cb1bb 
Adds a yarn resolution to force qs to >=6.14.2, patching two DoS
vulnerabilities: arrayLimit bypass via bracket notation (>= 4.0.0,
<= 6.14.1) and arrayLimit bypass via comma parsing (<= 6.14.1).
Consolidates 6.11.0 and 6.13.0 consumers onto 6.15.0.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@antonis antonis added the ready-to-merge Triggers the full CI test suite label Feb 24, 2026
@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented Feb 24, 2026 •
edited
Loading

Semver Impact of This PR

⚪ None (no version bump detected)

📋 Changelog Preview

This is how your changes will appear in the changelog.
Entries from this PR are highlighted with a left border (blockquote style).

  • chore(deps): bump qs to ^6.14.2 by antonis in #5707
  • chore(deps): bump lodash to ^4.17.23 by antonis in #5702
  • chore(deps): bump getsentry/craft from 2.21.4 to 2.21.7 by dependabot in #5694
  • chore(deps): bump getsentry/craft/.github/workflows/changelog-preview.yml from 2.21.4 to 2.21.7 by dependabot in #5695
  • chore(deps): update CLI to v3.2.2 by github-actions in #5692
  • chore(deps): bump github/codeql-action from 4.32.3 to 4.32.4 by dependabot in #5693
  • chore(deps): update Maestro to v2.2.0 by github-actions in #5691
  • chore(deps): update Cocoa SDK to v9.5.0 by github-actions in #5685
  • chore(deps): update Android SDK Stubs to v8.33.0 by github-actions in #5697
  • chore(deps): update Android SDK to v8.33.0 by github-actions in #5684
  • chore(deps): update Sentry Android Gradle Plugin to v6.1.0 by github-actions in #5687
  • Ref(CI): Add android sdk version check by lucas-zimerman in #5686

🤖 This preview updates automatically when you update the PR.

@antonis antonis mentioned this pull request Feb 24, 2026
Closed
@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented Feb 24, 2026 •
edited
Loading

iOS (legacy) Performance metrics 🚀

  Plain With Sentry Diff
Startup time 1228.43 ms 1224.07 ms -4.37 ms
Size 3.38 MiB 4.78 MiB 1.40 MiB

Baseline results on branch: main

Startup times

Revision Plain With Sentry Diff
90e7cb3+dirty 1206.61 ms 1209.46 ms 2.84 ms
60cd796+dirty 1204.87 ms 1202.71 ms -2.17 ms
8e653ac+dirty 1218.63 ms 1223.88 ms 5.24 ms
f70acbf+dirty 1235.71 ms 1243.14 ms 7.43 ms
ad27f6e+dirty 1223.41 ms 1246.29 ms 22.88 ms
6c11c6a+dirty 1202.43 ms 1212.70 ms 10.27 ms
664c66f+dirty 1215.37 ms 1221.30 ms 5.92 ms
d916aa3+dirty 1221.02 ms 1228.98 ms 7.96 ms
36841a6+dirty 1221.32 ms 1222.17 ms 0.85 ms
bca62c0+dirty 1183.61 ms 1183.76 ms 0.14 ms

App size

Revision Plain With Sentry Diff
90e7cb3+dirty 3.41 MiB 4.58 MiB 1.17 MiB
60cd796+dirty 3.44 MiB 4.67 MiB 1.23 MiB
8e653ac+dirty 2.63 MiB 4.01 MiB 1.38 MiB
f70acbf+dirty 2.63 MiB 3.98 MiB 1.34 MiB
ad27f6e+dirty 3.41 MiB 4.67 MiB 1.25 MiB
6c11c6a+dirty 3.44 MiB 4.60 MiB 1.16 MiB
664c66f+dirty 3.38 MiB 4.60 MiB 1.22 MiB
d916aa3+dirty 2.63 MiB 3.81 MiB 1.18 MiB
36841a6+dirty 3.41 MiB 4.67 MiB 1.25 MiB
bca62c0+dirty 3.38 MiB 4.60 MiB 1.22 MiB

@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented Feb 24, 2026 •
edited
Loading

Android (legacy) Performance metrics 🚀

  Plain With Sentry Diff
Startup time 424.60 ms 482.18 ms 57.58 ms
Size 43.75 MiB 48.46 MiB 4.71 MiB

Baseline results on branch: main

Startup times

Revision Plain With Sentry Diff
eeebd10+dirty 493.12 ms 545.91 ms 52.79 ms
664c66f+dirty 434.82 ms 471.38 ms 36.56 ms
d73150f+dirty 411.21 ms 465.86 ms 54.65 ms
4a17c8f+dirty 406.62 ms 400.58 ms -6.04 ms
2adbd1e+dirty 433.98 ms 427.96 ms -6.02 ms
98f632c 424.25 ms 435.48 ms 11.23 ms
9ced351+dirty 405.40 ms 419.39 ms 13.98 ms
64cd15c 439.02 ms 427.63 ms -11.39 ms
8490686+dirty 365.59 ms 400.24 ms 34.65 ms
1853710 555.47 ms 556.59 ms 1.12 ms

App size

Revision Plain With Sentry Diff
eeebd10+dirty 43.75 MiB 48.41 MiB 4.66 MiB
664c66f+dirty 43.75 MiB 48.55 MiB 4.80 MiB
d73150f+dirty 43.75 MiB 48.55 MiB 4.80 MiB
4a17c8f+dirty 43.75 MiB 47.99 MiB 4.24 MiB
2adbd1e+dirty 17.75 MiB 19.70 MiB 1.96 MiB
98f632c 17.75 MiB 20.15 MiB 2.41 MiB
9ced351+dirty 43.75 MiB 48.41 MiB 4.66 MiB
64cd15c 17.75 MiB 20.15 MiB 2.41 MiB
8490686+dirty 17.75 MiB 19.70 MiB 1.96 MiB
1853710 17.75 MiB 19.68 MiB 1.94 MiB

@antonis antonis marked this pull request as ready for review February 24, 2026 13:06
cursor[bot]
cursor Bot reviewed Feb 24, 2026
View reviewed changes
Copy link
Copy Markdown

@cursor cursor Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cursor Bugbot has reviewed your changes and found 1 potential issue.

Bugbot Autofix is OFF. To automatically fix reported issues with Cloud Agents, enable Autofix in the Cursor dashboard.

Comment thread package.json
"resolutions": {
"appium-chromedriver@npm:5.6.73/@xmldom/xmldom": "0.8.10",
"form-data": "4.0.4",
"qs": "^6.14.2",
Copy link
Copy Markdown

@cursor cursor Bot Feb 24, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Non-deterministic qs version resolution

Medium Severity

Using a range in resolutions ("qs": "^6.14.2") allows future installs to pick up newer qs releases without an intentional lockfile change, which can make dependency resolution less reproducible and introduce unexpected behavior changes across environments.

Additional Locations (1)

Fix in Cursor Fix in Web

@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented Feb 24, 2026 •
edited
Loading

iOS (new) Performance metrics 🚀

  Plain With Sentry Diff
Startup time 1226.06 ms 1229.04 ms 2.98 ms
Size 3.38 MiB 4.78 MiB 1.40 MiB

Baseline results on branch: main

Startup times

Revision Plain With Sentry Diff
90e7cb3+dirty 1212.61 ms 1213.80 ms 1.19 ms
60cd796+dirty 1206.08 ms 1213.36 ms 7.28 ms
8e653ac+dirty 1215.46 ms 1220.20 ms 4.75 ms
f70acbf+dirty 1239.00 ms 1242.53 ms 3.53 ms
ad27f6e+dirty 1214.28 ms 1203.67 ms -10.62 ms
6c11c6a+dirty 1217.55 ms 1221.49 ms 3.94 ms
664c66f+dirty 1195.94 ms 1194.80 ms -1.14 ms
d916aa3+dirty 1211.02 ms 1221.33 ms 10.31 ms
36841a6+dirty 1215.87 ms 1217.27 ms 1.40 ms
bca62c0+dirty 1219.65 ms 1226.14 ms 6.50 ms

App size

Revision Plain With Sentry Diff
90e7cb3+dirty 3.41 MiB 4.58 MiB 1.17 MiB
60cd796+dirty 3.44 MiB 4.67 MiB 1.23 MiB
8e653ac+dirty 3.19 MiB 4.58 MiB 1.39 MiB
f70acbf+dirty 3.19 MiB 4.54 MiB 1.36 MiB
ad27f6e+dirty 3.41 MiB 4.67 MiB 1.25 MiB
6c11c6a+dirty 3.44 MiB 4.60 MiB 1.16 MiB
664c66f+dirty 3.38 MiB 4.60 MiB 1.22 MiB
d916aa3+dirty 3.19 MiB 4.38 MiB 1.19 MiB
36841a6+dirty 3.41 MiB 4.67 MiB 1.25 MiB
bca62c0+dirty 3.38 MiB 4.60 MiB 1.22 MiB

@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented Feb 24, 2026 •
edited
Loading

Android (new) Performance metrics 🚀

  Plain With Sentry Diff
Startup time 398.33 ms 429.43 ms 31.10 ms
Size 43.94 MiB 49.33 MiB 5.39 MiB

Baseline results on branch: main

Startup times

Revision Plain With Sentry Diff
df1f7df+dirty 374.68 ms 384.96 ms 10.28 ms
a483f9f+dirty 428.57 ms 475.98 ms 47.41 ms
7091004+dirty 377.76 ms 402.11 ms 24.35 ms
5526494+dirty 380.79 ms 432.70 ms 51.91 ms
98f632c+dirty 323.98 ms 375.39 ms 51.41 ms
5c16cdc+dirty 375.45 ms 426.62 ms 51.17 ms
8ece263+dirty 369.44 ms 414.65 ms 45.21 ms
a2bb688+dirty 371.19 ms 389.18 ms 17.99 ms
526494a+dirty 361.10 ms 410.84 ms 49.74 ms
60cd796+dirty 410.56 ms 439.00 ms 28.44 ms

App size

Revision Plain With Sentry Diff
df1f7df+dirty 43.94 MiB 48.91 MiB 4.97 MiB
a483f9f+dirty 43.94 MiB 49.27 MiB 5.33 MiB
7091004+dirty 43.94 MiB 48.81 MiB 4.88 MiB
5526494+dirty 7.15 MiB 8.41 MiB 1.26 MiB
98f632c+dirty 7.15 MiB 8.42 MiB 1.27 MiB
5c16cdc+dirty 7.15 MiB 8.41 MiB 1.26 MiB
8ece263+dirty 7.15 MiB 8.41 MiB 1.26 MiB
a2bb688+dirty 7.15 MiB 8.43 MiB 1.28 MiB
526494a+dirty 43.94 MiB 48.82 MiB 4.88 MiB
60cd796+dirty 43.94 MiB 48.90 MiB 4.96 MiB

@lucas-zimerman lucas-zimerman merged commit 19a0088 into main Feb 24, 2026
72 checks passed
@lucas-zimerman lucas-zimerman deleted the antonis/bump-qs branch February 24, 2026 16:11
lucas-zimerman added a commit that referenced this pull request Feb 25, 2026
@lucas-zimerman
Revert "chore(deps): bump qs to ^6.14.2 (#5707)"
cc66a5c 
This reverts commit 19a0088.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@cursor cursor[bot] cursor[bot] left review comments

@lucas-zimerman lucas-zimerman lucas-zimerman approved these changes

@alwx alwx Awaiting requested review from alwx alwx is a code owner

Assignees

No one assigned

Labels

ready-to-merge Triggers the full CI test suite

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@antonis @lucas-zimerman