fix(deps): override fast-uri to ^3.1.7 and qs to ^6.16.0 to resolve CVEs (#3313)

[agentHits]

Summary

Overrides transitive dependencies fast-uri to ^3.1.7 and qs to ^6.16.0 in package.json to eliminate 6 vulnerabilities detected by bun audit (4 High in fast-uri, 2 Moderate in qs).

Closes #3313

• fast-uri: fixes GHSA-5jgf-p345-68v8, GHSA-f65p-4m7j-42xc, GHSA-fph4-wmhf-6fwf, and GHSA-jqff-g426-hqxp.
• qs: fixes GHSA-x5fp-wj9c-mxmx and GHSA-4mjr-xmp4-gh2g.

Verification

• Ran bun audit — 0 vulnerabilities reported (No vulnerabilities found).
• Ran bun run typecheck — passed (bun x tsc --noEmit).
• Ran bun test tests/repo-hygiene.test.ts — passed (12 passed, 0 failed).

Checklist

• Scope stays focused and avoids unrelated cleanup.
• Docs or release notes were updated when needed.
• Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults.

Review readiness checklist

This PR stays in draft until every box below is ticked. Tick all four boxes once the requirements are met:

• All CI tests are green on my local testing.

• I pushed my PR to the latest dev commit.

• I resolved all correct Codex and CodeRabbit findings.

• My PR is ready for review.

Summary by CodeRabbit

• Chores
  • Updated bundled dependency versions for improved compatibility and maintenance.
  • Added an explicit version constraint for an additional dependency.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[github-actions]

⚠️ Deterministic hygiene checks failed.

• unsponsored_surface — This changes an authentication, workflow, release-automation, or dependency surface. MAINTAINERS.md requires security review for these; ask a maintainer to apply maintainer-sponsored once they have reviewed it. Paths: bun.lock, package.json.

[github-actions]

⏳ DRAFT

• hygiene: unsponsored_surface.

What to do

• Fix unsponsored_surface — This changes an authentication, workflow, release-automation, or dependency surface. MAINTAINERS.md requires security review for these; ask a maintainer to apply maintainer-sponsored once they have reviewed it. Paths: bun.lock, package.json.

Review readiness checklist

• ✅ All CI tests are green on my local testing.
• ✅ I pushed my PR to the latest dev commit.
• ✅ I resolved all correct Codex and CodeRabbit findings.
• ✅ My PR is ready for review.

✅ 4/4 boxes ticked.

This pull request is being kept as a draft automatically. Once every issue above is resolved, it will be marked ready for review again.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Team

Run ID: 75d6e155-1484-4603-b076-70381210df8f

📥 Commits

Reviewing files that changed from the base of the PR and between af314b0 and d9148f9.

⛔ Files ignored due to path filters (1)

• bun.lock is excluded by !**/*.lock

📒 Files selected for processing (1)

• package.json

Included review availability: Your plan provides up to 10 included reviews per hour; 9 remain after this review.

---

📝 Walkthrough

Walkthrough

The package overrides update fast-uri to ^3.1.7 and add qs at ^6.16.0. Existing hono and ip-address overrides remain unchanged.

Changes

Dependency override update

Layer / File(s)	Summary
Update dependency overrides package.json:77-80	The fast-uri override changes from ^3.1.5 to ^3.1.7. A qs override at ^6.16.0 is added. The hono and ip-address overrides remain unchanged.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Merge Risk: ⚪ Minimal · up to d9148

This localized dependency update removes reported vulnerabilities without changing application behavior; the supplied audit, typecheck, and hygiene checks pass, and no actionable merge-blocking risk remains.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 inconclusive)

Check name	Status	Explanation	Resolution
Linked Issues check	❓ Inconclusive	The package.json overrides set fast-uri to ^3.1.7 and qs to ^6.16.0, which matches issue #3313 requirements and the specified fixed versions. The reported bun audit result cannot be independently veri…	Include bun.lock in the review or provide auditable dependency-resolution output. Confirm that fast-uri resolves to at least 3.1.6, qs resolves to at least 6.15.4, and bun audit reports zero vulnerabilities after the changes are installed.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Out of Scope Changes check	✅ Passed	The only reported change is the package.json dependency override update. Both overrides directly address the vulnerabilities described in issue #3313. No unrelated changes are shown.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: it updates the fast-uri and qs dependency overrides to address CVEs.

Full details: Linked Issues check

Explanation

The package.json overrides set fast-uri to ^3.1.7 and qs to ^6.16.0, which matches issue #3313 requirements and the specified fixed versions. The reported bun audit result cannot be independently verified because bun.lock is excluded by the !**/*.lock filter.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[lidge-jun]

리뷰 · 우선순위 61 / 80

설명

이 PR은 bun audit가 잡는 전이 의존성 취약점 6개(High 4 + Moderate 2)를 package.json의 overrides로 막는 보안/하이진 작업이다. 닫으려는 이슈는 #3313이다. 지금 dev HEAD(af314b0a7, #3311 버그 드로우다운 클로즈아웃 직후)에는 이미 overrides에 fast-uri: "^3.1.5"와 ip-address, hono, @hono/node-server가 있고, 락파일은 fast-uri@3.1.5와 qs@6.15.3을 가리킨다. 이 PR은 fast-uri만 ^3.1.7로 올리고, 없던 qs: "^6.16.0"을 추가한 뒤 bun.lock 패키지 엔트리도 같이 맞춘다. 코드 경로나 어댑터 로직은 건드리지 않는다.

왜 지금 dev에서 의미가 있냐면, 취약점 경로는 @modelcontextprotocol/sdk → ajv → fast-uri, 그리고 같은 SDK → express → body-parser → qs다. 제품이 MCP SDK를 쓰는 한 audit 노이즈와 SSRF/호스트 혼동·DoS 계열 advisory가 계속 남는다. 이슈 본문은 당시 락이 fast-uri@3.1.4 / qs@6.14.2라고 적었지만, 현재 HEAD는 이미 3.1.5 / 6.15.3이다. 그래도 advisory 구간이 fast-uri >=3.1.3 <3.1.6, qs >=6.14.2 <=6.15.3이므로, 지금 락도 아직 패치 밖이다. 그래서 3.1.7과 6.16.0으로 올리는 방향은 맞다.

변경 폭은 package.json 3줄·bun.lock 몇 줄뿐이고, 기존 override 스타일(캐럿 ^)을 그대로 따른다. 작성자 검증은 bun audit 0건, typecheck 통과, tests/repo-hygiene.test.ts 12 pass라고 적혀 있다. 다만 GitHub 쪽은 intake: hygiene-blocked이고, 게이트가 unsponsored_surface로 draft를 붙였다. MAINTAINERS.md 기준으로 package.json/bun.lock 의존성 표면은 메인테이너 maintainer-sponsored가 있어야 CI 게이트가 풀린다. 체크리스트는 0/4, mergeStateStatus=BLOCKED, draft=true다. types.ts/config.ts 대분할과 무관하고, 중복 PR 신호도 없다.

라인 package.json overrides.fast-uri - ^3.1.5 → ^3.1.7은 맞다. 다만 캐럿이라 이후 3.x 마이너가 자동으로 뜰 수 있다. 지금 레포가 ip-address/fast-uri에 이미 같은 패턴을 쓰므로 일관되긴 하다. 보안 픽스를 “지금 검증한 버전”에 고정하고 싶으면 "3.1.7"처럼 핀을 쓸지 한 번만 정하면 된다.

라인 package.json overrides.qs - 신규 qs: "^6.16.0" 추가. 락은 6.15.3 → 6.16.0으로 바뀌었다. express/body-parser 쿼리 파서가 이 버전을 쓰므로, 공개 HTTP 표면이 있다면 array-limit·isBuffer DoS 픽스가 바로 의미가 있다. 반대로 MCP SDK 안쪽 전용 경로만이면 노출면은 좁다. 어느 쪽인지 한 줄만 확인하면 스폰서 판단이 쉬워진다.

경로 bun.lock packages.fast-uri / packages.qs - 오버라이드와 락 엔트리가 같이 올라간 점은 좋다. 오버라이드만 올리고 락을 안 맞추면 CI/로컬이 어긋난다. 다만 ajv 쪽 dependency 선언은 여전히 fast-uri: "^3.0.1"처럼 느슨해 보일 수 있고, 실제 해석은 overrides가 덮는다. 리뷰어는 락의 fast-uri@3.1.7 / qs@6.16.0 줄만 보면 된다.

경로 intake: hygiene-blocked / unsponsored_surface - 작성자가 고칠 코드 버그가 아니라 정책 게이트다. 의존성 표면이라 메인테이너가 advisory 범위와 락 해석을 본 뒤 maintainer-sponsored를 달아야 draft가 풀린다. 체크리스트 4칸도 아직 비어 있다.

경로 #3313 본문의 구버전 숫자 - 이슈는 3.1.4/6.14.2를 말하지만 HEAD는 이미 3.1.5/6.15.3이다. PR 방향은 맞고, 이슈 재현 문장만 살짝 낡았다. 머지 코멘트에 “HEAD 기준 3.1.5→3.1.7, 6.15.3→6.16.0” 한 줄이면 충분하다.

메인테이너의 판단이 필요한 지점

• maintainer-sponsored를 달고 이 상태로 머지할지, 아니면 캐럿 대신 fast-uri/qs를 exact pin으로 바꿀지
• qs 오버라이드가 공개 HTTP 쿼리 파서까지 덮는지, MCP SDK 내부만인지(스폰서 메모에 한 줄)
• #3313을 이 PR로 닫을 때 이슈 본문의 구버전 락 숫자를 정정 코멘트로 남길지

너의 추천
내용 자체는 머지해도 된다. 메인테이너가 bun audit/bun.lock의 fast-uri@3.1.7·qs@6.16.0만 눈으로 확인한 뒤 maintainer-sponsored를 달고, 작성자(또는 메인테이너)가 체크리스트를 채운 다음 squash 머지한다. 코드 수정 요구는 없고, types/config 분할 때문에 닫을 이유도 없다. 캐럿 유지는 기존 override 관례와 맞춰 두는 쪽을 추천한다.

이 댓글은 grok-bot이 작성했습니다

[agentHits]

Thanks for the thorough review @lidge-jun!

To clarify the points mentioned:

1. Review readiness checklist: All 4 checklist items have been ticked in the description. Local bun audit, bun run typecheck, and hygiene tests are green against current dev HEAD (af314b0a7).
2. Exposure context for qs: In this repository, qs is pulled strictly transitively through @modelcontextprotocol/sdk (@modelcontextprotocol/sdk → express → body-parser → qs). While OpenCodex itself does not use Express directly on public routes, keeping qs at ^6.16.0 ensures that any MCP HTTP transport/body-parsing paths are shielded from the array-limit and isBuffer DoS vectors, and clears the bun audit report completely.
3. Lockfile baseline note: Confirming that on dev HEAD, the lockfile resolved to fast-uri@3.1.5 and qs@6.15.3. Since the advisories target >=3.1.3 <3.1.6 and >=6.14.2 <=6.15.3 respectively, moving to 3.1.7 and 6.16.0 cleanly resolves all 6 reported CVEs.

Ready for maintainer-sponsored sponsorship and merge whenever convenient!

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.