fix: resolve dependabot alert#861
Merged
Merged
Conversation
Shubhangi-Microsoft
requested review from
Avijit-Microsoft,
Prajwal-Microsoft,
Roopan-Microsoft,
Vinay-Microsoft,
aniaroramsft,
malrose07,
nchandhi and
toherman-msft
as code owners
- qs: 6.15.1 -> 6.15.2 (fixes GHSA-q8mj-m7cp-5q26 - remotely triggerable DoS via null/undefined entries in comma-format arrays)
Shubhangi-Microsoft
force-pushed
the
psl-dependabot-fix
branch
from
2e67225 to
d741d13
Compare
Shubhangi-Microsoft
had a problem deploying
to
production
GitHub Actions
Failure
Shubhangi-Microsoft
force-pushed
the
psl-dependabot-fix
branch
from
d741d13 to
3765b22
Compare
Shubhangi-Microsoft
had a problem deploying
to
production
GitHub Actions
Failure
… qs to 6.15.2 - vite: 7.3.2 -> 8.0.16 (fixes GHSA-gv7w-rqvm-qjhr - esbuild missing binary integrity verification) - qs: 6.15.1 -> 6.15.2 (fixes GHSA-q8mj-m7cp-5q26 - DoS via null/undefined in comma-format arrays) - Also fixes: @babel/core arbitrary file read, brace-expansion DoS
Shubhangi-Microsoft
force-pushed
the
psl-dependabot-fix
branch
from
3765b22 to
b068a69
Compare
Shubhangi-Microsoft
temporarily deployed
to
production
GitHub Actions
Inactive
Shubhangi-Microsoft
changed the title
Avijit-Microsoft
approved these changes
Jun 17, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This pull request updates dependencies in both the frontend and backend parts of the project to ensure compatibility and security. The most important changes are:
Dependency updates:
vitedependency insrc/App/package.jsonfrom version^7.3.2to^8.0.16to use the latest version of the build tool.qspackage insrc/App/server/package-lock.jsonfrom version6.15.1to6.15.2for improved security and bug fixes.This pull request updates a dependency in the server package. Theqspackage has been upgraded from version 6.15.1 to 6.15.2 to ensure the latest fixes and improvements are included.Dependency update:
qspackage from version 6.15.1 to 6.15.2 inpackage-lock.jsonto incorporate the latest changes and maintain up-to-date dependencies.- qs: 6.15.1 -> 6.15.2 (fixes GHSA-q8mj-m7cp-5q26 - remotely triggerable DoS via null/undefined entries in comma-format arrays)Purpose
Does this introduce a breaking change?
Golden Path Validation
Deployment Validation
What to Check
Verify that the following are valid
Other Information
This pull request includes dependency updates to keep the project secure and up-to-date. The most notable changes are upgrades to the
viteandqspackages.Dependency updates:
viteinsrc/App/package.jsonfrom version^7.3.2to^8.0.16to ensure compatibility with the latest features and bug fixes.qsinsrc/App/server/package-lock.jsonfrom version6.15.1to6.15.2to include the latest security and stability improvements.