Build(deps-dev): Bump baseline-browser-mapping from 2.9.19 to 2.11.27

[dependabot]

Bumps baseline-browser-mapping from 2.9.19 to 2.11.27.

Release notes

Sourced from baseline-browser-mapping's releases.

v2.11.0

What's Changed in 2.11.0

• feat: Adds a new getTimeline() method for getting the series of minimum browser changes, either grouped by date or by browser.
• refactor: Substantial refactoring of the data compression process that replaces the full list of browsers from @mdn/browser-compat-data and downstream-browsers.json and features from web-features (in their very pared down form) with a change-list timeline that reflects which versions supported Baseline (newly available) on a given date. Thanks to @​swwind for the idea!
• refactor: Some common functions have been moved to a util.ts module for use in other scripts.
• fix: Removes process.exit() calls when unsupported option combinations are passed to getCompatibleVersions() and getAllVersions() in favour of throwing an Error. There is a small security risk with process.exit() calls that sites accepting unsanitised inputs could be the subject of attacks. Unsupported config options now throw and Error which should allow for more graceful handling. Thanks to @​bnbdr for flagging this as vulnerability CVE-2026-45819 .

Fixes #134

Full Changelog: web-platform-dx/baseline-browser-mapping@v2.10.44...v2.11.0

v2.10.0

What's Changed

• Introduces support for Node 6 by refactoring all Object.entries and Object.values instances and lowering ES target in Rollup to es2015.
• Adds specified Node version support in package.json for >=6.0.0.
• Refactors CLI code to avoid parseArgs which is not supported by versions of Node prior to 18, changes import to require and changes Rollup export to cjs to allow execution on older versions of Node.
• Adds a new legacy-test.js file that allows basic testing on older versions of Node where current versions of Jasmine and ESLint are not supported.
• Adds a test matrix to run tests on all even-numbered Node versions from 6 to 24.
• refactor publish workflows to support NPM's new OIDC integration

Full Changelog: web-platform-dx/baseline-browser-mapping@v2.9.24...v2.10.0

Commits

• 6141d06 Patch to 2.11.27 because browser or feature data changed
• e1d166b Browser or feature data changed
• 42972a7 Updating static site
• c1934c6 Patch to 2.11.26 because browser or feature data changed
• 4873684 Browser or feature data changed
• 9030798 Updating static site
• a5df351 Updating static site
• ecc5b54 Updating static site
• 719bf7a Patch to 2.11.25 because browser or feature data changed
• c4f5b49 Browser or feature data changed
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for baseline-browser-mapping since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[github-actions]

❌MegaLinter analysis: Error

Descriptor	Linter	Files	Fixed	Errors	Warnings	Elapsed time
✅ ACTION	actionlint	5		0	0	0.15s
❌ ACTION	zizmor	5		1	0	0.31s
❌ JAVASCRIPT	eslint	19		19	0	7.8s
✅ JAVASCRIPT	prettier	19		0	0	0.81s
✅ JSON	npm-package-json-lint	yes		no	no	0.57s
✅ JSON	prettier	29		0	0	0.98s
✅ MARKDOWN	markdownlint	10		0	0	0.83s
✅ REPOSITORY	betterleaks	yes		no	no	0.54s
✅ REPOSITORY	checkov	yes		no	no	14.49s
✅ REPOSITORY	gitleaks	yes		no	no	1.36s
✅ REPOSITORY	git_diff	yes		no	no	0.01s
❌ REPOSITORY	grype	yes		42	no	93.78s
❌ REPOSITORY	osv-scanner	yes		79	no	1.99s
✅ REPOSITORY	secretlint	yes		no	no	0.86s
✅ REPOSITORY	syft	yes		no	no	3.02s
❌ REPOSITORY	trivy	yes		1	no	14.61s
✅ REPOSITORY	trivy-sbom	yes		no	no	2.95s
✅ REPOSITORY	trufflehog	yes		no	no	26.27s
❌ TYPESCRIPT	eslint	108		26	0	7.02s
✅ TYPESCRIPT	prettier	108		0	0	2.6s
✅ YAML	prettier	25		0	0	0.65s
✅ YAML	yamllint	25		0	0	0.51s

Detailed Issues

❌ JAVASCRIPT / eslint - 19 errors

__fixtures__/javascript-esm/no-import/src/index.js
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/javascript-esm/no-import/src/index.js

__fixtures__/javascript-esm/no-import/src/main.js
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/javascript-esm/no-import/src/main.js

__fixtures__/javascript-esm/success/post/index.js
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/javascript-esm/success/post/index.js

__fixtures__/javascript-esm/success/post/main.js
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/javascript-esm/success/post/main.js

__fixtures__/javascript-esm/success/pre/index.js
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/javascript-esm/success/pre/index.js

__fixtures__/javascript-esm/success/pre/main.js
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/javascript-esm/success/pre/main.js

__fixtures__/javascript-esm/success/src/index.js
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/javascript-esm/success/src/index.js

__fixtures__/javascript-esm/success/src/main.js
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/javascript-esm/success/src/main.js

__fixtures__/javascript/no-export/src/index.js
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/javascript/no-export/src/index.js

__fixtures__/javascript/no-export/src/main.js
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/javascript/no-export/src/main.js

__fixtures__/javascript/no-import/src/index.js
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/javascript/no-import/src/index.js

__fixtures__/javascript/no-import/src/main.js
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/javascript/no-import/src/main.js

__fixtures__/javascript/success/post/index.js
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/javascript/success/post/index.js

__fixtures__/javascript/success/post/main.js
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/javascript/success/post/main.js

__fixtures__/javascript/success/pre/index.js
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/javascript/success/pre/index.js

__fixtures__/javascript/success/pre/main.js
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/javascript/success/pre/main.js

__fixtures__/javascript/success/src/index.js
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/javascript/success/src/index.js

__fixtures__/javascript/success/src/main.js
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/javascript/success/src/main.js

bin/local-action.js
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): bin/local-action.js

✖ 19 problems (19 errors, 0 warnings)

❌ TYPESCRIPT / eslint - 26 errors

has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript-esm/no-export/src/index.ts

__fixtures__/typescript-esm/no-export/src/main.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript-esm/no-export/src/main.ts

__fixtures__/typescript-esm/no-import/src/index.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript-esm/no-import/src/index.ts

__fixtures__/typescript-esm/no-import/src/main.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript-esm/no-import/src/main.ts

__fixtures__/typescript-esm/success/post/index.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript-esm/success/post/index.ts

__fixtures__/typescript-esm/success/post/main.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript-esm/success/post/main.ts

__fixtures__/typescript-esm/success/pre/index.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript-esm/success/pre/index.ts

__fixtures__/typescript-esm/success/pre/main.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript-esm/success/pre/main.ts

__fixtures__/typescript-esm/success/src/index.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript-esm/success/src/index.ts

__fixtures__/typescript-esm/success/src/main.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript-esm/success/src/main.ts

__fixtures__/typescript-esm/tsconfig-comments/src/index.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript-esm/tsconfig-comments/src/index.ts

__fixtures__/typescript-esm/tsconfig-comments/src/main.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript-esm/tsconfig-comments/src/main.ts

__fixtures__/typescript/no-import/src/index.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript/no-import/src/index.ts

__fixtures__/typescript/no-import/src/main.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript/no-import/src/main.ts

__fixtures__/typescript/success-yaml/post/index.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript/success-yaml/post/index.ts

__fixtures__/typescript/success-yaml/post/main.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript/success-yaml/post/main.ts

__fixtures__/typescript/success-yaml/pre/index.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript/success-yaml/pre/index.ts

__fixtures__/typescript/success-yaml/pre/main.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript/success-yaml/pre/main.ts

__fixtures__/typescript/success-yaml/src/index.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript/success-yaml/src/index.ts

__fixtures__/typescript/success-yaml/src/main.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript/success-yaml/src/main.ts

__fixtures__/typescript/success/post/index.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript/success/post/index.ts

__fixtures__/typescript/success/post/main.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript/success/post/main.ts

__fixtures__/typescript/success/pre/index.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript/success/pre/index.ts

__fixtures__/typescript/success/pre/main.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript/success/pre/main.ts

__fixtures__/typescript/success/src/index.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript/success/src/index.ts

__fixtures__/typescript/success/src/main.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript/success/src/main.ts

✖ 26 problems (26 errors, 0 warnings)

(Truncated to last 6666 characters out of 6769)

❌ REPOSITORY / grype - 42 errors

[0000]  WARN no explicit name and version provided for directory source, deriving artifact ID from the given path (which is not ideal) from=syft
NAME              INSTALLED  FIXED IN  TYPE  VULNERABILITY        SEVERITY  EPSS         RISK   
lodash            4.17.23    4.18.0    npm   GHSA-r5fr-rjxr-66jc  High      2.6% (84th)  2.0    
undici            7.24.4     7.28.0    npm   GHSA-vxpw-j846-p89q  High      0.8% (54th)  0.6    
brace-expansion   1.1.12     1.1.18    npm   GHSA-rgw5-rvv9-x895  High      0.6% (49th)  0.5    
brace-expansion   2.0.2      2.1.4     npm   GHSA-rgw5-rvv9-x895  High      0.6% (49th)  0.5    
brace-expansion   1.1.12     1.1.17    npm   GHSA-mh99-v99m-4gvg  High      0.6% (49th)  0.5    
brace-expansion   2.0.2      2.1.3     npm   GHSA-mh99-v99m-4gvg  High      0.6% (49th)  0.5    
undici            7.24.4     7.29.0    npm   GHSA-4cwx-7wf7-3272  High      0.6% (45th)  0.4    
undici            7.24.4     7.28.0    npm   GHSA-vmh5-mc38-953g  High      0.6% (44th)  0.4    
brace-expansion   1.1.12     1.1.13    npm   GHSA-f886-m6hf-6m8v  Medium    0.6% (47th)  0.4    
brace-expansion   2.0.2      2.0.3     npm   GHSA-f886-m6hf-6m8v  Medium    0.6% (47th)  0.4    
figlet            1.10.0     1.11.3    npm   GHSA-62ch-8vmq-8xm7  High      0.4% (32nd)  0.3    
undici            7.24.4     7.29.1    npm   GHSA-rfgv-xxqx-mfg5  High      0.4% (31st)  0.3    
undici            7.24.4     7.28.0    npm   GHSA-hm92-r4w5-c3mj  High      0.4% (30th)  0.3    
brace-expansion   1.1.12     1.1.19    npm   GHSA-6j4f-fj2g-mc7p  High      0.4% (26th)  0.3    
brace-expansion   1.1.12     1.1.20    npm   GHSA-qhr7-859c-m2p7  High      0.4% (26th)  0.3    
brace-expansion   2.0.2      2.1.5     npm   GHSA-6j4f-fj2g-mc7p  High      0.4% (26th)  0.3    
brace-expansion   2.0.2      2.1.6     npm   GHSA-qhr7-859c-m2p7  High      0.4% (26th)  0.3    
brace-expansion   1.1.12     1.1.16    npm   GHSA-3jxr-9vmj-r5cp  High      0.4% (28th)  0.3    
brace-expansion   2.0.2      2.1.2     npm   GHSA-3jxr-9vmj-r5cp  High      0.4% (28th)  0.3    
yaml              2.8.2      2.8.3     npm   GHSA-48c2-rrv3-qjmp  Medium    0.5% (43rd)  0.2    
undici            7.24.4     7.28.0    npm   GHSA-pr7r-676h-xcf6  Medium    0.4% (34th)  0.2    
undici            7.24.4     7.29.1    npm   GHSA-3xpg-4rpp-hhhm  Medium    0.4% (33rd)  0.2    
lodash            4.17.23    4.18.0    npm   GHSA-f23m-r3pf-42rh  Medium    0.4% (29th)  0.2    
undici            7.24.4     7.29.0    npm   GHSA-jr45-8vmc-qm54  Medium    0.4% (31st)  0.2    
undici            7.24.4     7.29.1    npm   GHSA-rx4f-c7p8-82vq  Medium    0.4% (28th)  0.2    
undici            7.24.4     7.29.1    npm   GHSA-pmjh-fq2x-6v4x  Medium    0.4% (27th)  0.2    
fast-xml-builder  1.1.4      1.1.7     npm   GHSA-5wm8-gmm8-39j9  High      0.3% (15th)  0.2    
undici            7.24.4     7.28.0    npm   GHSA-p88m-4jfj-68fv  Medium    0.3% (24th)  0.2    
undici            7.24.4     7.29.1    npm   GHSA-2jfj-6hjv-fm6j  Medium    0.3% (21st)  0.2    
brace-expansion   1.1.12     1.1.21    npm   GHSA-q2hr-2g5m-vwhr  Medium    0.3% (20th)  0.2    
brace-expansion   2.0.2      2.1.7     npm   GHSA-q2hr-2g5m-vwhr  Medium    0.3% (20th)  0.2    
fast-xml-parser   5.5.7      5.7.0     npm   GHSA-gh4j-gqv2-49f6  Medium    0.3% (17th)  0.2    
undici            7.24.4     7.29.1    npm   GHSA-w293-vg96-wgc3  High      0.1% (3rd)   0.1    
undici            7.24.4     7.29.0    npm   GHSA-v3r7-h72x-cjcm  Medium    0.2% (7th)   < 0.1  
undici            7.24.4     7.28.0    npm   GHSA-35p6-xmwp-9g52  Low       0.3% (17th)  < 0.1  
undici            7.24.4     7.29.0    npm   GHSA-m8rv-5g2x-5cg5  Medium    0.2% (8th)   < 0.1  
undici            7.24.4     7.29.0    npm   GHSA-8xcm-r25x-g524  Medium    0.2% (6th)   < 0.1  
undici            7.24.4     7.29.1    npm   GHSA-r53p-7pc4-xj5r  Low       0.2% (13th)  < 0.1  
undici            7.24.4     7.28.0    npm   GHSA-g8m3-5g58-fq7m  Low       0.2% (13th)  < 0.1  
undici            7.24.4     7.29.1    npm   GHSA-2gqq-gqf2-x968  Low       0.2% (8th)   < 0.1  
undici            7.24.4     7.29.1    npm   GHSA-8436-99hf-9mmv  Low       0.1% (1st)   < 0.1  
esbuild           0.27.3     0.28.1    npm   GHSA-g7r4-m6w7-qqqr  Low       N/A          N/A
[0093] ERROR discovered vulnerabilities at or above the severity threshold

❌ REPOSITORY / osv-scanner - 79 errors

.5  | npm       | brace-expansion (dev) | 5.0.4   | 5.0.8         | package-lock.json |
| https://osv.dev/GHSA-q2hr-2g5m-vwhr | 5.3  | npm       | brace-expansion (dev) | 5.0.4   | 5.0.12        | package-lock.json |
| https://osv.dev/GHSA-qhr7-859c-m2p7 | 7.5  | npm       | brace-expansion (dev) | 5.0.4   | 5.0.11        | package-lock.json |
| https://osv.dev/GHSA-rgw5-rvv9-x895 | 7.5  | npm       | brace-expansion (dev) | 5.0.4   | 5.0.9         | package-lock.json |
| https://osv.dev/GHSA-vfj7-8cjw-p6xm | 8.7  | npm       | braces (dev)          | 3.0.3   | --            | package-lock.json |
| https://osv.dev/GHSA-73wf-gq98-2v4g | 7.5  | npm       | browserslist (dev)    | 4.28.1  | 4.28.7        | package-lock.json |
| https://osv.dev/GHSA-c83g-rgw3-j3cx | 7.5  | npm       | browserslist (dev)    | 4.28.1  | 4.28.7        | package-lock.json |
| https://osv.dev/GHSA-g7r4-m6w7-qqqr | 2.5  | npm       | esbuild               | 0.27.3  | 0.28.1        | package-lock.json |
| https://osv.dev/GHSA-5wm8-gmm8-39j9 | 8.7  | npm       | fast-xml-builder      | 1.1.4   | 1.1.7         | package-lock.json |
| https://osv.dev/GHSA-gh4j-gqv2-49f6 | 6.1  | npm       | fast-xml-parser       | 5.5.7   | 5.7.0         | package-lock.json |
| https://osv.dev/GHSA-62ch-8vmq-8xm7 | 8.2  | npm       | figlet                | 1.10.0  | 1.11.3        | package-lock.json |
| https://osv.dev/GHSA-25h7-pfq9-p65f | 7.5  | npm       | flatted (dev)         | 3.3.3   | 3.4.0         | package-lock.json |
| https://osv.dev/GHSA-rf6f-7fwh-wjgh | 8.9  | npm       | flatted (dev)         | 3.3.3   | 3.4.2         | package-lock.json |
| https://osv.dev/GHSA-2883-xcg3-v3hh | 7.5  | npm       | js-yaml (dev)         | 3.14.2  | 3.15.2        | package-lock.json |
| https://osv.dev/GHSA-52cp-r559-cp3m | 7.5  | npm       | js-yaml (dev)         | 3.14.2  | 3.15.0        | package-lock.json |
| https://osv.dev/GHSA-5p4m-2wfm-xmqj | 7.5  | npm       | js-yaml (dev)         | 3.14.2  | 3.15.1        | package-lock.json |
| https://osv.dev/GHSA-h67p-54hq-rp68 | 5.3  | npm       | js-yaml (dev)         | 3.14.2  | 3.15.0        | package-lock.json |
| https://osv.dev/GHSA-2883-xcg3-v3hh | 7.5  | npm       | js-yaml (dev)         | 4.1.1   | 4.3.2         | package-lock.json |
| https://osv.dev/GHSA-52cp-r559-cp3m | 7.5  | npm       | js-yaml (dev)         | 4.1.1   | 4.3.0         | package-lock.json |
| https://osv.dev/GHSA-5p4m-2wfm-xmqj | 7.5  | npm       | js-yaml (dev)         | 4.1.1   | 4.3.1         | package-lock.json |
| https://osv.dev/GHSA-h67p-54hq-rp68 | 5.3  | npm       | js-yaml (dev)         | 4.1.1   | 4.2.0         | package-lock.json |
| https://osv.dev/GHSA-f23m-r3pf-42rh | 6.5  | npm       | lodash                | 4.17.23 | 4.18.0        | package-lock.json |
| https://osv.dev/GHSA-r5fr-rjxr-66jc | 8.1  | npm       | lodash                | 4.17.23 | 4.18.0        | package-lock.json |
| https://osv.dev/GHSA-3v7f-55p6-f55p | 5.3  | npm       | picomatch (dev)       | 2.3.1   | 2.3.2         | package-lock.json |
| https://osv.dev/GHSA-c2c7-rcm5-vvqj | 7.5  | npm       | picomatch (dev)       | 2.3.1   | 2.3.2         | package-lock.json |
| https://osv.dev/GHSA-3v7f-55p6-f55p | 5.3  | npm       | picomatch (dev)       | 4.0.3   | 4.0.4         | package-lock.json |
| https://osv.dev/GHSA-c2c7-rcm5-vvqj | 7.5  | npm       | picomatch (dev)       | 4.0.3   | 4.0.4         | package-lock.json |
| https://osv.dev/GHSA-hp3w-g68c-fv3c | 6.9  | npm       | sprintf-js (dev)      | 1.0.3   | --            | package-lock.json |
| https://osv.dev/GHSA-2gqq-gqf2-x968 | 3.7  | npm       | undici                | 7.24.4  | 7.29.1        | package-lock.json |
| https://osv.dev/GHSA-2jfj-6hjv-fm6j | 6.5  | npm       | undici                | 7.24.4  | 7.29.1        | package-lock.json |
| https://osv.dev/GHSA-35p6-xmwp-9g52 | 3.7  | npm       | undici                | 7.24.4  | 7.28.0        | package-lock.json |
| https://osv.dev/GHSA-3xpg-4rpp-hhhm | 5.9  | npm       | undici                | 7.24.4  | 7.29.1        | package-lock.json |
| https://osv.dev/GHSA-4cwx-7wf7-3272 | 7.4  | npm       | undici                | 7.24.4  | 7.29.0        | package-lock.json |
| https://osv.dev/GHSA-8436-99hf-9mmv | 3.7  | npm       | undici                | 7.24.4  | 7.29.1        | package-lock.json |
| https://osv.dev/GHSA-8xcm-r25x-g524 | 4.8  | npm       | undici                | 7.24.4  | 7.29.0        | package-lock.json |
| https://osv.dev/GHSA-g8m3-5g58-fq7m | 3.7  | npm       | undici                | 7.24.4  | 7.28.0        | package-lock.json |
| https://osv.dev/GHSA-hm92-r4w5-c3mj | 7.5  | npm       | undici                | 7.24.4  | 7.28.0        | package-lock.json |
| https://osv.dev/GHSA-jr45-8vmc-qm54 | 5.9  | npm       | undici                | 7.24.4  | 7.29.0        | package-lock.json |
| https://osv.dev/GHSA-m8rv-5g2x-5cg5 | 4.2  | npm       | undici                | 7.24.4  | 7.29.0        | package-lock.json |
| https://osv.dev/GHSA-p88m-4jfj-68fv | 5.9  | npm       | undici                | 7.24.4  | 7.28.0        | package-lock.json |
| https://osv.dev/GHSA-pmjh-fq2x-6v4x | 5.9  | npm       | undici                | 7.24.4  | 7.29.1        | package-lock.json |
| https://osv.dev/GHSA-pr7r-676h-xcf6 | 5.9  | npm       | undici                | 7.24.4  | 7.28.0        | package-lock.json |
| https://osv.dev/GHSA-r53p-7pc4-xj5r | 3.7  | npm       | undici                | 7.24.4  | 7.29.1        | package-lock.json |
| https://osv.dev/GHSA-rfgv-xxqx-mfg5 | 7.5  | npm       | undici                | 7.24.4  | 7.29.1        | package-lock.json |
| https://osv.dev/GHSA-rx4f-c7p8-82vq | 5.9  | npm       | undici                | 7.24.4  | 7.29.1        | package-lock.json |
| https://osv.dev/GHSA-v3r7-h72x-cjcm | 4.8  | npm       | undici                | 7.24.4  | 7.29.0        | package-lock.json |
| https://osv.dev/GHSA-vmh5-mc38-953g | 7.4  | npm       | undici                | 7.24.4  | 7.28.0        | package-lock.json |
| https://osv.dev/GHSA-vxpw-j846-p89q | 7.5  | npm       | undici                | 7.24.4  | 7.28.0        | package-lock.json |
| https://osv.dev/GHSA-w293-vg96-wgc3 | 7.4  | npm       | undici                | 7.24.4  | 7.29.1        | package-lock.json |
| https://osv.dev/GHSA-w5hq-g745-h8pq | 7.5  | npm       | uuid (dev)            | 8.3.2   | 11.1.1        | package-lock.json |
| https://osv.dev/GHSA-48c2-rrv3-qjmp | 4.3  | npm       | yaml                  | 2.8.2   | 2.8.3         | package-lock.json |
+-------------------------------------+------+-----------+-----------------------+---------+---------------+-------------------+

(Truncated to last 6666 characters out of 11081)

❌ REPOSITORY / trivy - 1 error

│        │                   │                              ├──────────────────────────────────────────────────────────────┤
│                  │ CVE-2026-85014      │          │        │                   │                              │ undici: undici: Denial of Service via WebSocketStream        │
│                  │                     │          │        │                   │                              │ unclean close                                                │
│                  │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-85014                   │
│                  ├─────────────────────┤          │        │                   ├──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│                  │ CVE-2026-9678       │          │        │                   │ 7.28.0, 8.5.0                │ undici: Undici: Information disclosure due to improper       │
│                  │                     │          │        │                   │                              │ cache-control header parsing                                 │
│                  │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-9678                    │
│                  ├─────────────────────┤          │        │                   ├──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│                  │ CVE-2026-9679       │          │        │                   │ 6.27.0, 7.28.0, 8.5.0        │ undici: undici vulnerable to HTTP header injection via       │
│                  │                     │          │        │                   │                              │ Set-Cookie percent-decoding                                  │
│                  │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-9679                    │
│                  ├─────────────────────┼──────────┤        │                   │                              ├──────────────────────────────────────────────────────────────┤
│                  │ CVE-2026-11525      │ LOW      │        │                   │                              │ undici: undici: Weakening of cookie SameSite policy due to   │
│                  │                     │          │        │                   │                              │ incorrect parsing of...                                      │
│                  │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-11525                   │
│                  ├─────────────────────┤          │        │                   ├──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│                  │ CVE-2026-18540      │          │        │                   │ 6.28.1, 7.29.1, 8.10.2       │ undici: undici: HTTP response splitting via retry            │
│                  │                     │          │        │                   │                              │ interceptor                                                  │
│                  │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-18540                   │
│                  ├─────────────────────┤          │        │                   ├──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│                  │ CVE-2026-6733       │          │        │                   │ 6.27.0, 7.28.0, 8.5.0        │ undici: Undici: Response queue poisoning on reused           │
│                  │                     │          │        │                   │                              │ keep-alive sockets can lead to...                            │
│                  │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-6733                    │
│                  ├─────────────────────┤          │        │                   ├──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│                  │ CVE-2026-84947      │          │        │                   │ 7.29.1, 8.10.2               │ undici: Undici: Response truncation and connection           │
│                  │                     │          │        │                   │                              │ termination                                                  │
│                  │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-84947                   │
│                  ├─────────────────────┤          │        │                   │                              ├──────────────────────────────────────────────────────────────┤
│                  │ CVE-2026-85008      │          │        │                   │                              │ undici: undici: Integrity failure due to caching of unsafe   │
│                  │                     │          │        │                   │                              │ HTTP method responses...                                     │
│                  │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-85008                   │
├──────────────────┼─────────────────────┼──────────┤        ├───────────────────┼──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ yaml             │ CVE-2026-33532      │ MEDIUM   │        │ 2.8.2             │ 2.8.3, 1.10.3                │ yaml: yaml: Denial of Service via deeply nested YAML         │
│                  │                     │          │        │                   │                              │ document parsing                                             │
│                  │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-33532                   │
└──────────────────┴─────────────────────┴──────────┴────────┴───────────────────┴──────────────────────────────┴──────────────────────────────────────────────────────────────┘

📣 Notices:
  - Version 0.75.0 of Trivy is now available, current version is 0.71.2

To suppress version checks, run Trivy scans with the --skip-version-check flag

(Truncated to last 6666 characters out of 35229)

❌ ACTION / zizmor - 1 error

INFO zizmor: 🌈 zizmor v1.25.0
fatal: no audit was performed
'ref-confusion' audit failed on file://.github/workflows/codeql-analysis.yml

Caused by:
    0: error in 'ref-confusion' audit
    1: couldn't list branches for actions/checkout
    2: request error while accessing GitHub API
    3: HTTP status client error (401 Unauthorized) for url (https://github.com/actions/checkout.git/git-upload-pack)


[ACTION_ZIZMOR_ERROR_GITHUB_API_UNREACHABLE] Zizmor could not access a repository referenced by a `uses:` clause via the GitHub API (missing token, insufficient scope, or cross-repo private access).
To allow zizmor to authenticate with GITHUB_TOKEN (or a PAT with `Contents: read-only`), whitelist the variable in your .mega-linter.yml:
ACTION_ZIZMOR_UNSECURED_ENV_VARIABLES:
  - GITHUB_TOKEN
If the referenced workflow is in a private repo outside the current one, provide a PAT with cross-repo access instead of the default GITHUB_TOKEN, or run zizmor in offline mode.

Notices

📣 MegaLinter 9.5.0 is out! Discover the new features and security recommendations in the release announcement. (Skip this info by defining SECURITY_SUGGESTIONS: false)

See detailed reports in MegaLinter artifacts

Show us your support by starring ⭐ the repository