security: pin fast-uri 3.1.6, qs 6.16.0 (6 npm advisories) - #1270
Merged
Merged
Conversation
fast-uri 3.1.5 (pinned for GHSA-7p8r-x3mc-p8w7/GHSA-v2hh-gcrm-f6hx) is below the fix floor for four newer advisories, all <3.1.6: GHSA-jqff-g426-hqxp, GHSA-f65p-4m7j-42xc, GHSA-fph4-wmhf-6fwf, GHSA-5jgf-p345-68v8 (host confusion / SSRF via scheme, IPv6 and IDN normalization bugs). qs was unpinned and pulled in transitively at ~6.15.1, vulnerable to GHSA-4mjr-xmp4-gh2g (DoS via attacker- controlled isBuffer) and GHSA-x5fp-wj9c-mxmx (array-limit bypass); 6.16.0 fixes both. Both packages exist only in the JS Yarn graph (kotlin-js-store/yarn.lock), not the Wasm one, so both pins are NpmPinTarget.JS-scoped like the existing fast-uri pin. kotlinUpgradeYarnLock + kotlinWasmUpgradeYarnLock regenerated the lockfiles; verifyNpmPins passes (9 pins verified). JS/wasmJs compile clean. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PLfVvtURRYZETceamLi8kP
aharakal
approved these changes
Sep 7, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes the 4 high + 2 medium Dependabot alerts in
kotlin-js-store/yarn.lockusing the existingsk.ainet.npm-pinsmechanism:fast-uri: 3.1.5 → 3.1.6 (the existing pin was below the fix floor for 4 newer advisories — host confusion / SSRF via scheme, IPv6, and IDN normalization bugs)qs: unpinned → 6.16.0 (new pin; was resolving to ~6.15.1, vulnerable to a DoS and an array-limit bypass)Both packages exist only in the JS Yarn graph, not the Wasm one, so both are
NpmPinTarget.JS-scoped.Not covered by this PR
The remaining 11 open alerts (Jackson, jsoup, BouncyCastle, httpclient, OpenTelemetry, Commons Lang3, kotlin-gradle-plugin) all trace back into the internal, isolated dependency graphs of third-party Gradle plugins — Android Gradle Plugin 9.4.0 and Dokka 2.2.0 (both already the latest stable releases), plus what looks like the Kotlin Build Tools API's own resolution. None of these are reachable by
sk.ainet.maven-pins(which only patchesproject.allprojectsconfigurations, not plugin/buildscript classpaths), and there's no newer AGP/Dokka release yet to bump to.kotlin-gradle-plugin's own CVE (unsafe build-cache deserialization) is fixed only in a2.4.20-Beta1prerelease — not something to adopt for a stable toolchain yet. Recommend revisiting once AGP/Dokka/Kotlin ship patched stable releases.Test plan
kotlinUpgradeYarnLock+kotlinWasmUpgradeYarnLockregenerated the lockfiles./gradlew verifyNpmPins— 9 pins verified🤖 Generated with Claude Code
https://claude.ai/code/session_01PLfVvtURRYZETceamLi8kP