From be032e39d7e9c6844f7cc1765fb7c924e0b2abbd Mon Sep 17 00:00:00 2001 From: "Eli Kent [SSW]" <69125238+kulesy@users.noreply.github.com> Date: Tue, 18 Aug 2026 14:05:52 +1000 Subject: [PATCH 1/3] fix(deps): override qs to ^6.15.2 to clear three advisories (#7442) Closes #7441 **TL;DR** One line in `pnpm-workspace.yaml` collapses four vulnerable `qs` copies into one patched version, and unblocks three Dependabot PRs as a side effect. **Pain:** The lockfile carried four separate `qs` copies (6.5.3, 6.5.5, 6.11.0, 6.14.0), every one below the 6.14.1 patch line for GHSA-6rw7-vpxm-498p, with two further advisories applying up to 6.15.2. `main` looked green only because `dependency-review` reports what a diff introduces rather than what is already present, so the problem stayed invisible until Dependabot regenerated some lockfiles and pulled qs 6.5.3 up to 6.5.5. Three unrelated PRs (#7425, #7421, #7321) then failed the same check for a vulnerability that had been on `main` all along. The tempting fix, pinning qs back to 6.5.3, would turn the check green while fixing nothing, because 6.5.3 is equally affected. **Solution:** Added `qs: ^6.15.2` to the existing `overrides:` block, which collapses all four copies to a single 6.15.3, past the patch line for all three open advisories. The affected chain is test-only (`vitest@0.32.4` to `jsdom@15.2.1` to `request-promise-native` to `request` to `qs`), so nothing user-facing changes. Retiring `vitest@0.32.4` and the deprecated `request` chain is the real fix and is tracked separately on #7441. Co-authored-by: Claude Opus 5 --- pnpm-lock.yaml | 54 ++++++++++++++++++++++++++------------------- pnpm-workspace.yaml | 1 + 2 files changed, 32 insertions(+), 23 deletions(-) diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 4edd8bbd7b..f746bf73a7 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -656,6 +656,7 @@ catalogs: version: 3.25.76 overrides: + qs: ^6.15.2 '@clerk/clerk-js>react': 19.2.3 '@clerk/clerk-js>react-dom': 19.2.3 '@clerk/backend>react': 19.2.3 @@ -14043,16 +14044,8 @@ packages: peerDependencies: react: ^16.8.0 || ^17.0.0 || ^18.0.0 - qs@6.11.0: - resolution: {integrity: sha512-MvjoMCJwEarSbUYk5O+nmoSzSutSsTwF85zcHPQ9OrlFoZOYIjaqBAJIqIXjptyD5vThxGq52Xu/MaJzRkIk4Q==} - engines: {node: '>=0.6'} - - qs@6.14.0: - resolution: {integrity: sha512-YWWTjgABSKcvs/nWBi9PycY/JiPJqOD4JA6o9Sej2AtvSGarXxKC3OQSk4pAarbdQlKAh5D4FCQkJNkW+GAn3w==} - engines: {node: '>=0.6'} - - qs@6.5.3: - resolution: {integrity: sha512-qxXIEh4pCGfHICj1mAJQ2/2XVZkjCDTcEgfoSQxc/fYivUZxTkk7L3bDBJSoNrEzXI17oUO5Dp07ktqE5KzczA==} + qs@6.15.3: + resolution: {integrity: sha512-O9gl3zCl5h5blw1KGUzQKhA5oUXSl8rwUIM5o0S3nCXMliSvy5Dzx7/DJcI+SwgICv+IneSZwhBh1oSyEHA71A==} engines: {node: '>=0.6'} quansync@0.2.11: @@ -14704,6 +14697,10 @@ packages: resolution: {integrity: sha512-FCLHtRD/gnpCiCHEiJLOwdmFP+wzCmDEkc9y7NsYxeF4u7Btsn1ZuwgwJGxImImHicJArLP4R0yX4c2KCrMrTA==} engines: {node: '>= 0.4'} + side-channel-list@1.0.1: + resolution: {integrity: sha512-mjn/0bi/oUURjc5Xl7IaWi/OJJJumuoJFQJfDDyO46+hBWsfaVM65TBHq2eoZBhzl9EchxOijpkbRC8SVBQU0w==} + engines: {node: '>= 0.4'} + side-channel-map@1.0.1: resolution: {integrity: sha512-VCjCNfgMsby3tTdo02nbjtM/ewra6jPHmpThenkTYh8pG9ucZ/1P8So4u4FGBek/BjpOVsDCMoLA/iuBKIFXRA==} engines: {node: '>= 0.4'} @@ -14716,6 +14713,10 @@ packages: resolution: {integrity: sha512-ZX99e6tRweoUXqR+VBrslhda51Nh5MTQwou5tnUDgbtyM0dBgmhEDtWGP/xbKn6hqfPRHujUNwz5fy/wbbhnpw==} engines: {node: '>= 0.4'} + side-channel@1.1.1: + resolution: {integrity: sha512-6x6dK6zJdpTzF4sQeNYxwtvBzf6Eg4GtlesS94HOvTudUeyK2WXAaIfmDgsyslYrRBeFIlsi54AYsFGUuhmvrQ==} + engines: {node: '>= 0.4'} + siginfo@2.0.0: resolution: {integrity: sha512-ybx0WO1/8bSBLEWXZvEd7gMW3Sn3JFlW3TvX1nREbDLRNQNaeNN8WK0meBwPdAaOI7TtRRRJn/Es1zhrrCHu7g==} @@ -19183,7 +19184,7 @@ snapshots: core-js: 3.26.1 dequal: 2.0.3 qrcode.react: 3.1.0(react@19.2.3) - qs: 6.11.0 + qs: 6.15.3 react: 19.2.3 regenerator-runtime: 0.13.11 transitivePeerDependencies: @@ -25609,7 +25610,7 @@ snapshots: http-errors: 2.0.1 iconv-lite: 0.4.24 on-finished: 2.4.1 - qs: 6.14.0 + qs: 6.15.3 raw-body: 2.5.3 type-is: 1.6.18 unpipe: 1.0.0 @@ -27386,7 +27387,7 @@ snapshots: parseurl: 1.3.3 path-to-regexp: 0.1.12 proxy-addr: 2.0.7 - qs: 6.14.0 + qs: 6.15.3 range-parser: 1.2.1 safe-buffer: 5.2.1 send: 0.19.2 @@ -31958,16 +31959,10 @@ snapshots: dependencies: react: 19.2.3 - qs@6.11.0: - dependencies: - side-channel: 1.1.0 - - qs@6.14.0: + qs@6.15.3: dependencies: - side-channel: 1.1.0 - - qs@6.5.3: - optional: true + es-define-property: 1.0.1 + side-channel: 1.1.1 quansync@0.2.11: {} @@ -32547,7 +32542,7 @@ snapshots: mime-types: 2.1.35 oauth-sign: 0.9.0 performance-now: 2.1.0 - qs: 6.5.3 + qs: 6.15.3 safe-buffer: 5.2.1 tough-cookie: 2.5.0 tunnel-agent: 0.6.0 @@ -32980,6 +32975,11 @@ snapshots: es-errors: 1.3.0 object-inspect: 1.13.4 + side-channel-list@1.0.1: + dependencies: + es-errors: 1.3.0 + object-inspect: 1.13.4 + side-channel-map@1.0.1: dependencies: call-bound: 1.0.4 @@ -33003,6 +33003,14 @@ snapshots: side-channel-map: 1.0.1 side-channel-weakmap: 1.0.2 + side-channel@1.1.1: + dependencies: + es-errors: 1.3.0 + object-inspect: 1.13.4 + side-channel-list: 1.0.1 + side-channel-map: 1.0.1 + side-channel-weakmap: 1.0.2 + siginfo@2.0.0: {} signal-exit@3.0.7: {} diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index 97f05f00ae..538e735876 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -17,6 +17,7 @@ minimumReleaseAgeExclude: - create-tina-app - next-tinacms-* overrides: + qs: ^6.15.2 "@clerk/clerk-js>react": 19.2.3 "@clerk/clerk-js>react-dom": 19.2.3 "@clerk/backend>react": 19.2.3 From e552d481a09e5d78294927d130d2c7908da413a8 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 18 Aug 2026 15:41:01 +1000 Subject: [PATCH 2/3] chore(deps): bump next-auth from 4.24.13 to 4.24.15 (#7321) Bumps [next-auth](https://github.com/nextauthjs/next-auth) from 4.24.13 to 4.24.15.
Release notes

Sourced from next-auth's releases.

next-auth@4.24.15

Security patch release for the 4.x line.

  • getToken() now returns null instead of throwing when the Authorization header contains a malformed Bearer value.
  • OAuth state, nonce, and PKCE check cookies are now bound to the provider that created them and are rejected when a different provider handles the callback. Sign-ins in flight across the upgrade fail once and succeed on retry.
  • Email addresses are Unicode-normalized (NFKC) before validation in the email sign-in flow, closing a homoglyph @ bypass.
  • An explicitly configured NEXTAUTH_URL now takes precedence over the auto-detected forwarded host in trusted-host mode.
  • Restores CommonJS compatibility by pinning uuid to ^11.1.1; the 14.x line is ESM-only and broke require() on Node versions below 20.19.

next-auth@4.24.14

Bugfixes

  • providers: add issuer to GitHub provider for RFC 9207 compliance (#13412)

GitHub now returns an iss parameter in OAuth callbacks. openid-client validates it unconditionally, which was breaking authentication for apps that didn't configure an issuer. This sets the default GitHub provider issuer to https://github.com/login/oauth.

Commits
Maintainer changes

This version was pushed to npm by better-gustavo, a new releaser for next-auth since your current version.


Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Eli Kent [SSW] <69125238+kulesy@users.noreply.github.com> Co-authored-by: kulesy --- .../next/tina-self-hosted-demo/package.json | 2 +- packages/tinacms-authjs/package.json | 2 +- pnpm-lock.yaml | 37 +++++++++---------- 3 files changed, 20 insertions(+), 21 deletions(-) diff --git a/examples/next/tina-self-hosted-demo/package.json b/examples/next/tina-self-hosted-demo/package.json index f854b1cc71..102aeb9ea7 100644 --- a/examples/next/tina-self-hosted-demo/package.json +++ b/examples/next/tina-self-hosted-demo/package.json @@ -20,7 +20,7 @@ "date-fns": "^2.30.0", "mongodb-level": "^0.0.3", "next": "14.2.35", - "next-auth": "^4.24.11", + "next-auth": "^4.24.15", "react": "^18.3.1", "react-dom": "^18.3.1", "react-icons": "^4.12.0", diff --git a/packages/tinacms-authjs/package.json b/packages/tinacms-authjs/package.json index 6ab6144322..f6be74fb86 100644 --- a/packages/tinacms-authjs/package.json +++ b/packages/tinacms-authjs/package.json @@ -30,7 +30,7 @@ "@tinacms/datalayer": "workspace:*", "@tinacms/scripts": "workspace:*", "next": "^15.5.16", - "next-auth": "^4.24.13", + "next-auth": "^4.24.15", "react": "^19.2.3", "tinacms": "workspace:*", "typescript": "^5.7.3" diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index f746bf73a7..0d65b39fc4 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -1037,8 +1037,8 @@ importers: specifier: 14.2.35 version: 14.2.35(@babel/core@7.29.7)(@opentelemetry/api@1.9.0)(@playwright/test@1.61.1)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)(sass@1.97.3) next-auth: - specifier: ^4.24.11 - version: 4.24.13(next@14.2.35(@babel/core@7.29.7)(@opentelemetry/api@1.9.0)(@playwright/test@1.61.1)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)(sass@1.97.3))(react-dom@18.3.1(react@18.3.1))(react@18.3.1) + specifier: ^4.24.15 + version: 4.24.15(next@14.2.35(@babel/core@7.29.7)(@opentelemetry/api@1.9.0)(@playwright/test@1.61.1)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)(sass@1.97.3))(react-dom@18.3.1(react@18.3.1))(react@18.3.1) react: specifier: ^18.3.1 version: 18.3.1 @@ -2573,8 +2573,8 @@ importers: specifier: ^15.5.16 version: 15.5.19(@opentelemetry/api@1.9.0)(@playwright/test@1.61.1)(babel-plugin-react-compiler@1.0.0)(react-dom@18.3.1(react@19.2.3))(react@19.2.3)(sass@1.97.3) next-auth: - specifier: ^4.24.13 - version: 4.24.13(next@15.5.19(@opentelemetry/api@1.9.0)(@playwright/test@1.61.1)(babel-plugin-react-compiler@1.0.0)(react-dom@18.3.1(react@19.2.3))(react@19.2.3)(sass@1.97.3))(react-dom@18.3.1(react@19.2.3))(react@19.2.3) + specifier: ^4.24.15 + version: 4.24.15(next@15.5.19(@opentelemetry/api@1.9.0)(@playwright/test@1.61.1)(babel-plugin-react-compiler@1.0.0)(react-dom@18.3.1(react@19.2.3))(react@19.2.3)(sass@1.97.3))(react-dom@18.3.1(react@19.2.3))(react@19.2.3) react: specifier: ^19.2.3 version: 19.2.3 @@ -13294,8 +13294,8 @@ packages: resolution: {integrity: sha512-Z4SmBUweYa09+o6pG+eASabEpP6QkQ70yHj351pQoEXIs8uHbaU2DWVmzBANKgflPa47A50PtB2+NgRpQvr7vA==} engines: {node: '>= 10'} - next-auth@4.24.13: - resolution: {integrity: sha512-sgObCfcfL7BzIK76SS5TnQtc3yo2Oifp/yIpfv6fMfeBOiBJkDWF3A2y9+yqnmJ4JKc2C+nMjSjmgDeTwgN1rQ==} + next-auth@4.24.15: + resolution: {integrity: sha512-NnjYtjrSOAx/TIVFGTX4IfI/9yHnNpi4B7FuLUwuV20v2Zxgr2OGP/YN0ynJuI7y8QOnTBPitfOdEXZrVvhIuA==} peerDependencies: '@auth/core': 0.34.3 next: ^12.2.5 || ^13 || ^14 || ^15 || ^16 @@ -15816,13 +15816,12 @@ packages: resolution: {integrity: sha512-0/A9rDy9P7cJ+8w1c9WD9V//9Wj15Ce2MPz8Ri6032usz+NfePxx5AcN3bN+r6ZL6jEo066/yNYB3tn4pQEx+A==} hasBin: true - uuid@3.4.0: - resolution: {integrity: sha512-HjSDRw6gZE5JMggctHBcjVak08+KEVhSIiDzFnT9S9aegmp85S/bReBVTb4QTFaRNptJ9kuYaNhnbNEOkbKb/A==} - deprecated: uuid@10 and below is no longer supported. For ESM codebases, update to uuid@latest. For CommonJS codebases, use uuid@11 (but be aware this version will likely be deprecated in 2028). + uuid@11.1.1: + resolution: {integrity: sha512-vIYxrBCC/N/K+Js3qSN88go7kIfNPssr/hHCesKCQNAjmgvYS2oqr69kIufEG+O4+PfezOH4EbIeHCfFov8ZgQ==} hasBin: true - uuid@8.3.2: - resolution: {integrity: sha512-+NYs2QeMWy+GWFOEm9xnn6HCDp0l7QBD7ml8zLUmJ+93Q5NF0NocErnwkTkXVFNiX3/fpC6afS8Dhb/gz7R7eg==} + uuid@3.4.0: + resolution: {integrity: sha512-HjSDRw6gZE5JMggctHBcjVak08+KEVhSIiDzFnT9S9aegmp85S/bReBVTb4QTFaRNptJ9kuYaNhnbNEOkbKb/A==} deprecated: uuid@10 and below is no longer supported. For ESM codebases, update to uuid@latest. For CommonJS codebases, use uuid@11 (but be aware this version will likely be deprecated in 2028). hasBin: true @@ -31071,9 +31070,9 @@ snapshots: neotraverse@0.6.18: {} - next-auth@4.24.13(next@14.2.35(@babel/core@7.29.7)(@opentelemetry/api@1.9.0)(@playwright/test@1.61.1)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)(sass@1.97.3))(react-dom@18.3.1(react@18.3.1))(react@18.3.1): + next-auth@4.24.15(next@14.2.35(@babel/core@7.29.7)(@opentelemetry/api@1.9.0)(@playwright/test@1.61.1)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)(sass@1.97.3))(react-dom@18.3.1(react@18.3.1))(react@18.3.1): dependencies: - '@babel/runtime': 7.28.6 + '@babel/runtime': 7.29.7 '@panva/hkdf': 1.2.1 cookie: 0.7.2 jose: 4.15.9 @@ -31084,11 +31083,11 @@ snapshots: preact-render-to-string: 5.2.6(preact@10.28.3) react: 18.3.1 react-dom: 18.3.1(react@18.3.1) - uuid: 8.3.2 + uuid: 11.1.1 - next-auth@4.24.13(next@15.5.19(@opentelemetry/api@1.9.0)(@playwright/test@1.61.1)(babel-plugin-react-compiler@1.0.0)(react-dom@18.3.1(react@19.2.3))(react@19.2.3)(sass@1.97.3))(react-dom@18.3.1(react@19.2.3))(react@19.2.3): + next-auth@4.24.15(next@15.5.19(@opentelemetry/api@1.9.0)(@playwright/test@1.61.1)(babel-plugin-react-compiler@1.0.0)(react-dom@18.3.1(react@19.2.3))(react@19.2.3)(sass@1.97.3))(react-dom@18.3.1(react@19.2.3))(react@19.2.3): dependencies: - '@babel/runtime': 7.28.6 + '@babel/runtime': 7.29.7 '@panva/hkdf': 1.2.1 cookie: 0.7.2 jose: 4.15.9 @@ -31099,7 +31098,7 @@ snapshots: preact-render-to-string: 5.2.6(preact@10.28.3) react: 19.2.3 react-dom: 18.3.1(react@19.2.3) - uuid: 8.3.2 + uuid: 11.1.1 next@14.2.35(@babel/core@7.29.7)(@opentelemetry/api@1.9.0)(@playwright/test@1.61.1)(babel-plugin-macros@3.1.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(sass@1.97.3): dependencies: @@ -34304,11 +34303,11 @@ snapshots: uuid@11.1.0: {} + uuid@11.1.1: {} + uuid@3.4.0: optional: true - uuid@8.3.2: {} - uvu@0.5.6: dependencies: dequal: 2.0.3 From 36a126158ec46b8924d4bb4f7cea4d5bda7dcff1 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 18 Aug 2026 05:51:37 +0000 Subject: [PATCH 3/3] chore(deps): bump js-yaml from 3.14.2 to 3.15.1 (#7425) Bumps [js-yaml](https://github.com/nodeca/js-yaml) from 3.14.2 to 3.15.1.
Changelog

Sourced from js-yaml's changelog.

3.15.1 - 2026-07-31

Security

  • [backport] Remove quadratic complexity from !!omap duplicate key detection.

3.15.0 - 2026-06-27

Added

  • Added maxTotalMergeKeys (10000) loader option to limit the total number of keys processed by YAML merge (<<) across one safeLoad() / safeLoadAll() call.
Commits

--------- Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Eli Kent [SSW] <69125238+kulesy@users.noreply.github.com> Co-authored-by: kulesy Co-authored-by: Claude Opus 5 --- packages/@tinacms/graphql/package.json | 2 +- pnpm-lock.yaml | 22 +++++++++++----------- 2 files changed, 12 insertions(+), 12 deletions(-) diff --git a/packages/@tinacms/graphql/package.json b/packages/@tinacms/graphql/package.json index b14387c959..8432da17b0 100644 --- a/packages/@tinacms/graphql/package.json +++ b/packages/@tinacms/graphql/package.json @@ -45,7 +45,7 @@ "gray-matter": "catalog:", "isomorphic-git": "catalog:", "js-sha1": "catalog:", - "js-yaml": "^3.14.1", + "js-yaml": "^3.15.1", "jsonpath-plus": "catalog:", "many-level": "catalog:", "micromatch": "catalog:", diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 0d65b39fc4..81dec9e2ca 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -1638,8 +1638,8 @@ importers: specifier: 'catalog:' version: 0.6.0 js-yaml: - specifier: ^3.14.1 - version: 3.14.2 + specifier: ^3.15.1 + version: 3.15.1 jsonpath-plus: specifier: 'catalog:' version: 10.3.0 @@ -12166,8 +12166,8 @@ packages: js-tokens@9.0.1: resolution: {integrity: sha512-mxa9E9ITFOt0ban3j6L5MpjwegGz6lBQmM1IJkWeBZGcMxto50+eWdjC/52xDbS2vy0k7vIMK0Fe2wfL9OQSpQ==} - js-yaml@3.14.2: - resolution: {integrity: sha512-PMSmkqxr106Xa156c2M265Z+FTrPl+oxd/rgOQy2tijQeK5TxQ43psO1ZCwhVOSdnn+RzkzlRz/eY4BgJBYVpg==} + js-yaml@3.15.1: + resolution: {integrity: sha512-S99WuO3HlhO3XN41EtYUNl9zzXjoJx7QvmipxsJVxtCBT0YHEFy+iOJhjSvrmV12nYhWpZaM8lPHkJm0yUMbag==} hasBin: true js-yaml@4.1.1: @@ -19778,7 +19778,7 @@ snapshots: globals: 13.24.0 ignore: 4.0.6 import-fresh: 3.3.1 - js-yaml: 3.14.2 + js-yaml: 3.15.1 minimatch: 3.1.2 strip-json-comments: 3.1.1 transitivePeerDependencies: @@ -20330,7 +20330,7 @@ snapshots: camelcase: 5.3.1 find-up: 4.1.0 get-package-type: 0.1.0 - js-yaml: 3.14.2 + js-yaml: 3.15.1 resolve-from: 5.0.0 '@istanbuljs/schema@0.1.3': {} @@ -27181,7 +27181,7 @@ snapshots: import-fresh: 3.3.1 imurmurhash: 0.1.4 is-glob: 4.0.3 - js-yaml: 3.14.2 + js-yaml: 3.15.1 json-stable-stringify-without-jsonify: 1.0.1 levn: 0.4.1 lodash.merge: 4.6.2 @@ -27635,7 +27635,7 @@ snapshots: front-matter@4.0.2: dependencies: - js-yaml: 3.14.2 + js-yaml: 3.15.1 fs-constants@1.0.0: {} @@ -27832,7 +27832,7 @@ snapshots: gray-matter@4.0.3: dependencies: - js-yaml: 3.14.2 + js-yaml: 3.15.1 kind-of: 6.0.3 section-matter: 1.0.0 strip-bom-string: 1.0.0 @@ -29387,7 +29387,7 @@ snapshots: js-tokens@9.0.1: {} - js-yaml@3.14.2: + js-yaml@3.15.1: dependencies: argparse: 1.0.10 esprima: 4.0.1 @@ -32242,7 +32242,7 @@ snapshots: read-yaml-file@1.1.0: dependencies: graceful-fs: 4.2.11 - js-yaml: 3.14.2 + js-yaml: 3.15.1 pify: 4.0.1 strip-bom: 3.0.0