[DysektAI]

Advisory chain

Pins the express → body-parser transitive to exactly 2.4.0 (was 2.3.0), fixing GHSA-27r3-jxmh-p828 (high): DoS via trailing bytes after a compressed request body. Reachable here: the public /data and /issue forms use express.json/express.urlencoded with default inflate: true.

Vetting (early adoption — published 2026-10-22, inside the 7-day cooldown)

• Published by GitHub Actions trusted publishing with SLSA provenance from expressjs/body-parser.
• Every file in the registry tarball (except package.json) matches tag v2.4.0 (b4744d7) byte-for-byte.
• No lifecycle scripts; lib/ diff vs 2.3.0 only reorders charset validation, destroys/unpipes the decompression stream after reading, and adds optional zstd — no new network, exec, or obfuscated code.
• Transitive bumps from its ranges: qs 6.16.1 (2026-10-14), content-type 2.1.0 (2026-08-13), iconv-lite 0.7.3 (2026-07-03) — all past cooldown.

Verification

• npm ci --ignore-scripts && npm test: 11/11 pass.
• npm audit --omit=dev no longer reports body-parser. Remaining standalone advisories are fixed in sibling PRs and combined in fix(web): share report limits and surface submission errors #38, whose audit:prod CI gate is the regression check.

Integration

Merged into #38 alongside #39/#40 so #38's merge commit lands every advisory fix together.

https://claude.ai/code/session_01NrbT7UzDQzESHKsvnJAgps

---

Summary by cubic

Pins the express → body-parser transitive dependency to exactly 2.4.0 via package.json overrides, patching GHSA-27r3-jxmh-p828 (high), a DoS via trailing bytes after a compressed request body. The vulnerability was reachable from the public /data and /issue forms, which parse request bodies with default inflate: true.

• Updates package-lock.json with matching transitive bumps for content-type, iconv-lite, and qs.
• npm audit --omit=dev no longer reports the body-parser advisory.

^{Written for commit 57399ab. Summary will update on new commits.}

[coderabbitai]

Warning

Review limit reached

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

Next included review available in 59 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available. Your 61 included PR review attempts over the past 7 days set your current allowance at 1 review per hour.

Learn how review limits work.

Review configuration:

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: ASSERTIVE
• Plan: Essentials
• Run ID: 3734310c-0db3-4845-87f9-e1e09e884f2b

Commits

Reviewing files that changed from the base of the PR and between 23ca4c9 and 57399ab.

Files ignored due to path filters: 1

• package-lock.json is excluded by !**/package-lock.json

Files selected for processing: 1

• package.json

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}