You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
This release hardens redirect and URL handling, improves the validateStatus configuration semantics, and includes updates to documentation, dependencies, and release metadata.
This release adds Node HTTP zstd decompression, hardens config and release workflows, and fixes authentication, header, proxy, and type-handling regressions.
Markdown: Fix blank lines between list items and nested sub-lists being removed in Markdown/MDX (#17746 by @byplayer)
Prettier was removing blank lines between list items and their nested sub-lists, converting loose lists into tight lists and changing their semantic meaning.
<!-- Input -->- a
- b
- c
- d
<!-- Prettier 3.8.3 -->- a
- b
- c
- d
<!-- Prettier 3.8.4 -->- a
- b
- c
- d
[0000] WARN no explicit name and version provided for directory source, deriving artifact ID from the given path (which is not ideal) from=syft
error purl scheme is not "pkg": ""
error purl scheme is not "pkg": ""
error purl scheme is not "pkg": ""
error purl scheme is not "pkg": ""
error purl scheme is not "pkg": ""
error purl scheme is not "pkg": ""
error purl scheme is not "pkg": ""
error purl scheme is not "pkg": ""
error purl scheme is not "pkg": ""
error purl scheme is not "pkg": ""
error purl scheme is not "pkg": ""
error purl scheme is not "pkg": ""
error purl scheme is not "pkg": ""
error purl scheme is not "pkg": ""
error purl scheme is not "pkg": ""
error purl scheme is not "pkg": ""
error purl scheme is not "pkg": ""
error purl scheme is not "pkg": ""
error purl scheme is not "pkg": ""
error purl scheme is not "pkg": ""
error purl scheme is not "pkg": ""
error purl scheme is not "pkg": ""
error purl scheme is not "pkg": ""
error purl scheme is not "pkg": ""
error purl scheme is not "pkg": ""
error purl scheme is not "pkg": ""
error purl scheme is not "pkg": ""
error purl scheme is not "pkg": ""
error purl scheme is not "pkg": ""
error purl scheme is not "pkg": ""
error purl scheme is not "pkg": ""
error purl scheme is not "pkg": ""
error purl scheme is not "pkg": ""
error purl scheme is not "pkg": ""
error purl scheme is not "pkg": ""
error purl scheme is not "pkg": ""
error purl scheme is not "pkg": ""
error purl scheme is not "pkg": ""
error purl scheme is not "pkg": ""
error purl scheme is not "pkg": ""
error purl scheme is not "pkg": ""
error purl scheme is not "pkg": ""
error purl scheme is not "pkg": ""
error purl scheme is not "pkg": ""
error purl scheme is not "pkg": ""
error purl scheme is not "pkg": ""
error purl scheme is not "pkg": ""
error purl scheme is not "pkg": ""
error purl scheme is not "pkg": ""
error purl scheme is not "pkg": ""
error purl scheme is not "pkg": ""
error purl scheme is not "pkg": ""
error purl scheme is not "pkg": ""
error purl scheme is not "pkg": ""
error purl scheme is not "pkg": ""
error purl scheme is not "pkg": ""
error purl scheme is not "pkg": ""
error purl scheme is not "pkg": ""
error purl scheme is not "pkg": ""
error purl scheme is not "pkg": ""
error purl scheme is not "pkg": ""
error purl scheme is not "pkg": ""
error purl scheme is not "pkg": ""
error purl scheme is not "pkg": ""
error purl scheme is not "pkg": ""
error purl scheme is not "pkg": ""
error purl scheme is not "pkg": ""
error purl scheme is not "pkg": ""
error purl scheme is not "pkg": ""
error purl scheme is not "pkg": ""
error purl scheme is not "pkg": ""
error purl scheme is not "pkg": ""
error purl scheme is not "pkg": ""
error purl scheme is not "pkg": ""
error purl scheme is not "pkg": ""
error purl scheme is not "pkg": ""
error purl scheme is not "pkg": ""
error purl scheme is not "pkg": ""
error purl scheme is not "pkg": ""
error purl scheme is not "pkg": ""
error purl scheme is not "pkg": ""
error purl scheme is not "pkg": ""
error purl scheme is not "pkg": ""
error purl scheme is not "pkg": ""
error purl scheme is not "pkg": ""
error purl scheme is not "pkg": ""
error purl scheme is not "pkg": ""
error purl scheme is not "pkg": ""
error purl scheme is not "pkg": ""
error purl scheme is not "pkg": ""
error purl scheme is not "pkg": ""
error purl scheme is not "pkg": ""
error purl scheme is not "pkg": ""
error purl scheme is not "pkg": ""
error purl scheme is not "pkg": ""
error purl scheme is not "pkg": ""
error purl scheme is not "pkg": ""
error purl scheme is not "pkg": ""
error purl scheme is not "pkg": ""
error purl scheme is not "pkg": ""
error purl scheme is not "pkg": ""
error purl scheme is not "pkg": ""
error purl scheme is not "pkg": ""
error purl scheme is not "pkg": ""
error purl scheme is not "pkg": ""
error purl scheme is not "pkg": ""
error purl scheme is not "pkg": ""
NAME INSTALLED FIXED IN TYPE VULNERABILITY SEVERITY EPSS RISK
form-data 4.0.5 4.0.6 npm GHSA-hmw2-7cc7-3qxx High 0.3% (24th) 0.3
brace-expansion 5.0.5 5.0.6 npm GHSA-jxxr-4gwj-5jf2 Medium 0.2% (10th) 0.1
logback-core 1.5.18 1.5.19 java-archive GHSA-25qh-j22f-pwp8 Medium 0.2% (4th) < 0.1
logback-core 1.5.18 1.5.25 java-archive GHSA-qqpg-mvqg-649v Low 0.2% (4th) < 0.1
jackson-core 2.19.0 2.21.1 java-archive GHSA-72hv-8253-57qq Medium N/A N/A
tar 7.5.13 7.5.16 npm GHSA-vmf3-w455-68vh Medium N/A N/A
[0044] ERROR discovered vulnerabilities at or above the severity threshold
❌ REPOSITORY / trivy - 1 error
2026-06-20T13:12:43Z INFO [vulndb] Need to update DB
2026-06-20T13:12:43Z INFO [vulndb] Downloading vulnerability DB...
2026-06-20T13:12:43Z INFO [vulndb] Downloading artifact... repo="mirror.gcr.io/aquasec/trivy-db:2"
2.36 MiB / 97.02 MiB [->_____________________________________________________________] 2.43% ? p/s ?27.06 MiB / 97.02 MiB [----------------->___________________________________________] 27.89% ? p/s ?58.55 MiB / 97.02 MiB [------------------------------------>________________________] 60.35% ? p/s ?91.08 MiB / 97.02 MiB [-------------------------------------------->__] 93.88% 147.91 MiB p/s ETA 0s97.02 MiB / 97.02 MiB [--------------------------------------------->] 100.00% 147.91 MiB p/s ETA 0s97.02 MiB / 97.02 MiB [--------------------------------------------->] 100.00% 147.91 MiB p/s ETA 0s97.02 MiB / 97.02 MiB [--------------------------------------------->] 100.00% 139.01 MiB p/s ETA 0s97.02 MiB / 97.02 MiB [--------------------------------------------->] 100.00% 139.01 MiB p/s ETA 0s97.02 MiB / 97.02 MiB [--------------------------------------------->] 100.00% 139.01 MiB p/s ETA 0s97.02 MiB / 97.02 MiB [--------------------------------------------->] 100.00% 130.04 MiB p/s ETA 0s97.02 MiB / 97.02 MiB [--------------------------------------------->] 100.00% 130.04 MiB p/s ETA 0s97.02 MiB / 97.02 MiB [--------------------------------------------->] 100.00% 130.04 MiB p/s ETA 0s97.02 MiB / 97.02 MiB [--------------------------------------------->] 100.00% 121.65 MiB p/s ETA 0s97.02 MiB / 97.02 MiB [--------------------------------------------->] 100.00% 121.65 MiB p/s ETA 0s97.02 MiB / 97.02 MiB [--------------------------------------------->] 100.00% 121.65 MiB p/s ETA 0s97.02 MiB / 97.02 MiB [--------------------------------------------->] 100.00% 113.80 MiB p/s ETA 0s97.02 MiB / 97.02 MiB [--------------------------------------------->] 100.00% 113.80 MiB p/s ETA 0s97.02 MiB / 97.02 MiB [--------------------------------------------->] 100.00% 113.80 MiB p/s ETA 0s97.02 MiB / 97.02 MiB [-------------------------------------------------] 100.00% 27.76 MiB p/s 3.7s2026-06-20T13:12:47Z INFO [vulndb] Artifact successfully downloaded repo="mirror.gcr.io/aquasec/trivy-db:2"
2026-06-20T13:12:47Z INFO [vuln] Vulnerability scanning is enabled
2026-06-20T13:12:47Z INFO [misconfig] Misconfiguration scanning is enabled
2026-06-20T13:12:47Z INFO [misconfig] Need to update the checks bundle
2026-06-20T13:12:47Z INFO [misconfig] Downloading the checks bundle...
165.46 KiB / 165.46 KiB [---------------------------------------------------------] 100.00% ? p/s 0s2026-06-20T13:12:49Z INFO Suppressing dependencies for development and testing. To display them, try the '--include-dev-deps' flag.
2026-06-20T13:12:49Z INFO Number of language-specific files num=1
2026-06-20T13:12:49Z INFO [npm] Detecting vulnerabilities...
2026-06-20T13:12:49Z INFO Detected config files num=1
Report Summary
┌───────────────────┬────────────┬─────────────────┬───────────────────┐
│ Target │ Type │ Vulnerabilities │ Misconfigurations │
├───────────────────┼────────────┼─────────────────┼───────────────────┤
│ package-lock.json │ npm │ 3 │ - │
├───────────────────┼────────────┼─────────────────┼───────────────────┤
│ Dockerfile │ dockerfile │ - │ 0 │
└───────────────────┴────────────┴─────────────────┴───────────────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)
For OSS Maintainers: VEX Notice
--------------------------------
If you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement.
VEX allows you to communicate the actual status of vulnerabilities in your project, improving security transparency and reducing false positives for your users.
Learn more and start using VEX: https://trivy.dev/v0.67/docs/supply-chain/vex/repo#publishing-vex-documents
To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable.
package-lock.json (npm)
=======================
Total: 3 (UNKNOWN: 0, LOW: 0, MEDIUM: 2, HIGH: 1, CRITICAL: 0)
┌─────────────────┬────────────────┬──────────┬────────┬───────────────────┬─────────────────────┬────────────────────────────────────────────────────────────┐
│ Library │ Vulnerability │ Severity │ Status │ Installed Version │ Fixed Version │ Title │
├─────────────────┼────────────────┼──────────┼────────┼───────────────────┼─────────────────────┼────────────────────────────────────────────────────────────┤
│ brace-expansion │ CVE-2026-45149 │ MEDIUM │ fixed │ 5.0.5 │ 5.0.6 │ brace-expansion: brace-expansion: Denial of Service due to │
│ │ │ │ │ │ │ excessive memory allocation when expanding... │
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2026-45149 │
├─────────────────┼────────────────┼──────────┤ ├───────────────────┼─────────────────────┼────────────────────────────────────────────────────────────┤
│ form-data │ CVE-2026-12143 │ HIGH │ │ 4.0.5 │ 2.5.6, 3.0.5, 4.0.6 │ form-data is a library for creating readable │
│ │ │ │ │ │ │ multipart/form-data strea ... │
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2026-12143 │
├─────────────────┼────────────────┼──────────┤ ├───────────────────┼─────────────────────┼────────────────────────────────────────────────────────────┤
│ tar │ CVE-2026-53655 │ MEDIUM │ │ 7.5.13 │ 7.5.16 │ node-tar applies PAX size override to intermediary GNU │
│ │ │ │ │ │ │ long-name/long-link headers, causing tar... │
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2026-53655 │
└─────────────────┴────────────────┴──────────┴────────┴───────────────────┴─────────────────────┴────────────────────────────────────────────────────────────┘
📣 Notices:
- Version 0.71.2 of Trivy is now available, current version is 0.67.2
To suppress version checks, run Trivy scans with the --skip-version-check flag
docs/github-dependents-info.md:11:3 MD051/link-fragments Link fragments should be valid [Context: "[github.com/nvuillam/npm-groovy-lint](#package-github.comnvuillamnpm-groovy-lint)"]
docs/index.md:39:65 MD059/descriptive-link-text Link text should be descriptive [Context: "[**here**]"]
README.md:39:65 MD059/descriptive-link-text Link text should be descriptive [Context: "[**here**]"]
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.
Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/js-yaml@4.2.0. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
7.29.0→7.29.77.28.6→7.29.73.23.4→3.24.11.16.1→1.18.01.16.1→1.18.04.1.1→4.2.011.7.5→11.7.6v3.2.0→v3.2.13.8.3→3.8.414.0.0→14.0.1Release Notes
babel/babel (@babel/core)
v7.29.7Compare Source
v7.29.7 (2026-05-25)
Re-release all packages with npm provenance attestations
v7.29.6Compare Source
v7.29.6 (2026-05-25)
🐛 Bug Fix
babel-generatorbabel-corebabel-core,babel-generatorCommitters: 3
axios/axios (axios)
v1.18.0Compare Source
This release hardens redirect and URL handling, improves the validateStatus configuration semantics, and includes updates to documentation, dependencies, and release metadata.
v1.17.0Compare Source
This release adds Node HTTP zstd decompression, hardens config and release workflows, and fixes authentication, header, proxy, and type-handling regressions.
nodeca/js-yaml (js-yaml)
v4.2.0Compare Source
Added
docs/safety.mdwith notes about processing untrusted YAML.maxDepth(100) loader option. Not a problem, but gives a betterexception instead of RangeError on stack overflow.
maxMergeSeqLength(20) loader option. Not a problem aftermergefix,but an additional restriction for safety.
dist/builds.Changed
dist/files are no longer kept in the repository.Fixed
Security
elements (makes sense for malformed files > 10K).
mochajs/mocha (mocha)
v11.7.6Compare Source
🩹 Fixes
describe().timeout()work (aafe6fd)wmicusage with native Windows API (#5694) (73ebdfa)🧹 Chores
nvuillam/github-dependents-info (nvuillam/github-dependents-info)
v3.2.1Compare Source
What's Changed
Pull Requests
0611638by @renovate[bot] in #1039650006cby @renovate[bot] in #1026df4cb1cby @renovate[bot] in #10577be385ctoe86edaaby @dependabot[bot] in #1018Full Changelog: nvuillam/github-dependents-info@v3.2.0...v3.2.1
prettier/prettier (prettier)
v3.8.4Compare Source
diff
Markdown: Fix blank lines between list items and nested sub-lists being removed in Markdown/MDX (#17746 by @byplayer)
Prettier was removing blank lines between list items and their nested sub-lists, converting loose lists into tight lists and changing their semantic meaning.
uuidjs/uuid (uuid)
v14.0.1Compare Source
Bug Fixes
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.