Update dependency graphql-request to v3.4.0 (main) - #13
Update dependency graphql-request to v3.4.0 (main)#13mend-for-github-com[bot] wants to merge 1 commit into
Security Report
❌ New vulnerabilities:
| Vulnerability | Severity |  CVSS Score |
Exploit Maturity | EPSS | Vulnerable Library | Direct Library | Suggested Fix | Issue | Reachability |
|---|---|---|---|---|---|---|---|---|---|
CVE-2025-25290Path to dependency file: /package.json Path to vulnerable library: /package.json Dependency Hierarchy: -> actions-toolkit-6.0.1.tgz (Root Library) -> rest-17.11.2.tgz -> core-2.5.4.tgz -> ❌ request-5.6.3.tgz (Vulnerable Library) |
 Medium |
5.3 | Not Defined | 0.768% | Transitive request-5.6.3.tgz |
actions-toolkit-6.0.1.tgz | Transitive 8.4.1 |
#6 |
|
CVE-2025-25289Path to dependency file: /package.json Path to vulnerable library: /package.json Dependency Hierarchy: -> actions-toolkit-6.0.1.tgz (Root Library) -> rest-17.11.2.tgz -> core-2.5.4.tgz -> request-5.6.3.tgz -> ❌ request-error-2.1.0.tgz (Vulnerable Library) |
Medium |
5.3 | Not Defined | 0.615% | Transitive request-error-2.1.0.tgz |
actions-toolkit-6.0.1.tgz | Transitive @octokit/request-error - 5.1.1,6.1.7 |
#6 |
|
CVE-2025-25285Path to dependency file: /package.json Path to vulnerable library: /package.json Dependency Hierarchy: -> actions-toolkit-6.0.1.tgz (Root Library) -> rest-17.11.2.tgz -> core-2.5.4.tgz -> request-5.6.3.tgz -> ❌ endpoint-6.0.12.tgz (Vulnerable Library) |
Medium |
5.3 | Not Defined | 0.615% | Transitive endpoint-6.0.12.tgz |
actions-toolkit-6.0.1.tgz | Transitive @octokit/endpoint - 9.0.6,10.1.3 |
#6 |
|
✔️ Remediated vulnerabilities:
| Vulnerability | Vulnerable Library |
|---|---|
| CVE-2026-12143 | form-data-3.0.0.tgz |
| CVE-2025-25289 | request-error-2.0.3.tgz |
| CVE-2025-25290 | request-5.4.10.tgz |
| CVE-2025-25285 | endpoint-6.0.9.tgz |
| CVE-2025-7783 | form-data-3.0.0.tgz |
| CVE-2024-21538 | cross-spawn-6.0.5.tgz |
Base branch total remaining vulnerabilities: 14
Base branch commit: null
Total libraries scanned: 117
Scan token: 41f7d6e820f64892b6b2a85f41cf6698