fix(simple-rest): update query-string

Author: harshmaur

.changeset/tidy-rivers-rest.md

@@ -0,0 +1,5 @@
+---
+"@refinedev/simple-rest": patch
+---
+
+fix: update `query-string` to remove the vulnerable `decode-uri-component` version. Fixes #7601.

packages/simple-rest/package.json

@@ -42,7 +42,7 @@
   },
   "dependencies": {
     "axios": "^1.11.0",
-    "query-string": "^7.1.1"
+    "query-string": "^9.5.1"
   },
   "devDependencies": {
     "@esbuild-plugins/node-resolve": "^0.1.4",

packages/simple-rest/refine.config.js

@@ -5,7 +5,7 @@ module.exports = {
     items: [
       {
         label: "Data Provider",
-        requiredPackages: ["query-string@7.1.1", "axios@1.6.2"],
+        requiredPackages: ["query-string@9.5.1", "axios@1.6.2"],
         files: [
           {
             src: "./src/provider.ts",

packages/simple-rest/src/index.ts

@@ -1,6 +1,8 @@
-import { stringify } from "query-string";
+import queryString from "query-string";
 import { dataProvider } from "./provider.js";
 
+const { stringify } = queryString;
+
 export default dataProvider;
 
 export * from "./utils/index.js";

packages/simple-rest/src/provider.ts

@@ -1,8 +1,10 @@
 import type { AxiosInstance } from "axios";
-import { stringify } from "query-string";
+import queryString from "query-string";
 import type { DataProvider } from "@refinedev/core";
 import { axiosInstance, generateSort, generateFilter } from "./utils";
 
+const { stringify } = queryString;
+
 type MethodTypes = "get" | "delete" | "head" | "options";
 type MethodTypesWithBody = "post" | "put" | "patch";
 

packages/simple-rest/tsup.config.ts

@@ -1,20 +1,33 @@
 import { defineConfig } from "tsup";
 import { NodeResolvePlugin } from "@esbuild-plugins/node-resolve";
 
+const bundledDependencies = [
+  "decode-uri-component",
+  "filter-obj",
+  "query-string",
+  "split-on-first",
+];
+
 export default defineConfig((options) => ({
   entry: ["src/index.ts"],
   splitting: false,
   sourcemap: true,
   clean: false,
   minify: false,
   format: ["cjs", "esm"],
+  noExternal: bundledDependencies,
   outExtension: ({ format }) => ({ js: format === "cjs" ? ".cjs" : ".mjs" }),
   platform: "browser",
   esbuildPlugins: [
     NodeResolvePlugin({
       extensions: [".js", "ts", "tsx", "jsx"],
       onResolved: (resolved) => {
-        if (resolved.includes("node_modules")) {
+        if (
+          resolved.includes("node_modules") &&
+          !bundledDependencies.some((dependency) =>
+            resolved.includes(`/node_modules/${dependency}/`),
+          )
+        ) {
           return {
             external: true,
           };