Skip to content

Conversation

@azizbecha
Copy link
Contributor

Summary

This PR addresses a reported security issue related to the qs dependency used by cli-server-api.

The CLI currently pulls in [email protected] via [email protected]. Versions of qs6.14.0 are affected by a known DoS vulnerability related to arrayLimit handling in bracket notation.

Following the maintainer’s guidance in #2750, this change bumps body-parser to a version that depends on a patched qs release, resolving the vulnerability without introducing functional changes to the CLI itself.

Closes #2750.

Test Plan

No runtime behavior changes are expected, as this is a dependency-only update.

Checklist

  • Documentation is up to date.
  • Follows commit message convention described in CONTRIBUTING.md.
  • For functional changes, my test plan has linked these CLI changes into a local react-native checkout (instructions).

@azizbecha azizbecha requested a review from thymikee as a code owner January 7, 2026 20:43
@github-actions github-actions bot added the bugfix label Jan 7, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Dependency 'qs' security issue

1 participant