[claude]

Requested by Samuel Attard · Slack thread

Lockfile-only security refresh: body-parser 1.20.6 → 1.20.9 (GHSA-27r3-jxmh-p828, in range under express 4.22.1; it brings qs 6.15.3 → 6.16.1 with it) and js-yaml 4.1.1 → 4.3.2 (GHSA-52cp-r559-cp3m, GHSA-5p4m-2wfm-xmqj, GHSA-2883-xcg3-v3hh), which is in range for @probot/octokit-plugin-config's ^4.1.0. The js-yaml 4.2/4.3 changelog has no API changes, only stricter parsing and safety limits (1_000 no longer parses as a number, max nesting depth 100, caps on YAML merge keys). Probot's repo-config loader is the only user of js-yaml 4, and trop never calls context.config(), so none of this affects trop. Its own config.yml is parsed with yaml. The 7-day npmMinimalAgeGate was bypassed for this install only via YARN_NPM_MINIMAL_AGE_GATE=0 (body-parser 1.20.9 is 2 days old); .yarnrc.yml is unchanged. Verified: yarn npm audit --recursive --environment production --severity high is clean, and yarn build, yarn lint and yarn test (387 tests) all pass.

---

Generated by Claude Code

[socket-security]

All alerts resolved. Learn more about Socket for GitHub.

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

Ignoring alerts on:

• js-yaml@4.3.2
• qs@6.16.1
• body-parser@1.20.9

View full report

[claude]

I reviewed this lockfile-only bump and didn't find any bugs. A human from the code owners should still look, mainly because body-parser 1.20.9 was installed with the 7-day minimum-age gate turned off, and I couldn't check the new versions or checksums against the npm registry from here.

What was reviewed:

• The body-parser, qs and js-yaml entries in yarn.lock. Each still matches its existing range (~1.20.3, ~6.16.0, ^4.1.0), and the old qs ~6.15.1 entry is gone, not left behind.
• Express keeps its own qs ~6.14.0 entry, and js-yaml ^3.14.1 is untouched, so no other consumer's resolution moves.
• I could not confirm from the checkout that body-parser 1.20.9 really declares qs ~6.16.0, or that the new checksums are right.

Extended reasoning...

The change only touches yarn.lock: body-parser 1.20.6 to 1.20.9, qs 6.15.3 to 6.16.1 (with its range changed to ~6.16.0), and js-yaml 4.1.1 to 4.3.2, each with a new checksum. No source or package.json files change, and it touches no auth, crypto or injection-sensitive code. Supply chain is the risk: the description says the minimum-age gate was bypassed for a 2-day-old release, and registry access wasn't available to check versions, dependency ranges or checksums. A catch-all rule in .github/CODEOWNERS assigns every path to a code-owner team, which on its own rules out auto-approval.

[MarshallOfSound]

@SocketSecurity ignore-all