kelp404 / capybara-router / #932

91%

push

fix: upgrade query-string to 9.5.1

query-string 7 pulls in decode-uri-component <=0.4.2, which is
vulnerable to a denial of service through exponential decoding of
malformed percent-encoded input (GHSA-vcc3-ghjq-m6fr). A crafted link
such as `?a=` followed by `%C0%A0` repeated 500 times took 16 seconds
to parse; it now takes 1 ms.

The advisory is only fixed in query-string 9, which is ESM only, hence
the `.default` on the requires and the jest transform pattern. This is
a breaking change for anyone requiring the package from CommonJS on
node v18 or older.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

125 of 161 branches covered (77.64%)

Branch coverage included in aggregate %.

2 of 2 new or added lines in 2 files covered. (100.0%)

341 of 365 relevant lines covered (93.42%)

26.88 hits per line