Build(deps-dev): Bump browserslist from 4.28.1 to 4.29.3

[dependabot]

Bumps browserslist from 4.28.1 to 4.29.3.

Release notes

Sourced from browserslist's releases.

4.29.3

• Updated Firefox ESR.

4.29.2

• Fixed ignoring null usage in cover X in Y query (by @​wahidrizka).

4.29.1

• Fixed config name loading protection on Windows (by @​oss-security-shop).
• Fixed case-insensitive negation queries (by @​jakezwang).
• Fixed percentage and supports queries case-insensitive (by @​wahidrizka).
• Fixed old Node.js tests (by @​aaron-belenky).
• Reduced code (by @​charmander).

4.29.0

• Added query continuations across lines and array entries (by @​fzlzjerry).

4.28.9

• Improve or parsing performance (by @​NotAFlightRisk).

4.28.8

• Fixed including kaios in baseline queries (by @​Jaybhade).

4.28.7

• Improved parsing performance.
• Fixed unbounded memory growth (by @​alanturing881).
• Fixed prototype write issue (by @​alanturing881).

4.28.6

• Fixed Electron version queries (by @​spokodev).

4.28.5

• Fixed > and >= queries (by @​spokodev).

4.28.4

• Fixed SyntaxError regression of 4.28.3.

4.28.3

• Fixed baseline query case-insensitivity (by @​swwind).

4.28.2

• Fix prototype pollution (by @​chluo1997).

Changelog

Sourced from browserslist's changelog.

4.29.3

• Updated Firefox ESR.

4.29.2

• Fixed ignoring null usage in cover X in Y query (by @​wahidrizka).

4.29.1

• Fixed config name loading protection on Windows (by @​oss-security-shop).
• Fixed case-insensitive negation queries (by @​jakezwang).
• Fixed percentage and supports queries case-insensitive (by @​wahidrizka).
• Fixed old Node.js tests (by @​aaron-belenky).
• Reduced code (by @​charmander).

4.29.0

• Added query continuations across lines and array entries (by @​fzlzjerry).

4.28.9

• Improved or parsing performance (by @​NotAFlightRisk).

4.28.8

• Fixed including kaios in baseline queries (by @​Jaybhade).

4.28.7

• Improved parsing performance.
• Fixed unbounded memory growth (by @​alanturing881).
• Fixed prototype write issue (by @​alanturing881).

4.28.6

• Fixed Electron version queries (by @​spokodev).

4.28.5

• Fixed > and >= queries (by @​spokodev).

4.28.4

• Fixed SyntaxError regression of 4.28.3.

4.28.3

• Fixed baseline query case-insensitivity (by @​swwind).

... (truncated)

Commits

• b4809dd Release 4.29.3 version
• 9d844f8 Update Firefox ESR
• 0033f34 Update dependencies
• 906d329 Release 4.29.2 version
• ff8c83f Update dependencies
• 067f4a1 Merge pull request #952 from wahidrizka/fix-cover-null-usage
• f760921 Do not add versions without usage data to cover queries
• 5be63f5 Merge pull request #953 from wahidrizka/docs-android-latest-version
• 1e5356f Note that Android version queries return only the latest version
• 5b7e941 Add missed changes to ChangeLog
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for browserslist since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[github-actions]

❌MegaLinter analysis: Error

Descriptor	Linter	Files	Fixed	Errors	Warnings	Elapsed time
✅ ACTION	actionlint	5		0	0	0.18s
❌ ACTION	zizmor	5		1	0	0.23s
❌ JAVASCRIPT	eslint	19		19	0	6.52s
✅ JAVASCRIPT	prettier	19		0	0	1.12s
✅ JSON	npm-package-json-lint	yes		no	no	0.45s
✅ JSON	prettier	29		0	0	1.09s
✅ MARKDOWN	markdownlint	10		0	0	0.72s
✅ REPOSITORY	betterleaks	yes		no	no	0.58s
✅ REPOSITORY	checkov	yes		no	no	14.46s
✅ REPOSITORY	gitleaks	yes		no	no	1.17s
✅ REPOSITORY	git_diff	yes		no	no	0.01s
❌ REPOSITORY	grype	yes		42	no	91.47s
❌ REPOSITORY	osv-scanner	yes		77	no	1.57s
✅ REPOSITORY	secretlint	yes		no	no	0.8s
✅ REPOSITORY	syft	yes		no	no	1.82s
❌ REPOSITORY	trivy	yes		1	no	14.41s
✅ REPOSITORY	trivy-sbom	yes		no	no	2.13s
✅ REPOSITORY	trufflehog	yes		no	no	24.59s
❌ TYPESCRIPT	eslint	108		26	0	7.3s
✅ TYPESCRIPT	prettier	108		0	0	2.52s
✅ YAML	prettier	25		0	0	0.56s
✅ YAML	yamllint	25		0	0	0.58s

Detailed Issues

❌ JAVASCRIPT / eslint - 19 errors

__fixtures__/javascript-esm/no-import/src/index.js
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/javascript-esm/no-import/src/index.js

__fixtures__/javascript-esm/no-import/src/main.js
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/javascript-esm/no-import/src/main.js

__fixtures__/javascript-esm/success/post/index.js
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/javascript-esm/success/post/index.js

__fixtures__/javascript-esm/success/post/main.js
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/javascript-esm/success/post/main.js

__fixtures__/javascript-esm/success/pre/index.js
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/javascript-esm/success/pre/index.js

__fixtures__/javascript-esm/success/pre/main.js
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/javascript-esm/success/pre/main.js

__fixtures__/javascript-esm/success/src/index.js
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/javascript-esm/success/src/index.js

__fixtures__/javascript-esm/success/src/main.js
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/javascript-esm/success/src/main.js

__fixtures__/javascript/no-export/src/index.js
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/javascript/no-export/src/index.js

__fixtures__/javascript/no-export/src/main.js
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/javascript/no-export/src/main.js

__fixtures__/javascript/no-import/src/index.js
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/javascript/no-import/src/index.js

__fixtures__/javascript/no-import/src/main.js
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/javascript/no-import/src/main.js

__fixtures__/javascript/success/post/index.js
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/javascript/success/post/index.js

__fixtures__/javascript/success/post/main.js
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/javascript/success/post/main.js

__fixtures__/javascript/success/pre/index.js
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/javascript/success/pre/index.js

__fixtures__/javascript/success/pre/main.js
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/javascript/success/pre/main.js

__fixtures__/javascript/success/src/index.js
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/javascript/success/src/index.js

__fixtures__/javascript/success/src/main.js
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/javascript/success/src/main.js

bin/local-action.js
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): bin/local-action.js

✖ 19 problems (19 errors, 0 warnings)

❌ TYPESCRIPT / eslint - 26 errors

has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript-esm/no-export/src/index.ts

__fixtures__/typescript-esm/no-export/src/main.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript-esm/no-export/src/main.ts

__fixtures__/typescript-esm/no-import/src/index.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript-esm/no-import/src/index.ts

__fixtures__/typescript-esm/no-import/src/main.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript-esm/no-import/src/main.ts

__fixtures__/typescript-esm/success/post/index.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript-esm/success/post/index.ts

__fixtures__/typescript-esm/success/post/main.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript-esm/success/post/main.ts

__fixtures__/typescript-esm/success/pre/index.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript-esm/success/pre/index.ts

__fixtures__/typescript-esm/success/pre/main.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript-esm/success/pre/main.ts

__fixtures__/typescript-esm/success/src/index.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript-esm/success/src/index.ts

__fixtures__/typescript-esm/success/src/main.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript-esm/success/src/main.ts

__fixtures__/typescript-esm/tsconfig-comments/src/index.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript-esm/tsconfig-comments/src/index.ts

__fixtures__/typescript-esm/tsconfig-comments/src/main.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript-esm/tsconfig-comments/src/main.ts

__fixtures__/typescript/no-import/src/index.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript/no-import/src/index.ts

__fixtures__/typescript/no-import/src/main.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript/no-import/src/main.ts

__fixtures__/typescript/success-yaml/post/index.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript/success-yaml/post/index.ts

__fixtures__/typescript/success-yaml/post/main.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript/success-yaml/post/main.ts

__fixtures__/typescript/success-yaml/pre/index.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript/success-yaml/pre/index.ts

__fixtures__/typescript/success-yaml/pre/main.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript/success-yaml/pre/main.ts

__fixtures__/typescript/success-yaml/src/index.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript/success-yaml/src/index.ts

__fixtures__/typescript/success-yaml/src/main.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript/success-yaml/src/main.ts

__fixtures__/typescript/success/post/index.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript/success/post/index.ts

__fixtures__/typescript/success/post/main.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript/success/post/main.ts

__fixtures__/typescript/success/pre/index.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript/success/pre/index.ts

__fixtures__/typescript/success/pre/main.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript/success/pre/main.ts

__fixtures__/typescript/success/src/index.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript/success/src/index.ts

__fixtures__/typescript/success/src/main.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript/success/src/main.ts

✖ 26 problems (26 errors, 0 warnings)

(Truncated to last 6666 characters out of 6769)

❌ REPOSITORY / grype - 42 errors

[0000]  WARN no explicit name and version provided for directory source, deriving artifact ID from the given path (which is not ideal) from=syft
NAME              INSTALLED  FIXED IN  TYPE  VULNERABILITY        SEVERITY  EPSS         RISK   
lodash            4.17.23    4.18.0    npm   GHSA-r5fr-rjxr-66jc  High      2.6% (84th)  2.0    
undici            7.24.4     7.28.0    npm   GHSA-vxpw-j846-p89q  High      0.8% (54th)  0.6    
brace-expansion   1.1.12     1.1.18    npm   GHSA-rgw5-rvv9-x895  High      0.6% (49th)  0.5    
brace-expansion   2.0.2      2.1.4     npm   GHSA-rgw5-rvv9-x895  High      0.6% (49th)  0.5    
brace-expansion   1.1.12     1.1.17    npm   GHSA-mh99-v99m-4gvg  High      0.6% (49th)  0.5    
brace-expansion   2.0.2      2.1.3     npm   GHSA-mh99-v99m-4gvg  High      0.6% (49th)  0.5    
undici            7.24.4     7.29.0    npm   GHSA-4cwx-7wf7-3272  High      0.6% (45th)  0.4    
undici            7.24.4     7.28.0    npm   GHSA-vmh5-mc38-953g  High      0.6% (44th)  0.4    
brace-expansion   1.1.12     1.1.13    npm   GHSA-f886-m6hf-6m8v  Medium    0.6% (47th)  0.4    
brace-expansion   2.0.2      2.0.3     npm   GHSA-f886-m6hf-6m8v  Medium    0.6% (47th)  0.4    
figlet            1.10.0     1.11.3    npm   GHSA-62ch-8vmq-8xm7  High      0.4% (32nd)  0.3    
undici            7.24.4     7.29.1    npm   GHSA-rfgv-xxqx-mfg5  High      0.4% (31st)  0.3    
undici            7.24.4     7.28.0    npm   GHSA-hm92-r4w5-c3mj  High      0.4% (30th)  0.3    
brace-expansion   1.1.12     1.1.19    npm   GHSA-6j4f-fj2g-mc7p  High      0.4% (26th)  0.3    
brace-expansion   1.1.12     1.1.20    npm   GHSA-qhr7-859c-m2p7  High      0.4% (26th)  0.3    
brace-expansion   2.0.2      2.1.5     npm   GHSA-6j4f-fj2g-mc7p  High      0.4% (26th)  0.3    
brace-expansion   2.0.2      2.1.6     npm   GHSA-qhr7-859c-m2p7  High      0.4% (26th)  0.3    
brace-expansion   1.1.12     1.1.16    npm   GHSA-3jxr-9vmj-r5cp  High      0.4% (28th)  0.3    
brace-expansion   2.0.2      2.1.2     npm   GHSA-3jxr-9vmj-r5cp  High      0.4% (28th)  0.3    
yaml              2.8.2      2.8.3     npm   GHSA-48c2-rrv3-qjmp  Medium    0.5% (43rd)  0.2    
undici            7.24.4     7.28.0    npm   GHSA-pr7r-676h-xcf6  Medium    0.4% (34th)  0.2    
undici            7.24.4     7.29.1    npm   GHSA-3xpg-4rpp-hhhm  Medium    0.4% (33rd)  0.2    
lodash            4.17.23    4.18.0    npm   GHSA-f23m-r3pf-42rh  Medium    0.4% (29th)  0.2    
undici            7.24.4     7.29.0    npm   GHSA-jr45-8vmc-qm54  Medium    0.4% (31st)  0.2    
undici            7.24.4     7.29.1    npm   GHSA-rx4f-c7p8-82vq  Medium    0.4% (28th)  0.2    
undici            7.24.4     7.29.1    npm   GHSA-pmjh-fq2x-6v4x  Medium    0.4% (27th)  0.2    
fast-xml-builder  1.1.4      1.1.7     npm   GHSA-5wm8-gmm8-39j9  High      0.3% (15th)  0.2    
undici            7.24.4     7.28.0    npm   GHSA-p88m-4jfj-68fv  Medium    0.3% (24th)  0.2    
undici            7.24.4     7.29.1    npm   GHSA-2jfj-6hjv-fm6j  Medium    0.3% (21st)  0.2    
brace-expansion   1.1.12     1.1.21    npm   GHSA-q2hr-2g5m-vwhr  Medium    0.3% (20th)  0.2    
brace-expansion   2.0.2      2.1.7     npm   GHSA-q2hr-2g5m-vwhr  Medium    0.3% (20th)  0.2    
fast-xml-parser   5.5.7      5.7.0     npm   GHSA-gh4j-gqv2-49f6  Medium    0.3% (17th)  0.2    
undici            7.24.4     7.29.1    npm   GHSA-w293-vg96-wgc3  High      0.1% (3rd)   0.1    
undici            7.24.4     7.29.0    npm   GHSA-v3r7-h72x-cjcm  Medium    0.2% (7th)   < 0.1  
undici            7.24.4     7.28.0    npm   GHSA-35p6-xmwp-9g52  Low       0.3% (17th)  < 0.1  
undici            7.24.4     7.29.0    npm   GHSA-m8rv-5g2x-5cg5  Medium    0.2% (8th)   < 0.1  
undici            7.24.4     7.29.0    npm   GHSA-8xcm-r25x-g524  Medium    0.2% (6th)   < 0.1  
undici            7.24.4     7.29.1    npm   GHSA-r53p-7pc4-xj5r  Low       0.2% (13th)  < 0.1  
undici            7.24.4     7.28.0    npm   GHSA-g8m3-5g58-fq7m  Low       0.2% (13th)  < 0.1  
undici            7.24.4     7.29.1    npm   GHSA-2gqq-gqf2-x968  Low       0.2% (8th)   < 0.1  
undici            7.24.4     7.29.1    npm   GHSA-8436-99hf-9mmv  Low       0.1% (1st)   < 0.1  
esbuild           0.27.3     0.28.1    npm   GHSA-g7r4-m6w7-qqqr  Low       N/A          N/A
[0091] ERROR discovered vulnerabilities at or above the severity threshold

❌ REPOSITORY / osv-scanner - 77 errors

.5  | npm       | brace-expansion (dev) | 5.0.4   | 5.0.5         | package-lock.json |
| https://osv.dev/GHSA-jxxr-4gwj-5jf2 | 6.5  | npm       | brace-expansion (dev) | 5.0.4   | 5.0.6         | package-lock.json |
| https://osv.dev/GHSA-mh99-v99m-4gvg | 7.5  | npm       | brace-expansion (dev) | 5.0.4   | 5.0.8         | package-lock.json |
| https://osv.dev/GHSA-q2hr-2g5m-vwhr | 5.3  | npm       | brace-expansion (dev) | 5.0.4   | 5.0.12        | package-lock.json |
| https://osv.dev/GHSA-qhr7-859c-m2p7 | 7.5  | npm       | brace-expansion (dev) | 5.0.4   | 5.0.11        | package-lock.json |
| https://osv.dev/GHSA-rgw5-rvv9-x895 | 7.5  | npm       | brace-expansion (dev) | 5.0.4   | 5.0.9         | package-lock.json |
| https://osv.dev/GHSA-vfj7-8cjw-p6xm | 8.7  | npm       | braces (dev)          | 3.0.3   | --            | package-lock.json |
| https://osv.dev/GHSA-g7r4-m6w7-qqqr | 2.5  | npm       | esbuild               | 0.27.3  | 0.28.1        | package-lock.json |
| https://osv.dev/GHSA-5wm8-gmm8-39j9 | 8.7  | npm       | fast-xml-builder      | 1.1.4   | 1.1.7         | package-lock.json |
| https://osv.dev/GHSA-gh4j-gqv2-49f6 | 6.1  | npm       | fast-xml-parser       | 5.5.7   | 5.7.0         | package-lock.json |
| https://osv.dev/GHSA-62ch-8vmq-8xm7 | 8.2  | npm       | figlet                | 1.10.0  | 1.11.3        | package-lock.json |
| https://osv.dev/GHSA-25h7-pfq9-p65f | 7.5  | npm       | flatted (dev)         | 3.3.3   | 3.4.0         | package-lock.json |
| https://osv.dev/GHSA-rf6f-7fwh-wjgh | 8.9  | npm       | flatted (dev)         | 3.3.3   | 3.4.2         | package-lock.json |
| https://osv.dev/GHSA-2883-xcg3-v3hh | 7.5  | npm       | js-yaml (dev)         | 3.14.2  | 3.15.2        | package-lock.json |
| https://osv.dev/GHSA-52cp-r559-cp3m | 7.5  | npm       | js-yaml (dev)         | 3.14.2  | 3.15.0        | package-lock.json |
| https://osv.dev/GHSA-5p4m-2wfm-xmqj | 7.5  | npm       | js-yaml (dev)         | 3.14.2  | 3.15.1        | package-lock.json |
| https://osv.dev/GHSA-h67p-54hq-rp68 | 5.3  | npm       | js-yaml (dev)         | 3.14.2  | 3.15.0        | package-lock.json |
| https://osv.dev/GHSA-2883-xcg3-v3hh | 7.5  | npm       | js-yaml (dev)         | 4.1.1   | 4.3.2         | package-lock.json |
| https://osv.dev/GHSA-52cp-r559-cp3m | 7.5  | npm       | js-yaml (dev)         | 4.1.1   | 4.3.0         | package-lock.json |
| https://osv.dev/GHSA-5p4m-2wfm-xmqj | 7.5  | npm       | js-yaml (dev)         | 4.1.1   | 4.3.1         | package-lock.json |
| https://osv.dev/GHSA-h67p-54hq-rp68 | 5.3  | npm       | js-yaml (dev)         | 4.1.1   | 4.2.0         | package-lock.json |
| https://osv.dev/GHSA-f23m-r3pf-42rh | 6.5  | npm       | lodash                | 4.17.23 | 4.18.0        | package-lock.json |
| https://osv.dev/GHSA-r5fr-rjxr-66jc | 8.1  | npm       | lodash                | 4.17.23 | 4.18.0        | package-lock.json |
| https://osv.dev/GHSA-3v7f-55p6-f55p | 5.3  | npm       | picomatch (dev)       | 2.3.1   | 2.3.2         | package-lock.json |
| https://osv.dev/GHSA-c2c7-rcm5-vvqj | 7.5  | npm       | picomatch (dev)       | 2.3.1   | 2.3.2         | package-lock.json |
| https://osv.dev/GHSA-3v7f-55p6-f55p | 5.3  | npm       | picomatch (dev)       | 4.0.3   | 4.0.4         | package-lock.json |
| https://osv.dev/GHSA-c2c7-rcm5-vvqj | 7.5  | npm       | picomatch (dev)       | 4.0.3   | 4.0.4         | package-lock.json |
| https://osv.dev/GHSA-hp3w-g68c-fv3c | 6.9  | npm       | sprintf-js (dev)      | 1.0.3   | --            | package-lock.json |
| https://osv.dev/GHSA-2gqq-gqf2-x968 | 3.7  | npm       | undici                | 7.24.4  | 7.29.1        | package-lock.json |
| https://osv.dev/GHSA-2jfj-6hjv-fm6j | 6.5  | npm       | undici                | 7.24.4  | 7.29.1        | package-lock.json |
| https://osv.dev/GHSA-35p6-xmwp-9g52 | 3.7  | npm       | undici                | 7.24.4  | 7.28.0        | package-lock.json |
| https://osv.dev/GHSA-3xpg-4rpp-hhhm | 5.9  | npm       | undici                | 7.24.4  | 7.29.1        | package-lock.json |
| https://osv.dev/GHSA-4cwx-7wf7-3272 | 7.4  | npm       | undici                | 7.24.4  | 7.29.0        | package-lock.json |
| https://osv.dev/GHSA-8436-99hf-9mmv | 3.7  | npm       | undici                | 7.24.4  | 7.29.1        | package-lock.json |
| https://osv.dev/GHSA-8xcm-r25x-g524 | 4.8  | npm       | undici                | 7.24.4  | 7.29.0        | package-lock.json |
| https://osv.dev/GHSA-g8m3-5g58-fq7m | 3.7  | npm       | undici                | 7.24.4  | 7.28.0        | package-lock.json |
| https://osv.dev/GHSA-hm92-r4w5-c3mj | 7.5  | npm       | undici                | 7.24.4  | 7.28.0        | package-lock.json |
| https://osv.dev/GHSA-jr45-8vmc-qm54 | 5.9  | npm       | undici                | 7.24.4  | 7.29.0        | package-lock.json |
| https://osv.dev/GHSA-m8rv-5g2x-5cg5 | 4.2  | npm       | undici                | 7.24.4  | 7.29.0        | package-lock.json |
| https://osv.dev/GHSA-p88m-4jfj-68fv | 5.9  | npm       | undici                | 7.24.4  | 7.28.0        | package-lock.json |
| https://osv.dev/GHSA-pmjh-fq2x-6v4x | 5.9  | npm       | undici                | 7.24.4  | 7.29.1        | package-lock.json |
| https://osv.dev/GHSA-pr7r-676h-xcf6 | 5.9  | npm       | undici                | 7.24.4  | 7.28.0        | package-lock.json |
| https://osv.dev/GHSA-r53p-7pc4-xj5r | 3.7  | npm       | undici                | 7.24.4  | 7.29.1        | package-lock.json |
| https://osv.dev/GHSA-rfgv-xxqx-mfg5 | 7.5  | npm       | undici                | 7.24.4  | 7.29.1        | package-lock.json |
| https://osv.dev/GHSA-rx4f-c7p8-82vq | 5.9  | npm       | undici                | 7.24.4  | 7.29.1        | package-lock.json |
| https://osv.dev/GHSA-v3r7-h72x-cjcm | 4.8  | npm       | undici                | 7.24.4  | 7.29.0        | package-lock.json |
| https://osv.dev/GHSA-vmh5-mc38-953g | 7.4  | npm       | undici                | 7.24.4  | 7.28.0        | package-lock.json |
| https://osv.dev/GHSA-vxpw-j846-p89q | 7.5  | npm       | undici                | 7.24.4  | 7.28.0        | package-lock.json |
| https://osv.dev/GHSA-w293-vg96-wgc3 | 7.4  | npm       | undici                | 7.24.4  | 7.29.1        | package-lock.json |
| https://osv.dev/GHSA-w5hq-g745-h8pq | 7.5  | npm       | uuid (dev)            | 8.3.2   | 11.1.1        | package-lock.json |
| https://osv.dev/GHSA-48c2-rrv3-qjmp | 4.3  | npm       | yaml                  | 2.8.2   | 2.8.3         | package-lock.json |
+-------------------------------------+------+-----------+-----------------------+---------+---------------+-------------------+

(Truncated to last 6666 characters out of 10821)

❌ REPOSITORY / trivy - 1 error

│        │                   │                              ├──────────────────────────────────────────────────────────────┤
│                  │ CVE-2026-85014      │          │        │                   │                              │ undici: undici: Denial of Service via WebSocketStream        │
│                  │                     │          │        │                   │                              │ unclean close                                                │
│                  │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-85014                   │
│                  ├─────────────────────┤          │        │                   ├──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│                  │ CVE-2026-9678       │          │        │                   │ 7.28.0, 8.5.0                │ undici: Undici: Information disclosure due to improper       │
│                  │                     │          │        │                   │                              │ cache-control header parsing                                 │
│                  │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-9678                    │
│                  ├─────────────────────┤          │        │                   ├──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│                  │ CVE-2026-9679       │          │        │                   │ 6.27.0, 7.28.0, 8.5.0        │ undici: undici vulnerable to HTTP header injection via       │
│                  │                     │          │        │                   │                              │ Set-Cookie percent-decoding                                  │
│                  │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-9679                    │
│                  ├─────────────────────┼──────────┤        │                   │                              ├──────────────────────────────────────────────────────────────┤
│                  │ CVE-2026-11525      │ LOW      │        │                   │                              │ undici: undici: Weakening of cookie SameSite policy due to   │
│                  │                     │          │        │                   │                              │ incorrect parsing of...                                      │
│                  │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-11525                   │
│                  ├─────────────────────┤          │        │                   ├──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│                  │ CVE-2026-18540      │          │        │                   │ 6.28.1, 7.29.1, 8.10.2       │ undici: undici: HTTP response splitting via retry            │
│                  │                     │          │        │                   │                              │ interceptor                                                  │
│                  │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-18540                   │
│                  ├─────────────────────┤          │        │                   ├──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│                  │ CVE-2026-6733       │          │        │                   │ 6.27.0, 7.28.0, 8.5.0        │ undici: Undici: Response queue poisoning on reused           │
│                  │                     │          │        │                   │                              │ keep-alive sockets can lead to...                            │
│                  │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-6733                    │
│                  ├─────────────────────┤          │        │                   ├──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│                  │ CVE-2026-84947      │          │        │                   │ 7.29.1, 8.10.2               │ undici: Undici: Response truncation and connection           │
│                  │                     │          │        │                   │                              │ termination                                                  │
│                  │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-84947                   │
│                  ├─────────────────────┤          │        │                   │                              ├──────────────────────────────────────────────────────────────┤
│                  │ CVE-2026-85008      │          │        │                   │                              │ undici: undici: Integrity failure due to caching of unsafe   │
│                  │                     │          │        │                   │                              │ HTTP method responses...                                     │
│                  │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-85008                   │
├──────────────────┼─────────────────────┼──────────┤        ├───────────────────┼──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ yaml             │ CVE-2026-33532      │ MEDIUM   │        │ 2.8.2             │ 2.8.3, 1.10.3                │ yaml: yaml: Denial of Service via deeply nested YAML         │
│                  │                     │          │        │                   │                              │ document parsing                                             │
│                  │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-33532                   │
└──────────────────┴─────────────────────┴──────────┴────────┴───────────────────┴──────────────────────────────┴──────────────────────────────────────────────────────────────┘

📣 Notices:
  - Version 0.75.0 of Trivy is now available, current version is 0.71.2

To suppress version checks, run Trivy scans with the --skip-version-check flag

(Truncated to last 6666 characters out of 35129)

❌ ACTION / zizmor - 1 error

INFO zizmor: 🌈 zizmor v1.25.0
fatal: no audit was performed
'ref-confusion' audit failed on file://.github/workflows/codeql-analysis.yml

Caused by:
    0: error in 'ref-confusion' audit
    1: couldn't list branches for actions/checkout
    2: request error while accessing GitHub API
    3: HTTP status client error (401 Unauthorized) for url (https://github.com/actions/checkout.git/git-upload-pack)


[ACTION_ZIZMOR_ERROR_GITHUB_API_UNREACHABLE] Zizmor could not access a repository referenced by a `uses:` clause via the GitHub API (missing token, insufficient scope, or cross-repo private access).
To allow zizmor to authenticate with GITHUB_TOKEN (or a PAT with `Contents: read-only`), whitelist the variable in your .mega-linter.yml:
ACTION_ZIZMOR_UNSECURED_ENV_VARIABLES:
  - GITHUB_TOKEN
If the referenced workflow is in a private repo outside the current one, provide a PAT with cross-repo access instead of the default GITHUB_TOKEN, or run zizmor in offline mode.

Notices

📣 MegaLinter 9.5.0 is out! Discover the new features and security recommendations in the release announcement. (Skip this info by defining SECURITY_SUGGESTIONS: false)

See detailed reports in MegaLinter artifacts

Show us your support by starring ⭐ the repository