[dependabot]

Bumps undici from 7.24.4 to 8.12.3.

Release notes

Sourced from undici's releases.

v8.12.3

What's Changed

• ci: use Python 3.14 for the WPT server on macOS by @​mrityunjay-pandey in nodejs/undici#6029
• build(deps-dev): bump neostandard from 0.13.0 to 0.14.0 by @​dependabot[bot] in nodejs/undici#6006
• build(deps-dev): bump eslint from 9.39.4 to 10.12.0 by @​dependabot[bot] in nodejs/undici#5967
• docs: document the options of interceptors.cache() by @​qodelicious in nodejs/undici#6050
• fix(h2): replace a connection that stops responding after a stream timeout by @​mcollina in nodejs/undici#6052
• fix(pool): keep caller async context for queued requests by @​mcollina in nodejs/undici#5982

New Contributors

• @​qodelicious made their first contribution in nodejs/undici#6050

Full Changelog: nodejs/undici@v8.12.2...v8.12.3

v8.12.2

Security fixes

High severity

Denial of service via TLS 1.2 certificate-changing renegotiation

CVE-2026-87018 · GHSA-qrxm-fqhp-jwvm

A malicious or compromised HTTPS server could crash the Node.js process by initiating TLS 1.2 renegotiation and presenting a different, CA-trusted certificate whose hostname did not match the requested host. The resulting socket error reached an assertion in undici's HTTP/1.1 and HTTP/2 connection handling. This release handles post-connect certificate errors without terminating the process.

TLS certificate validation bypass through dropped Agent options

CVE-2026-109383 · GHSA-2m5v-pch6-74hx

Agent used a JSON-based clone for constructor options, which silently removed function-valued TLS options such as checkServerIdentity. Applications relying on custom certificate or public-key verification could therefore accept a certificate that the callback was intended to reject. This release preserves TLS options when creating per-origin dispatchers.

Cache poisoning and cross-user disclosure through cross-origin redirects

CVE-2026-109829 · GHSA-4w7w-5xrc-9h26

When an originless Agent combined redirect and shared-cache interceptors as compose(redirect(), cache()), a response from a cross-origin redirect could be stored under the original URL. This could allow persistent cache poisoning or disclosure of user-specific responses to later callers. This release verifies the response origin before caching and preserves redirect-hop cache-control policy.

Denial of service through excessive Content-Encoding values

CVE-2026-109869 · GHSA-xjj6-f33q-929c

A malicious HTTP server could crash the Node.js process by returning more than five content codings and closing the connection before sending the body. Although fetch() rejected the response, an error from an orphaned internal stream could remain unhandled. This release validates the content-encoding chain before creating the body stream and aborts oversized chains safely.

Medium severity

Denial of service through the decompress interceptor

CVE-2026-87029 · GHSA-55wc-3pg8-jfw6

... (truncated)

Commits

• ff9cc5e Bumped v8.12.3 (#6053)
• 0bbf614 fix(pool): keep caller async context for queued requests (#5982)
• aa1eef1 fix(h2): replace a connection that stops responding after a stream timeout (#...
• e34b872 docs: document the options of interceptors.cache() (#6050)
• e8f3423 build(deps-dev): bump eslint from 9.39.4 to 10.12.0 (#5967)
• b777e40 build(deps-dev): bump neostandard from 0.13.0 to 0.14.0 (#6006)
• 43700ff ci: use Python 3.14 for the WPT server on macOS (#6029)
• bb6cc0a Bumped v8.12.2 (#6021)
• b217373 fix(websocket): bound automatic PONG writes under backpressure
• 789ef26 fix(eventsource): bound retained SSE parser state
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[github-actions]

❌MegaLinter analysis: Error

Descriptor	Linter	Files	Fixed	Errors	Warnings	Elapsed time
✅ ACTION	actionlint	5		0	0	0.12s
❌ ACTION	zizmor	5		1	0	0.31s
❌ JAVASCRIPT	eslint	19		19	0	7.21s
✅ JAVASCRIPT	prettier	19		0	0	0.72s
✅ JSON	npm-package-json-lint	yes		no	no	0.73s
✅ JSON	prettier	29		0	0	1.21s
✅ MARKDOWN	markdownlint	10		0	0	0.52s
✅ REPOSITORY	betterleaks	yes		no	no	0.67s
✅ REPOSITORY	checkov	yes		no	no	15.29s
✅ REPOSITORY	gitleaks	yes		no	no	0.72s
✅ REPOSITORY	git_diff	yes		no	no	0.02s
❌ REPOSITORY	grype	yes		21	no	101.65s
❌ REPOSITORY	osv-scanner	yes		62	no	1.79s
✅ REPOSITORY	secretlint	yes		no	no	0.74s
✅ REPOSITORY	syft	yes		no	no	1.76s
❌ REPOSITORY	trivy	yes		1	no	15.12s
✅ REPOSITORY	trivy-sbom	yes		no	no	2.15s
✅ REPOSITORY	trufflehog	yes		no	no	24.29s
❌ TYPESCRIPT	eslint	108		26	0	6.81s
✅ TYPESCRIPT	prettier	108		0	0	2.21s
✅ YAML	prettier	25		0	0	0.76s
✅ YAML	yamllint	25		0	0	0.48s

Detailed Issues

❌ JAVASCRIPT / eslint - 19 errors

__fixtures__/javascript-esm/no-import/src/index.js
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/javascript-esm/no-import/src/index.js

__fixtures__/javascript-esm/no-import/src/main.js
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/javascript-esm/no-import/src/main.js

__fixtures__/javascript-esm/success/post/index.js
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/javascript-esm/success/post/index.js

__fixtures__/javascript-esm/success/post/main.js
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/javascript-esm/success/post/main.js

__fixtures__/javascript-esm/success/pre/index.js
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/javascript-esm/success/pre/index.js

__fixtures__/javascript-esm/success/pre/main.js
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/javascript-esm/success/pre/main.js

__fixtures__/javascript-esm/success/src/index.js
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/javascript-esm/success/src/index.js

__fixtures__/javascript-esm/success/src/main.js
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/javascript-esm/success/src/main.js

__fixtures__/javascript/no-export/src/index.js
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/javascript/no-export/src/index.js

__fixtures__/javascript/no-export/src/main.js
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/javascript/no-export/src/main.js

__fixtures__/javascript/no-import/src/index.js
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/javascript/no-import/src/index.js

__fixtures__/javascript/no-import/src/main.js
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/javascript/no-import/src/main.js

__fixtures__/javascript/success/post/index.js
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/javascript/success/post/index.js

__fixtures__/javascript/success/post/main.js
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/javascript/success/post/main.js

__fixtures__/javascript/success/pre/index.js
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/javascript/success/pre/index.js

__fixtures__/javascript/success/pre/main.js
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/javascript/success/pre/main.js

__fixtures__/javascript/success/src/index.js
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/javascript/success/src/index.js

__fixtures__/javascript/success/src/main.js
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/javascript/success/src/main.js

bin/local-action.js
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): bin/local-action.js

✖ 19 problems (19 errors, 0 warnings)

❌ TYPESCRIPT / eslint - 26 errors

has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript-esm/no-export/src/index.ts

__fixtures__/typescript-esm/no-export/src/main.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript-esm/no-export/src/main.ts

__fixtures__/typescript-esm/no-import/src/index.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript-esm/no-import/src/index.ts

__fixtures__/typescript-esm/no-import/src/main.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript-esm/no-import/src/main.ts

__fixtures__/typescript-esm/success/post/index.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript-esm/success/post/index.ts

__fixtures__/typescript-esm/success/post/main.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript-esm/success/post/main.ts

__fixtures__/typescript-esm/success/pre/index.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript-esm/success/pre/index.ts

__fixtures__/typescript-esm/success/pre/main.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript-esm/success/pre/main.ts

__fixtures__/typescript-esm/success/src/index.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript-esm/success/src/index.ts

__fixtures__/typescript-esm/success/src/main.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript-esm/success/src/main.ts

__fixtures__/typescript-esm/tsconfig-comments/src/index.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript-esm/tsconfig-comments/src/index.ts

__fixtures__/typescript-esm/tsconfig-comments/src/main.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript-esm/tsconfig-comments/src/main.ts

__fixtures__/typescript/no-import/src/index.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript/no-import/src/index.ts

__fixtures__/typescript/no-import/src/main.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript/no-import/src/main.ts

__fixtures__/typescript/success-yaml/post/index.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript/success-yaml/post/index.ts

__fixtures__/typescript/success-yaml/post/main.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript/success-yaml/post/main.ts

__fixtures__/typescript/success-yaml/pre/index.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript/success-yaml/pre/index.ts

__fixtures__/typescript/success-yaml/pre/main.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript/success-yaml/pre/main.ts

__fixtures__/typescript/success-yaml/src/index.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript/success-yaml/src/index.ts

__fixtures__/typescript/success-yaml/src/main.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript/success-yaml/src/main.ts

__fixtures__/typescript/success/post/index.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript/success/post/index.ts

__fixtures__/typescript/success/post/main.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript/success/post/main.ts

__fixtures__/typescript/success/pre/index.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript/success/pre/index.ts

__fixtures__/typescript/success/pre/main.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript/success/pre/main.ts

__fixtures__/typescript/success/src/index.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript/success/src/index.ts

__fixtures__/typescript/success/src/main.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript/success/src/main.ts

✖ 26 problems (26 errors, 0 warnings)

(Truncated to last 6666 characters out of 6769)

❌ REPOSITORY / grype - 21 errors

[0000]  WARN no explicit name and version provided for directory source, deriving artifact ID from the given path (which is not ideal) from=syft
NAME              INSTALLED  FIXED IN  TYPE  VULNERABILITY        SEVERITY  EPSS         RISK  
lodash            4.17.23    4.18.0    npm   GHSA-r5fr-rjxr-66jc  High      2.6% (85th)  2.0   
brace-expansion   1.1.12     1.1.18    npm   GHSA-rgw5-rvv9-x895  High      0.6% (49th)  0.5   
brace-expansion   2.0.2      2.1.4     npm   GHSA-rgw5-rvv9-x895  High      0.6% (49th)  0.5   
brace-expansion   1.1.12     1.1.17    npm   GHSA-mh99-v99m-4gvg  High      0.6% (49th)  0.5   
brace-expansion   2.0.2      2.1.3     npm   GHSA-mh99-v99m-4gvg  High      0.6% (49th)  0.5   
brace-expansion   1.1.12     1.1.13    npm   GHSA-f886-m6hf-6m8v  Medium    0.6% (48th)  0.4   
brace-expansion   2.0.2      2.0.3     npm   GHSA-f886-m6hf-6m8v  Medium    0.6% (48th)  0.4   
figlet            1.10.0     1.11.3    npm   GHSA-62ch-8vmq-8xm7  High      0.4% (33rd)  0.3   
brace-expansion   1.1.12     1.1.20    npm   GHSA-qhr7-859c-m2p7  High      0.4% (27th)  0.3   
brace-expansion   2.0.2      2.1.6     npm   GHSA-qhr7-859c-m2p7  High      0.4% (27th)  0.3   
brace-expansion   1.1.12     1.1.19    npm   GHSA-6j4f-fj2g-mc7p  High      0.4% (27th)  0.3   
brace-expansion   2.0.2      2.1.5     npm   GHSA-6j4f-fj2g-mc7p  High      0.4% (27th)  0.3   
brace-expansion   1.1.12     1.1.16    npm   GHSA-3jxr-9vmj-r5cp  High      0.4% (28th)  0.3   
brace-expansion   2.0.2      2.1.2     npm   GHSA-3jxr-9vmj-r5cp  High      0.4% (28th)  0.3   
yaml              2.8.2      2.8.3     npm   GHSA-48c2-rrv3-qjmp  Medium    0.5% (43rd)  0.2   
lodash            4.17.23    4.18.0    npm   GHSA-f23m-r3pf-42rh  Medium    0.4% (32nd)  0.2   
fast-xml-builder  1.1.4      1.1.7     npm   GHSA-5wm8-gmm8-39j9  High      0.3% (15th)  0.2   
brace-expansion   1.1.12     1.1.21    npm   GHSA-q2hr-2g5m-vwhr  Medium    0.3% (21st)  0.2   
brace-expansion   2.0.2      2.1.7     npm   GHSA-q2hr-2g5m-vwhr  Medium    0.3% (21st)  0.2   
fast-xml-parser   5.5.7      5.7.0     npm   GHSA-gh4j-gqv2-49f6  Medium    0.3% (18th)  0.2   
esbuild           0.27.3     0.28.1    npm   GHSA-g7r4-m6w7-qqqr  Low       N/A          N/A
[0101] ERROR discovered vulnerabilities at or above the severity threshold

❌ REPOSITORY / osv-scanner - 62 errors

.2   | 2.1.7         | package-lock.json |
| https://osv.dev/GHSA-qhr7-859c-m2p7 | 7.5  | npm       | brace-expansion                | 2.0.2   | 2.1.6         | package-lock.json |
| https://osv.dev/GHSA-rgw5-rvv9-x895 | 7.5  | npm       | brace-expansion                | 2.0.2   | 2.1.4         | package-lock.json |
| https://osv.dev/GHSA-3jxr-9vmj-r5cp | 7.7  | npm       | brace-expansion (dev)          | 5.0.2   | 5.0.7         | package-lock.json |
| https://osv.dev/GHSA-6j4f-fj2g-mc7p | 7.5  | npm       | brace-expansion (dev)          | 5.0.2   | 5.0.10        | package-lock.json |
| https://osv.dev/GHSA-f886-m6hf-6m8v | 6.5  | npm       | brace-expansion (dev)          | 5.0.2   | 5.0.5         | package-lock.json |
| https://osv.dev/GHSA-jxxr-4gwj-5jf2 | 6.5  | npm       | brace-expansion (dev)          | 5.0.2   | 5.0.6         | package-lock.json |
| https://osv.dev/GHSA-mh99-v99m-4gvg | 7.5  | npm       | brace-expansion (dev)          | 5.0.2   | 5.0.8         | package-lock.json |
| https://osv.dev/GHSA-q2hr-2g5m-vwhr | 5.3  | npm       | brace-expansion (dev)          | 5.0.2   | 5.0.12        | package-lock.json |
| https://osv.dev/GHSA-qhr7-859c-m2p7 | 7.5  | npm       | brace-expansion (dev)          | 5.0.2   | 5.0.11        | package-lock.json |
| https://osv.dev/GHSA-rgw5-rvv9-x895 | 7.5  | npm       | brace-expansion (dev)          | 5.0.2   | 5.0.9         | package-lock.json |
| https://osv.dev/GHSA-3jxr-9vmj-r5cp | 7.7  | npm       | brace-expansion (dev)          | 5.0.4   | 5.0.7         | package-lock.json |
| https://osv.dev/GHSA-6j4f-fj2g-mc7p | 7.5  | npm       | brace-expansion (dev)          | 5.0.4   | 5.0.10        | package-lock.json |
| https://osv.dev/GHSA-f886-m6hf-6m8v | 6.5  | npm       | brace-expansion (dev)          | 5.0.4   | 5.0.5         | package-lock.json |
| https://osv.dev/GHSA-jxxr-4gwj-5jf2 | 6.5  | npm       | brace-expansion (dev)          | 5.0.4   | 5.0.6         | package-lock.json |
| https://osv.dev/GHSA-mh99-v99m-4gvg | 7.5  | npm       | brace-expansion (dev)          | 5.0.4   | 5.0.8         | package-lock.json |
| https://osv.dev/GHSA-q2hr-2g5m-vwhr | 5.3  | npm       | brace-expansion (dev)          | 5.0.4   | 5.0.12        | package-lock.json |
| https://osv.dev/GHSA-qhr7-859c-m2p7 | 7.5  | npm       | brace-expansion (dev)          | 5.0.4   | 5.0.11        | package-lock.json |
| https://osv.dev/GHSA-rgw5-rvv9-x895 | 7.5  | npm       | brace-expansion (dev)          | 5.0.4   | 5.0.9         | package-lock.json |
| https://osv.dev/GHSA-vfj7-8cjw-p6xm | 8.7  | npm       | braces (dev)                   | 3.0.3   | --            | package-lock.json |
| https://osv.dev/GHSA-73wf-gq98-2v4g | 7.5  | npm       | browserslist (dev)             | 4.28.1  | 4.28.7        | package-lock.json |
| https://osv.dev/GHSA-c83g-rgw3-j3cx | 7.5  | npm       | browserslist (dev)             | 4.28.1  | 4.28.7        | package-lock.json |
| https://osv.dev/GHSA-g7r4-m6w7-qqqr | 2.5  | npm       | esbuild                        | 0.27.3  | 0.28.1        | package-lock.json |
| https://osv.dev/GHSA-5wm8-gmm8-39j9 | 8.7  | npm       | fast-xml-builder               | 1.1.4   | 1.1.7         | package-lock.json |
| https://osv.dev/GHSA-gh4j-gqv2-49f6 | 6.1  | npm       | fast-xml-parser                | 5.5.7   | 5.7.0         | package-lock.json |
| https://osv.dev/GHSA-62ch-8vmq-8xm7 | 8.2  | npm       | figlet                         | 1.10.0  | 1.11.3        | package-lock.json |
| https://osv.dev/GHSA-25h7-pfq9-p65f | 7.5  | npm       | flatted (dev)                  | 3.3.3   | 3.4.0         | package-lock.json |
| https://osv.dev/GHSA-rf6f-7fwh-wjgh | 8.9  | npm       | flatted (dev)                  | 3.3.3   | 3.4.2         | package-lock.json |
| https://osv.dev/GHSA-8r5x-fm3f-whwj | 9.8  | npm       | handlebars (dev)               | 4.7.9   | 4.7.10        | package-lock.json |
| https://osv.dev/GHSA-p8wg-vrv2-v86f | 9.2  | npm       | handlebars (dev)               | 4.7.9   | 4.7.10        | package-lock.json |
| https://osv.dev/GHSA-xw65-4hp5-5hc7 | 4.7  | npm       | handlebars (dev)               | 4.7.9   | 4.7.10        | package-lock.json |
| https://osv.dev/GHSA-2883-xcg3-v3hh | 7.5  | npm       | js-yaml (dev)                  | 3.14.2  | 3.15.2        | package-lock.json |
| https://osv.dev/GHSA-52cp-r559-cp3m | 7.5  | npm       | js-yaml (dev)                  | 3.14.2  | 3.15.0        | package-lock.json |
| https://osv.dev/GHSA-5p4m-2wfm-xmqj | 7.5  | npm       | js-yaml (dev)                  | 3.14.2  | 3.15.1        | package-lock.json |
| https://osv.dev/GHSA-h67p-54hq-rp68 | 5.3  | npm       | js-yaml (dev)                  | 3.14.2  | 3.15.0        | package-lock.json |
| https://osv.dev/GHSA-2883-xcg3-v3hh | 7.5  | npm       | js-yaml (dev)                  | 4.1.1   | 4.3.2         | package-lock.json |
| https://osv.dev/GHSA-52cp-r559-cp3m | 7.5  | npm       | js-yaml (dev)                  | 4.1.1   | 4.3.0         | package-lock.json |
| https://osv.dev/GHSA-5p4m-2wfm-xmqj | 7.5  | npm       | js-yaml (dev)                  | 4.1.1   | 4.3.1         | package-lock.json |
| https://osv.dev/GHSA-h67p-54hq-rp68 | 5.3  | npm       | js-yaml (dev)                  | 4.1.1   | 4.2.0         | package-lock.json |
| https://osv.dev/GHSA-f23m-r3pf-42rh | 6.5  | npm       | lodash                         | 4.17.23 | 4.18.0        | package-lock.json |
| https://osv.dev/GHSA-r5fr-rjxr-66jc | 8.1  | npm       | lodash                         | 4.17.23 | 4.18.0        | package-lock.json |
| https://osv.dev/GHSA-3v7f-55p6-f55p | 5.3  | npm       | picomatch (dev)                | 2.3.1   | 2.3.2         | package-lock.json |
| https://osv.dev/GHSA-c2c7-rcm5-vvqj | 7.5  | npm       | picomatch (dev)                | 2.3.1   | 2.3.2         | package-lock.json |
| https://osv.dev/GHSA-3v7f-55p6-f55p | 5.3  | npm       | picomatch (dev)                | 4.0.3   | 4.0.4         | package-lock.json |
| https://osv.dev/GHSA-c2c7-rcm5-vvqj | 7.5  | npm       | picomatch (dev)                | 4.0.3   | 4.0.4         | package-lock.json |
| https://osv.dev/GHSA-hp3w-g68c-fv3c | 6.9  | npm       | sprintf-js (dev)               | 1.0.3   | --            | package-lock.json |
| https://osv.dev/GHSA-w5hq-g745-h8pq | 7.5  | npm       | uuid (dev)                     | 8.3.2   | 11.1.1        | package-lock.json |
| https://osv.dev/GHSA-48c2-rrv3-qjmp | 4.3  | npm       | yaml                           | 2.8.2   | 2.8.3         | package-lock.json |
+-------------------------------------+------+-----------+--------------------------------+---------+---------------+-------------------+

(Truncated to last 6666 characters out of 9482)

❌ REPOSITORY / trivy - 1 error

──────┤        │                   ├──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│                  │ CVE-2026-102277     │ MEDIUM   │        │                   │ 5.0.12, 3.0.9, 2.1.7, 1.1.21 │ brace-expansion: brace-expansion: Denial of Service via      │
│                  │                     │          │        │                   │                              │ crafted brace patterns                                       │
│                  │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-102277                  │
│                  ├─────────────────────┤          │        │                   ├──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│                  │ CVE-2026-33750      │          │        │                   │ 5.0.5, 3.0.2, 2.0.3, 1.1.13  │ brace-expansion: brace-expansion: Denial of Service via zero │
│                  │                     │          │        │                   │                              │ step value in brace pattern...                               │
│                  │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-33750                   │
├──────────────────┼─────────────────────┼──────────┤        ├───────────────────┼──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ esbuild          │ GHSA-g7r4-m6w7-qqqr │ LOW      │        │ 0.27.3            │ 0.28.1                       │ esbuild allows arbitrary file read when running the          │
│                  │                     │          │        │                   │                              │ development server on Windows...                             │
│                  │                     │          │        │                   │                              │ https://github.com/advisories/GHSA-g7r4-m6w7-qqqr            │
├──────────────────┼─────────────────────┼──────────┤        ├───────────────────┼──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ fast-xml-builder │ CVE-2026-44665      │ HIGH     │        │ 1.1.4             │ 1.1.7                        │ fast-xml-builder: fast-xml-builder: Attribute injection      │
│                  │                     │          │        │                   │                              │ leading to information disclosure or content manipulation    │
│                  │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-44665                   │
├──────────────────┼─────────────────────┼──────────┤        ├───────────────────┼──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ fast-xml-parser  │ CVE-2026-41650      │ MEDIUM   │        │ 5.5.7             │ 5.7.0                        │ fast-xml-parser: fast-xml-parser: XML injection via improper │
│                  │                     │          │        │                   │                              │ escaping of comment and CDATA sequences...                   │
│                  │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-41650                   │
├──────────────────┼─────────────────────┼──────────┤        ├───────────────────┼──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ figlet           │ CVE-2026-96780      │ HIGH     │        │ 1.10.0            │ 1.11.3                       │ figlet is vulnerable to denial of service via unbounded loop │
│                  │                     │          │        │                   │                              │ when whitespaceBreak...                                      │
│                  │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-96780                   │
├──────────────────┼─────────────────────┤          │        ├───────────────────┼──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ lodash           │ CVE-2026-4800       │          │        │ 4.17.23           │ 4.18.0                       │ lodash: lodash: Arbitrary code execution via untrusted input │
│                  │                     │          │        │                   │                              │ in template imports                                          │
│                  │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-4800                    │
│                  ├─────────────────────┼──────────┤        │                   │                              ├──────────────────────────────────────────────────────────────┤
│                  │ CVE-2026-2950       │ MEDIUM   │        │                   │                              │ lodash: Lodash: Prototype pollution allows deletion of       │
│                  │                     │          │        │                   │                              │ built-in prototype properties via array...                   │
│                  │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-2950                    │
├──────────────────┼─────────────────────┤          │        ├───────────────────┼──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ yaml             │ CVE-2026-33532      │          │        │ 2.8.2             │ 2.8.3, 1.10.3                │ yaml: yaml: Denial of Service via deeply nested YAML         │
│                  │                     │          │        │                   │                              │ document parsing                                             │
│                  │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-33532                   │
└──────────────────┴─────────────────────┴──────────┴────────┴───────────────────┴──────────────────────────────┴──────────────────────────────────────────────────────────────┘

📣 Notices:
  - Version 0.76.0 of Trivy is now available, current version is 0.71.2

To suppress version checks, run Trivy scans with the --skip-version-check flag

(Truncated to last 6666 characters out of 20472)

❌ ACTION / zizmor - 1 error

INFO zizmor: 🌈 zizmor v1.25.0
fatal: no audit was performed
'ref-confusion' audit failed on file://.github/workflows/codeql-analysis.yml

Caused by:
    0: error in 'ref-confusion' audit
    1: couldn't list branches for actions/checkout
    2: request error while accessing GitHub API
    3: HTTP status client error (401 Unauthorized) for url (https://github.com/actions/checkout.git/git-upload-pack)


[ACTION_ZIZMOR_ERROR_GITHUB_API_UNREACHABLE] Zizmor could not access a repository referenced by a `uses:` clause via the GitHub API (missing token, insufficient scope, or cross-repo private access).
To allow zizmor to authenticate with GITHUB_TOKEN (or a PAT with `Contents: read-only`), whitelist the variable in your .mega-linter.yml:
ACTION_ZIZMOR_UNSECURED_ENV_VARIABLES:
  - GITHUB_TOKEN
If the referenced workflow is in a private repo outside the current one, provide a PAT with cross-repo access instead of the default GITHUB_TOKEN, or run zizmor in offline mode.

Notices

📣 MegaLinter 9.5.0 is out! Discover the new features and security recommendations in the release announcement. (Skip this info by defining SECURITY_SUGGESTIONS: false)

See detailed reports in MegaLinter artifacts

Show us your support by starring ⭐ the repository