Skip to content

chore(deps)(deps): bump the web-dependencies group across 1 directory with 17 updates#38

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/web/web-dependencies-ac23363b48
Closed

chore(deps)(deps): bump the web-dependencies group across 1 directory with 17 updates#38
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/web/web-dependencies-ac23363b48

Conversation

@dependabot
Copy link
Copy Markdown

@dependabot dependabot Bot commented on behalf of github Mar 30, 2026 •
edited
Loading

Bumps the web-dependencies group with 14 updates in the /web directory:

Package From To
i18next-browser-languagedetector 8.2.0 8.2.1
livekit-client 2.16.0 2.18.0
maplibre-gl 5.14.0 5.21.1
web-vitals 5.1.0 5.2.0
zustand 5.0.9 5.0.12
@playwright/test 1.58.0 1.58.2
@testing-library/react 16.3.0 16.3.2
@types/maplibre-gl 1.13.2 1.14.0
@vitest/coverage-v8 4.0.18 4.1.2
autoprefixer 10.4.22 10.4.27
eslint-plugin-react-refresh 0.4.24 0.5.2
msw 2.12.7 2.12.14
postcss 8.5.6 8.5.8
typescript-eslint 8.49.0 8.57.2

Updates i18next-browser-languagedetector from 8.2.0 to 8.2.1

Changelog

Sourced from i18next-browser-languagedetector's changelog.

8.2.1

  • Add missing typescript definition for hash options 33154
Commits

Updates livekit-client from 2.16.0 to 2.18.0

Release notes

Sourced from livekit-client's releases.

v2.18.0

Minor Changes

Patch Changes

v2.17.3

Patch Changes

  • Update happy-dom dependency version - #1821 (@​renovate)

  • e2ee: ensure current key index isn't unintentionally updated - #1830 (@​lukasIO)

  • Prevent unmute -> mute -> unmute cycle for track restarts that happen during unmute - #1793 (@​mfairley)

  • Use controller.error to signal unexpected errors mid data stream - #1834 (@​lukasIO)

  • Signal leave on failed connection attempts if signalling is connected - #1817 (@​lukasIO)

  • Vendored ts-debounce and added critical timers to debounce function - #1800 (@​mfairley)

  • Ensure cryptor setup respects async queue in worker - #1833 (@​lukasIO)

  • Adds new OutgoingDataTrackManager to manage sending data track payloads - #1810 (@​1egoman)

v2.17.2

Patch Changes

  • Ensure connection state mismatches aren't triggered for ongoing PC connection attempts - #1807 (@​lukasIO)

  • Fix unnecessary track restarts on unmute when using ideal device constraints - #1794 (@​mfairley)

  • Prevent ongoing renegotiations from declaring the negotiation as timed out - #1813 (@​lukasIO)

  • Add data track packetizer and depacketizer implementations - #1798 (@​1egoman)

  • Add missing type exports required by @livekit/components-core - #1815 (@​1egoman)

v2.17.1

Patch Changes

... (truncated)

Changelog

Sourced from livekit-client's changelog.

2.18.0

Minor Changes

Patch Changes

2.17.3

Patch Changes

  • Update happy-dom dependency version - #1821 (@​renovate)

  • e2ee: ensure current key index isn't unintentionally updated - #1830 (@​lukasIO)

  • Prevent unmute -> mute -> unmute cycle for track restarts that happen during unmute - #1793 (@​mfairley)

  • Use controller.error to signal unexpected errors mid data stream - #1834 (@​lukasIO)

  • Signal leave on failed connection attempts if signalling is connected - #1817 (@​lukasIO)

  • Vendored ts-debounce and added critical timers to debounce function - #1800 (@​mfairley)

  • Ensure cryptor setup respects async queue in worker - #1833 (@​lukasIO)

  • Adds new OutgoingDataTrackManager to manage sending data track payloads - #1810 (@​1egoman)

2.17.2

Patch Changes

  • Ensure connection state mismatches aren't triggered for ongoing PC connection attempts - #1807 (@​lukasIO)

  • Fix unnecessary track restarts on unmute when using ideal device constraints - #1794 (@​mfairley)

  • Prevent ongoing renegotiations from declaring the negotiation as timed out - #1813 (@​lukasIO)

  • Add data track packetizer and depacketizer implementations - #1798 (@​1egoman)

  • Add missing type exports required by @livekit/components-core - #1815 (@​1egoman)

... (truncated)

Commits

Updates maplibre-gl from 5.14.0 to 5.21.1

Release notes

Sourced from maplibre-gl's releases.

v5.21.1

🐞 Bug fixes

  • Add missing promoteId parameter to geojson worker and refactor communication object (#7320) (by @​HarelM)

v5.21.0

✨ Features and improvements

  • Add compatibility for ES2020 (#7283) (by @​claudiobgit)
  • Add referrerPolicy option to RequestParameters to allow controlling the referrer policy for tile requests (#7278) (by @​Bingtagui404)
  • Wait for the GPU to finish its callstack for rendering benchmarks (#7285) (by @​xavierjs)
  • Remove Edge 18 WebP detection workaround; always send Accept: image/webp header for image requests (#7293) (by @​johanrd)
  • Remove legacy browser compatibility code targeting IE11 and pre-2016 browsers (#7294) (by @​johanrd)
  • Remove legacy DOM.remove() and DOM.mouseButton() wrappers; use native APIs directly (baseline 2015) (#7295) (by @​johanrd)
  • Make setTransformRequest accept an async function in addition to a sync function. (#7184) (by @​kikuomax )

🐞 Bug fixes

  • Fix incorrect popup location in case of terrain and jumpTo (#7267) (by @​HarelM)
  • Fix memory leak in VideoSource: remove playing event listener and pause video on source removal (#7279) (by @​johanrd)
  • Fix memory leak where typed array views retained StructArray buffers after GPU upload, preventing garbage collection (#7280) (by @​johanrd)
  • Fix raster DEM tiles getting stuck in "reloading" state (#7284) (by @​katemihalikova)
  • Fix GeolocateControl leaking a movestart listener on the map after removal, which could also crash if the control was in active tracking state when removed (#7286) (by @​johanrd)
  • Cap tile texture reuse pool to prevent unbounded VRAM growth during rapid zoom/pan (#7289) (by @​johanrd)
  • Fix Marker click listener not removed on remove(), leaking the handler added in #7028 (#7287) (by @​johanrd)
  • Fix Terrain GPU resource leak: free FBO, textures, and meshes when terrain is disabled via setTerrain(null) (#7288) (by @​johanrd)
  • Fix guard against partial layout in PauseablePlacement (#7079) (by @​garethbowker)
  • Fix missing tile encoding for MLT queryRenderedFeatures (#7056) (by @​dannote and @​ted-piotrowski)
  • Fix 3D Tiles example (#7275) (by @​hh-hang)

v5.20.2

🐞 Bug fixes

  • Fix update GeoJSON when using diff update by updating geojson-vt package (#7257) (by @​HarelM)

v5.20.1

🐞 Bug fixes

  • Fix cannot read properties of undefined (reading 'range') by updating geojson-vt package (#7245) (by @​HarelM)
  • Fix a bug where raster-resampling: nearest was not applied as expected (#7247) (by @​yano-h)

v5.20.0

✨ Features and improvements

... (truncated)

Changelog

Sourced from maplibre-gl's changelog.

5.21.1

🐞 Bug fixes

  • Add missing promoteId parameter to geojson worker and refactor communication object (#7320) (by @​HarelM)

5.21.0

✨ Features and improvements

  • Add compatibility for ES2020 (#7283) (by @​claudiobgit)
  • Add referrerPolicy option to RequestParameters to allow controlling the referrer policy for tile requests (#7278) (by @​Bingtagui404)
  • Wait for the GPU to finish its callstack for rendering benchmarks (#7285) (by @​xavierjs)
  • Remove Edge 18 WebP detection workaround; always send Accept: image/webp header for image requests (#7293) (by @​johanrd)
  • Remove legacy browser compatibility code targeting IE11 and pre-2016 browsers (#7294) (by @​johanrd)
  • Remove legacy DOM.remove() and DOM.mouseButton() wrappers; use native APIs directly (baseline 2015) (#7295) (by @​johanrd)
  • Make setTransformRequest accept an async function in addition to a sync function. (#7184) (by @​kikuomax )

🐞 Bug fixes

  • Fix incorrect popup location in case of terrain and jumpTo (#7267) (by @​HarelM)
  • Fix memory leak in VideoSource: remove playing event listener and pause video on source removal (#7279) (by @​johanrd)
  • Fix memory leak where typed array views retained StructArray buffers after GPU upload, preventing garbage collection (#7280) (by @​johanrd)
  • Fix raster DEM tiles getting stuck in "reloading" state (#7284) (by @​katemihalikova)
  • Fix GeolocateControl leaking a movestart listener on the map after removal, which could also crash if the control was in active tracking state when removed (#7286) (by @​johanrd)
  • Cap tile texture reuse pool to prevent unbounded VRAM growth during rapid zoom/pan (#7289) (by @​johanrd)
  • Fix Marker click listener not removed on remove(), leaking the handler added in #7028 (#7287) (by @​johanrd)
  • Fix Terrain GPU resource leak: free FBO, textures, and meshes when terrain is disabled via setTerrain(null) (#7288) (by @​johanrd)
  • Fix guard against partial layout in PauseablePlacement (#7079) (by @​garethbowker)
  • Fix missing tile encoding for MLT queryRenderedFeatures (#7056) (by @​dannote and @​ted-piotrowski)
  • Fix 3D Tiles example (#7275) (by @​hh-hang)

5.20.2

🐞 Bug fixes

  • Fix update GeoJSON when using diff update by updating geojson-vt package (#7257) (by @​HarelM)

5.20.1

🐞 Bug fixes

  • Fix cannot read properties of undefined (reading 'range') by updating geojson-vt package (#7245) (by @​HarelM)
  • Fix a bug where raster-resampling: nearest was not applied as expected (#7247) (by @​yano-h)

5.20.0

✨ Features and improvements

... (truncated)

Commits
  • 1fe69fd Bump js version to 5.21.1 (#7325)
  • 1bf28ae Add missing promoteId parameter to geojson worker (#7320)
  • 1557f52 chore(deps-dev): bump canvas from 3.2.1 to 3.2.2 (#7324)
  • 73db19a chore(deps-dev): bump @​vitest/eslint-plugin in the vitest group (#7321)
  • 9eeb0fd chore(deps-dev): bump rollup from 4.59.1 to 4.60.0 (#7322)
  • a5a63bc chore(deps-dev): bump rollup from 4.59.0 to 4.59.1 (#7316)
  • a54d7a1 chore(deps): bump github/codeql-action from 4.33.0 to 4.34.1 (#7317)
  • a4c8bc8 chore(deps): bump ggilder/codecoverage from 1.3.0 to 1.3.1 (#7318)
  • a8cf500 chore(deps-dev): bump devtools-protocol from 0.0.1596832 to 0.0.1602427 (#7312)
  • 65766d2 chore(deps-dev): bump puppeteer from 24.39.1 to 24.40.0 (#7313)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for maplibre-gl since your current version.


Updates web-vitals from 5.1.0 to 5.2.0

Changelog

Sourced from web-vitals's changelog.

v5.2.0 (2026-03-25)

  • Replace filter()[0] with find() for better performance (#658)
  • Use queueMicrotask for microtask scheduling (#660)
  • Simplify the event and LoAF entry clean up logic (#662)
  • Remove obsolete FID polyfill types (#675)
  • Use LargestContentfulPaint.id as fallback when element is removed from DOM (#676)
  • Fix bug for onLCP when attached late (#697)
  • FHandle initially hidden pages and onLCP registered on visibility change (#698)
  • Ensure we clear idle callbacks in whenIdleOrHidden (#707)
  • Limit pending events to conserve memory (#710)
  • Add includeProcessedEventEntries option (#714)
  • Reduce bundle size by refactoring (#713)
Commits
Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.


Updates zustand from 5.0.9 to 5.0.12

Release notes

Sourced from zustand's releases.

v5.0.12

Two small fixes.

What's Changed

New Contributors

Full Changelog: pmndrs/zustand@v5.0.11...v5.0.12

v5.0.11

This release includes small improvements in middleware thanks to contributors.

What's Changed

New Contributors

Full Changelog: pmndrs/zustand@v5.0.10...v5.0.11

v5.0.10

This version includes a fix to the persist middleware for an edge case.

What's Changed

New Contributors

... (truncated)

Commits

Updates @playwright/test from 1.58.0 to 1.58.2

Release notes

Sourced from @​playwright/test's releases.

v1.58.2

Highlights

#39121 fix(trace viewer): make paths via stdin work #39129 fix: do not force swiftshader on chromium mac

Browser Versions

  • Chromium 145.0.7632.6
  • Mozilla Firefox 146.0.1
  • WebKit 26.0

v1.58.1

Highlights

#39036 fix(msedge): fix local network permissions #39037 chore: update cft download location #38995 chore(webkit): disable frame sessions on fronzen builds

Browser Versions

  • Chromium 145.0.7632.6
  • Mozilla Firefox 146.0.1
  • WebKit 26.0
Commits

Updates @testing-library/react from 16.3.0 to 16.3.2

Release notes

Sourced from @​testing-library/react's releases.

v16.3.2

16.3.2 (2026-01-19)

Bug Fixes

  • Update 'onCaughtError' type inference in 'RenderOptions' to work with React v19 (#1438) (f32bd1b)

v16.3.1

16.3.1 (2025-12-15)

Bug Fixes

Commits
Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for @​testing-library/react since your current version.


Updates @types/maplibre-gl from 1.13.2 to 1.14.0

Commits

Updates @vitest/coverage-v8 from 4.0.18 to 4.1.2

Release notes

Sourced from @​vitest/coverage-v8's releases.

v4.1.2

This release bumps Vitest's flatted version and removes version pinning to resolve flatted's CVE related issues (vitest-dev/vitest#9975).

   🐞 Bug Fixes

    View changes on GitHub

v4.1.1

   🚀 Features

   🐞 Bug Fixes

@dependabot
chore(deps)(deps): bump the web-dependencies group across 1 directory…
ba986f7 
… with 17 updates

Bumps the web-dependencies group with 14 updates in the /web directory:

| Package | From | To |
| --- | --- | --- |
| [i18next-browser-languagedetector](https://github.com/i18next/i18next-browser-languageDetector) | `8.2.0` | `8.2.1` |
| [livekit-client](https://github.com/livekit/client-sdk-js) | `2.16.0` | `2.18.0` |
| [maplibre-gl](https://github.com/maplibre/maplibre-gl-js) | `5.14.0` | `5.21.1` |
| [web-vitals](https://github.com/GoogleChrome/web-vitals) | `5.1.0` | `5.2.0` |
| [zustand](https://github.com/pmndrs/zustand) | `5.0.9` | `5.0.12` |
| [@playwright/test](https://github.com/microsoft/playwright) | `1.58.0` | `1.58.2` |
| [@testing-library/react](https://github.com/testing-library/react-testing-library) | `16.3.0` | `16.3.2` |
| [@types/maplibre-gl](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/maplibre-gl) | `1.13.2` | `1.14.0` |
| [@vitest/coverage-v8](https://github.com/vitest-dev/vitest/tree/HEAD/packages/coverage-v8) | `4.0.18` | `4.1.2` |
| [autoprefixer](https://github.com/postcss/autoprefixer) | `10.4.22` | `10.4.27` |
| [eslint-plugin-react-refresh](https://github.com/ArnaudBarre/eslint-plugin-react-refresh) | `0.4.24` | `0.5.2` |
| [msw](https://github.com/mswjs/msw) | `2.12.7` | `2.12.14` |
| [postcss](https://github.com/postcss/postcss) | `8.5.6` | `8.5.8` |
| [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint) | `8.49.0` | `8.57.2` |



Updates `i18next-browser-languagedetector` from 8.2.0 to 8.2.1
- [Changelog](https://github.com/i18next/i18next-browser-languageDetector/blob/master/CHANGELOG.md)
- [Commits](i18next/i18next-browser-languageDetector@v8.2.0...v8.2.1)

Updates `livekit-client` from 2.16.0 to 2.18.0
- [Release notes](https://github.com/livekit/client-sdk-js/releases)
- [Changelog](https://github.com/livekit/client-sdk-js/blob/main/CHANGELOG.md)
- [Commits](livekit/client-sdk-js@v2.16.0...v2.18.0)

Updates `maplibre-gl` from 5.14.0 to 5.21.1
- [Release notes](https://github.com/maplibre/maplibre-gl-js/releases)
- [Changelog](https://github.com/maplibre/maplibre-gl-js/blob/main/CHANGELOG.md)
- [Commits](maplibre/maplibre-gl-js@v5.14.0...v5.21.1)

Updates `web-vitals` from 5.1.0 to 5.2.0
- [Changelog](https://github.com/GoogleChrome/web-vitals/blob/main/CHANGELOG.md)
- [Commits](GoogleChrome/web-vitals@v5.1.0...v5.2.0)

Updates `zustand` from 5.0.9 to 5.0.12
- [Release notes](https://github.com/pmndrs/zustand/releases)
- [Commits](pmndrs/zustand@v5.0.9...v5.0.12)

Updates `@playwright/test` from 1.58.0 to 1.58.2
- [Release notes](https://github.com/microsoft/playwright/releases)
- [Commits](microsoft/playwright@v1.58.0...v1.58.2)

Updates `@testing-library/react` from 16.3.0 to 16.3.2
- [Release notes](https://github.com/testing-library/react-testing-library/releases)
- [Changelog](https://github.com/testing-library/react-testing-library/blob/main/CHANGELOG.md)
- [Commits](testing-library/react-testing-library@v16.3.0...v16.3.2)

Updates `@types/maplibre-gl` from 1.13.2 to 1.14.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/maplibre-gl)

Updates `@vitest/coverage-v8` from 4.0.18 to 4.1.2
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.2/packages/coverage-v8)

Updates `@vitest/ui` from 4.0.18 to 4.1.2
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.2/packages/ui)

Updates `autoprefixer` from 10.4.22 to 10.4.27
- [Release notes](https://github.com/postcss/autoprefixer/releases)
- [Changelog](https://github.com/postcss/autoprefixer/blob/main/CHANGELOG.md)
- [Commits](postcss/autoprefixer@10.4.22...10.4.27)

Updates `eslint-plugin-react-refresh` from 0.4.24 to 0.5.2
- [Release notes](https://github.com/ArnaudBarre/eslint-plugin-react-refresh/releases)
- [Changelog](https://github.com/ArnaudBarre/eslint-plugin-react-refresh/blob/main/CHANGELOG.md)
- [Commits](ArnaudBarre/eslint-plugin-react-refresh@v0.4.24...v0.5.2)

Updates `msw` from 2.12.7 to 2.12.14
- [Release notes](https://github.com/mswjs/msw/releases)
- [Changelog](https://github.com/mswjs/msw/blob/main/CHANGELOG.md)
- [Commits](mswjs/msw@v2.12.7...v2.12.14)

Updates `playwright` from 1.58.0 to 1.58.2
- [Release notes](https://github.com/microsoft/playwright/releases)
- [Commits](microsoft/playwright@v1.58.0...v1.58.2)

Updates `postcss` from 8.5.6 to 8.5.8
- [Release notes](https://github.com/postcss/postcss/releases)
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md)
- [Commits](postcss/postcss@8.5.6...8.5.8)

Updates `typescript-eslint` from 8.49.0 to 8.57.2
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.57.2/packages/typescript-eslint)

Updates `vitest` from 4.0.18 to 4.1.2
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.2/packages/vitest)

---
updated-dependencies:
- dependency-name: i18next-browser-languagedetector
  dependency-version: 8.2.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: web-dependencies
- dependency-name: livekit-client
  dependency-version: 2.18.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: web-dependencies
- dependency-name: maplibre-gl
  dependency-version: 5.21.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: web-dependencies
- dependency-name: web-vitals
  dependency-version: 5.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: web-dependencies
- dependency-name: zustand
  dependency-version: 5.0.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: web-dependencies
- dependency-name: "@playwright/test"
  dependency-version: 1.58.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: web-dependencies
- dependency-name: "@testing-library/react"
  dependency-version: 16.3.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: web-dependencies
- dependency-name: "@types/maplibre-gl"
  dependency-version: 1.14.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: web-dependencies
- dependency-name: "@vitest/coverage-v8"
  dependency-version: 4.1.2
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: web-dependencies
- dependency-name: "@vitest/ui"
  dependency-version: 4.1.2
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: web-dependencies
- dependency-name: autoprefixer
  dependency-version: 10.4.27
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: web-dependencies
- dependency-name: eslint-plugin-react-refresh
  dependency-version: 0.5.2
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: web-dependencies
- dependency-name: msw
  dependency-version: 2.12.14
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: web-dependencies
- dependency-name: playwright
  dependency-version: 1.58.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: web-dependencies
- dependency-name: postcss
  dependency-version: 8.5.8
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: web-dependencies
- dependency-name: typescript-eslint
  dependency-version: 8.57.2
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: web-dependencies
- dependency-name: vitest
  dependency-version: 4.1.2
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: web-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Mar 30, 2026
@dependabot @github
Copy link
Copy Markdown
Author

dependabot Bot commented on behalf of github Mar 30, 2026

Labels

The following labels could not be found: frontend, npm, security. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@github-actions
Copy link
Copy Markdown

github-actions Bot commented Mar 30, 2026

NPM Vulnerability Scan Results - e2e

Severity Count
Critical 0
High 1
Moderate 0
Low 1
Total 2
Click to see details 
# npm audit report

path-to-regexp  <0.1.13
Severity: high
path-to-regexp vulnerable to Regular Expression Denial of Service via multiple route parameters - https://github.com/advisories/GHSA-37ch-88jc-xwx2
fix available via `npm audit fix`
node_modules/path-to-regexp

qs  6.7.0 - 6.14.1
qs's arrayLimit bypass in comma parsing allows denial of service - https://github.com/advisories/GHSA-w7fw-mjwx-w883
fix available via `npm audit fix`
node_modules/qs

2 vulnerabilities (1 low, 1 high)

To address all issues, run:
  npm audit fix

@github-actions
Copy link
Copy Markdown

github-actions Bot commented Mar 30, 2026

NPM Vulnerability Scan Results - web

Severity Count
Critical 0
High 3
Moderate 2
Low 0
Total 5
Click to see details 
# npm audit report

ajv  <6.14.0
Severity: moderate
ajv has ReDoS when using `$data` option - https://github.com/advisories/GHSA-2g4f-4pwh-qvx6
fix available via `npm audit fix`
node_modules/ajv

brace-expansion  <1.1.13
Severity: moderate
brace-expansion: Zero-step sequence causes process hang and memory exhaustion - https://github.com/advisories/GHSA-f886-m6hf-6m8v
fix available via `npm audit fix`
node_modules/brace-expansion

minimatch  <=3.1.3
Severity: high
minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern - https://github.com/advisories/GHSA-3ppc-4f35-3m26
minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments - https://github.com/advisories/GHSA-7r86-cg39-jmmj
minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions - https://github.com/advisories/GHSA-23c5-xmqv-rm74
fix available via `npm audit fix`
node_modules/minimatch

picomatch  <=2.3.1 || 4.0.0 - 4.0.3
Severity: high
Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching - https://github.com/advisories/GHSA-3v7f-55p6-f55p
Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching - https://github.com/advisories/GHSA-3v7f-55p6-f55p
Picomatch has a ReDoS vulnerability via extglob quantifiers - https://github.com/advisories/GHSA-c2c7-rcm5-vvqj
Picomatch has a ReDoS vulnerability via extglob quantifiers - https://github.com/advisories/GHSA-c2c7-rcm5-vvqj
fix available via `npm audit fix`
node_modules/picomatch
node_modules/rollup-plugin-visualizer/node_modules/picomatch
node_modules/tinyglobby/node_modules/picomatch
node_modules/vite/node_modules/picomatch
node_modules/vitest/node_modules/picomatch

rollup  4.0.0 - 4.58.0
Severity: high
Rollup 4 has Arbitrary File Write via Path Traversal - https://github.com/advisories/GHSA-mw96-cpmx-2vgc
fix available via `npm audit fix`
node_modules/rollup

5 vulnerabilities (2 moderate, 3 high)

To address all issues, run:
  npm audit fix

@github-actions
Copy link
Copy Markdown

github-actions Bot commented Mar 30, 2026

Docker Image Scan Results - Dockerfile.frontend

Image: subcults-frontend:scan

Severity Count
Critical 0
High 0
Medium 3
Low 3
Total 6
Click to see details 

Report Summary

┌────────────────────────────────────────┬────────┬─────────────────┬─────────┐
│                 Target                 │  Type  │ Vulnerabilities │ Secrets │
├────────────────────────────────────────┼────────┼─────────────────┼─────────┤
│ subcults-frontend:scan (alpine 3.19.9) │ alpine │        6        │    -    │
└────────────────────────────────────────┴────────┴─────────────────┴─────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)


For OSS Maintainers: VEX Notice
--------------------------------
If you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement.
VEX allows you to communicate the actual status of vulnerabilities in your project, improving security transparency and reducing false positives for your users.
Learn more and start using VEX: https://trivy.dev/docs/v0.69/guide/supply-chain/vex/repo#publishing-vex-documents

To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable.


subcults-frontend:scan (alpine 3.19.9)
======================================
Total: 6 (LOW: 3, MEDIUM: 3, HIGH: 0, CRITICAL: 0)

┌───────────────┬────────────────┬──────────┬────────┬───────────────────┬───────────────┬──────────────────────────────────────────────────────────────┐
│    Library    │ Vulnerability  │ Severity │ Status │ Installed Version │ Fixed Version │                            Title                             │
├───────────────┼────────────────┼──────────┼────────┼───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ busybox       │ CVE-2024-58251 │ MEDIUM   │ fixed  │ 1.36.1-r20        │ 1.36.1-r21    │ In netstat in BusyBox through 1.37.0, local users can launch │
│               │                │          │        │                   │               │ of networ...                                                 │
│               │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2024-58251                   │
│               ├────────────────┼──────────┤        │                   │               ├──────────────────────────────────────────────────────────────┤
│               │ CVE-2025-46394 │ LOW      │        │                   │               │ In tar in BusyBox through 1.37.0, a TAR archive can have     │
│               │                │          │        │                   │               │ filenames...                                                 │
│               │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2025-46394                   │
├───────────────┼────────────────┼──────────┤        │                   │               ├──────────────────────────────────────────────────────────────┤
│ busybox-binsh │ CVE-2024-58251 │ MEDIUM   │        │                   │               │ In netstat in BusyBox through 1.37.0, local users can launch │
│               │                │          │        │                   │               │ of networ...                                                 │
│               │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2024-58251                   │
│               ├────────────────┼──────────┤        │                   │               ├──────────────────────────────────────────────────────────────┤
│               │ CVE-2025-46394 │ LOW      │        │                   │               │ In tar in BusyBox through 1.37.0, a TAR archive can have     │
│               │                │          │        │                   │               │ filenames...                                                 │
│               │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2025-46394                   │
├───────────────┼────────────────┼──────────┤        │                   │               ├──────────────────────────────────────────────────────────────┤
│ ssl_client    │ CVE-2024-58251 │ MEDIUM   │        │                   │               │ In netstat in BusyBox through 1.37.0, local users can launch │
│               │                │          │        │                   │               │ of networ...                                                 │
│               │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2024-58251                   │
│               ├────────────────┼──────────┤        │                   │               ├──────────────────────────────────────────────────────────────┤
│               │ CVE-2025-46394 │ LOW      │        │                   │               │ In tar in BusyBox through 1.37.0, a TAR archive can have     │
│               │                │          │        │                   │               │ filenames...                                                 │
│               │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2025-46394                   │
└───────────────┴────────────────┴──────────┴────────┴───────────────────┴───────────────┴──────────────────────────────────────────────────────────────┘

@github-actions
Copy link
Copy Markdown

github-actions Bot commented Mar 30, 2026

Docker Image Scan Results - Dockerfile.indexer

Image: subcults-indexer:scan

Severity Count
Critical 1
High 2
Medium 1
Low 1
Total 5
Click to see details 

Report Summary

┌──────────────────────────────────────┬──────────┬─────────────────┬─────────┐
│                Target                │   Type   │ Vulnerabilities │ Secrets │
├──────────────────────────────────────┼──────────┼─────────────────┼─────────┤
│ subcults-indexer:scan (debian 12.13) │  debian  │        0        │    -    │
├──────────────────────────────────────┼──────────┼─────────────────┼─────────┤
│ app/indexer                          │ gobinary │        5        │    -    │
└──────────────────────────────────────┴──────────┴─────────────────┴─────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)


For OSS Maintainers: VEX Notice
--------------------------------
If you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement.
VEX allows you to communicate the actual status of vulnerabilities in your project, improving security transparency and reducing false positives for your users.
Learn more and start using VEX: https://trivy.dev/docs/v0.69/guide/supply-chain/vex/repo#publishing-vex-documents

To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable.


app/indexer (gobinary)
======================
Total: 5 (LOW: 1, MEDIUM: 1, HIGH: 2, CRITICAL: 1)

┌──────────────────────────────┬────────────────┬──────────┬────────┬───────────────────┬────────────────┬─────────────────────────────────────────────────────────────┐
│           Library            │ Vulnerability  │ Severity │ Status │ Installed Version │ Fixed Version  │                            Title                            │
├──────────────────────────────┼────────────────┼──────────┼────────┼───────────────────┼────────────────┼─────────────────────────────────────────────────────────────┤
│ go.opentelemetry.io/otel/sdk │ CVE-2026-24051 │ HIGH     │ fixed  │ v1.38.0           │ 1.40.0         │ OpenTelemetry Go SDK Vulnerable to Arbitrary Code Execution │
│                              │                │          │        │                   │                │ via PATH Hijacking                                          │
│                              │                │          │        │                   │                │ https://avd.aquasec.com/nvd/cve-2026-24051                  │
├──────────────────────────────┼────────────────┼──────────┤        ├───────────────────┼────────────────┼─────────────────────────────────────────────────────────────┤
│ google.golang.org/grpc       │ CVE-2026-33186 │ CRITICAL │        │ v1.77.0           │ 1.79.3         │ gRPC-Go has an authorization bypass via missing leading     │
│                              │                │          │        │                   │                │ slash in :path                                              │
│                              │                │          │        │                   │                │ https://avd.aquasec.com/nvd/cve-2026-33186                  │
├──────────────────────────────┼────────────────┼──────────┤        ├───────────────────┼────────────────┼─────────────────────────────────────────────────────────────┤
│ stdlib                       │ CVE-2026-25679 │ HIGH     │        │ v1.24.13          │ 1.25.8, 1.26.1 │ net/url: Incorrect parsing of IPv6 host literals in net/url │
│                              │                │          │        │                   │                │ https://avd.aquasec.com/nvd/cve-2026-25679                  │
│                              ├────────────────┼──────────┤        │                   │                ├─────────────────────────────────────────────────────────────┤
│                              │ CVE-2026-27142 │ MEDIUM   │        │                   │                │ html/template: URLs in meta content attribute actions are   │
│                              │                │          │        │                   │                │ not escaped in html/template...                             │
│                              │                │          │        │                   │                │ https://avd.aquasec.com/nvd/cve-2026-27142                  │
│                              ├────────────────┼──────────┤        │                   │                ├─────────────────────────────────────────────────────────────┤
│                              │ CVE-2026-27139 │ LOW      │        │                   │                │ os: FileInfo can escape from a Root in golang os module     │
│                              │                │          │        │                   │                │ https://avd.aquasec.com/nvd/cve-2026-27139                  │
└──────────────────────────────┴────────────────┴──────────┴────────┴───────────────────┴────────────────┴─────────────────────────────────────────────────────────────┘

@dependabot @github
Copy link
Copy Markdown
Author

dependabot Bot commented on behalf of github Apr 6, 2026

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Apr 6, 2026
@dependabot dependabot Bot deleted the dependabot/npm_and_yarn/web/web-dependencies-ac23363b48 branch April 6, 2026 09:43
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants