From 7df6d09a2bb554b0369399a877be31c18a8fb3f5 Mon Sep 17 00:00:00 2001 From: "claude[bot]" Date: Wed, 5 Aug 2026 02:18:39 +0000 Subject: [PATCH 1/2] chore: upgrade socket.io-parser to ^4.2.7 to address CVE-2026-69185 Co-Authored-By: Claude Opus 5 (1M context) --- yarn.lock | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/yarn.lock b/yarn.lock index 7ba1fbf52..5bb539958 100644 --- a/yarn.lock +++ b/yarn.lock @@ -21835,12 +21835,12 @@ __metadata: linkType: hard "socket.io-parser@npm:~4.2.4": - version: 4.2.6 - resolution: "socket.io-parser@npm:4.2.6" + version: 4.2.7 + resolution: "socket.io-parser@npm:4.2.7" dependencies: "@socket.io/component-emitter": "npm:~3.1.0" debug: "npm:~4.4.1" - checksum: 10c0/ba0a0b541b0a8e9d02b45c04c4c93a02331be5ea3478073c65bb9ff87032f12469c9adb309728eb90c0a352618d645ab88999c167a11c783cac861d7fd35c9d1 + checksum: 10c0/16a5579718b871114ca644d688987dd3cf9292010c949fb083633eefbc1d8fdaf424691d6511d746e5c10f5c88cbd8911cd0b1e807242159f40989be90842b4e languageName: node linkType: hard From c6665dba63c5e12d8ecac75741e6a440a21be0f0 Mon Sep 17 00:00:00 2001 From: "claude[bot]" Date: Wed, 5 Aug 2026 02:18:58 +0000 Subject: [PATCH 2/2] chore: add CHANGELOG entry for socket.io-parser upgrade Co-Authored-By: Claude Opus 5 (1M context) --- CHANGELOG.md | 1 + 1 file changed, 1 insertion(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index ab1195e04..40fc15370 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -17,6 +17,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 - Fixed a crash when searching with `context:` referencing a search context that does not exist; it now returns a graceful error. [#1362](https://github.com/sourcebot-dev/sourcebot/pull/1362) - Fixed search queries failing to parse when negating a bare term that contains a colon (e.g. `-foo:bar`, `-http://example.com`). [#1301](https://github.com/sourcebot-dev/sourcebot/pull/1301) - Fixed the Review Agent failing to fetch pull request diffs for private GitHub repositories. [#1352](https://github.com/sourcebot-dev/sourcebot/pull/1352) +- Upgraded `socket.io-parser` to `^4.2.7`. [#1542](https://github.com/sourcebot-dev/sourcebot/pull/1542) ## [5.1.5] - 2026-07-31