chore(deps): bump the npm_and_yarn group across 2 directories with 4 updates by dependabot[bot] · Pull Request #8644 · oxsecurity/megalinter

dependabot · 2026-08-05T08:36:08Z

Bumps the npm_and_yarn group with 4 updates in the /.automation/test/repository_grype/bad directory: brace-expansion, ip-address, tar and undici.
Bumps the npm_and_yarn group with 3 updates in the /.automation/test/repository_syft/good/good directory: brace-expansion, ip-address and tar.

Updates brace-expansion from 1.1.14 to 1.1.18

Release notes

Sourced from brace-expansion's releases.

v1.1.15

Backport v5.0.6 change to v1 (#111) 0b09384

juliangruber/brace-expansion@v1.1.14...v1.1.15

Commits

758fcd6 1.1.18
27fbeed Merge commit from fork
5c57cc2 1.1.17
d757f1d npm ignore .claude
cb4b9e4 fix: backport GHSA-mh99-v99m-4gvg (#129)
447763a 1.1.16
d74e630 fix: v1 backport for CVE-2026-13149 (#122)
2203f4f 1.1.15
0b09384 Backport v5.0.6 change to v1 (#111)
See full diff in compare view

Updates ip-address from 10.1.0 to 10.4.0

Release notes

Sourced from ip-address's releases.

v10.4.0

What's Changed

Add GitHub Actions CI by @beaugunderson in beaugunderson/ip-address#213

Keep the package loadable on node 12, and enforce it by @beaugunderson in beaugunderson/ip-address#216

Validate the byte arrays Address6 is given by @beaugunderson in beaugunderson/ip-address#217

Full Changelog: beaugunderson/ip-address@v10.3.1...v10.4.0

v10.3.1

Full Changelog: beaugunderson/ip-address@v10.3.0...v10.3.1

v10.3.0

Full Changelog: beaugunderson/ip-address@v10.2.2...v10.3.0

v10.2.2

Full Changelog: beaugunderson/ip-address@v10.2.1...v10.2.2

v10.2.1

Full Changelog: beaugunderson/ip-address@v10.2.0...v10.2.1

Commits

fbb8db2 10.4.0
45a2b11 Validate the byte arrays Address6 is given (#217)
bac8810 Keep the package loadable on node 12, and enforce it (#216)
9b3d848 Add a security policy and a README section on security posture
e84a7b3 Order the README API reference Address4, Address6, AddressError
015160b Collapse each class in the README API reference
34061a8 Pin checkout and setup-node to commits in the release job
c5fae5d Pin action-gh-release to a commit and move it to 3.0.2
e0ef048 Replace CircleCI with GitHub Actions
5e3ceb7 Add GitHub Actions CI across Node 20, 22, 24 and 25 (#213)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for ip-address since your current version.

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.

Updates tar from 7.5.13 to 7.5.22

Commits

2a22bfc 7.5.22
df1cd8d Allow transform to be falsey
0cd9cc3 7.5.21
631ae59 list: prevent unbounded recursion
ebbb720 7.5.20
2f27196 fix: fully disable and dispose of unzip when aborting parser
be440da 7.5.19
2812e93 add maxDecompressionRatio guard against explosive decompression
9ecd4d2 7.5.18
9e78bf0 refuse to let header size be less than 0
Additional commits viewable in compare view

Updates undici from 6.25.0 to 6.28.0

Release notes

Sourced from undici's releases.

v6.28.0

⚠️ Security fixes

GHSA-m8rv-5g2x-5cg5: a malicious type property on a duck-typed blob-like HTTP/1.1 request body could inject CRLF sequences into the generated content-type header. Undici now coerces and validates the value before adding it to the request. Fixed by 740a0b7c.

GHSA-8xcm-r25x-g524: the retry interceptor could expose a stale Content-Length after resuming a partial response, potentially causing downstream response desynchronization, hangs, or corruption. Undici now rejects partial responses whose Content-Length is inconsistent with Content-Range. Fixed by cba3a52a, with corrected fixtures in 4fd5a0c6.

GHSA-v3r7-h72x-cjcm: unsanitized domain and unparsed values passed to setCookie() could inject cookie attributes. Undici now validates cookie domains, paths, and unparsed attributes more strictly. Fixed by af748404.

GHSA-4cwx-7wf7-3272 and GHSA-jr45-8vmc-qm54 affect the cache interceptor in Undici v7 and v8; Undici v6 is not in their affected version ranges.

Full Changelog: nodejs/undici@v6.27.0...v6.28.0

v6.27.0

⚠️ Security Release

This release line addresses 4 security advisories.
Action required: Upgrade to undici 6.27.0 or later.
npm install undici@^6.27.0
Note on patched version: the v6 fixes shipped in v6.27.0, not 6.26.0 — v6.26.0 contains only the chunked-EOF fix (#5308) and the version bump, none of the security fixes below.

The v6 line is not affected by the SOCKS5 advisories (GHSA-vmh5-mc38-953g, GHSA-hm92-r4w5-c3mj), the shared-cache disclosure (GHSA-pr7r-676h-xcf6), or the 8.x-only WebSocket regression (GHSA-38rv-x7px-6hhq).

Summary

Advisory CVE Severity (CVSS) Fixed in Fix commit

GHSA-vxpw-j846-p89q CVE-2026-12151 High (7.5) 6.27.0 b7f252e7

GHSA-p88m-4jfj-68fv CVE-2026-9679 Moderate (5.9) 6.27.0 25efa447

GHSA-g8m3-5g58-fq7m CVE-2026-11525 Low (3.7) 6.27.0 25efa447

GHSA-35p6-xmwp-9g52 CVE-2026-6733 Low (3.7) 6.27.0 f4c31d60

High severity

WebSocket DoS via fragment count bypass — CVE-2026-12151

GHSA-vxpw-j846-p89q · CWE-400, CWE-770 Fix: b7f252e7 Backport WebSocket maxPayloadSize fixes (#5423, backported to v6 in #5428)

A malicious WebSocket server can stream a large number of small or empty continuation frames. Undici enforced a limit on cumulative payload size but did

... (truncated)

Commits

01a912e Bumped v6.28.0 (#5591)
481ecfc Use Node 22 and npm 11 to release
740a0b7 fix: validate blob body content type
2698e49 fix: validate coerced header values for CRLF (#5579)
4fd5a0c test(retry): correct broken content-range fixtures in retry-handler.js
cba3a52 fix(retry): reject partial content length mismatch
af74840 fix: harden cookie domain, path, and unparsed attribute validation
551138c Bumped v6.27.0 (#5431)
b7f252e Backport WebSocket maxPayloadSize fixes to v7.x (#5423) (#5428)
25efa44 fix(cookies): preserve values and parse SameSite strictly
Additional commits viewable in compare view

Updates brace-expansion from 1.1.14 to 1.1.18

Release notes

Sourced from brace-expansion's releases.

v1.1.15

Backport v5.0.6 change to v1 (#111) 0b09384

juliangruber/brace-expansion@v1.1.14...v1.1.15

Commits

758fcd6 1.1.18
27fbeed Merge commit from fork
5c57cc2 1.1.17
d757f1d npm ignore .claude
cb4b9e4 fix: backport GHSA-mh99-v99m-4gvg (#129)
447763a 1.1.16
d74e630 fix: v1 backport for CVE-2026-13149 (#122)
2203f4f 1.1.15
0b09384 Backport v5.0.6 change to v1 (#111)
See full diff in compare view

Updates ip-address from 10.1.0 to 10.4.0

Release notes

Sourced from ip-address's releases.

v10.4.0

What's Changed

Add GitHub Actions CI by @beaugunderson in beaugunderson/ip-address#213

Keep the package loadable on node 12, and enforce it by @beaugunderson in beaugunderson/ip-address#216

Validate the byte arrays Address6 is given by @beaugunderson in beaugunderson/ip-address#217

Full Changelog: beaugunderson/ip-address@v10.3.1...v10.4.0

v10.3.1

Full Changelog: beaugunderson/ip-address@v10.3.0...v10.3.1

v10.3.0

Full Changelog: beaugunderson/ip-address@v10.2.2...v10.3.0

v10.2.2

Full Changelog: beaugunderson/ip-address@v10.2.1...v10.2.2

v10.2.1

Full Changelog: beaugunderson/ip-address@v10.2.0...v10.2.1

Commits

fbb8db2 10.4.0
45a2b11 Validate the byte arrays Address6 is given (#217)
bac8810 Keep the package loadable on node 12, and enforce it (#216)
9b3d848 Add a security policy and a README section on security posture
e84a7b3 Order the README API reference Address4, Address6, AddressError
015160b Collapse each class in the README API reference
34061a8 Pin checkout and setup-node to commits in the release job
c5fae5d Pin action-gh-release to a commit and move it to 3.0.2
e0ef048 Replace CircleCI with GitHub Actions
5e3ceb7 Add GitHub Actions CI across Node 20, 22, 24 and 25 (#213)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for ip-address since your current version.

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.

Updates tar from 7.5.13 to 7.5.22

Commits

2a22bfc 7.5.22
df1cd8d Allow transform to be falsey
0cd9cc3 7.5.21
631ae59 list: prevent unbounded recursion
ebbb720 7.5.20
2f27196 fix: fully disable and dispose of unzip when aborting parser
be440da 7.5.19
2812e93 add maxDecompressionRatio guard against explosive decompression
9ecd4d2 7.5.18
9e78bf0 refuse to let header size be less than 0
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the Security Alerts page.

…updates Bumps the npm_and_yarn group with 4 updates in the /.automation/test/repository_grype/bad directory: [brace-expansion](https://github.com/juliangruber/brace-expansion), [ip-address](https://github.com/beaugunderson/ip-address), [tar](https://github.com/isaacs/node-tar) and [undici](https://github.com/nodejs/undici). Bumps the npm_and_yarn group with 3 updates in the /.automation/test/repository_syft/good/good directory: [brace-expansion](https://github.com/juliangruber/brace-expansion), [ip-address](https://github.com/beaugunderson/ip-address) and [tar](https://github.com/isaacs/node-tar). Updates `brace-expansion` from 1.1.14 to 1.1.18 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@v1.1.14...v1.1.18) Updates `ip-address` from 10.1.0 to 10.4.0 - [Release notes](https://github.com/beaugunderson/ip-address/releases) - [Commits](beaugunderson/ip-address@v10.1.0...v10.4.0) Updates `tar` from 7.5.13 to 7.5.22 - [Release notes](https://github.com/isaacs/node-tar/releases) - [Changelog](https://github.com/isaacs/node-tar/blob/main/CHANGELOG.md) - [Commits](isaacs/node-tar@v7.5.13...v7.5.22) Updates `undici` from 6.25.0 to 6.28.0 - [Release notes](https://github.com/nodejs/undici/releases) - [Commits](nodejs/undici@v6.25.0...v6.28.0) Updates `brace-expansion` from 1.1.14 to 1.1.18 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@v1.1.14...v1.1.18) Updates `ip-address` from 10.1.0 to 10.4.0 - [Release notes](https://github.com/beaugunderson/ip-address/releases) - [Commits](beaugunderson/ip-address@v10.1.0...v10.4.0) Updates `tar` from 7.5.13 to 7.5.22 - [Release notes](https://github.com/isaacs/node-tar/releases) - [Changelog](https://github.com/isaacs/node-tar/blob/main/CHANGELOG.md) - [Commits](isaacs/node-tar@v7.5.13...v7.5.22) --- updated-dependencies: - dependency-name: brace-expansion dependency-version: 1.1.18 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: ip-address dependency-version: 10.4.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: tar dependency-version: 7.5.22 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: undici dependency-version: 6.28.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: brace-expansion dependency-version: 1.1.18 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: ip-address dependency-version: 10.4.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: tar dependency-version: 7.5.22 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

github-actions · 2026-08-05T08:43:11Z

✅⚠️MegaLinter analysis: Success with warnings

⚠️ PYTHON / bandit - 138 errors

---------------------
>> Issue: [B311:blacklist] Standard pseudo-random generators are not suitable for security/cryptographic purposes.
   Severity: Low   Confidence: High
   CWE: CWE-330 (https://cwe.mitre.org/data/definitions/330.html)
   More Info: https://bandit.readthedocs.io/en/1.9.4/blacklists/blacklist_calls.html#b311-random
   Location: ./megalinter/utils_sarif.py:156:61
155	                        rule["id"] = (
156	                            rule["id"] + "_DUPLICATE_" + str(random.randint(1, 99999))
157	                        )

--------------------------------------------------
>> Issue: [B101:assert_used] Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.
   Severity: Low   Confidence: High
   CWE: CWE-703 (https://cwe.mitre.org/data/definitions/703.html)
   More Info: https://bandit.readthedocs.io/en/1.9.4/plugins/b101_assert_used.html
   Location: ./megalinter/utilstest.py:122:4
121	    )
122	    assert os.path.isdir(config.get(request_id, "DEFAULT_WORKSPACE")), (
123	        "DEFAULT_WORKSPACE "
124	        + config.get(request_id, "DEFAULT_WORKSPACE")
125	        + " is not a valid folder"
126	    )
127	

--------------------------------------------------
>> Issue: [B101:assert_used] Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.
   Severity: Low   Confidence: High
   CWE: CWE-703 (https://cwe.mitre.org/data/definitions/703.html)
   More Info: https://bandit.readthedocs.io/en/1.9.4/plugins/b101_assert_used.html
   Location: ./megalinter/utilstest.py:167:4
166	    tmp_report_folder = tempfile.gettempdir() + os.path.sep + str(uuid.uuid4())
167	    assert os.path.isdir(workspace), f"Test folder {workspace} is not existing"
168	    linter_name = linter.linter_name

--------------------------------------------------
>> Issue: [B101:assert_used] Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.
   Severity: Low   Confidence: High
   CWE: CWE-703 (https://cwe.mitre.org/data/definitions/703.html)
   More Info: https://bandit.readthedocs.io/en/1.9.4/plugins/b101_assert_used.html
   Location: ./megalinter/utilstest.py:241:4
240	    tmp_report_folder = tempfile.gettempdir() + os.path.sep + str(uuid.uuid4())
241	    assert os.path.isdir(workspace), f"Test folder {workspace} is not existing"
242	    if os.path.isfile(workspace + os.path.sep + "no_test_failure"):

--------------------------------------------------
>> Issue: [B101:assert_used] Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.
   Severity: Low   Confidence: High
   CWE: CWE-703 (https://cwe.mitre.org/data/definitions/703.html)
   More Info: https://bandit.readthedocs.io/en/1.9.4/plugins/b101_assert_used.html
   Location: ./megalinter/utilstest.py:490:4
489	    )
490	    assert os.path.isdir(workspace), f"Test folder {workspace} is not existing"
491	    expected_file_name = ""

--------------------------------------------------
>> Issue: [B101:assert_used] Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.
   Severity: Low   Confidence: High
   CWE: CWE-703 (https://cwe.mitre.org/data/definitions/703.html)
   More Info: https://bandit.readthedocs.io/en/1.9.4/plugins/b101_assert_used.html
   Location: ./megalinter/utilstest.py:590:4
589	        workspace += os.path.sep + "bad"
590	    assert os.path.isdir(workspace), f"Test folder {workspace} is not existing"
591	    # Call linter

--------------------------------------------------
>> Issue: [B101:assert_used] Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.
   Severity: Low   Confidence: High
   CWE: CWE-703 (https://cwe.mitre.org/data/definitions/703.html)
   More Info: https://bandit.readthedocs.io/en/1.9.4/plugins/b101_assert_used.html
   Location: ./megalinter/utilstest.py:683:4
682	        workspace = workspace + os.path.sep + "fix"
683	    assert os.path.isdir(workspace), f"Test folder {workspace} is not existing"
684	

--------------------------------------------------
>> Issue: [B101:assert_used] Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.
   Severity: Low   Confidence: High
   CWE: CWE-703 (https://cwe.mitre.org/data/definitions/703.html)
   More Info: https://bandit.readthedocs.io/en/1.9.4/plugins/b101_assert_used.html
   Location: ./megalinter/utilstest.py:789:12
788	            ]
789	            assert (len(list(diffs))) > 0, f"No changes in the {file} file"
790	

--------------------------------------------------
>> Issue: [B108:hardcoded_tmp_directory] Probable insecure usage of temp file/directory.
   Severity: Medium   Confidence: Medium
   CWE: CWE-377 (https://cwe.mitre.org/data/definitions/377.html)
   More Info: https://bandit.readthedocs.io/en/1.9.4/plugins/b108_hardcoded_tmp_directory.html
   Location: ./server/server.py:81:42
80	    if item.fileUploadId:
81	        uploaded_file_path = os.path.join("/tmp/server-files", item.fileUploadId)
82	        if not os.path.isdir(uploaded_file_path):

--------------------------------------------------
>> Issue: [B108:hardcoded_tmp_directory] Probable insecure usage of temp file/directory.
   Severity: Medium   Confidence: Medium
   CWE: CWE-377 (https://cwe.mitre.org/data/definitions/377.html)
   More Info: https://bandit.readthedocs.io/en/1.9.4/plugins/b108_hardcoded_tmp_directory.html
   Location: ./server/server.py:103:38
102	    file_upload_id = "FILE_" + str(uuid1())
103	    uploaded_file_path = os.path.join("/tmp/server-files", file_upload_id)
104	    os.makedirs(uploaded_file_path)

--------------------------------------------------
>> Issue: [B108:hardcoded_tmp_directory] Probable insecure usage of temp file/directory.
   Severity: Medium   Confidence: Medium
   CWE: CWE-377 (https://cwe.mitre.org/data/definitions/377.html)
   More Info: https://bandit.readthedocs.io/en/1.9.4/plugins/b108_hardcoded_tmp_directory.html
   Location: ./server/server_worker.py:98:34
97	        temp_dir = self.create_temp_dir()
98	        upload_dir = os.path.join("/tmp/server-files", file_upload_id)
99	        if os.path.exists(upload_dir):

--------------------------------------------------

Code scanned:
	Total lines of code: 21369
	Total lines skipped (#nosec): 0
	Total potential issues skipped due to specifically being disabled (e.g., #nosec BXXX): 0

Run metrics:
	Total issues (by severity):
		Undefined: 0
		Low: 106
		Medium: 23
		High: 9
	Total issues (by confidence):
		Undefined: 0
		Low: 13
		Medium: 22
		High: 103
Files skipped (0):

(Truncated to last 6666 characters out of 92961)

⚠️ BASH / bash-exec - 1 error

Results of bash-exec linter (version 5.3.9)
See documentation on https://megalinter.io/beta/descriptors/bash_bash_exec/
-----------------------------------------------

✅ [SUCCESS] .automation/build_schemas_doc.sh
✅ [SUCCESS] .automation/format-tables.sh
✅ [SUCCESS] .vscode/testlinter.sh
✅ [SUCCESS] build.sh
✅ [SUCCESS] entrypoint.sh
❌ [ERROR] sh/megalinter_exec.sh
    Error: File:[sh/megalinter_exec.sh] is not executable

✅ [SUCCESS] sh/setup-runtime-user.sh

⚠️ SPELL / lychee - 52 errors

nter-descriptor.yml
[ERROR] https://eslint.org/ (at 100:17) | Network error: Connection reset by peer (os error 104)

Errors in megalinter/descriptors/jsx.megalinter-descriptor.yml
[404] https://eslint-react.xyz/docs/getting-started/installation (at 82:37) | Rejected status code: 404 Not Found

Errors in megalinter/descriptors/kotlin.megalinter-descriptor.yml
[404] https://pinterest.github.io/ktlint/latest/api/custom-rule-set/ (at 67:15) | Rejected status code: 404 Not Found
[404] https://pinterest.github.io/ktlint/latest/faq/#how-do-i-suppress-errors-for-a-lineblockfile (at 38:38) | Rejected status code: 404 Not Found
[404] https://pinterest.github.io/ktlint/latest/rules/configuration-ktlint/ (at 37:37) | Rejected status code: 404 Not Found

Errors in megalinter/descriptors/kubernetes.megalinter-descriptor.yml
[404] https://raw.githubusercontent.com/datreeio/CRDs-catalog/main/%7B%7B.Group%7D%7D/%7B%7B.ResourceKind%7D%7D_%7B%7B.ResourceAPIVersion%7D%7D.json (at 69:22) | Rejected status code: 404 Not Found

Errors in megalinter/descriptors/latex.megalinter-descriptor.yml
[TIMEOUT] https://www.nongnu.org/chktex (at 26:17) | Request timed out
[TIMEOUT] https://www.nongnu.org/chktex/ (at 29:23) | Request timed out
[TIMEOUT] https://www.nongnu.org/chktex/ (at 31:38) | Request timed out

Errors in megalinter/descriptors/markdown.megalinter-descriptor.yml
[404] https://github.com/rvben/rumdl/blob/main/docs/RULES.md (at 162:23) | Rejected status code: 404 Not Found
[403] https://www.npmjs.com/package/markdown-table-formatter (at 101:17) | Rejected status code: 403 Forbidden

Errors in megalinter/descriptors/repository.megalinter-descriptor.yml
[404] https://raw.githubusercontent.com/oxsecurity/megalinter/main/docs/assets/icons/linters/betterleaks.png (at 285:26) | Rejected status code: 404 Not Found

Errors in megalinter/descriptors/rst.megalinter-descriptor.yml
[403] https://docutils.sourceforge.io/docs/ref/rst/directives.html#raw-data-pass-through (at 34:38) | Rejected status code: 403 Forbidden

Errors in megalinter/descriptors/salesforce.megalinter-descriptor.yml
[403] https://developer.salesforce.com/docs/platform/salesforce-code-analyzer/guide/config.html (at 366:37) | Rejected status code: 403 Forbidden
[403] https://developer.salesforce.com/docs/platform/salesforce-code-analyzer/guide/engine-flow.html (at 363:17) | Rejected status code: 403 Forbidden
[403] https://developer.salesforce.com/docs/platform/salesforce-code-analyzer/guide/get-started.html (at 172:17) | Rejected status code: 403 Forbidden
[403] https://developer.salesforce.com/docs/platform/salesforce-code-analyzer/guide/get-started.html (at 270:17) | Rejected status code: 403 Forbidden
[403] https://developer.salesforce.com/docs/platform/salesforce-code-analyzer/guide/get-started.html (at 72:17) | Rejected status code: 403 Forbidden
[403] https://developer.salesforce.com/docs/platform/salesforce-code-analyzer/guide/rules-flow.html (at 365:23) | Rejected status code: 403 Forbidden

Errors in megalinter/descriptors/spell.megalinter-descriptor.yml
[404] https://vale.sh/docs/topics/vocab/ (at 186:38) | Rejected status code: 404 Not Found | Followed 2 redirects. Redirects: https://vale.sh/docs/topics/vocab/ --[301]--> https://docs.vale.sh/topics/vocab/ --[302]--> https://docs.vale.sh/topics/vocab
[404] https://vale.sh/docs/vale-cli/structure/ (at 180:95) | Rejected status code: 404 Not Found | Followed 2 redirects. Redirects: https://vale.sh/docs/vale-cli/structure/ --[301]--> https://docs.vale.sh/vale-cli/structure/ --[302]--> https://docs.vale.sh/vale-cli/structure
[TIMEOUT] https://vale.sh/explorer/ (at 185:37) | Request timed out | Followed 1 redirect. Redirects: https://vale.sh/explorer/ --[301]--> https://vale.sh/explorer

Errors in megalinter/descriptors/tsx.megalinter-descriptor.yml
[404] https://eslint-react.xyz/docs/getting-started/installation (at 82:37) | Error (cached)

Errors in megalinter/descriptors/xml.megalinter-descriptor.yml
[406] https://gitlab.gnome.org/GNOME/libxml2/-/wikis/home (at 38:17) | Rejected status code: 406 Not Acceptable

Errors in README.md
[ERROR] https://ampcode.com/ (at 238:1) | HTTP/2 protocol error. Server may not support HTTP/2 properly
[301] https://future-architect.github.io/authors/%E5%AE%AE%E6%B0%B8%E5%B4%87%E5%8F%B2 (at 1944:104) | Rejected status code: 301 Moved Permanently
[TIMEOUT] https://generated.at/ (at 1298:301) | Request timed out
[404] https://github.com/oxsecurity/megalinter/stargazers (at 2076:3) | Rejected status code: 404 Not Found
[404] https://github.com/oxsecurity/megalinter/stargazers/ (at 23:1) | Rejected status code: 404 Not Found
[403] https://medium.com/@caodanju/30-seconds-to-setup-megalinter-your-go-to-tool-for-automated-code-quality-and-iac-security-969d90a5a99c (at 1912:3) | Rejected status code: 403 Forbidden
[403] https://medium.com/@RunningMattress (at 1921:255) | Rejected status code: 403 Forbidden
[403] https://medium.com/@RunningMattress/level-up-your-unity-packages-with-ci-cd-9498d2791211 (at 1921:3) | Rejected status code: 403 Forbidden
[403] https://medium.com/@SeasonedDeveloper (at 1908:255) | Rejected status code: 403 Forbidden
[403] https://medium.com/@SeasonedDeveloper/looking-for-the-best-ci-cd-pipeline-linting-tool-try-megalinter-d89c9eba850d (at 1908:3) | Rejected status code: 403 Forbidden
[403] https://medium.com/datamindedbe/integrating-megalinter-to-automate-linting-across-multiple-codebases-a-technical-description-a200bb235b71 (at 1909:3) | Rejected status code: 403 Forbidden
[403] https://npmjs.org/package/mega-linter-runner (at 1213:1) | Error (cached)
[403] https://npmjs.org/package/mega-linter-runner (at 1214:1) | Error (cached)
[403] https://npmjs.org/package/mega-linter-runner (at 1215:1) | Error (cached)
[403] https://npmjs.org/package/mega-linter-runner (at 21:1) | Rejected status code: 403 Forbidden | Followed 1 redirect. Redirects: https://npmjs.org/package/mega-linter-runner --[301]--> https://www.npmjs.com/package/mega-linter-runner
[403] https://openai.com/codex/ (at 230:1) | Rejected status code: 403 Forbidden
[403] https://pmd.sourceforge.io/pmd-6.55.0/pmd_userdocs_tools_ci.html (at 2008:3) | Rejected status code: 403 Forbidden
[403] https://www.npmjs.com/package/@downatthebottomofthemolehole/megalinter-mcp-server (at 1886:354) | Rejected status code: 403 Forbidden

Hint: Followed 729 redirects. You might want to consider replacing redirecting URLs with the resolved URLs. Use verbose mode (`-v`/`-vv`) to see redirection details.
Hint: Rejected redirectional status codes. This means some redirects were not followed. You might want to increase the limit for `-m`/`--max-redirects`.

(Truncated to last 6666 characters out of 29862)

⚠️ MARKDOWN / markdownlint - 338 errors

uld have alternate text (alt text)
docs/reporters/ApiReporter.md:335:1 error MD045/no-alt-text Images should have alternate text (alt text)
docs/reporters/ApiReporter.md:343:1 error MD045/no-alt-text Images should have alternate text (alt text)
docs/reporters/ApiReporter.md:349:1 error MD045/no-alt-text Images should have alternate text (alt text)
docs/reporters/ApiReporter.md:359:1 error MD045/no-alt-text Images should have alternate text (alt text)
docs/reporters/ApiReporter.md:365:1 error MD045/no-alt-text Images should have alternate text (alt text)
docs/reporters/AzureCommentReporter.md:6 error MD025/single-title/single-h1 Multiple top-level headings in the same document [Context: "Azure Comment Reporter"]
docs/reporters/BitbucketCommentReporter.md:6 error MD025/single-title/single-h1 Multiple top-level headings in the same document [Context: "Bitbucket Comment Reporter"]
docs/reporters/ConfigReporter.md:5 error MD025/single-title/single-h1 Multiple top-level headings in the same document [Context: "IDE Configuration Reporter"]
docs/reporters/ConsoleReporter.md:5 error MD025/single-title/single-h1 Multiple top-level headings in the same document [Context: "Console Reporter"]
docs/reporters/EmailReporter.md:5 error MD025/single-title/single-h1 Multiple top-level headings in the same document [Context: "E-mail Reporter"]
docs/reporters/FileIoReporter.md:5 error MD025/single-title/single-h1 Multiple top-level headings in the same document [Context: "File.io Reporter"]
docs/reporters/GitHubCommentReporter.md:6 error MD025/single-title/single-h1 Multiple top-level headings in the same document [Context: "GitHub Comment Reporter"]
docs/reporters/GitHubCommentReporter.md:27:196 error MD056/table-column-count Table column count [Expected: 4; Actual: 3; Too few cells, row will be missing data]
docs/reporters/GitHubCommentReporter.md:27:46 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
docs/reporters/GitHubCommentReporter.md:27:174 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
docs/reporters/GitHubCommentReporter.md:27:196 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
docs/reporters/GitHubCommentReporter.md:28:179 error MD056/table-column-count Table column count [Expected: 4; Actual: 3; Too few cells, row will be missing data]
docs/reporters/GitHubCommentReporter.md:28:46 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
docs/reporters/GitHubCommentReporter.md:28:160 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
docs/reporters/GitHubCommentReporter.md:28:179 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
docs/reporters/GitHubCommentReporter.md:29:159 error MD056/table-column-count Table column count [Expected: 4; Actual: 3; Too few cells, row will be missing data]
docs/reporters/GitHubCommentReporter.md:29:48 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
docs/reporters/GitHubCommentReporter.md:29:143 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
docs/reporters/GitHubCommentReporter.md:29:159 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
docs/reporters/GitHubCommentReporter.md:30:171 error MD056/table-column-count Table column count [Expected: 4; Actual: 3; Too few cells, row will be missing data]
docs/reporters/GitHubCommentReporter.md:30:46 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
docs/reporters/GitHubCommentReporter.md:30:152 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
docs/reporters/GitHubCommentReporter.md:30:171 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
docs/reporters/GitHubStatusReporter.md:6 error MD025/single-title/single-h1 Multiple top-level headings in the same document [Context: "GitHub Status Reporter"]
docs/reporters/GitlabCommentReporter.md:6 error MD025/single-title/single-h1 Multiple top-level headings in the same document [Context: "Gitlab Comment Reporter"]
docs/reporters/JsonReporter.md:5 error MD025/single-title/single-h1 Multiple top-level headings in the same document [Context: "JSON Reporter"]
docs/reporters/MarkdownSummaryReporter.md:6 error MD025/single-title/single-h1 Multiple top-level headings in the same document [Context: "Markdown Summary Reporter"]
docs/reporters/SarifReporter.md:6 error MD025/single-title/single-h1 Multiple top-level headings in the same document [Context: "SARIF Reporter (beta)"]
docs/reporters/TapReporter.md:5 error MD025/single-title/single-h1 Multiple top-level headings in the same document [Context: "TAP Reporter"]
docs/reporters/TextReporter.md:5 error MD025/single-title/single-h1 Multiple top-level headings in the same document [Context: "Text Reporter"]
docs/reporters/UpdatedSourcesReporter.md:5 error MD025/single-title/single-h1 Multiple top-level headings in the same document [Context: "Updated Sources Reporter"]
docs/special-thanks.md:9 error MD025/single-title/single-h1 Multiple top-level headings in the same document [Context: "Special thanks"]
docs/special-thanks.md:23:3 error MD045/no-alt-text Images should have alternate text (alt text)
docs/sponsor.md:5 error MD025/single-title/single-h1 Multiple top-level headings in the same document [Context: "Sponsoring"]
docs/supported-linters.md:9 error MD025/single-title/single-h1 Multiple top-level headings in the same document [Context: "Supported Linters"]
mega-linter-runner/generators/mega-linter-custom-flavor/templates/README.md:69 error MD024/no-duplicate-heading Multiple headings with the same content [Context: "How to use the custom flavor"]
mega-linter-runner/README.md:27:274 error MD051/link-fragments Link fragments should be valid [Context: "[**apply formatting and auto-fixes**](#apply-fixes)"]
mega-linter-runner/README.md:27:217 error MD051/link-fragments Link fragments should be valid [Context: "[**reports in several formats**](#reports)"]
README.md:210:127 error MD051/link-fragments Link fragments should be valid [Context: "[many additional features](#mega-linter-vs-super-linter)"]
README.md:2103:3 error MD045/no-alt-text Images should have alternate text (alt text)

(Truncated to last 6666 characters out of 44718)

⚠️ YAML / prettier - 14 errors

ns.yml 3ms (unchanged)
.github/linters/valestyles/proselint/P-Value.yml 2ms (unchanged)
.github/linters/valestyles/proselint/RASSyndrome.yml 3ms (unchanged)
.github/linters/valestyles/proselint/Skunked.yml 2ms (unchanged)
.github/linters/valestyles/proselint/Spelling.yml 3ms (unchanged)
.github/linters/valestyles/proselint/Typography.yml 5ms (unchanged)
.github/linters/valestyles/proselint/Uncomparables.yml 5ms (unchanged)
.github/linters/valestyles/proselint/Very.yml 4ms (unchanged)
.github/release-drafter.yml 7ms (unchanged)
.grype.yaml 3ms (unchanged)
.mega-linter.yml 9ms (unchanged)
.pre-commit-hooks.yaml 6ms (unchanged)
action.yml 3ms (unchanged)
codecov.yml 1ms (unchanged)
mega-linter-runner/.eslintrc.yml 7ms (unchanged)
mega-linter-runner/.mega-linter.yml 7ms (unchanged)
mega-linter-runner/generators/mega-linter-custom-flavor/templates/action.yml 3ms (unchanged)
mega-linter-runner/generators/mega-linter-custom-flavor/templates/check-new-megalinter-version.yml 15ms (unchanged)
mega-linter-runner/generators/mega-linter-custom-flavor/templates/megalinter-custom-flavor-builder.yml 15ms (unchanged)
[error] mega-linter-runner/generators/mega-linter-custom-flavor/templates/megalinter-custom-flavor.yml: SyntaxError: Implicit map keys need to be followed by map values (6:1)
[error]   4 | label: <%= CUSTOM_FLAVOR_LABEL %>
[error]   5 | linters:
[error] > 6 | <%= CUSTOM_FLAVOR_LINTERS %>
[error]     | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^
[error]   7 |
mega-linter-runner/generators/mega-linter/templates/.drone.yml 5ms (unchanged)
mega-linter-runner/generators/mega-linter/templates/.gitlab-ci.yml 5ms (unchanged)
mega-linter-runner/generators/mega-linter/templates/azure-pipelines.yml 3ms (unchanged)
mega-linter-runner/generators/mega-linter/templates/bitbucket-pipelines.yml 5ms (unchanged)
mega-linter-runner/generators/mega-linter/templates/concourse-task.yml 3ms (unchanged)
[error] mega-linter-runner/generators/mega-linter/templates/mega-linter.yml: SyntaxError: Implicit map keys need to be followed by map values (67:11)
[error]   65 |           # Only define `secrets.PAT` if you fully understand the trade-off.
[error]   66 |           token: ${{ secrets.PAT || secrets.GITHUB_TOKEN }}
[error] > 67 |           <%- PERSIST_CREDENTIALS %>
[error]      |           ^^^^^^^^^^^^^^^^^^^^^^^^^^
[error]   68 |
[error]   69 |           # If you use VALIDATE_ALL_CODEBASE = true, you can remove this line to
[error]   70 |           # improve performance
megalinter/descriptors/action.megalinter-descriptor.yml 18ms (unchanged)
megalinter/descriptors/ansible.megalinter-descriptor.yml 9ms (unchanged)
megalinter/descriptors/arm.megalinter-descriptor.yml 6ms (unchanged)
megalinter/descriptors/bash.megalinter-descriptor.yml 28ms (unchanged)
megalinter/descriptors/bicep.megalinter-descriptor.yml 4ms (unchanged)
megalinter/descriptors/c.megalinter-descriptor.yml 12ms (unchanged)
megalinter/descriptors/clojure.megalinter-descriptor.yml 15ms (unchanged)
megalinter/descriptors/cloudformation.megalinter-descriptor.yml 6ms (unchanged)
megalinter/descriptors/coffee.megalinter-descriptor.yml 12ms (unchanged)
megalinter/descriptors/copypaste.megalinter-descriptor.yml 4ms (unchanged)
megalinter/descriptors/cpp.megalinter-descriptor.yml 11ms (unchanged)
megalinter/descriptors/csharp.megalinter-descriptor.yml 14ms (unchanged)
megalinter/descriptors/css.megalinter-descriptor.yml 7ms (unchanged)
megalinter/descriptors/dart.megalinter-descriptor.yml 5ms (unchanged)
megalinter/descriptors/dockerfile.megalinter-descriptor.yml 10ms (unchanged)
megalinter/descriptors/editorconfig.megalinter-descriptor.yml 2ms (unchanged)
megalinter/descriptors/env.megalinter-descriptor.yml 4ms (unchanged)
megalinter/descriptors/gherkin.megalinter-descriptor.yml 6ms (unchanged)
megalinter/descriptors/go.megalinter-descriptor.yml 8ms (unchanged)
megalinter/descriptors/graphql.megalinter-descriptor.yml 3ms (unchanged)
megalinter/descriptors/groovy.megalinter-descriptor.yml 5ms (unchanged)
megalinter/descriptors/html.megalinter-descriptor.yml 7ms (unchanged)
megalinter/descriptors/java.megalinter-descriptor.yml 9ms (unchanged)
megalinter/descriptors/javascript.megalinter-descriptor.yml 32ms (unchanged)
megalinter/descriptors/json.megalinter-descriptor.yml 9ms (unchanged)
megalinter/descriptors/jsx.megalinter-descriptor.yml 7ms (unchanged)
megalinter/descriptors/kotlin.megalinter-descriptor.yml 9ms (unchanged)
megalinter/descriptors/kubernetes.megalinter-descriptor.yml 12ms (unchanged)
megalinter/descriptors/latex.megalinter-descriptor.yml 2ms (unchanged)
megalinter/descriptors/lua.megalinter-descriptor.yml 8ms (unchanged)
megalinter/descriptors/markdown.megalinter-descriptor.yml 13ms (unchanged)
megalinter/descriptors/perl.megalinter-descriptor.yml 4ms (unchanged)
megalinter/descriptors/php.megalinter-descriptor.yml 18ms (unchanged)
megalinter/descriptors/powershell.megalinter-descriptor.yml 7ms (unchanged)
megalinter/descriptors/protobuf.megalinter-descriptor.yml 4ms (unchanged)
megalinter/descriptors/python.megalinter-descriptor.yml 53ms (unchanged)
megalinter/descriptors/r.megalinter-descriptor.yml 4ms (unchanged)
megalinter/descriptors/raku.megalinter-descriptor.yml 3ms (unchanged)
megalinter/descriptors/repository.megalinter-descriptor.yml 77ms (unchanged)
megalinter/descriptors/robotframework.megalinter-descriptor.yml 4ms (unchanged)
megalinter/descriptors/rst.megalinter-descriptor.yml 8ms (unchanged)
megalinter/descriptors/ruby.megalinter-descriptor.yml 7ms (unchanged)
megalinter/descriptors/rust.megalinter-descriptor.yml 3ms (unchanged)
megalinter/descriptors/salesforce.megalinter-descriptor.yml 20ms (unchanged)
megalinter/descriptors/scala.megalinter-descriptor.yml 3ms (unchanged)
megalinter/descriptors/snakemake.megalinter-descriptor.yml 5ms (unchanged)
megalinter/descriptors/spell.megalinter-descriptor.yml 15ms (unchanged)
megalinter/descriptors/sql.megalinter-descriptor.yml 5ms (unchanged)
megalinter/descriptors/swift.megalinter-descriptor.yml 6ms (unchanged)
megalinter/descriptors/tekton.megalinter-descriptor.yml 3ms (unchanged)
megalinter/descriptors/terraform.megalinter-descriptor.yml 9ms (unchanged)
megalinter/descriptors/tsx.megalinter-descriptor.yml 7ms (unchanged)
megalinter/descriptors/typescript.megalinter-descriptor.yml 20ms (unchanged)
megalinter/descriptors/vbdotnet.megalinter-descriptor.yml 3ms (unchanged)
megalinter/descriptors/xml.megalinter-descriptor.yml 3ms (unchanged)
megalinter/descriptors/yaml.megalinter-descriptor.yml 8ms (unchanged)
server/docker-compose-dev.yml 2ms (unchanged)
server/docker-compose.yml 4ms (unchanged)
trivy-secret.yaml 2ms (unchanged)
zizmor.yml 4ms (unchanged)

(Truncated to last 6666 characters out of 11780)

⚠️ YAML / yamllint - 34 errors

.grype.yaml
  6:1       warning  missing document start "---"  (document-start)

mega-linter-runner/.eslintrc.yml
  11:9      warning  too few spaces inside empty braces  (braces)

mega-linter-runner/generators/mega-linter-custom-flavor/templates/megalinter-custom-flavor-builder.yml
  48:15     warning  too few spaces inside empty braces  (braces)

mega-linter-runner/generators/mega-linter-custom-flavor/templates/megalinter-custom-flavor.yml
  7:1       error    syntax error: could not find expected ':' (syntax)

mega-linter-runner/generators/mega-linter/templates/mega-linter.yml
  38:15     warning  too few spaces inside empty braces  (braces)
  69:11     error    syntax error: could not find expected ':' (syntax)

megalinter/descriptors/copypaste.megalinter-descriptor.yml
  18:301    warning  line too long (313 > 300 characters)  (line-length)

megalinter/descriptors/javascript.megalinter-descriptor.yml
  54:301    warning  line too long (475 > 300 characters)  (line-length)
  348:301   warning  line too long (307 > 300 characters)  (line-length)

megalinter/descriptors/jsx.megalinter-descriptor.yml
  30:301    warning  line too long (475 > 300 characters)  (line-length)

megalinter/descriptors/perl.megalinter-descriptor.yml
  25:301    warning  line too long (310 > 300 characters)  (line-length)

megalinter/descriptors/php.megalinter-descriptor.yml
  195:301   warning  line too long (389 > 300 characters)  (line-length)
  209:301   warning  line too long (302 > 300 characters)  (line-length)

megalinter/descriptors/repository.megalinter-descriptor.yml
  183:301   warning  line too long (408 > 300 characters)  (line-length)
  287:301   warning  line too long (345 > 300 characters)  (line-length)
  461:301   warning  line too long (306 > 300 characters)  (line-length)
  624:301   warning  line too long (316 > 300 characters)  (line-length)
  949:301   warning  line too long (1263 > 300 characters)  (line-length)
  1042:301  warning  line too long (879 > 300 characters)  (line-length)
  1056:301  warning  line too long (358 > 300 characters)  (line-length)
  1118:301  warning  line too long (346 > 300 characters)  (line-length)
  1125:301  warning  line too long (307 > 300 characters)  (line-length)

megalinter/descriptors/salesforce.megalinter-descriptor.yml
  52:301    warning  line too long (359 > 300 characters)  (line-length)

megalinter/descriptors/spell.megalinter-descriptor.yml
  178:301   warning  line too long (315 > 300 characters)  (line-length)

megalinter/descriptors/terraform.megalinter-descriptor.yml
  27:301    warning  line too long (330 > 300 characters)  (line-length)
  87:301    warning  line too long (346 > 300 characters)  (line-length)
  153:301   warning  line too long (328 > 300 characters)  (line-length)

megalinter/descriptors/tsx.megalinter-descriptor.yml
  30:301    warning  line too long (475 > 300 characters)  (line-length)

megalinter/descriptors/typescript.megalinter-descriptor.yml
  41:301    warning  line too long (475 > 300 characters)  (line-length)
  338:301   warning  line too long (314 > 300 characters)  (line-length)

mkdocs.yml
  8:301     warning  line too long (590 > 300 characters)  (line-length)
  72:5      warning  wrong indentation: expected 6 but found 4  (indentation)
  85:5      warning  wrong indentation: expected 6 but found 4  (indentation)

zizmor.yml
  1:1       warning  missing document start "---"  (document-start)

✅ Linters with no issues

actionlint, betterleaks, black, checkov, cspell, flake8, git_diff, grype, hadolint, isort, jscpd, jsonlint, markdown-table-formatter, mypy, npm-groovy-lint, osv-scanner, pylint, ruff, secretlint, shellcheck, shfmt, syft, trivy, trivy-sbom, trufflehog, v8r, v8r, xmllint, zizmor

Notices

⚠️ Your configuration references items that have been removed from MegaLinter and are ignored: API. See Removed linters to find their replacements.

See detailed reports in MegaLinter artifacts

Show us your support by starring ⭐ the repository

dependabot · 2026-08-05T22:27:53Z

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Aug 5, 2026

dependabot Bot requested review from echoix and nvuillam as code owners August 5, 2026 08:36

dependabot Bot added the dependencies Pull requests that update a dependency file label Aug 5, 2026

dependabot Bot requested review from Kurt-von-Laven and bdovaz as code owners August 5, 2026 08:36

dependabot Bot added the javascript Pull requests that update Javascript code label Aug 5, 2026

dependabot Bot temporarily deployed to dev August 5, 2026 08:36 Inactive

nvuillam closed this Aug 5, 2026

dependabot Bot deleted the dependabot/npm_and_yarn/dot-automation/test/repository_grype/bad/npm_and_yarn-91dec8e812 branch August 5, 2026 22:28

Navigation Menu

Uh oh!

Uh oh!

chore(deps): bump the npm_and_yarn group across 2 directories with 4 updates - #8644

chore(deps): bump the npm_and_yarn group across 2 directories with 4 updates#8644
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/dot-automation/test/repository_grype/bad/npm_and_yarn-91dec8e812

dependabot Bot commented on behalf of github Aug 5, 2026

Uh oh!

github-actions Bot commented Aug 5, 2026

Uh oh!

dependabot Bot commented on behalf of github Aug 5, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Advisory	CVE	Severity (CVSS)	Fixed in	Fix commit
GHSA-vxpw-j846-p89q	CVE-2026-12151	High (7.5)	6.27.0	`b7f252e7`
GHSA-p88m-4jfj-68fv	CVE-2026-9679	Moderate (5.9)	6.27.0	`25efa447`
GHSA-g8m3-5g58-fq7m	CVE-2026-11525	Low (3.7)	6.27.0	`25efa447`
GHSA-35p6-xmwp-9g52	CVE-2026-6733	Low (3.7)	6.27.0	`f4c31d60`

Uh oh!

Uh oh!

Conversation

dependabot Bot commented on behalf of github Aug 5, 2026

v1.1.15

v10.4.0

What's Changed

v10.3.1

v10.3.0

v10.2.2

v10.2.1

v6.28.0

⚠️ Security fixes

v6.27.0

⚠️ Security Release

Summary

High severity

WebSocket DoS via fragment count bypass — CVE-2026-12151

v1.1.15

v10.4.0

What's Changed

v10.3.1

v10.3.0

v10.2.2

v10.2.1

Uh oh!

github-actions Bot commented Aug 5, 2026

✅⚠️MegaLinter analysis: Success with warnings

✅ Linters with no issues

Notices

Uh oh!

dependabot Bot commented on behalf of github Aug 5, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant