chore(deps): bump form-data and jira-client - #16
Conversation
Bumps [form-data](https://github.com/form-data/form-data) to 4.0.6 and updates ancestor dependency [jira-client](https://github.com/jira-node/node-jira-client). These dependencies need to be updated together. Updates `form-data` from 4.0.0 to 4.0.6 - [Changelog](https://github.com/form-data/form-data/blob/master/CHANGELOG.md) - [Commits](form-data/form-data@v4.0.0...v4.0.6) Updates `jira-client` from 6.23.0 to 8.2.2 - [Release notes](https://github.com/jira-node/node-jira-client/releases) - [Commits](jira-node/node-jira-client@v6.23.0...v8.2.2) --- updated-dependencies: - dependency-name: form-data dependency-version: 4.0.6 dependency-type: indirect - dependency-name: jira-client dependency-version: 8.2.2 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
![aikido-pr-checks[bot]](https://avatars.githubusercontent.com/in/898896?s=60&v=4){kind=small}
There was a problem hiding this comment.
CVE-2026-8723 in qs - medium severity
Summary
qs.stringify throws TypeError when called with arrayFormat: 'comma' and encodeValuesOnly: true on an array containing null or undefined. The throw is synchronous and not handled by any of qs's null-related options (skipNulls, strictNullHandling).
Details
In the comma + encodeValuesOnly branch, lib/stringify.js:145 mapped the array through the raw encoder before joining:
obj = utils.maybeMap(obj, encoder);
utils.encode (lib/utils.js:195) reads str.length with no null guard, so a null or undefined element throws TypeError. skipNulls and strictNullHandling are both checked in the per-element loop below this line and never get a chance to run.
Same class of bug as the filter-array path fixed in 0c180a4. The vulnerable shape of the comma + encodeValuesOnly branch was introduced in 4c4b23d ("encode comma values more consistently", PR mergeability#463, 2023-01-19), first released in v6.11.1.
PoC
const qs = require('qs');
qs.stringify({ a: [null, 'b'] }, { arrayFormat: 'comma', encodeValuesOnly: true });
qs.stringify({ a: [undefined, 'b'] }, { arrayFormat: 'comma', encodeValuesOnly: true });
qs.stringify({ a: [null] }, { arrayFormat: 'comma', encodeValuesOnly: true });
// TypeError: Cannot read properties of null (reading 'length')
// at encode (lib/utils.js:195:13)
// at Object.maybeMap (lib/utils.js:322:37)
// at stringify (lib/stringify.js...
<details><summary>Details</summary>
**Remediation** Aikido suggests bumping this package to version 6.15.2 to resolve this issue
<sub>Reply `@AikidoSec ignore: [REASON]` to ignore this issue.</sub>
<sub>[More info](https://app.aikido.dev/repositories/841410/pull_requests/16/latest?groupId=29053)</sub>
</details>
Bumps form-data to 4.0.6 and updates ancestor dependency jira-client. These dependencies need to be updated together.
Updates
form-datafrom 4.0.0 to 4.0.6Changelog
Sourced from form-data's changelog.
... (truncated)
Commits
64190dbv4.0.692ae0eb[Deps] updatehasown,mime-typesf31d21e[Dev Deps] update@ljharb/eslint-config,auto-changelog,tape8dff42c[Fix] escape CR, LF, and"in field names and filenames67b0f65[Dev Deps] updatejs-randomness-predictor68ff7ddv4.0.55822467[Dev Deps] update@ljharb/eslint-config,eslint76d0dee[Fix] set Symbol.toStringTag in the proper place16e0076[Tests] Switch to newer v8 prediction library; enable node 24 testing41996f5v4.0.4Maintainer changes
This version was pushed to npm by ljharb, a new releaser for form-data since your current version.
Install script changes
This version modifies
prepublishscript that runs during installation. Review the package contents before updating.Updates
jira-clientfrom 6.23.0 to 8.2.2Release notes
Sourced from jira-client's releases.
Commits
f9102bbRelease v8.2.270f48deUpdating deprecated endpoint and surfacing inactive user option (#355)21d973dRelease v8.2.102e480dFix error throw parameter on doRequest (#353)22bd071Merge pull request #352 from jira-node/dependabot/npm_and_yarn/nanoid-3.3.1f60fef3Bump nanoid from 3.1.25 to 3.3.17145077Release v8.2.0bc43d06Merge pull request #349 from jira-node/update-worklogfa68d30Merge pull request #347 from jira-node/dependabot/npm_and_yarn/json-schema-an...6d98ffeAdd updateWorklog methodMaintainer changes
This version was pushed to npm by seth10001, a new releaser for jira-client since your current version.
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.