From 2b3d2a9beb45c4f180f551b8bd329ecf1cdb7172 Mon Sep 17 00:00:00 2001 From: SatoshiQaziMuhammed Date: Fri, 6 Nov 2026 22:46:44 +0400 Subject: [PATCH] build(deps): bump body-parser, multer, qs, zod, fast-uri, serialize-javascript and ip-address (#42) Root yarn.lock, all within existing ranges: - body-parser 2.4.0 (GHSA high) and qs 6.16.1 via express - zod 4.6.7 via @modelcontextprotocol/sdk - fast-uri 3.1.9, serialize-javascript 7.1.3 and ip-address 10.7.4 zod 3.25.76 stays: @subql/cli 6.6.3 (latest) requires ^3.25.67 and fails to build the project when forced onto zod 4. docker/indexer: body-parser 2.4.0, qs 6.16.1 and multer 2.5.0. multer is pinned exactly by @nestjs/platform-express, so it is overridden in scope. --- docker/indexer/package-lock.json | 24 +++++++-------- docker/indexer/package.json | 5 +++- yarn.lock | 51 ++++++++++++++------------------ 3 files changed, 38 insertions(+), 42 deletions(-) diff --git a/docker/indexer/package-lock.json b/docker/indexer/package-lock.json index d842742..444c776 100644 --- a/docker/indexer/package-lock.json +++ b/docker/indexer/package-lock.json @@ -1964,18 +1964,18 @@ "license": "MIT" }, "node_modules/body-parser": { - "version": "2.3.0", - "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-2.3.0.tgz", - "integrity": "sha512-2cGmJupaNgg+QUwVLAucDuWuoMZ6EX9iHDRswZ5lsNYEmwPaRknMPCLZz07yTzVq/83p4o/wzbDZbBrTvGGTIw==", + "version": "2.4.0", + "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-2.4.0.tgz", + "integrity": "sha512-Ifk1KcLrxaGt1occQagQNFNNOqRt1LFuehEnHHzB8Z6cRgIxRU1TBaiIsUiCdA+gy5PL7Y1IX31DNKkRmxtXjQ==", "license": "MIT", "dependencies": { "bytes": "^3.1.2", - "content-type": "^2.0.0", + "content-type": "^2.1.0", "debug": "^4.4.3", "http-errors": "^2.0.1", - "iconv-lite": "^0.7.2", + "iconv-lite": "^0.7.3", "on-finished": "^2.4.1", - "qs": "^6.15.2", + "qs": "^6.16.1", "raw-body": "^3.0.2", "type-is": "^2.1.0" }, @@ -3620,9 +3620,9 @@ "license": "MIT" }, "node_modules/multer": { - "version": "2.4.0", - "resolved": "https://registry.npmjs.org/multer/-/multer-2.4.0.tgz", - "integrity": "sha512-7dqa0ZcFfzbefdTuIkzOSMvZWC0J7FLqBOjJUZvDCXShIURWKxAyTT1wHhnE5q19c7jOJf43IYYKjBmZVZmvhg==", + "version": "2.5.0", + "resolved": "https://registry.npmjs.org/multer/-/multer-2.5.0.tgz", + "integrity": "sha512-BsqOzYGVq49JcW2IzoSAxeKYRevb+dGGPPWleOR8Lrlk4igwxu1/9pwSXlByhCb7MVZDrNJFC0IBP5/O5nLYRw==", "license": "MIT", "dependencies": { "append-field": "^1.0.0", @@ -4141,9 +4141,9 @@ } }, "node_modules/qs": { - "version": "6.16.0", - "resolved": "https://registry.npmjs.org/qs/-/qs-6.16.0.tgz", - "integrity": "sha512-h6fhOIaRrID2CbEY2fqs+7t+UXZo+MLAnU5gRIq85uFtdiUPCdsApMlHhXogKVM4HM2DVbIjGNTTYH2OcmP1vA==", + "version": "6.16.1", + "resolved": "https://registry.npmjs.org/qs/-/qs-6.16.1.tgz", + "integrity": "sha512-5Px6J7rfHBAGUhNQ3es4YzcOdBBw0SDcVtThJml4RdnKw4tKs2epA0kPZ+K8X+WiHktT93RHVcQ/3ym5aTCgtg==", "license": "BSD-3-Clause", "dependencies": { "es-define-property": "^1.0.1", diff --git a/docker/indexer/package.json b/docker/indexer/package.json index a8fd669..4204736 100644 --- a/docker/indexer/package.json +++ b/docker/indexer/package.json @@ -30,6 +30,9 @@ "overrides": { "package-json": "^7.0.0", "uuid": "^11.1.1", - "vm2": "3.12.2" + "vm2": "3.12.2", + "@nestjs/platform-express": { + "multer": "2.5.0" + } } } diff --git a/yarn.lock b/yarn.lock index 51c799a..3eb5cf8 100644 --- a/yarn.lock +++ b/yarn.lock @@ -3751,19 +3751,19 @@ __metadata: linkType: hard "body-parser@npm:^2.3.0": - version: 2.3.0 - resolution: "body-parser@npm:2.3.0" + version: 2.4.0 + resolution: "body-parser@npm:2.4.0" dependencies: bytes: "npm:^3.1.2" - content-type: "npm:^2.0.0" + content-type: "npm:^2.1.0" debug: "npm:^4.4.3" http-errors: "npm:^2.0.1" - iconv-lite: "npm:^0.7.2" + iconv-lite: "npm:^0.7.3" on-finished: "npm:^2.4.1" - qs: "npm:^6.15.2" + qs: "npm:^6.16.1" raw-body: "npm:^3.0.2" type-is: "npm:^2.1.0" - checksum: 10c0/2a8fbbdc471b588338555a3e1a597d1eb0ad0c21cf20fdc3bac5d3f8d9c3a4b19b4163575ab852a43a5dfc0df7770ced5284f979e561f1a24c2f851ce89e695a + checksum: 10c0/247b891a27f661410b149c8a4771d3a9a076c86f41fff033d87b8bc828198195bd03ba321e3a8993ac37abca5a7ffeb62c96ea41f7ad3f11c170b73de5c27afe languageName: node linkType: hard @@ -4201,7 +4201,7 @@ __metadata: languageName: node linkType: hard -"content-type@npm:^2.0.0": +"content-type@npm:^2.0.0, content-type@npm:^2.1.0": version: 2.1.0 resolution: "content-type@npm:2.1.0" checksum: 10c0/f5d420f55fd0c7a7f7cbae9637777ce67a074aa79b489d8d9fee8599089592b5f8bb194e1d6885741fee20271034baca0d68d5419535b52d070c4f7e39f4b448 @@ -4942,9 +4942,9 @@ __metadata: linkType: hard "fast-uri@npm:^3.0.1": - version: 3.1.8 - resolution: "fast-uri@npm:3.1.8" - checksum: 10c0/c9c47860a7f9110176d94bb30a02942182f0bfc8d6780e9702f320336dc2dadb83b1d9879cceaf8d4b439642d1ec6d78c317cb808ab155455551bd5d9d7c22d8 + version: 3.1.9 + resolution: "fast-uri@npm:3.1.9" + checksum: 10c0/052757540d8c0bbc16bb124a45b8f5cb5d0932f9b89f019221ee41cdb3cafc1db44b2e809d6b888b87922af3e5560a863124454e9d9193e1fc955887357b5add languageName: node linkType: hard @@ -5578,7 +5578,7 @@ __metadata: languageName: node linkType: hard -"iconv-lite@npm:^0.7.2": +"iconv-lite@npm:^0.7.3": version: 0.7.3 resolution: "iconv-lite@npm:0.7.3" dependencies: @@ -5681,14 +5681,7 @@ __metadata: languageName: node linkType: hard -"ip-address@npm:^10.0.1": - version: 10.7.3 - resolution: "ip-address@npm:10.7.3" - checksum: 10c0/145d9848f315a0375437d206dee763e2dd654063e8c5d6270a329e249cfad30b4ae760b237bb1991abfe67276f542310a89fca891ddf76f934e397e0dda1bf3b - languageName: node - linkType: hard - -"ip-address@npm:^10.2.0": +"ip-address@npm:^10.0.1, ip-address@npm:^10.2.0": version: 10.7.4 resolution: "ip-address@npm:10.7.4" checksum: 10c0/22401f5723acd96a8b261ff5b098857bee86a700f8f4f7e7afcf3645a5ddb74b961296577b03c53acbd3235c6424aab11087ff1da9dbce11a55e05af9dde5bbb @@ -7613,13 +7606,13 @@ __metadata: languageName: node linkType: hard -"qs@npm:^6.15.2, qs@npm:^6.16.0": - version: 6.16.0 - resolution: "qs@npm:6.16.0" +"qs@npm:^6.16.0, qs@npm:^6.16.1": + version: 6.16.1 + resolution: "qs@npm:6.16.1" dependencies: es-define-property: "npm:^1.0.1" side-channel: "npm:^1.1.1" - checksum: 10c0/eb3e31992fbd70e31a1791e571ed817d70975de7d3bfcbbbec93d77d1dd305877e9e8fdbcc62303c228ee5c3606685622cd6231c042dbc4790bb4e7c65fcbe18 + checksum: 10c0/84ee9124b251ab2953132fbea1d70c966aa6e6496cccabedbbb83afa412bf4177bddebc779ca3ddafe23da83b2f593d530b41be6a726e971404fabb20ff22c94 languageName: node linkType: hard @@ -7965,9 +7958,9 @@ __metadata: linkType: hard "serialize-javascript@npm:^7.0.5": - version: 7.1.2 - resolution: "serialize-javascript@npm:7.1.2" - checksum: 10c0/568ea22e16893a26cd2506433b8d98bb82f4af37e149330a3deb042bd417516988e6ca9a5010739e1a8dc4866caae320f582dfd2a1a0f0ab69ba3c03f1e155ba + version: 7.1.3 + resolution: "serialize-javascript@npm:7.1.3" + checksum: 10c0/5c2d4cbaa8c35d0a9f64498e9d14410f8e590eff7f2394d8e9e99f81558c0a9191dd65eaa4900ace7a3d6b8de8b8c2ff0d7a6963b68281515f2e9fccc78c4514 languageName: node linkType: hard @@ -9324,9 +9317,9 @@ __metadata: linkType: hard "zod@npm:^3.25 || ^4.0": - version: 4.3.6 - resolution: "zod@npm:4.3.6" - checksum: 10c0/860d25a81ab41d33aa25f8d0d07b091a04acb426e605f396227a796e9e800c44723ed96d0f53a512b57be3d1520f45bf69c0cb3b378a232a00787a2609625307 + version: 4.6.7 + resolution: "zod@npm:4.6.7" + checksum: 10c0/4ce2eb14034317b7254e347ca37b5ad591cf8333147030cf05b9b5d31692d45073f7f2747aa50cf8c6b29012194d2b22978cecc89969cf34a0d18e89d0ee7d7b languageName: node linkType: hard