[cipherstash-agent]

Summary

Patches body-parser to 2.4.0 in the root pnpm-lock.yaml, the only lockfile that resolved a vulnerable version.

Advisories

• CVE-2026-111181 / GHSA-27r3-jxmh-p828 (High, CVSS 7.5): affects >= 2.0.0, < 2.4.0, fixed in 2.4.0. Dependabot alert: https://github.com/cipherstash/stack/security/dependabot/279

Versions

Lockfile	Before	After
pnpm-lock.yaml	2.3.0	2.4.0

Changes

body-parser is transitive (express@5.2.1 → @modelcontextprotocol/sdk → @anthropic-ai/claude-agent-sdk → @cipherstash/wizard).
An in-range pnpm update -r body-parser also moved rollup 4.64.12 → 4.65.0 and the platform packages with it, so I used the repo's existing convention instead: a security override in pnpm-workspace.yaml, scoped to the vulnerable range ('body-parser@>=2.0.0 <2.4.0': '2.4.0').
The override can be removed once express or the SDKs above resolve body-parser 2.4.0 on their own.

One extra package moved: qs 6.16.0 → 6.16.1, because body-parser@2.4.0 requires it. This is the same version PR #1434 targets.

No changeset: this only changes the lockfile and workspace overrides, not a published package's surface.

Verification

• pnpm install --lockfile-only --ignore-scripts with the override, then --frozen-lockfile check, both clean.
• deps.py over the branch: exit 0, no lockfile resolves a vulnerable version.
• Only pnpm-lock.yaml and pnpm-workspace.yaml changed.

---

Generated by Claude Code

Summary by CodeRabbit

• Bug Fixes
  • Updated the version used for request-body parsing in affected installations. This brings the component to a patched release and helps ensure applications receive the latest available fixes. No user-facing features or workflows have changed.

[changeset-bot]

⚠️ No Changeset found

Latest commit: ccdbd9a

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[coderabbitai]

No actionable comments were generated in the recent review.

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI; Enforced overrides: Organization
• Review profile: CHILL
• Plan: Advanced
• Run ID: 1b66c593-18ba-4e4e-93a1-5cd0bf4955a7

Commits

Reviewing files that changed from the base of the PR and between 9ff5185 and ccdbd9a.

Files ignored due to path filters: 1

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

Files selected for processing: 1

• pnpm-workspace.yaml

Included review availability: This review used your included allowance. Your plan provides up to 2 included reviews per hour; 1 remain after this review.

Walkthrough

The pnpm workspace adds an override that resolves body-parser versions from 2.0.0 up to, but not including, 2.4.0 to version 2.4.0.

Changes: Dependency override

Layer / File(s)	Summary
Configure the body-parser override pnpm-workspace.yaml	The workspace maps body-parser versions >=2.0.0 <2.4.0 to 2.4.0.

Priority: Low

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Bug fix

Suggested reviewers: auxesis

Merge Risk: Minimal · up to ccdbd

The override and lockfile consistently select body-parser 2.4.0. No actionable merge-blocking issue remains; the change is ready to merge subject to normal checks.

Pre-merge checks: 5

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely identifies the dependency fix: updating body-parser to version 2.4.0.
Docstring Coverage		No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[cipherstash-agent]

Review attestation at ccdbd9a: /code-review medium plus company-skills:cross-check-review-findings, run by Claude Code.

Critical/blocking issues: none.

• Lockfile and override change are consistent: body-parser 2.3.0 → 2.4.0 (fixes GHSA-27r3-jxmh-p828, range >=2.0.0 <2.4.0), with qs 6.16.1 pulled in as the new dependency.
• 1 minor finding posted inline (the override does not reach npm consumers of @cipherstash/wizard).
• Checked and dropped: the qs duplicate is disclosed in the PR body, and the 7-day install cooldown is satisfied (2.4.0 published 2026-10-22) and does not affect --frozen-lockfile installs.
• No existing human or bot review findings to cross-check against.

---

Generated by Claude Code

[cipherstash-agent]

minor This override applies only to this repo's lockfile; pnpm overrides are not published, so @cipherstash/wizard installs from npm still resolve body-parser through express and @modelcontextprotocol/sdk ranges and can land below 2.4.0. If consumers should be protected, add a direct body-parser floor to the wizard's dependencies; otherwise state in the PR that the remediation covers repo installs only.

---

Generated by Claude Code