chore(deps-dev)(deps-dev): bump express from 4.22.1 to 5.2.1 in /e2e by dependabot[bot] · Pull Request #7 · PatrickFanella/subcults

dependabot · 2026-03-17T21:33:59Z

Bumps express from 4.22.1 to 5.2.1.

Release notes

v5.2.1

What's Changed

[!IMPORTANT]
The prior release (5.2.0) included an erroneous breaking change related to the extended query parser. There is no actual security vulnerability associated with this behavior (CVE-2024-51999 has been rejected). The change has been fully reverted in this release.

Release: 5.2.1 by @UlisesGascon in expressjs/express#6933

Full Changelog: expressjs/express@v5.2.0...v5.2.1

v5.2.0

Important: Security

Security fix for CVE-2024-51999 (GHSA-pj86-cfqh-vqx6)

What's Changed

build(deps): bump github/codeql-action from 3.28.11 to 3.28.13 by @dependabot[bot] in expressjs/express#6429

Refactor: simplify acceptsLanguages implementation using spread operator by @Ayoub-Mabrouk in expressjs/express#6137

increased code coverage of utils.js file by @ashish3011 in expressjs/express#6386

chore: remove duplicate word by @dufucun in expressjs/express#6456

build(deps): bump github/codeql-action from 3.28.13 to 3.28.16 by @dependabot[bot] in expressjs/express#6498

build(deps): bump actions/setup-node from 4.3.0 to 4.4.0 by @dependabot[bot] in expressjs/express#6497

build(deps): bump actions/download-artifact from 4.2.1 to 4.3.0 by @dependabot[bot] in expressjs/express#6496

ci: add node.js 24 to test matrix by @Phillip9587 in expressjs/express#6504

ci: update codeql config by @Phillip9587 in expressjs/express#6488

chore: wider range for query test skip by @jonchurch in expressjs/express#6512

chore: fix typos in test by @noritaka1166 in expressjs/express#6535

ci: disable credential persistence for checkout actions by @mertssmnoglu in expressjs/express#6522

ci: allow manual triggering of workflow by @shivarm in expressjs/express#6515

test: add coverage for app.listen() variants by @kgarg1 in expressjs/express#6476

docs: move documentation and charters to the discussions and .github … by @bjohansebas in expressjs/express#6427

build(deps): bump github/codeql-action from 3.28.16 to 3.28.18 by @dependabot[bot] in expressjs/express#6549

build(deps): bump ossf/scorecard-action from 2.4.1 to 2.4.2 by @dependabot[bot] in expressjs/express#6548

chore: enforce explicit Buffer import and add lint rule by @shivarm in expressjs/express#6525

chore: use node protocol for querystring by @shivarm in expressjs/express#6520

chore: fix typo by @mountdisk in expressjs/express#6609

build(deps): bump github/codeql-action from 3.28.18 to 3.29.2 by @dependabot[bot] in expressjs/express#6618

add deprecation warnings for redirect arguments undefined by @bjohansebas in expressjs/express#6405

ci: run CI when the markdown changes by @bjohansebas in expressjs/express#6632

doc: fix CONTRIBUTING link by @jonchurch in expressjs/express#6653

doc: update contributing guidelines and code of conduct links by @ShubhamOulkar in expressjs/express#6601

build(deps-dev): bump morgan from 1.10.0 to 1.10.1 by @dependabot[bot] in expressjs/express#6679

build(deps-dev): bump cookie-session from 2.1.0 to 2.1.1 by @dependabot[bot] in expressjs/express#6678

lint: add --fix flag to automatic fix linting issue by @shivarm in expressjs/express#6644

chore: ignore yarn.lock file and update example by @shivarm in expressjs/express#6588

lib: use req.socket over deprecated req.connection by @bjohansebas in expressjs/express#6705

doc: update express app example by @shivarm in expressjs/express#6718

build(deps): bump github/codeql-action from 3.29.2 to 3.29.5 by @dependabot[bot] in expressjs/express#6675

Remove history.md from being packaged on publish by @sheplu in expressjs/express#6780

... (truncated)

Changelog

Sourced from express's changelog.

5.2.1 / 2025-12-01

Revert security fix for CVE-2024-51999 (GHSA-pj86-cfqh-vqx6)

The prior release (5.2.0) included an erroneous breaking change related to the extended query parser. There is no actual security vulnerability associated with this behavior (CVE-2024-51999 has been rejected). The change has been fully reverted in this release.

5.2.0 / 2025-12-01

Security fix for CVE-2024-51999 (GHSA-pj86-cfqh-vqx6)

deps: body-parser@^2.2.1

A deprecation warning was added when using res.redirect with undefined arguments, Express now emits a warning to help detect calls that pass undefined as the status or URL and make them easier to fix.

5.1.0 / 2025-03-31

Add support for Uint8Array in res.send()

Add support for ETag option in res.sendFile()

Add support for multiple links with the same rel in res.links()

Add funding field to package.json

perf: use loop for acceptParams

refactor: prefix built-in node module imports

deps: remove setprototypeof

deps: remove safe-buffer

deps: remove utils-merge

deps: remove methods

deps: remove depd

deps: debug@^4.4.0

deps: body-parser@^2.2.0

deps: router@^2.2.0

deps: content-type@^1.0.5

deps: finalhandler@^2.1.0

deps: qs@^6.14.0

deps: server-static@2.2.0

deps: type-is@2.0.1

5.0.1 / 2024-10-08

Update cookie semver lock to address CVE-2024-47764

5.0.0 / 2024-09-10

remove:

path-is-absolute dependency - use path.isAbsolute instead

breaking:

res.status() accepts only integers, and input must be greater than 99 and less than 1000

will throw a RangeError: Invalid status code: ${code}. Status code must be greater than 99 and less than 1000. for inputs outside this range

will throw a TypeError: Invalid status code: ${code}. Status code must be an integer. for non integer inputs

deps: send@1.0.0

... (truncated)

Commits

dbac741 5.2.1
697547c Revert "sec: security patch for CVE-2024-51999"
4007ad1 Release: 5.2.0 (#6920)
2f64f68 sec: security patch for CVE-2024-51999
ed0ba3f build(deps): bump actions/checkout from 5.0.0 to 6.0.0 (#6928)
8eace46 build(deps): bump github/codeql-action from 4.31.2 to 4.31.6 (#6929)
30bae81 build(deps): bump coverallsapp/github-action from 2.3.6 to 2.3.7 (#6930)
758d435 deps: body-parser@^2.2.1 (#6922)
77bcd52 docs: update emeritus triagers (#6890)
f33caf1 Nominate to @efekrskl for triage team (#6888)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [express](https://github.com/expressjs/express) from 4.22.1 to 5.2.1. - [Release notes](https://github.com/expressjs/express/releases) - [Changelog](https://github.com/expressjs/express/blob/master/History.md) - [Commits](expressjs/express@v4.22.1...v5.2.1) --- updated-dependencies: - dependency-name: express dependency-version: 5.2.1 dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-03-17T21:34:00Z

Labels

The following labels could not be found: dependencies, e2e, npm, security. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

github-actions · 2026-03-17T21:43:50Z

NPM Vulnerability Scan Results - web

Severity	Count
Critical	0
High	3
Moderate	1
Low	0
Total	4

Click to see details

# npm audit report

ajv  <6.14.0
Severity: moderate
ajv has ReDoS when using `$data` option - https://github.com/advisories/GHSA-2g4f-4pwh-qvx6
fix available via `npm audit fix`
node_modules/ajv

flatted  <3.4.0
Severity: high
flatted vulnerable to unbounded recursion DoS in parse() revive phase - https://github.com/advisories/GHSA-25h7-pfq9-p65f
fix available via `npm audit fix`
node_modules/flatted

minimatch  <=3.1.3 || 9.0.0 - 9.0.6
Severity: high
minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern - https://github.com/advisories/GHSA-3ppc-4f35-3m26
minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern - https://github.com/advisories/GHSA-3ppc-4f35-3m26
minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments - https://github.com/advisories/GHSA-7r86-cg39-jmmj
minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments - https://github.com/advisories/GHSA-7r86-cg39-jmmj
minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions - https://github.com/advisories/GHSA-23c5-xmqv-rm74
minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions - https://github.com/advisories/GHSA-23c5-xmqv-rm74
fix available via `npm audit fix`
node_modules/@typescript-eslint/typescript-estree/node_modules/minimatch
node_modules/minimatch

rollup  4.0.0 - 4.58.0
Severity: high
Rollup 4 has Arbitrary File Write via Path Traversal - https://github.com/advisories/GHSA-mw96-cpmx-2vgc
fix available via `npm audit fix`
node_modules/rollup

4 vulnerabilities (1 moderate, 3 high)

To address all issues, run:
  npm audit fix

github-actions · 2026-03-17T21:48:50Z

Go Vulnerability Scan Results

Found 299 vulnerability/vulnerabilities

Details:

=== Symbol Results ===

Vulnerability #1: GO-2026-4603
URLs in meta content attribute actions are not escaped in html/template
More info: https://pkg.go.dev/vuln/GO-2026-4603
Standard library
Found in: html/template@go1.24.12
Fixed in: html/template@go1.25.8
Example traces found:
#1: cmd/api/main.go:1310:34: api.main calls http.Server.ListenAndServe, which eventually calls template.Template.Execute
#2: cmd/api/main.go:1310:34: api.main calls http.Server.ListenAndServe, which eventually calls template.Template.ExecuteTemplate

Vulnerability #2: GO-2026-4602
FileInfo can escape from a Root in os
More info: https://pkg.go.dev/vuln/GO-2026-4602
Standard library
Found in: os@go1.24.12
Fixed in: os@go1.25.8
Example traces found:
#1: internal/tracing/tracing.go:225:25: tracing.Provider.Shutdown calls trace.TracerProvider.Shutdown, which eventually calls os.ReadDir

Vulnerability #3: GO-2026-4601
Incorrect parsing of IPv6 host literals in net/url
More info: https://pkg.go.dev/vuln/GO-2026-4601
Standard library
Found in: net/url@go1.24.12
Fixed in: net/url@go1.25.8
Example traces found:
#1: internal/api/payment_handlers.go:223:24: api.PaymentHandlers.CreateCheckoutSession calls url.Parse
#2: cmd/api/main.go:1310:34: api.main calls http.Server.ListenAndServe, which eventually calls url.ParseRequestURI
#3: internal/health/livekit.go:44:25: health.LiveKitChecker.HealthCheck calls http.Client.Do, which eventually calls url.URL.Parse

Vulnerability #4: GO-2026-4394
OpenTelemetry Go SDK Vulnerable to Arbitrary Code Execution via PATH
Hijacking in go.opentelemetry.io/otel/sdk
More info: https://pkg.go.dev/vuln/GO-2026-4394
Module: go.opentelemetry.io/otel/sdk
Found in: go.opentelemetry.io/otel/sdk@v1.38.0
Fixed in: go.opentelemetry.io/otel/sdk@v1.40.0
Example traces found:
#1: internal/tracing/tracing.go:111:23: tracing.NewProvider calls trace.WithBatcher, which eventually calls env.BatchSpanProcessorExportTimeout
#2: internal/tracing/tracing.go:111:23: tracing.NewProvider calls trace.WithBatcher, which eventually calls env.BatchSpanProcessorMaxExportBatchSize
#3: internal/tracing/tracing.go:111:23: tracing.NewProvider calls trace.WithBatcher, which eventually calls env.BatchSpanProcessorMaxQueueSize
#4: internal/tracing/tracing.go:111:23: tracing.NewProvider calls trace.WithBatcher, which eventually calls env.BatchSpanProcessorScheduleDelay
#5: internal/tracing/tracing.go:108:34: tracing.NewProvider calls trace.NewTracerProvider, which eventually calls env.SpanAttributeCount
#6: internal/tracing/tracing.go:108:34: tracing.NewProvider calls trace.NewTracerProvider, which eventually calls env.SpanAttributeValueLength
#7: internal/tracing/tracing.go:108:34: tracing.NewProvider calls trace.NewTracerProvider, which eventually calls env.SpanEventAttributeCount
#8: internal/tracing/tracing.go:108:34: tracing.NewProvider calls trace.NewTracerProvider, which eventually calls env.SpanEventCount
#9: internal/tracing/tracing.go:108:34: tracing.NewProvider calls trace.NewTracerProvider, which eventually calls env.SpanLinkAttributeCount
#10: internal/tracing/tracing.go:108:34: tracing.NewProvider calls trace.NewTracerProvider, which eventually calls env.SpanLinkCount
#11: internal/tracing/tracing.go:19:2: tracing.init calls trace.init, which calls env.init
#12: internal/tracing/tracing.go:19:2: tracing.init calls trace.init, which calls instrumentation.init
#13: internal/tracing/tracing.go:225:25: tracing.Provider.Shutdown calls trace.TracerProvider.Shutdown, which eventually calls resource.Default
#14: internal/tracing/tracing.go:108:34: tracing.NewProvider calls trace.NewTracerProvider, which eventually calls resource.Default
#15: internal/tracing/tracing.go:108:34: tracing.NewProvider calls trace.NewTracerProvider, which eventually calls resource.Environment
#16: internal/tracing/tracing.go:108:34: tracing.NewProvider calls trace.NewTracerProvider, which eventually calls resource.Merge
#17: internal/tracing/tracing.go:71:26: tracing.NewProvider calls resource.New
#18: internal/tracing/tracing.go:19:2: tracing.init calls trace.init, which eventually calls resource.NewSchemaless
#19: internal/tracing/tracing.go:111:23: tracing.NewProvider calls trace.WithBatcher, which eventually calls resource.Resource.Equivalent
#20: internal/tracing/tracing.go:111:23: tracing.NewProvider calls trace.WithBatcher, which eventually calls resource.Resource.Iter
#21: internal/tracing/tracing.go:111:23: tracing.NewProvider calls trace.WithBatcher, which eventually calls resource.Resource.SchemaURL
#22: internal/tracing/tracing.go:73:26: tracing.NewProvider calls resource.WithAttributes
#23: internal/tracing/tracing.go:18:2: tracing.init calls resource.init
#24: internal/tracing/tracing.go:236:20: tracing.Provider.Tracer calls trace.TracerProvider.Tracer, which eventually calls sdk.Version
#25: internal/tracing/tracing.go:19:2: tracing.init calls trace.init, which calls sdk.init
#26: internal/tracing/tracing.go:100:34: tracing.NewProvider calls trace.AlwaysSample
#27: internal/tracing/tracing.go:102:33: tracing.NewProvider calls trace.NeverSample
#28: internal/tracing/tracing.go:108:34: tracing.NewProvider calls trace.NewTracerProvider
#29: internal/health/livekit.go:48:1: health.LiveKitChecker.HealthCheck calls http.http2requestBody.Close, which eventually calls trace.Shutdown
#30: internal/health/livekit.go:48:1: health.LiveKitChecker.HealthCheck calls http.http2requestBody.Close, which eventually calls trace.Shutdown
#31: internal/tracing/tracing.go:104:39: tracing.NewProvider calls trace.TraceIDRatioBased
#32: internal/tracing/tracing.go:225:25: tracing.Provider.Shutdown calls trace.TracerProvider.Shutdown
#33: internal/tracing/tracing.go:236:20: tracing.Provider.Tracer calls trace.TracerProvider.Tracer
#34: internal/tracing/tracing.go:112:29: tracing.NewProvider calls trace.WithBatchTimeout
#35: internal/tracing/tracing.go:111:23: tracing.NewProvider calls trace.WithBatcher
#36: internal/tracing/tracing.go:113:35: tracing.NewProvider calls trace.WithMaxExportBatchSize
#37: internal/tracing/tracing.go:109:24: tracing.NewProvider calls trace.WithResource
#38: internal/tracing/tracing.go:110:23: tracing.NewProvider calls trace.WithSampler
#39: internal/indexer/repository.go:235:34: indexer.PostgresRecordRepository.DeleteRecord calls trace.errUnsupportedSampler.Error
#40: internal/tracing/tracing.go:19:2: tracing.init calls trace.init
#41: internal/health/livekit.go:48:1: health.LiveKitChecker.HealthCheck calls http.http2requestBody.Close, which eventually calls trace.init
#42: internal/health/livekit.go:48:1: health.LiveKitChecker.HealthCheck calls http.http2requestBody.Close, which eventually calls trace.logDropped[go.opentelemetry.io/otel/sdk/trace.Event]
#43: internal/health/livekit.go:48:1: health.LiveKitChecker.HealthCheck calls http.http2requestBody.Close, which eventually calls trace.logDropped[go.opentelemetry.io/otel/sdk/trace.Link]
#44: internal/tracing/helpers.go:91:15: tracing.AddEvent calls trace.nonRecordingSpan.AddEvent
#45: internal/health/livekit.go:48:1: health.LiveKitChecker.HealthCheck calls otelhttp.wrappedBody.Close, which calls trace.nonRecordingSpan.End
#46: internal/tracing/helpers.go:77:27: tracing.StartSpan calls noop.Tracer.Start, which calls trace.nonRecordingSpan.IsRecording
#47: internal/tracing/helpers.go:81:20: tracing.StartSpan calls trace.nonRecordingSpan.RecordError
#48: internal/tracing/helpers.go:97:20: tracing.SetAttributes calls trace.nonRecordingSpan.SetAttributes
#49: cmd/api/main.go:1310:34: api.main calls http.Server.ListenAndServe, which eventually calls trace.nonRecordingSpan.SetName
#50: internal/tracing/helpers.go:82:18: tracing.StartSpan calls trace.nonRecordingSpan.SetStatus
#51: internal/middleware/tracing.go:55:41: middleware.GetSpanID calls trace.SpanContextFromContext, which calls trace.nonRecordingSpan.SpanContext
#52: internal/health/livekit.go:44:25: health.LiveKitChecker.HealthCheck calls http.Client.Do, which eventually calls trace.nonRecordingSpan.TracerProvider
#53: internal/tracing/helpers.go:91:15: tracing.AddEvent calls trace.recordingSpan.AddEvent
#54: internal/health/livekit.go:48:1: health.LiveKitChecker.HealthCheck calls otelhttp.wrappedBody.Close, which calls trace.recordingSpan.End
#55: internal/tracing/helpers.go:77:27: tracing.StartSpan calls noop.Tracer.Start, which calls trace.recordingSpan.IsRecording
#56: internal/tracing/helpers.go:81:20: tracing.StartSpan calls trace.recordingSpan.RecordError
#57: internal/tracing/helpers.go:97:20: tracing.SetAttributes calls trace.recordingSpan.SetAttributes
#58: cmd/api/main.go:1310:34: api.main calls http.Server.ListenAndServe, which eventually calls trace.recordingSpan.SetName
#59: internal/tracing/helpers.go:82:18: tracing.StartSpan calls trace.recordingSpan.SetStatus
#60: internal/middleware/tracing.go:55:41: middleware.GetSpanID calls trace.SpanContextFromContext, which calls trace.recordingSpan.SpanContext
#61: internal/health/livekit.go:44:25: health.LiveKitChecker.HealthCheck calls http.Client.Do, which eventually calls trace.recordingSpan.TracerProvider
#62: internal/indexer/repository.go:235:34: indexer.PostgresRecordRepository.DeleteRecord calls trace.samplerArgParseError.Error
#63: internal/api/stream_handlers.go:1530:15: api.StreamHandlers.LockStream calls errors.Is, which eventually calls trace.samplerArgParseError.Unwrap
#64: internal/tracing/helpers.go:77:27: tracing.StartSpan calls trace.tracer.Start
#65: internal/tracing/tracing.go:121:27: tracing.NewProvider calls otel.SetTextMapPropagator, which eventually calls trace.tracerProviderConfig.MarshalLog
#66: internal/tracing/tracing.go:236:20: tracing.Provider.Tracer calls trace.TracerProvider.Tracer, which eventually calls x.Feature[string].Enabled[string]
#67: internal/tracing/tracing.go:225:25: tracing.Provider.Shutdown calls trace.TracerProvider.Shutdown, which eventually calls x.Feature[string].Enabled[string]
#68: internal/tracing/tracing.go:18:2: tracing.init calls resource.init, which calls x.init
#69: internal/tracing/tracing.go:19:2: tracing.init calls trace.init, which calls x.init

Vulnerability #5: GO-2026-4337
Unexpected session resumption in crypto/tls
More info: https://pkg.go.dev/vuln/GO-2026-4337
Standard library
Found in: crypto/tls@go1.24.12
Fixed in: crypto/tls@go1.24.13
Example traces found:
#1: internal/stream/quality_metrics_repository.go:209:15: stream.PostgresQualityMetricsRepository.GetParticipantsWithHighPacketLoss calls sql.Rows.Next, which eventually calls tls.Conn.Handshake
#2: internal/indexer/client.go:208:36: indexer.Client.connect calls websocket.Dialer.DialContext, which eventually calls tls.Conn.HandshakeContext
#3: internal/indexer/car.go:102:23: indexer.CARReader.ReadByte calls io.ReadFull, which eventually calls tls.Conn.Read
#4: examples/jwt-rotation-integration.go:45:12: examples.main calls fmt.Printf, which eventually calls tls.Conn.Write
#5: cmd/api/main.go:345:32: api.main calls redis.NewClient, which eventually calls tls.DialWithDialer
#6: internal/health/livekit.go:44:25: health.LiveKitChecker.HealthCheck calls http.Client.Do, which eventually calls tls.Dialer.DialContext

Your code is affected by 5 vulnerabilities from 1 module and the Go standard library.
This scan found no other vulnerabilities in packages you import or modules you
require.
Use '-show verbose' for more details.

github-actions · 2026-03-17T21:51:20Z

Docker Image Scan Results - Dockerfile.indexer

Image: subcults-indexer:scan

Severity	Count
Critical	0
High	1
Medium	2
Low	1
Total	4

Click to see details


Report Summary

┌──────────────────────────────────────┬──────────┬─────────────────┬─────────┐
│                Target                │   Type   │ Vulnerabilities │ Secrets │
├──────────────────────────────────────┼──────────┼─────────────────┼─────────┤
│ subcults-indexer:scan (debian 12.13) │  debian  │        0        │    -    │
├──────────────────────────────────────┼──────────┼─────────────────┼─────────┤
│ app/indexer                          │ gobinary │        4        │    -    │
└──────────────────────────────────────┴──────────┴─────────────────┴─────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)


For OSS Maintainers: VEX Notice
--------------------------------
If you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement.
VEX allows you to communicate the actual status of vulnerabilities in your project, improving security transparency and reducing false positives for your users.
Learn more and start using VEX: https://trivy.dev/docs/v0.69/guide/supply-chain/vex/repo#publishing-vex-documents

To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable.


app/indexer (gobinary)
======================
Total: 4 (LOW: 1, MEDIUM: 2, HIGH: 1, CRITICAL: 0)

┌──────────────────────────────┬────────────────┬──────────┬────────┬───────────────────┬────────────────┬─────────────────────────────────────────────────────────────┐
│           Library            │ Vulnerability  │ Severity │ Status │ Installed Version │ Fixed Version  │                            Title                            │
├──────────────────────────────┼────────────────┼──────────┼────────┼───────────────────┼────────────────┼─────────────────────────────────────────────────────────────┤
│ go.opentelemetry.io/otel/sdk │ CVE-2026-24051 │ HIGH     │ fixed  │ v1.38.0           │ 1.40.0         │ OpenTelemetry Go SDK Vulnerable to Arbitrary Code Execution │
│                              │                │          │        │                   │                │ via PATH Hijacking                                          │
│                              │                │          │        │                   │                │ https://avd.aquasec.com/nvd/cve-2026-24051                  │
├──────────────────────────────┼────────────────┼──────────┤        ├───────────────────┼────────────────┼─────────────────────────────────────────────────────────────┤
│ stdlib                       │ CVE-2026-25679 │ MEDIUM   │        │ v1.24.13          │ 1.25.8, 1.26.1 │ net/url: Incorrect parsing of IPv6 host literals in net/url │
│                              │                │          │        │                   │                │ https://avd.aquasec.com/nvd/cve-2026-25679                  │
│                              ├────────────────┤          │        │                   │                ├─────────────────────────────────────────────────────────────┤
│                              │ CVE-2026-27142 │          │        │                   │                │ html/template: URLs in meta content attribute actions are   │
│                              │                │          │        │                   │                │ not escaped in html/template...                             │
│                              │                │          │        │                   │                │ https://avd.aquasec.com/nvd/cve-2026-27142                  │
│                              ├────────────────┼──────────┤        │                   │                ├─────────────────────────────────────────────────────────────┤
│                              │ CVE-2026-27139 │ LOW      │        │                   │                │ os: FileInfo can escape from a Root in golang os module     │
│                              │                │          │        │                   │                │ https://avd.aquasec.com/nvd/cve-2026-27139                  │
└──────────────────────────────┴────────────────┴──────────┴────────┴───────────────────┴────────────────┴─────────────────────────────────────────────────────────────┘

github-actions · 2026-03-17T21:53:54Z

Docker Image Scan Results - Dockerfile.api

Image: subcults-api:scan

Severity	Count
Critical	0
High	1
Medium	3
Low	1
Total	5

Click to see details


Report Summary

┌───────────────────────────────────┬──────────┬─────────────────┬─────────┐
│              Target               │   Type   │ Vulnerabilities │ Secrets │
├───────────────────────────────────┼──────────┼─────────────────┼─────────┤
│ subcults-api:scan (alpine 3.21.6) │  alpine  │        0        │    -    │
├───────────────────────────────────┼──────────┼─────────────────┼─────────┤
│ app/api                           │ gobinary │        5        │    -    │
└───────────────────────────────────┴──────────┴─────────────────┴─────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)


For OSS Maintainers: VEX Notice
--------------------------------
If you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement.
VEX allows you to communicate the actual status of vulnerabilities in your project, improving security transparency and reducing false positives for your users.
Learn more and start using VEX: https://trivy.dev/docs/v0.69/guide/supply-chain/vex/repo#publishing-vex-documents

To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable.


app/api (gobinary)
==================
Total: 5 (LOW: 1, MEDIUM: 3, HIGH: 1, CRITICAL: 0)

┌──────────────────────────────┬────────────────┬──────────┬────────┬───────────────────┬────────────────┬──────────────────────────────────────────────────────────────┐
│           Library            │ Vulnerability  │ Severity │ Status │ Installed Version │ Fixed Version  │                            Title                             │
├──────────────────────────────┼────────────────┼──────────┼────────┼───────────────────┼────────────────┼──────────────────────────────────────────────────────────────┤
│ github.com/pion/dtls/v3      │ CVE-2026-26014 │ MEDIUM   │ fixed  │ v3.0.7            │ 3.1.1, 3.0.11  │ github.com/pion/dtls: Pion DTLS uses random nonce generation │
│                              │                │          │        │                   │                │ with AES GCM ciphers risks...                                │
│                              │                │          │        │                   │                │ https://avd.aquasec.com/nvd/cve-2026-26014                   │
├──────────────────────────────┼────────────────┼──────────┤        ├───────────────────┼────────────────┼──────────────────────────────────────────────────────────────┤
│ go.opentelemetry.io/otel/sdk │ CVE-2026-24051 │ HIGH     │        │ v1.38.0           │ 1.40.0         │ OpenTelemetry Go SDK Vulnerable to Arbitrary Code Execution  │
│                              │                │          │        │                   │                │ via PATH Hijacking                                           │
│                              │                │          │        │                   │                │ https://avd.aquasec.com/nvd/cve-2026-24051                   │
├──────────────────────────────┼────────────────┼──────────┤        ├───────────────────┼────────────────┼──────────────────────────────────────────────────────────────┤
│ stdlib                       │ CVE-2026-25679 │ MEDIUM   │        │ v1.24.13          │ 1.25.8, 1.26.1 │ net/url: Incorrect parsing of IPv6 host literals in net/url  │
│                              │                │          │        │                   │                │ https://avd.aquasec.com/nvd/cve-2026-25679                   │
│                              ├────────────────┤          │        │                   │                ├──────────────────────────────────────────────────────────────┤
│                              │ CVE-2026-27142 │          │        │                   │                │ html/template: URLs in meta content attribute actions are    │
│                              │                │          │        │                   │                │ not escaped in html/template...                              │
│                              │                │          │        │                   │                │ https://avd.aquasec.com/nvd/cve-2026-27142                   │
│                              ├────────────────┼──────────┤        │                   │                ├──────────────────────────────────────────────────────────────┤
│                              │ CVE-2026-27139 │ LOW      │        │                   │                │ os: FileInfo can escape from a Root in golang os module      │
│                              │                │          │        │                   │                │ https://avd.aquasec.com/nvd/cve-2026-27139                   │
└──────────────────────────────┴────────────────┴──────────┴────────┴───────────────────┴────────────────┴──────────────────────────────────────────────────────────────┘

github-actions · 2026-03-17T21:54:23Z

Docker Image Scan Results - Dockerfile.frontend

Image: subcults-frontend:scan

Severity	Count
Critical	0
High	0
Medium	3
Low	3
Total	6

Click to see details


Report Summary

┌────────────────────────────────────────┬────────┬─────────────────┬─────────┐
│                 Target                 │  Type  │ Vulnerabilities │ Secrets │
├────────────────────────────────────────┼────────┼─────────────────┼─────────┤
│ subcults-frontend:scan (alpine 3.19.9) │ alpine │        6        │    -    │
└────────────────────────────────────────┴────────┴─────────────────┴─────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)


For OSS Maintainers: VEX Notice
--------------------------------
If you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement.
VEX allows you to communicate the actual status of vulnerabilities in your project, improving security transparency and reducing false positives for your users.
Learn more and start using VEX: https://trivy.dev/docs/v0.69/guide/supply-chain/vex/repo#publishing-vex-documents

To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable.


subcults-frontend:scan (alpine 3.19.9)
======================================
Total: 6 (LOW: 3, MEDIUM: 3, HIGH: 0, CRITICAL: 0)

┌───────────────┬────────────────┬──────────┬────────┬───────────────────┬───────────────┬──────────────────────────────────────────────────────────────┐
│    Library    │ Vulnerability  │ Severity │ Status │ Installed Version │ Fixed Version │                            Title                             │
├───────────────┼────────────────┼──────────┼────────┼───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ busybox       │ CVE-2024-58251 │ MEDIUM   │ fixed  │ 1.36.1-r20        │ 1.36.1-r21    │ In netstat in BusyBox through 1.37.0, local users can launch │
│               │                │          │        │                   │               │ of networ...                                                 │
│               │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2024-58251                   │
│               ├────────────────┼──────────┤        │                   │               ├──────────────────────────────────────────────────────────────┤
│               │ CVE-2025-46394 │ LOW      │        │                   │               │ In tar in BusyBox through 1.37.0, a TAR archive can have     │
│               │                │          │        │                   │               │ filenames...                                                 │
│               │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2025-46394                   │
├───────────────┼────────────────┼──────────┤        │                   │               ├──────────────────────────────────────────────────────────────┤
│ busybox-binsh │ CVE-2024-58251 │ MEDIUM   │        │                   │               │ In netstat in BusyBox through 1.37.0, local users can launch │
│               │                │          │        │                   │               │ of networ...                                                 │
│               │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2024-58251                   │
│               ├────────────────┼──────────┤        │                   │               ├──────────────────────────────────────────────────────────────┤
│               │ CVE-2025-46394 │ LOW      │        │                   │               │ In tar in BusyBox through 1.37.0, a TAR archive can have     │
│               │                │          │        │                   │               │ filenames...                                                 │
│               │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2025-46394                   │
├───────────────┼────────────────┼──────────┤        │                   │               ├──────────────────────────────────────────────────────────────┤
│ ssl_client    │ CVE-2024-58251 │ MEDIUM   │        │                   │               │ In netstat in BusyBox through 1.37.0, local users can launch │
│               │                │          │        │                   │               │ of networ...                                                 │
│               │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2024-58251                   │
│               ├────────────────┼──────────┤        │                   │               ├──────────────────────────────────────────────────────────────┤
│               │ CVE-2025-46394 │ LOW      │        │                   │               │ In tar in BusyBox through 1.37.0, a TAR archive can have     │
│               │                │          │        │                   │               │ filenames...                                                 │
│               │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2025-46394                   │
└───────────────┴────────────────┴──────────┴────────┴───────────────────┴───────────────┴──────────────────────────────────────────────────────────────┘

This was referenced Mar 17, 2026

chore(ci)(deps): bump actions/upload-artifact from 4 to 7 #1

Open

chore(ci)(deps): bump actions/checkout from 4 to 6 #2

Open

This was referenced Mar 17, 2026

chore(ci)(deps): bump actions/github-script from 7 to 8 #4

Open

chore(deps-dev)(deps-dev): bump the e2e-dependencies group in /e2e with 2 updates #6

Closed

github-actions bot mentioned this pull request Mar 17, 2026

chore(deps-dev)(deps-dev): bump @types/node from 22.19.7 to 25.5.0 in /e2e #8

Open

This was referenced Mar 21, 2026

chore(deps-dev)(deps-dev): bump flatted from 3.3.3 to 3.4.2 in /web #32

Open

chore(deps-dev)(deps-dev): bump rollup from 4.53.3 to 4.59.1 in /web #33

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps-dev)(deps-dev): bump express from 4.22.1 to 5.2.1 in /e2e#7

chore(deps-dev)(deps-dev): bump express from 4.22.1 to 5.2.1 in /e2e#7
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/e2e/express-5.2.1

dependabot bot commented on behalf of github Mar 17, 2026

Uh oh!

dependabot bot commented on behalf of github Mar 17, 2026

Uh oh!

github-actions bot commented Mar 17, 2026

Uh oh!

github-actions bot commented Mar 17, 2026

Uh oh!

github-actions bot commented Mar 17, 2026

Uh oh!

github-actions bot commented Mar 17, 2026

Uh oh!

github-actions bot commented Mar 17, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot bot commented on behalf of github Mar 17, 2026

v5.2.1

What's Changed

v5.2.0

Important: Security

What's Changed

5.2.1 / 2025-12-01

5.2.0 / 2025-12-01

5.1.0 / 2025-03-31

5.0.1 / 2024-10-08

5.0.0 / 2024-09-10

Uh oh!

dependabot bot commented on behalf of github Mar 17, 2026

Labels

Uh oh!

github-actions bot commented Mar 17, 2026

NPM Vulnerability Scan Results - web

Uh oh!

github-actions bot commented Mar 17, 2026

Go Vulnerability Scan Results

Details:

Uh oh!

github-actions bot commented Mar 17, 2026

Docker Image Scan Results - Dockerfile.indexer

Uh oh!

github-actions bot commented Mar 17, 2026

Docker Image Scan Results - Dockerfile.api

Uh oh!

github-actions bot commented Mar 17, 2026

Docker Image Scan Results - Dockerfile.frontend

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants