From e03c51a75ec0460bdd1e447e99d7cfa556bc7c81 Mon Sep 17 00:00:00 2001
From: cheffe01 <32869042-cheffe01@users.noreply.replit.com>
Date: Mon, 25 May 2026 13:10:23 +0000
Subject: [PATCH] Fix qs vulnerability (GHSA-q8mj-m7cp-5q26)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Task: Fix medium-severity qs DoS vulnerability in the dependency chain.

The vulnerability affects qs >=6.11.1 <=6.15.1 — qs.stringify crashes
with a TypeError when null/undefined entries appear in comma-format arrays
with encodeValuesOnly set. The fix requires upgrading to qs >=6.15.2.

The affected path was: artifacts/api-server > express > qs@6.15.1

Fix: Added a pnpm workspace override in pnpm-workspace.yaml to force
qs to >=6.15.2 across all packages:

  qs: ">=6.15.2"

Ran `pnpm install` to apply the override (+1/-1 package). Confirmed with
`pnpm audit` — no known vulnerabilities found after the fix.

No code changes were required; only the lockfile and workspace config
were updated.

Replit-Task-Id: 59fbfd17-c5e4-4330-b97c-49a9e383db2e
---
 pnpm-lock.yaml      | 11 ++++++-----
 pnpm-workspace.yaml |  4 +++-
 2 files changed, 9 insertions(+), 6 deletions(-)

diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 879144f..66b2327 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -152,6 +152,7 @@ overrides:
   '@expo/ngrok-bin>@expo/ngrok-bin-win32-x64': '-'
   '@esbuild-kit/esm-loader': npm:tsx@^4.21.0
   esbuild: 0.27.3
+  qs: '>=6.15.2'
 
 importers:
 
@@ -2687,8 +2688,8 @@ packages:
     resolution: {integrity: sha512-uxFIHU0YlHYhDQtV4R9J6a52SLx28BCjT+4ieh7IGbgwVJWO+km431c4yRlREUAsAmt/uMjQUyQHNEPf0M39CA==}
     engines: {node: '>=6'}
 
-  qs@6.15.1:
-    resolution: {integrity: sha512-6YHEFRL9mfgcAvql/XhwTvf5jKcOiiupt2FiJxHkiX1z4j7WL8J/jRHYLluORvc1XxB5rV20KoeK00gVJamspg==}
+  qs@6.15.2:
+    resolution: {integrity: sha512-Rzq0KEyX/w/tEybncDgdkZrJgVUsUMk3xjh3t5bv3S1HTAtg+uOYt72+ZfwiQwKdysThkTBdL/rTi6HDmX9Ddw==}
     engines: {node: '>=0.6'}
 
   queue-microtask@1.2.3:
@@ -4454,7 +4455,7 @@ snapshots:
       http-errors: 2.0.1
       iconv-lite: 0.7.2
       on-finished: 2.4.1
-      qs: 6.15.1
+      qs: 6.15.2
       raw-body: 3.0.2
       type-is: 2.0.1
     transitivePeerDependencies:
@@ -4741,7 +4742,7 @@ snapshots:
       once: 1.4.0
       parseurl: 1.3.3
       proxy-addr: 2.0.7
-      qs: 6.15.1
+      qs: 6.15.2
       range-parser: 1.2.1
       router: 2.2.0
       send: 1.2.1
@@ -5265,7 +5266,7 @@ snapshots:
 
   punycode.js@2.3.1: {}
 
-  qs@6.15.1:
+  qs@6.15.2:
     dependencies:
       side-channel: 1.1.0
 
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index f7e92b4..98d5e98 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -157,4 +157,6 @@ overrides:
   "@expo/ngrok-bin>@expo/ngrok-bin-win32-x64": "-"
   # drizzle-kit uses esbuild internally on an older version that's vulnerable, this overrides it
   "@esbuild-kit/esm-loader": "npm:tsx@^4.21.0"
-  esbuild: "0.27.3"
\ No newline at end of file
+  esbuild: "0.27.3"
+  # Fix GHSA-q8mj-m7cp-5q26: qs DoS via stringify with null/undefined in comma-format arrays
+  qs: ">=6.15.2"
\ No newline at end of file