Repository navigation
fix(deps): patch body-parser to 2.4.0 - #1447
cipherstash-agent wants to merge 2 commits into
Conversation
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012Jmn7ng9L3hDYRnUZpQPbN
|
|
No actionable comments were generated in the recent review.
 |
| Layer / File(s) | Summary |
|---|---|
Configure the body-parser override pnpm-workspace.yaml |
The workspace maps body-parser versions >=2.0.0 <2.4.0 to 2.4.0. |
Estimated code review effort: 1 (Trivial) | ~5 minutes
Change: Bug fix
Suggested reviewers: auxesis
Merge Risk: 
ccdbd
-
The override and lockfile consistently select body-parser 2.4.0. No actionable merge-blocking issue remains; the change is ready to merge subject to normal checks.
Pre-merge checks: 
-
Check name Status Explanation Description Check Check skipped - CodeRabbit’s high-level summary is enabled. Title check The title clearly and concisely identifies the dependency fix: updating body-parser to version 2.4.0. Linked Issues check Check skipped because no linked issues were found for this pull request. Out of Scope Changes check Check skipped because no linked issues were found for this pull request.
cipherstash-agent
left a comment
cipherstash-agent
left a comment
There was a problem hiding this comment.
Review attestation at ccdbd9a: /code-review medium plus company-skills:cross-check-review-findings, run by Claude Code.
Critical/blocking issues: none.
- Lockfile and override change are consistent:
body-parser2.3.0 → 2.4.0 (fixes GHSA-27r3-jxmh-p828, range>=2.0.0 <2.4.0), withqs6.16.1 pulled in as the new dependency. - 1 minor finding posted inline (the override does not reach npm consumers of
@cipherstash/wizard). - Checked and dropped: the
qsduplicate is disclosed in the PR body, and the 7-day install cooldown is satisfied (2.4.0 published 2026-10-22) and does not affect--frozen-lockfileinstalls. - No existing human or bot review findings to cross-check against.
Generated by Claude Code
| 'sharp@<0.35.5': '0.35.5' | ||
| # #279 CVE-2026-111181 (GHSA-27r3-jxmh-p828, HIGH) — body-parser 2.x; fixed in | ||
| # 2.4.0. Reached through express 5 (`^2.2.1`) via @modelcontextprotocol/sdk. | ||
| 'body-parser@>=2.0.0 <2.4.0': '2.4.0' |
There was a problem hiding this comment.
minor This override applies only to this repo's lockfile; pnpm overrides are not published, so @cipherstash/wizard installs from npm still resolve body-parser through express and @modelcontextprotocol/sdk ranges and can land below 2.4.0. If consumers should be protected, add a direct body-parser floor to the wizard's dependencies; otherwise state in the PR that the remediation covers repo installs only.
Generated by Claude Code
The override added a 13th entry to `pnpm-workspace.yaml`, and the supply-chain e2e test caps the list at 12, so the E2E job failed. An override is not necessary. express 5 asks for `body-parser@^2.2.1`, and 2.4.0 is in that range. The lockfile keeps `body-parser@2.4.0` and `qs@6.16.1` with no override, and no other package moves.
|
I updated the PR description. Commit The old description:
|
|
Closing as superseded: main's Generated by Claude Code |
Summary
Patches
body-parserto 2.4.0 in the rootpnpm-lock.yaml. That is the only lockfile that resolved a vulnerable version.Advisories
>= 2.0.0, < 2.4.0, fixed in 2.4.0. Dependabot alert: https://github.com/cipherstash/stack/security/dependabot/279Versions
pnpm-lock.yamlChanges
body-parseris a transitive dependency:@cipherstash/wizard→@anthropic-ai/claude-agent-sdk→@modelcontextprotocol/sdk→express@5.2.1→body-parser.expressasks forbody-parser@^2.2.1, and 2.4.0 is in that range. So the lockfile resolves 2.4.0 with no override inpnpm-workspace.yaml. A fresh install of@cipherstash/wizardfrom npm also resolves 2.4.0.An earlier commit used a security override. That added a 13th entry to the overrides list, and
e2e/tests/supply-chain.e2e.test.tslimits the list to 12, so the E2E job failed. Commit148a823d6removes the override and keeps the in-range resolution.One other package moved:
qs6.16.0 → 6.16.1, becausebody-parser@2.4.0requires it. PR #1434 targets the same version. No other package moves, androllupstays the same.No changeset: this changes only the lockfile, not the surface of a published package.
Verification
pnpm install --frozen-lockfilepasses.e2e/tests/supply-chain.e2e.test.tspasses (29 tests).deps.pyover the branch (on the override commit): exit 0. No lockfile resolves a vulnerable version.main, onlypnpm-lock.yamlchanges.