fix(deps): resolve qs security advisory (VOI-KANEO-75) #210

Merged

backmeupplz merged 1 commit from voi-kaneo-75-resolve-qs-advisory into main

2026-07-21 18:12:17 +00:00

backmeupplz commented

2026-07-21 18:00:00 +00:00

(Migrated from github.com)

Summary

upgrade Express from 4.22.1 to the upstream 4.22.2 patch release
regenerate the Yarn 1 lockfile so Express, body-parser, and Stripe share qs 6.15.3
add a repeatable compatibility proof for the worker API JSON middleware/auth path and Stripe raw-body webhook path

Dependency path and compatibility decision

Express 4.22.1 required qs ~6.14.0, which blocked Dependabot below the fixed 6.15.2 floor. Express 4.22.2 changes that upstream requirement to qs ~6.15.1 and keeps body-parser on the compatible 1.20.x line. The regenerated lockfile therefore selects qs 6.15.3 for every production path without a Yarn resolution or out-of-range override.

This deliberately stays on Express 4 rather than taking the Express 5 major migration. It preserves Voicy's current runtime baseline while using the smallest upstream-supported patch that admits the security fix. The route proof starts the real Voicy Express app and verifies the worker JSON/auth response and Stripe raw-body rejection behavior.

Validation

mise exec node@20.20.2 -- npx --yes yarn@1.22.22 install --frozen-lockfile
mise exec node@20.20.2 -- npx --yes yarn@1.22.22 build-ts
mise exec node@20.20.2 -- npx --yes yarn@1.22.22 lint
mise exec node@20.20.2 -- node --check scripts/express-compatibility-proof.js
mise exec node@20.20.2 -- npx --yes yarn@1.22.22 test:express-compatibility
mise exec node@20.20.2 -- npx --yes yarn@1.22.22 test:worker-client
mise exec node@20.20.2 -- npx --yes yarn@1.22.22 test:stripe-webhook
mise exec node@20.20.2 -- npx --yes yarn@1.22.22 audit --groups dependencies --level moderate (0 vulnerabilities; 224 packages)
git diff --check

The Mongo-backed worker API proof was not run locally because the Docker daemon and local mongod are unavailable; the new no-DB compatibility proof covers the Express middleware and both mounted route groups.

Easypanel readiness

No environment or schema changes are required. The existing Nixpacks install/build commands will consume the reviewed frozen lockfile. After merge and Easypanel redeploy, production must be checked to confirm express 4.22.2 and qs 6.15.3 are installed before VOI-KANEO-75 can be completed.

## Summary - upgrade Express from 4.22.1 to the upstream 4.22.2 patch release - regenerate the Yarn 1 lockfile so Express, body-parser, and Stripe share qs 6.15.3 - add a repeatable compatibility proof for the worker API JSON middleware/auth path and Stripe raw-body webhook path ## Dependency path and compatibility decision Express 4.22.1 required qs ~6.14.0, which blocked Dependabot below the fixed 6.15.2 floor. Express 4.22.2 changes that upstream requirement to qs ~6.15.1 and keeps body-parser on the compatible 1.20.x line. The regenerated lockfile therefore selects qs 6.15.3 for every production path without a Yarn resolution or out-of-range override. This deliberately stays on Express 4 rather than taking the Express 5 major migration. It preserves Voicy's current runtime baseline while using the smallest upstream-supported patch that admits the security fix. The route proof starts the real Voicy Express app and verifies the worker JSON/auth response and Stripe raw-body rejection behavior. ## Validation - mise exec node@20.20.2 -- npx --yes yarn@1.22.22 install --frozen-lockfile - mise exec node@20.20.2 -- npx --yes yarn@1.22.22 build-ts - mise exec node@20.20.2 -- npx --yes yarn@1.22.22 lint - mise exec node@20.20.2 -- node --check scripts/express-compatibility-proof.js - mise exec node@20.20.2 -- npx --yes yarn@1.22.22 test:express-compatibility - mise exec node@20.20.2 -- npx --yes yarn@1.22.22 test:worker-client - mise exec node@20.20.2 -- npx --yes yarn@1.22.22 test:stripe-webhook - mise exec node@20.20.2 -- npx --yes yarn@1.22.22 audit --groups dependencies --level moderate (0 vulnerabilities; 224 packages) - git diff --check The Mongo-backed worker API proof was not run locally because the Docker daemon and local mongod are unavailable; the new no-DB compatibility proof covers the Express middleware and both mounted route groups. ## Easypanel readiness No environment or schema changes are required. The existing Nixpacks install/build commands will consume the reviewed frozen lockfile. After merge and Easypanel redeploy, production must be checked to confirm express 4.22.2 and qs 6.15.3 are installed before VOI-KANEO-75 can be completed.