From b976ef75872478b1f60be97df563333d2ee6888d Mon Sep 17 00:00:00 2001 From: Matthias Osswald Date: Wed, 9 Sep 2026 14:49:30 +0200 Subject: [PATCH] [INTERNAL] Fix audit allowlist paths for qs advisories MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Follow-up to https://github.com/UI5/cli/pull/1582 — align the qs allowlist entries with the paths npm 11 actually reports. --- audit-ci.jsonc | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/audit-ci.jsonc b/audit-ci.jsonc index 6bb31fcf671..d07dd7024df 100644 --- a/audit-ci.jsonc +++ b/audit-ci.jsonc @@ -27,9 +27,9 @@ // Confirmed upstream in https://github.com/expressjs/express/pull/7440. // We cannot bump qs ourselves (transitive via express); the fix is pending an Express 4.x // release (expressjs/express#7439, #7440; expressjs/body-parser#761 merged but unreleased). - "GHSA-4mjr-xmp4-gh2g|qs>", - "GHSA-4mjr-xmp4-gh2g|@ui5/cli>@ui5/server>express>body-parser>qs", - "GHSA-x5fp-wj9c-mxmx|qs>", - "GHSA-x5fp-wj9c-mxmx|@ui5/cli>@ui5/server>express>body-parser>qs" + "GHSA-4mjr-xmp4-gh2g|@ui5/cli>@ui5/server>express>qs", + "GHSA-4mjr-xmp4-gh2g|body-parser>qs", + "GHSA-x5fp-wj9c-mxmx|@ui5/cli>@ui5/server>express>qs", + "GHSA-x5fp-wj9c-mxmx|body-parser>qs" ] }