build(deps): remediate body-parser advisory #162

Merged

PorteGumi merged 1 commit from build/remediate-security-alerts into main

2026-08-22 19:08:26 -05:00

PorteGumi commented

2026-08-22 18:59:54 -05:00

(Migrated from github.com)

Summary

pin Express's transitive body-parser dependency to patched 2.3.0
refresh the pnpm lockfile so ingress no longer installs vulnerable 2.2.2
resolve GHSA-v422-hmwv-36x6 / CVE-2026-12590

Security assessment

The remaining deepmerge-ts alert (GHSA-ggr8-5vv4-36mx) was reviewed separately and dismissed as not_used. Its only path is Prisma CLI configuration loading (prisma -> @prisma/config -> deepmerge-ts). This repository passes a static, acyclic, repository-local prisma.config.ts; request data cannot reach the vulnerable recursive-graph merge path. Forcing the patched major across Prisma's exact 7.1.5 dependency would violate Prisma's declared package contract.

Validation

pnpm install --frozen-lockfile
pnpm --filter @multi-stream-alerts/ingress test
pnpm --filter @multi-stream-alerts/database test — 71 passed
pnpm --filter @multi-stream-alerts/web test — 227 passed
pnpm --filter @multi-stream-alerts/worker test — 4 passed
pnpm -r typecheck
pnpm -r lint
pnpm -r build
pnpm --filter @multi-stream-alerts/database prisma:generate
prettier --check package.json pnpm-lock.yaml
git diff --check
staged Gitleaks scan — no leaks
verified installed resolution: body-parser@2.3.0
pnpm audit --prod no longer reports GHSA-v422-hmwv-36x6

Known baseline

The repository-wide pnpm format:check still reports 10 pre-existing files that are untouched by this PR. Both changed files pass Prettier.

Risk

Low. The override is scoped to express>body-parser; Express already declares body-parser with a compatible ^2.2.1 range. No application code or runtime configuration changes.

## Summary - pin Express's transitive `body-parser` dependency to patched `2.3.0` - refresh the pnpm lockfile so ingress no longer installs vulnerable `2.2.2` - resolve GHSA-v422-hmwv-36x6 / CVE-2026-12590 ## Security assessment The remaining `deepmerge-ts` alert (GHSA-ggr8-5vv4-36mx) was reviewed separately and dismissed as `not_used`. Its only path is Prisma CLI configuration loading (`prisma` -> `@prisma/config` -> `deepmerge-ts`). This repository passes a static, acyclic, repository-local `prisma.config.ts`; request data cannot reach the vulnerable recursive-graph merge path. Forcing the patched major across Prisma's exact `7.1.5` dependency would violate Prisma's declared package contract. ## Validation - `pnpm install --frozen-lockfile` - `pnpm --filter @multi-stream-alerts/ingress test` - `pnpm --filter @multi-stream-alerts/database test` — 71 passed - `pnpm --filter @multi-stream-alerts/web test` — 227 passed - `pnpm --filter @multi-stream-alerts/worker test` — 4 passed - `pnpm -r typecheck` - `pnpm -r lint` - `pnpm -r build` - `pnpm --filter @multi-stream-alerts/database prisma:generate` - `prettier --check package.json pnpm-lock.yaml` - `git diff --check` - staged Gitleaks scan — no leaks - verified installed resolution: `body-parser@2.3.0` - `pnpm audit --prod` no longer reports GHSA-v422-hmwv-36x6 ## Known baseline The repository-wide `pnpm format:check` still reports 10 pre-existing files that are untouched by this PR. Both changed files pass Prettier. ## Risk Low. The override is scoped to `express>body-parser`; Express already declares `body-parser` with a compatible `^2.2.1` range. No application code or runtime configuration changes.

Gitchegumi (Migrated from github.com) approved these changes

2026-08-22 19:08:19 -05:00