chore(deps): update dependency typeorm-extension to v4

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
typeorm-extension (source)	2.8.1 → 4.1.0

---

Release Notes

tada5hi/typeorm-extension (typeorm-extension)

v4.1.0

Compare Source

Bug Fixes

• deps: bump the minorandpatch group across 1 directory with 12 updates (#​1284) (f32f812)

Features

• add create database template support for postgres (#​1244) (d4d66d3), closes #​1226
• postgres: allow schema creation for postgres (#​1247) (986ff58)

4.1.0 (2026-08-18)

Features

• generate javascript migration files (#​1434) (f1805b3)

Bug Fixes

• accept findOptions in the database context input types (dc37957)

4.0.0 (2026-08-11)

⚠ BREAKING CHANGES

• seeder: the factory callback receives the setMeta() payload as its first argument instead of a Faker instance, and SeederFactory.setLocale() is removed. Import a generator in the factory file and select the locale through its own API, for example "import { fakerDE as faker } from '@​faker-js/faker'".
• The query submodule (applyQuery, applyQueryFields, applyQueryFilters, applyQueryRelations, applyQueryPagination, applyQuerySort and their option/output types) is no longer exported. Use @​rapiq/typeorm instead.

Features

• remove query submodule in favor of @​rapiq/adapter-typeorm (#​1413) (bd364fa)

Bug Fixes

• correct and consolidate the entity helpers (#​1430) (b7ebcc9)

Miscellaneous Chores

• graduate the release line to stable 4.0.0 (3e8deb2)

Code Refactoring

• seeder: decouple the factory callback from faker (#​1431) (94dd012)

4.0.0-beta.3 (2026-07-29)

Bug Fixes

• alter the column in place in changeColumnType (#​1425) (108f360)

4.0.0-beta.2 (2026-07-29)

Features

• schema drift assertion + guarded repair migration helpers (#​1422) (ed938e1)

Bug Fixes

• deps: bump the minorandpatch group across 1 directory with 6 updates (#​1419) (85325c5)

4.0.0-beta.1 (2026-07-21)

⚠ BREAKING CHANGES

• The unused factoriesLoad property no longer exists on SeederOptions. Remove it from your options objects; factories provided via the factories property (or discovered via env/data-source options) are always loaded.
• new SeederExecutor(dataSource), runSeeder() and runSeeders() no longer register the given data source under the 'default' alias. Call setDataSource() explicitly if other code relies on useDataSource() returning it.
• For better-sqlite3, createDatabase creates the database file itself (previously it only verified the directory was writable), and dropDatabase without ifExist fails on a missing file (previously a silent no-op).
• The driver plumbing exports (createSimpleConnection, executeSimpleQuery, buildDriverOptions, createDriver, getCharsetFromDataSourceOptions, getCharacterSetFromDataSourceOptions, DriverOptions) are no longer part of the public API. Use createDatabase/dropDatabase, or implement the IDatabaseConnectionFactory/IDatabaseConnection interfaces for custom connection handling.

Features

• apply SQL database semantics to the sqlite dialect (#​1404) (567a92a)
• pure seeder-config resolver + SeederExecutor decomposition (#​1409) (39d2900)

Bug Fixes

• detect tsx as a just-in-time environment (#​1412) (5cbacef)
• remove the seeder executor's global data-source registration side effect (#​1406) (ed21216)

Code Refactoring

• split database layer into dialect core and connection-factory adapters (#​1401) (5470a4e), closes #​1400

4.0.0-beta.0 (2026-05-21)

⚠ BREAKING CHANGES

• peer/runtime dependency locter is bumped to ^3.0.0.
• The CLI command classes (DatabaseCreateCommand, DatabaseDropCommand, SeedRunCommand, SeedCreateCommand) are no longer exported from the package entry. Consumers embedding these in a custom yargs pipeline must now compose their own citty (or other) tree. The yargs runtime dependency has been removed.
• typeorm peer dependency is now ^1.0.0. typeorm 0.3.x is no longer supported — stay on typeorm-extension v3 if you need it.
• typeorm-extension is now ESM-only. CJS consumers on Node 22+ can still require('typeorm-extension') thanks to require(esm) support; older Node versions can no longer consume the package. Minimum Node is now 22 (was 20.19). The typeorm-extension-esm binary alias is removed - use typeorm-extension. See docs/guide/migration-guide-v4.md.

Features

• migrate CLI from yargs to citty (#​1379) (05cc0fc)
• modernize toolchain and ship ESM-only build (#​1373) (8df2109)
• support typeorm 1.x and drop 0.3.x peer dep (#​1377) (b6a29ca)
• upgrade locter to v3 and use setModuleLoader for vitest (27f079b)

Miscellaneous Chores

• release 4.0.0-alpha.0 (95b8ee4)
• release 4.0.0-beta.0 (6adf5a0)

3.9.0 (2026-02-26)

Features

• enable to hook in on joinRelation (#​1359) (bc949f0)

Bug Fixes

• don't destroy data-source in generateMigration (c824165)

3.8.0 (2026-02-02)

Features

• load faker on-demand so it is not required (#​1351) (7a40ba2)

Bug Fixes

• setting default pagination value if options.maxLimit is set (08dc50e)

3.7.4 (2026-01-30)

Bug Fixes

• allways apply pagination.maxLimit option (01022b2)

3.7.3 (2025-12-10)

Bug Fixes

• allow null type for entityExisting in unique check (3731139)
• preserve data source options in database operations (#​1347) (dc771e1)

3.7.2 (2025-11-25)

Bug Fixes

• deps: bump locter to v2.1.1 (b012542)
• deps: bump yargs to v18.0.0 (6b8e689)
• deps: define faker as peer-dependency (71408c0)

3.6.3 (2024-11-06)

Bug Fixes

• deps: bump locter from 2.1.3 to 2.1.5 (#​1191) (ee4d5d0)
• enhance skipRelation check in validate entity join columns fn (3120433)
• validate entity join columns - respect nullable join columns (ab87659)

3.6.2 (2024-10-08)

Bug Fixes

• consider runSchema- & synchronize-option in checkDatabase fn (b90a127)
• deps: bump locter from 2.1.0 to 2.1.3 (#​1155) (48752e7)

3.6.1 (2024-08-11)

Bug Fixes

• adjust data source cleanup behaviour to jsdoc description (e27f42e)
• schema detection in check-database fn (39dcc92)

v4.0.0

Compare Source

Bug Fixes

• deps: bump the minorandpatch group across 1 directory with 12 updates (#​1284) (f32f812)

Features

• add create database template support for postgres (#​1244) (d4d66d3), closes #​1226
• postgres: allow schema creation for postgres (#​1247) (986ff58)

4.1.0 (2026-08-18)

Features

• generate javascript migration files (#​1434) (f1805b3)

Bug Fixes

• accept findOptions in the database context input types (dc37957)

4.0.0 (2026-08-11)

⚠ BREAKING CHANGES

• seeder: the factory callback receives the setMeta() payload as its first argument instead of a Faker instance, and SeederFactory.setLocale() is removed. Import a generator in the factory file and select the locale through its own API, for example "import { fakerDE as faker } from '@​faker-js/faker'".
• The query submodule (applyQuery, applyQueryFields, applyQueryFilters, applyQueryRelations, applyQueryPagination, applyQuerySort and their option/output types) is no longer exported. Use @​rapiq/typeorm instead.

Features

• remove query submodule in favor of @​rapiq/adapter-typeorm (#​1413) (bd364fa)

Bug Fixes

• correct and consolidate the entity helpers (#​1430) (b7ebcc9)

Miscellaneous Chores

• graduate the release line to stable 4.0.0 (3e8deb2)

Code Refactoring

• seeder: decouple the factory callback from faker (#​1431) (94dd012)

4.0.0-beta.3 (2026-07-29)

Bug Fixes

• alter the column in place in changeColumnType (#​1425) (108f360)

4.0.0-beta.2 (2026-07-29)

Features

• schema drift assertion + guarded repair migration helpers (#​1422) (ed938e1)

Bug Fixes

• deps: bump the minorandpatch group across 1 directory with 6 updates (#​1419) (85325c5)

4.0.0-beta.1 (2026-07-21)

⚠ BREAKING CHANGES

• The unused factoriesLoad property no longer exists on SeederOptions. Remove it from your options objects; factories provided via the factories property (or discovered via env/data-source options) are always loaded.
• new SeederExecutor(dataSource), runSeeder() and runSeeders() no longer register the given data source under the 'default' alias. Call setDataSource() explicitly if other code relies on useDataSource() returning it.
• For better-sqlite3, createDatabase creates the database file itself (previously it only verified the directory was writable), and dropDatabase without ifExist fails on a missing file (previously a silent no-op).
• The driver plumbing exports (createSimpleConnection, executeSimpleQuery, buildDriverOptions, createDriver, getCharsetFromDataSourceOptions, getCharacterSetFromDataSourceOptions, DriverOptions) are no longer part of the public API. Use createDatabase/dropDatabase, or implement the IDatabaseConnectionFactory/IDatabaseConnection interfaces for custom connection handling.

Features

• apply SQL database semantics to the sqlite dialect (#​1404) (567a92a)
• pure seeder-config resolver + SeederExecutor decomposition (#​1409) (39d2900)

Bug Fixes

• detect tsx as a just-in-time environment (#​1412) (5cbacef)
• remove the seeder executor's global data-source registration side effect (#​1406) (ed21216)

Code Refactoring

• split database layer into dialect core and connection-factory adapters (#​1401) (5470a4e), closes #​1400

4.0.0-beta.0 (2026-05-21)

⚠ BREAKING CHANGES

• peer/runtime dependency locter is bumped to ^3.0.0.
• The CLI command classes (DatabaseCreateCommand, DatabaseDropCommand, SeedRunCommand, SeedCreateCommand) are no longer exported from the package entry. Consumers embedding these in a custom yargs pipeline must now compose their own citty (or other) tree. The yargs runtime dependency has been removed.
• typeorm peer dependency is now ^1.0.0. typeorm 0.3.x is no longer supported — stay on typeorm-extension v3 if you need it.
• typeorm-extension is now ESM-only. CJS consumers on Node 22+ can still require('typeorm-extension') thanks to require(esm) support; older Node versions can no longer consume the package. Minimum Node is now 22 (was 20.19). The typeorm-extension-esm binary alias is removed - use typeorm-extension. See docs/guide/migration-guide-v4.md.

Features

• migrate CLI from yargs to citty (#​1379) (05cc0fc)
• modernize toolchain and ship ESM-only build (#​1373) (8df2109)
• support typeorm 1.x and drop 0.3.x peer dep (#​1377) (b6a29ca)
• upgrade locter to v3 and use setModuleLoader for vitest (27f079b)

Miscellaneous Chores

• release 4.0.0-alpha.0 (95b8ee4)
• release 4.0.0-beta.0 (6adf5a0)

3.9.0 (2026-02-26)

Features

• enable to hook in on joinRelation (#​1359) (bc949f0)

Bug Fixes

• don't destroy data-source in generateMigration (c824165)

3.8.0 (2026-02-02)

Features

• load faker on-demand so it is not required (#​1351) (7a40ba2)

Bug Fixes

• setting default pagination value if options.maxLimit is set (08dc50e)

3.7.4 (2026-01-30)

Bug Fixes

• allways apply pagination.maxLimit option (01022b2)

3.7.3 (2025-12-10)

Bug Fixes

• allow null type for entityExisting in unique check (3731139)
• preserve data source options in database operations (#​1347) (dc771e1)

3.7.2 (2025-11-25)

Bug Fixes

• deps: bump locter to v2.1.1 (b012542)
• deps: bump yargs to v18.0.0 (6b8e689)
• deps: define faker as peer-dependency (71408c0)

3.6.3 (2024-11-06)

Bug Fixes

• deps: bump locter from 2.1.3 to 2.1.5 (#​1191) (ee4d5d0)
• enhance skipRelation check in validate entity join columns fn (3120433)
• validate entity join columns - respect nullable join columns (ab87659)

3.6.2 (2024-10-08)

Bug Fixes

• consider runSchema- & synchronize-option in checkDatabase fn (b90a127)
• deps: bump locter from 2.1.0 to 2.1.3 (#​1155) (48752e7)

3.6.1 (2024-08-11)

Bug Fixes

• adjust data source cleanup behaviour to jsdoc description (e27f42e)
• schema detection in check-database fn (39dcc92)

v3.9.0

Compare Source

Bug Fixes

• deps: bump the minorandpatch group across 1 directory with 12 updates (#​1284) (f32f812)

Features

• add create database template support for postgres (#​1244) (d4d66d3), closes #​1226
• postgres: allow schema creation for postgres (#​1247) (986ff58)

4.0.0 (2026-08-11)

⚠ BREAKING CHANGES

• seeder: the factory callback receives the setMeta() payload as its first argument instead of a Faker instance, and SeederFactory.setLocale() is removed. Import a generator in the factory file and select the locale through its own API, for example "import { fakerDE as faker } from '@​faker-js/faker'".
• The query submodule (applyQuery, applyQueryFields, applyQueryFilters, applyQueryRelations, applyQueryPagination, applyQuerySort and their option/output types) is no longer exported. Use @​rapiq/typeorm instead.

Features

• remove query submodule in favor of @​rapiq/adapter-typeorm (#​1413) (bd364fa)

Bug Fixes

• correct and consolidate the entity helpers (#​1430) (b7ebcc9)

Miscellaneous Chores

• graduate the release line to stable 4.0.0 (3e8deb2)

Code Refactoring

• seeder: decouple the factory callback from faker (#​1431) (94dd012)

4.0.0-beta.3 (2026-07-29)

Bug Fixes

• alter the column in place in changeColumnType (#​1425) (108f360)

4.0.0-beta.2 (2026-07-29)

Features

• schema drift assertion + guarded repair migration helpers (#​1422) (ed938e1)

Bug Fixes

• deps: bump the minorandpatch group across 1 directory with 6 updates (#​1419) (85325c5)

4.0.0-beta.1 (2026-07-21)

⚠ BREAKING CHANGES

• The unused factoriesLoad property no longer exists on SeederOptions. Remove it from your options objects; factories provided via the factories property (or discovered via env/data-source options) are always loaded.
• new SeederExecutor(dataSource), runSeeder() and runSeeders() no longer register the given data source under the 'default' alias. Call setDataSource() explicitly if other code relies on useDataSource() returning it.
• For better-sqlite3, createDatabase creates the database file itself (previously it only verified the directory was writable), and dropDatabase without ifExist fails on a missing file (previously a silent no-op).
• The driver plumbing exports (createSimpleConnection, executeSimpleQuery, buildDriverOptions, createDriver, getCharsetFromDataSourceOptions, getCharacterSetFromDataSourceOptions, DriverOptions) are no longer part of the public API. Use createDatabase/dropDatabase, or implement the IDatabaseConnectionFactory/IDatabaseConnection interfaces for custom connection handling.

Features

• apply SQL database semantics to the sqlite dialect (#​1404) (567a92a)
• pure seeder-config resolver + SeederExecutor decomposition (#​1409) (39d2900)

Bug Fixes

• detect tsx as a just-in-time environment (#​1412) (5cbacef)
• remove the seeder executor's global data-source registration side effect (#​1406) (ed21216)

Code Refactoring

• split database layer into dialect core and connection-factory adapters (#​1401) (5470a4e), closes #​1400

4.0.0-beta.0 (2026-05-21)

⚠ BREAKING CHANGES

• peer/runtime dependency locter is bumped to ^3.0.0.
• The CLI command classes (DatabaseCreateCommand, DatabaseDropCommand, SeedRunCommand, SeedCreateCommand) are no longer exported from the package entry. Consumers embedding these in a custom yargs pipeline must now compose their own citty (or other) tree. The yargs runtime dependency has been removed.
• typeorm peer dependency is now ^1.0.0. typeorm 0.3.x is no longer supported — stay on typeorm-extension v3 if you need it.
• typeorm-extension is now ESM-only. CJS consumers on Node 22+ can still require('typeorm-extension') thanks to require(esm) support; older Node versions can no longer consume the package. Minimum Node is now 22 (was 20.19). The typeorm-extension-esm binary alias is removed - use typeorm-extension. See docs/guide/migration-guide-v4.md.

Features

• migrate CLI from yargs to citty (#​1379) (05cc0fc)
• modernize toolchain and ship ESM-only build (#​1373) (8df2109)
• support typeorm 1.x and drop 0.3.x peer dep (#​1377) (b6a29ca)
• upgrade locter to v3 and use setModuleLoader for vitest (27f079b)

Miscellaneous Chores

• release 4.0.0-alpha.0 (95b8ee4)
• release 4.0.0-beta.0 (6adf5a0)

3.9.0 (2026-02-26)

Features

• enable to hook in on joinRelation (#​1359) (bc949f0)

Bug Fixes

• don't destroy data-source in generateMigration (c824165)

3.8.0 (2026-02-02)

Features

• load faker on-demand so it is not required (#​1351) (7a40ba2)

Bug Fixes

• setting default pagination value if options.maxLimit is set (08dc50e)

3.7.4 (2026-01-30)

Bug Fixes

• allways apply pagination.maxLimit option (01022b2)

3.7.3 (2025-12-10)

Bug Fixes

• allow null type for entityExisting in unique check (3731139)
• preserve data source options in database operations (#​1347) (dc771e1)

3.7.2 (2025-11-25)

Bug Fixes

• deps: bump locter to v2.1.1 (b012542)
• deps: bump yargs to v18.0.0 (6b8e689)
• deps: define faker as peer-dependency (71408c0)

3.6.3 (2024-11-06)

Bug Fixes

• deps: bump locter from 2.1.3 to 2.1.5 (#​1191) (ee4d5d0)
• enhance skipRelation check in validate entity join columns fn (3120433)
• validate entity join columns - respect nullable join columns (ab87659)

3.6.2 (2024-10-08)

Bug Fixes

• consider runSchema- & synchronize-option in checkDatabase fn (b90a127)
• deps: bump locter from 2.1.0 to 2.1.3 (#​1155) (48752e7)

3.6.1 (2024-08-11)

Bug Fixes

• adjust data source cleanup behaviour to jsdoc description (e27f42e)
• schema detection in check-database fn (39dcc92)

v3.8.0

Compare Source

Bug Fixes

• deps: bump the minorandpatch group across 1 directory with 12 updates (#​1284) (f32f812)

Features

• add create database template support for postgres (#​1244) (d4d66d3), closes #​1226
• postgres: allow schema creation for postgres (#​1247) (986ff58)

4.0.0-beta.0 (2026-05-21)

⚠ BREAKING CHANGES

• peer/runtime dependency locter is bumped to ^3.0.0.
• The CLI command classes (DatabaseCreateCommand, DatabaseDropCommand, SeedRunCommand, SeedCreateCommand) are no longer exported from the package entry. Consumers embedding these in a custom yargs pipeline must now compose their own citty (or other) tree. The yargs runtime dependency has been removed.
• typeorm peer dependency is now ^1.0.0. typeorm 0.3.x is no longer supported — stay on typeorm-extension v3 if you need it.
• typeorm-extension is now ESM-only. CJS consumers on Node 22+ can still require('typeorm-extension') thanks to require(esm) support; older Node versions can no longer consume the package. Minimum Node is now 22 (was 20.19). The typeorm-extension-esm binary alias is removed - use typeorm-extension. See docs/guide/migration-guide-v4.md.

Features

• migrate CLI from yargs to citty (#​1379) (05cc0fc)
• modernize toolchain and ship ESM-only build (#​1373) (8df2109)
• support typeorm 1.x and drop 0.3.x peer dep (#​1377) (b6a29ca)
• upgrade locter to v3 and use setModuleLoader for vitest (27f079b)

Miscellaneous Chores

• release 4.0.0-alpha.0 (95b8ee4)
• release 4.0.0-beta.0 (6adf5a0)

3.9.0 (2026-02-26)

Features

• enable to hook in on joinRelation (#​1359) (bc949f0)

Bug Fixes

• don't destroy data-source in generateMigration (c824165)

3.8.0 (2026-02-02)

Features

• load faker on-demand so it is not required (#​1351) (7a40ba2)

Bug Fixes

• setting default pagination value if options.maxLimit is set (08dc50e)

3.7.4 (2026-01-30)

Bug Fixes

• allways apply pagination.maxLimit option (01022b2)

3.7.3 (2025-12-10)

Bug Fixes

• allow null type for entityExisting in unique check (3731139)
• preserve data source options in database operations (#​1347) (dc771e1)

3.7.2 (2025-11-25)

Bug Fixes

• deps: bump locter to v2.1.1 (b012542)
• deps: bump yargs to v18.0.0 (6b8e689)
• deps: define faker as peer-dependency (71408c0)

3.6.3 (2024-11-06)

Bug Fixes

• deps: bump locter from 2.1.3 to 2.1.5 (#​1191) (ee4d5d0)
• enhance skipRelation check in validate entity join columns fn (3120433)
• validate entity join columns - respect nullable join columns (ab87659)

3.6.2 (2024-10-08)

Bug Fixes

• consider runSchema- & synchronize-option in checkDatabase fn (b90a127)
• deps: bump locter from 2.1.0 to 2.1.3 (#​1155) (48752e7)

3.6.1 (2024-08-11)

Bug Fixes

• adjust data source cleanup behaviour to jsdoc description (e27f42e)
• schema detection in check-database fn (39dcc92)

v3.7.4

Compare Source

Bug Fixes

• deps: bump the minorandpatch group across 1 directory with 12 updates (#​1284) (f32f812)

Features

• add create database template support for postgres (#​1244) (d4d66d3), closes #​1226
• postgres: allow schema creation for postgres (#​1247) (986ff58)

4.0.0-beta.0 (2026-05-21)

⚠ BREAKING CHANGES

• peer/runtime dependency locter is bumped to ^3.0.0.
• The CLI command classes (DatabaseCreateCommand, DatabaseDropCommand, SeedRunCommand, SeedCreateCommand) are no longer exported from the package entry. Consumers embedding these in a custom yargs pipeline must now compose their own citty (or other) tree. The yargs runtime dependency has been removed.
• typeorm peer dependency is now ^1.0.0. typeorm 0.3.x is no longer supported — stay on typeorm-extension v3 if you need it.
• typeorm-extension is now ESM-only. CJS consumers on Node 22+ can still require('typeorm-extension') thanks to require(esm) support; older Node versions can no longer consume the package. Minimum Node is now 22 (was 20.19). The typeorm-extension-esm binary alias is removed - use typeorm-extension. See docs/guide/migration-guide-v4.md.

Features

• migrate CLI from yargs to citty (#​1379) (05cc0fc)
• modernize toolchain and ship ESM-only build (#​1373) (8df2109)
• support typeorm 1.x and drop 0.3.x peer dep (#​1377) (b6a29ca)
• upgrade locter to v3 and use setModuleLoader for vitest (27f079b)

Miscellaneous Chores

• release 4.0.0-alpha.0 (95b8ee4)
• release 4.0.0-beta.0 (6adf5a0)

3.9.0 (2026-02-26)

Features

• enable to hook in on joinRelation (#​1359) (bc949f0)

Bug Fixes

• don't destroy data-source in generateMigration (c824165)

3.8.0 (2026-02-02)

Features

• load faker on-demand so it is not required (#​1351) (7a40ba2)

Bug Fixes

• setting default pagination value if options.maxLimit is set (08dc50e)

3.7.4 (2026-01-30)

Bug Fixes

• allways apply pagination.maxLimit option (01022b2)

3.7.3 (2025-12-10)

Bug Fixes

• allow null type for entityExisting in unique check (3731139)
• preserve data source options in database operations (#​1347) (dc771e1)

3.7.2 (2025-11-25)

Bug Fixes

• deps: bump locter to v2.1.1 (b012542)
• deps: bump yargs to v18.0.0 (6b8e689)
• deps: define faker as peer-dependency (71408c0)

3.6.3 (2024-11-06)

Bug Fixes

• deps: bump locter from 2.1.3 to 2.1.5 (#​1191) (ee4d5d0)
• enhance skipRelation check in validate entity join columns fn (3120433)
• validate entity join columns - respect nullable join columns (ab87659)

3.6.2 (2024-10-08)

Bug Fixes

• consider runSchema- & synchronize-option in checkDatabase fn (b90a127)
• deps: bump locter from 2.1.0 to 2.1.3 (#​1155) (48752e7)

3.6.1 (2024-08-11)

Bug Fixes

• adjust data source cleanup behaviour to jsdoc description (e27f42e)
• schema detection in check-database fn (39dcc92)

v3.7.3

Compare Source

Bug Fixes

• deps: bump the minorandpatch group across 1 directory with 12 updates (#​1284) (f32f812)

Features

• add create database template support for postgres (#​1244) (d4d66d3), closes #​1226
• postgres: allow schema creation for postgres ([#​1247](http

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[kodiakhq]

This PR currently has a merge conflict. Please resolve this and then re-add the automerge label.

[github-actions]

❌MegaLinter analysis: Error

Descriptor	Linter	Files	Fixed	Errors	Max errors	Warnings	Elapsed time
✅ COPYPASTE	jscpd	yes		no		no	1.19s
✅ EDITORCONFIG	editorconfig-checker	2		0		0	0.01s
✅ JSON	jsonlint	1		0		0	0.13s
✅ JSON	npm-package-json-lint	yes		no		no	0.54s
⚠️ JSON	prettier	1	0	1		0	0.72s
✅ JSON	v8r	1		0		0	6.12s
❌ REPOSITORY	betterleaks	yes		2		no	0.9s
❌ REPOSITORY	checkov	yes		1		no	26.64s
❌ REPOSITORY	devskim	yes		45		no	6.17s
✅ REPOSITORY	dustilock	yes		no		no	2.11s
✅ REPOSITORY	git_diff	yes		no		no	0.02s
❌ REPOSITORY	grype	yes		108		no	73.17s
❌ REPOSITORY	kingfisher	yes		1		no	24.41s
❌ REPOSITORY	osv-scanner	yes		108		no	2.24s
❌ REPOSITORY	secretlint	yes		1		no	2.7s
✅ REPOSITORY	syft	yes		no		no	7.29s
⚠️ REPOSITORY	trivy	yes		1		no	13.38s
✅ REPOSITORY	trivy-sbom	yes		no		no	1.73s
✅ REPOSITORY	trufflehog	yes		no		no	4.95s
✅ SPELL	cspell	3		0		0	3.66s
❌ SPELL	lychee	2		1		0	0.85s
✅ YAML	prettier	1	0	0		0	0.19s
✅ YAML	v8r	1		0		0	1.77s
❌ YAML	yamllint	1		8		0	5.1s

Detailed Issues

❌ REPOSITORY / betterleaks - 2 errors

+ ○
   ▾
 betterleaks 1.7.3

┌─generic-api-key──○
│
│ 9 │ SECRET=REDACTED
│   │        ^^^^^^^^
│
│ attributes:
│   path .......... .env.example
│   resource ...... fs.content
└○


┌─generic-api-key──○
│
│ 63 │           POSTGRES_PASSWORD: REDACTED
│    │                              ^^^^^^^^
│
│ attributes:
│   path .......... .github/workflows/ci.yml
│   resource ...... fs.content
└○


2:08PM INF scanned ~417614 bytes (417.61 KB) in 869ms
2:08PM WRN leaks found: 2

❌ REPOSITORY / checkov - 1 error

dockerfile scan results:

Passed checks: 77, Failed checks: 1, Skipped checks: 0

Check: CKV_DOCKER_3: "Ensure that a user for the container has been created"
	FAILED for resource: /Dockerfile.
	File: /Dockerfile:1-47
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/docker-policies/docker-policy-index/ensure-that-a-user-for-the-container-has-been-created

		1  | ARG NODE_VERSION=lts-slim
		2  | 
		3  | FROM node:${NODE_VERSION} AS dependencies
		4  | 
		5  | WORKDIR /app
		6  | 
		7  | ENV PNPM_HOME="/pnpm"
		8  | ENV PATH="$PNPM_HOME:$PATH"
		9  | 
		10 | RUN --mount=type=cache,id=pnpm-store,target=/pnpm/store \
		11 |     --mount=type=bind,source=package.json,target=/app/package.json \
		12 |     --mount=type=bind,source=pnpm-lock.yaml,target=/app/pnpm-lock.yaml \
		13 |     corepack enable && \
		14 |     pnpm install --frozen-lockfile --strict-peer-dependencies
		15 | 
		16 | FROM dependencies AS builder
		17 | 
		18 | COPY --chown=node:node src/ /app/src
		19 | 
		20 | RUN --mount=type=bind,source=package.json,target=/app/package.json \
		21 |     --mount=type=bind,source=nest-cli.json,target=/app/nest-cli.json \
		22 |     --mount=type=bind,source=tsconfig.json,target=/app/tsconfig.json \
		23 |     --mount=type=bind,source=tsconfig.build.json,target=/app/tsconfig.build.json \
		24 |     pnpm build
		25 | 
		26 | FROM builder AS pruner
		27 | 
		28 | RUN --mount=type=cache,id=pnpm-store,target=/pnpm/store \
		29 |     --mount=type=bind,source=package.json,target=/app/package.json \
		30 |     --mount=type=bind,source=pnpm-lock.yaml,target=/app/pnpm-lock.yaml \
		31 |     pnpm prune --prod --ignore-scripts
		32 | 
		33 | FROM gcr.io/distroless/nodejs22-debian12:nonroot
		34 | 
		35 | WORKDIR /app
		36 | 
		37 | ENV PORT=3000
		38 | 
		39 | COPY --chown=nonroot:nonroot --from=pruner /app/node_modules ./node_modules
		40 | COPY --chown=nonroot:nonroot --from=builder /app/dist .
		41 | COPY --chown=nonroot:nonroot CHANGELOG.md LICENSE package.json /app/
		42 | 
		43 | EXPOSE ${PORT}
		44 | 
		45 | HEALTHCHECK --interval=30s --timeout=2s --start-period=10s --retries=2 CMD [ "/nodejs/bin/node", "bin/health-checker.js" ]
		46 | 
		47 | CMD ["main.js"]

❌ REPOSITORY / devskim - 45 errors

Algorithm"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"pnpm-lock.yaml"},"region":{"startLine":953,"startColumn":91,"endLine":953,"endColumn":94,"charOffset":44728,"charLength":3,"snippet":{"text":"mD5","rendered":{"text":"mD5","markdown":"`mD5`"}},"sourceLanguage":"yaml"}}}],"fixes":[],"properties":{"tags":["Cryptography.BannedHashAlgorithm"],"DevSkimSeverity":"Critical","DevSkimConfidence":"High"}},{"ruleId":"DS126858","level":"error","message":{"text":"Weak/Broken Hash Algorithm"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"pnpm-lock.yaml"},"region":{"startLine":905,"startColumn":61,"endLine":905,"endColumn":64,"charOffset":42475,"charLength":3,"snippet":{"text":"Md5","rendered":{"text":"Md5","markdown":"`Md5`"}},"sourceLanguage":"yaml"}}}],"fixes":[],"properties":{"tags":["Cryptography.BannedHashAlgorithm"],"DevSkimSeverity":"Critical","DevSkimConfidence":"High"}},{"ruleId":"DS162092","level":"note","message":{"text":"Do not leave debug code in production"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":".github/workflows/ci.yml"},"region":{"startLine":100,"startColumn":43,"endLine":100,"endColumn":52,"charOffset":3304,"charLength":9,"snippet":{"text":"localhost","rendered":{"text":"localhost","markdown":"`localhost`"}},"sourceLanguage":"yaml"}}}],"properties":{"tags":["Hygiene.Network.AccessingLocalhost"],"DevSkimSeverity":"ManualReview","DevSkimConfidence":"High"}},{"ruleId":"DS162092","level":"note","message":{"text":"Do not leave debug code in production"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":".github/workflows/ci.yml"},"region":{"startLine":95,"startColumn":60,"endLine":95,"endColumn":69,"charOffset":3041,"charLength":9,"snippet":{"text":"localhost","rendered":{"text":"localhost","markdown":"`localhost`"}},"sourceLanguage":"yaml"}}}],"properties":{"tags":["Hygiene.Network.AccessingLocalhost"],"DevSkimSeverity":"ManualReview","DevSkimConfidence":"High"}},{"ruleId":"DS162092","level":"note","message":{"text":"Do not leave debug code in production"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":".devcontainer/docker-compose.yml"},"region":{"startLine":24,"startColumn":50,"endLine":24,"endColumn":59,"charOffset":717,"charLength":9,"snippet":{"text":"localhost","rendered":{"text":"localhost","markdown":"`localhost`"}},"sourceLanguage":"yaml"}}}],"properties":{"tags":["Hygiene.Network.AccessingLocalhost"],"DevSkimSeverity":"ManualReview","DevSkimConfidence":"High"}},{"ruleId":"DS162092","level":"note","message":{"text":"Do not leave debug code in production"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":".github/workflows/ci.yml"},"region":{"startLine":89,"startColumn":60,"endLine":89,"endColumn":69,"charOffset":2710,"charLength":9,"snippet":{"text":"localhost","rendered":{"text":"localhost","markdown":"`localhost`"}},"sourceLanguage":"yaml"}}}],"properties":{"tags":["Hygiene.Network.AccessingLocalhost"],"DevSkimSeverity":"ManualReview","DevSkimConfidence":"High"}},{"ruleId":"DS197836","level":"error","message":{"text":"Do not take the hash of low-entropy content."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"pnpm-lock.yaml"},"region":{"startLine":718,"startColumn":28,"endLine":718,"endColumn":53,"charOffset":33285,"charLength":25,"snippet":{"text":"sha512-hO+ga+uYZ/WA4OtiME","rendered":{"text":"sha512-hO+ga+uYZ/WA4OtiME","markdown":"`sha512-hO+ga+uYZ/WA4OtiME`"}},"sourceLanguage":"yaml"}}}],"properties":{"tags":["Cryptography.HashAlgorithm.InsufficientEntropy"],"DevSkimSeverity":"Important","DevSkimConfidence":"High"}}],"columnKind":"utf16CodeUnits"}]}

(Truncated to last 3636 characters out of 313204)

❌ REPOSITORY / grype - 108 errors

Medium    0.3% (19th)  0.1    
undici                6.14.1     6.27.0    npm   GHSA-p88m-4jfj-68fv  Medium    0.3% (17th)  0.1    
undici                6.23.0     6.27.0    npm   GHSA-p88m-4jfj-68fv  Medium    0.3% (17th)  0.1    
undici                7.22.0     7.28.0    npm   GHSA-p88m-4jfj-68fv  Medium    0.3% (17th)  0.1    
body-parser           1.20.4     1.20.6    npm   GHSA-v422-hmwv-36x6  Low       0.4% (34th)  0.1    
undici                6.14.1     6.24.0    npm   GHSA-4992-7rv2-5pvq  Medium    0.3% (19th)  0.1    
undici                6.23.0     6.24.0    npm   GHSA-4992-7rv2-5pvq  Medium    0.3% (19th)  0.1    
undici                7.22.0     7.24.0    npm   GHSA-4992-7rv2-5pvq  Medium    0.3% (19th)  0.1    
@nestjs/core          10.4.22    11.1.18   npm   GHSA-36xv-jgw5-4q75  Medium    0.2% (14th)  0.1    
brace-expansion       1.1.11     1.1.12    npm   GHSA-v6h2-p8h4-qcjw  Low       0.5% (40th)  0.1    
brace-expansion       2.0.1      2.0.2     npm   GHSA-v6h2-p8h4-qcjw  Low       0.5% (40th)  0.1    
undici                6.14.1     6.19.2    npm   GHSA-3g92-w8c5-73pq  Low       0.5% (38th)  0.1    
undici                6.14.1     6.28.0    npm   GHSA-v3r7-h72x-cjcm  Medium    0.2% (8th)   < 0.1  
undici                6.23.0     6.28.0    npm   GHSA-v3r7-h72x-cjcm  Medium    0.2% (8th)   < 0.1  
undici                7.22.0     7.29.0    npm   GHSA-v3r7-h72x-cjcm  Medium    0.2% (8th)   < 0.1  
undici                6.14.1     6.21.2    npm   GHSA-cxrh-j4jr-qwg3  Low       0.3% (22nd)  < 0.1  
tmp                   0.0.33     0.2.4     npm   GHSA-52f5-9888-hmc6  Low       0.3% (25th)  < 0.1  
undici                6.14.1     6.28.0    npm   GHSA-m8rv-5g2x-5cg5  Medium    0.2% (8th)   < 0.1  
undici                6.23.0     6.28.0    npm   GHSA-m8rv-5g2x-5cg5  Medium    0.2% (8th)   < 0.1  
undici                7.22.0     7.29.0    npm   GHSA-m8rv-5g2x-5cg5  Medium    0.2% (8th)   < 0.1  
undici                6.14.1     6.28.0    npm   GHSA-8xcm-r25x-g524  Medium    0.2% (7th)   < 0.1  
undici                6.23.0     6.28.0    npm   GHSA-8xcm-r25x-g524  Medium    0.2% (7th)   < 0.1  
undici                7.22.0     7.29.0    npm   GHSA-8xcm-r25x-g524  Medium    0.2% (7th)   < 0.1  
undici                6.14.1     6.27.0    npm   GHSA-g8m3-5g58-fq7m  Low       0.2% (14th)  < 0.1  
undici                6.23.0     6.27.0    npm   GHSA-g8m3-5g58-fq7m  Low       0.2% (14th)  < 0.1  
undici                7.22.0     7.28.0    npm   GHSA-g8m3-5g58-fq7m  Low       0.2% (14th)  < 0.1  
undici                6.14.1     6.27.0    npm   GHSA-35p6-xmwp-9g52  Low       0.2% (12th)  < 0.1  
undici                6.23.0     6.27.0    npm   GHSA-35p6-xmwp-9g52  Low       0.2% (12th)  < 0.1  
undici                7.22.0     7.28.0    npm   GHSA-35p6-xmwp-9g52  Low       0.2% (12th)  < 0.1  
webpack               5.97.1     5.104.0   npm   GHSA-38r7-794h-5758  Low       0.2% (9th)   < 0.1  
webpack               5.97.1     5.104.1   npm   GHSA-8fgc-7cc6-rx7x  Low       0.2% (9th)   < 0.1  
@babel/core           7.27.4     7.29.6    npm   GHSA-4x5r-pxfx-6jf8  Low       0.1% (2nd)   < 0.1  
js-yaml               3.14.1     3.15.1    npm   GHSA-5p4m-2wfm-xmqj  High      N/A          N/A    
js-yaml               4.1.0      4.3.1     npm   GHSA-5p4m-2wfm-xmqj  High      N/A          N/A    
serialize-javascript  6.0.1      7.0.3     npm   GHSA-5c6j-r48x-rmvq  High      N/A          N/A    
follow-redirects      1.15.9     1.16.0    npm   GHSA-r4q5-vmmm-2653  Medium    N/A          N/A
[0073] ERROR discovered vulnerabilities at or above the severity threshold

(Truncated to last 3636 characters out of 11224)

❌ REPOSITORY / kingfisher - 1 error

New Kingfisher release 2.0.0 available
 INFO kingfisher: Launching with 4 concurrent scan jobs. Use --jobs to override.
 INFO kingfisher::rule_loader: Loaded 1055 rules
 INFO kingfisher::scanner::runner: Using Vectorscan rule cache cache_dir=/github/home/.cache/kingfisher/rule-cache
 INFO kingfisher::scanner::runner: Starting secret validation phase...
POSTGRES URL WITH HARDCODED PASSWORD => [KINGFISHER.POSTGRES.1]
 |Finding.......: [REDACTED:1cb1a9db]
 |Fingerprint...: 2034115162828868254
 |Confidence....: medium
 |Entropy.......: 3.87
 |Validation....: Inactive Credential
 |__Response....: [REDACTED:32f62cda]
 |Language......: YAML
 |Line Num......: 24
 |Path..........: ./.devcontainer/docker-compose.yml


==========================================
Scan Summary:
==========================================
 |Findings....................: 1
 |__Successful Validations....: 0
 |__Failed Validations........: 1
 |__Skipped Validations.......: 0
 |Rules Applied...............: 1,055
 |__Blobs Scanned.............: 157
 |Bytes Scanned...............: 887.58 KiB
 |Scan Duration...............: 62ms 517us 385ns
 |Scan Date...................: 2026-08-26 14:08:30 +00:00
 |Kingfisher Version..........: 1.112.0
 |__Latest Version............: 2.0.0
New Kingfisher release 2.0.0 available

❌ SPELL / lychee - 1 error

📝 Summary
---------------------
🔍 Total............6
🔗 Unique...........4
✅ Successful.......1
⏳ Timeouts.........0
🔀 Redirected.......1
👻 Excluded.........4
❓ Unknown..........0
🚫 Errors...........1
⛔ Unsupported......1

Errors in pnpm-lock.yaml
[403] https://www.npmjs.com/support (at 2286:65) | Rejected status code: 403 Forbidden

Hint: Followed 1 redirect. You might want to consider replacing redirecting URLs with the resolved URLs. Use verbose mode (`-v`/`-vv`) to see redirection details.
Hint: You can configure accepted/rejected response codes with `-a` or `--accept`

❌ REPOSITORY / osv-scanner - 108 errors

lock.yaml |
| https://osv.dev/GHSA-g8m3-5g58-fq7m | 3.7  | npm       | undici               | 6.23.0  | 6.27.0        | pnpm-lock.yaml |
| https://osv.dev/GHSA-m8rv-5g2x-5cg5 | 4.2  | npm       | undici               | 6.23.0  | 6.28.0        | pnpm-lock.yaml |
| https://osv.dev/GHSA-p88m-4jfj-68fv | 5.9  | npm       | undici               | 6.23.0  | 6.27.0        | pnpm-lock.yaml |
| https://osv.dev/GHSA-v3r7-h72x-cjcm | 4.8  | npm       | undici               | 6.23.0  | 6.28.0        | pnpm-lock.yaml |
| https://osv.dev/GHSA-v9p9-hfj2-hcw8 | 7.5  | npm       | undici               | 6.23.0  | 6.24.0        | pnpm-lock.yaml |
| https://osv.dev/GHSA-vrm6-8vpv-qv8q | 7.5  | npm       | undici               | 6.23.0  | 6.24.0        | pnpm-lock.yaml |
| https://osv.dev/GHSA-vxpw-j846-p89q | 7.5  | npm       | undici               | 6.23.0  | 6.27.0        | pnpm-lock.yaml |
| https://osv.dev/GHSA-2mjp-6q6p-2qxm | 6.5  | npm       | undici               | 7.22.0  | 7.24.0        | pnpm-lock.yaml |
| https://osv.dev/GHSA-35p6-xmwp-9g52 | 3.7  | npm       | undici               | 7.22.0  | 7.28.0        | pnpm-lock.yaml |
| https://osv.dev/GHSA-4992-7rv2-5pvq | 4.6  | npm       | undici               | 7.22.0  | 7.24.0        | pnpm-lock.yaml |
| https://osv.dev/GHSA-4cwx-7wf7-3272 | 7.4  | npm       | undici               | 7.22.0  | 7.29.0        | pnpm-lock.yaml |
| https://osv.dev/GHSA-8xcm-r25x-g524 | 4.8  | npm       | undici               | 7.22.0  | 7.29.0        | pnpm-lock.yaml |
| https://osv.dev/GHSA-f269-vfmq-vjvj | 7.5  | npm       | undici               | 7.22.0  | 7.24.0        | pnpm-lock.yaml |
| https://osv.dev/GHSA-g8m3-5g58-fq7m | 3.7  | npm       | undici               | 7.22.0  | 7.28.0        | pnpm-lock.yaml |
| https://osv.dev/GHSA-jr45-8vmc-qm54 | 5.9  | npm       | undici               | 7.22.0  | 7.29.0        | pnpm-lock.yaml |
| https://osv.dev/GHSA-m8rv-5g2x-5cg5 | 4.2  | npm       | undici               | 7.22.0  | 7.29.0        | pnpm-lock.yaml |
| https://osv.dev/GHSA-p88m-4jfj-68fv | 5.9  | npm       | undici               | 7.22.0  | 7.28.0        | pnpm-lock.yaml |
| https://osv.dev/GHSA-phc3-fgpg-7m6h | 5.9  | npm       | undici               | 7.22.0  | 7.24.0        | pnpm-lock.yaml |
| https://osv.dev/GHSA-pr7r-676h-xcf6 | 5.9  | npm       | undici               | 7.22.0  | 7.28.0        | pnpm-lock.yaml |
| https://osv.dev/GHSA-v3r7-h72x-cjcm | 4.8  | npm       | undici               | 7.22.0  | 7.29.0        | pnpm-lock.yaml |
| https://osv.dev/GHSA-v9p9-hfj2-hcw8 | 7.5  | npm       | undici               | 7.22.0  | 7.24.0        | pnpm-lock.yaml |
| https://osv.dev/GHSA-vrm6-8vpv-qv8q | 7.5  | npm       | undici               | 7.22.0  | 7.24.0        | pnpm-lock.yaml |
| https://osv.dev/GHSA-vxpw-j846-p89q | 7.5  | npm       | undici               | 7.22.0  | 7.28.0        | pnpm-lock.yaml |
| https://osv.dev/GHSA-w5hq-g745-h8pq | 7.5  | npm       | uuid                 | 9.0.1   | 11.1.1        | pnpm-lock.yaml |
| https://osv.dev/GHSA-38r7-794h-5758 | 3.7  | npm       | webpack              | 5.97.1  | 5.104.0       | pnpm-lock.yaml |
| https://osv.dev/GHSA-8fgc-7cc6-rx7x | 3.7  | npm       | webpack              | 5.97.1  | 5.104.1       | pnpm-lock.yaml |
| https://osv.dev/GHSA-58qx-3vcg-4xpx | 4.4  | npm       | ws                   | 8.18.1  | 8.20.1        | pnpm-lock.yaml |
| https://osv.dev/GHSA-96hv-2xvq-fx4p | 7.5  | npm       | ws                   | 8.18.1  | 8.21.0        | pnpm-lock.yaml |
+-------------------------------------+------+-----------+----------------------+---------+---------------+----------------+

(Truncated to last 3636 characters out of 14374)

❌ REPOSITORY / secretlint - 1 error

.github/workflows/ci.yml
  89:24  error  [PostgreSQLConnection] found PostgreSQL connection string: *************************************************  @secretlint/secretlint-rule-preset-recommend > @secretlint/secretlint-rule-database-connection-string
  95:24  error  [PostgreSQLConnection] found PostgreSQL connection string: *************************************************  @secretlint/secretlint-rule-preset-recommend > @secretlint/secretlint-rule-database-connection-string

✖ 2 problems (2 errors, 0 warnings, 0 infos)

❌ YAML / yamllint - 8 errors

pnpm-lock.yaml
  1:1       warning  missing document start "---"  (document-start)
  40:501    error    line too long (629 > 500 characters)  (line-length)
  173:501   error    line too long (738 > 500 characters)  (line-length)
  9982:501  error    line too long (679 > 500 characters)  (line-length)
  9984:501  error    line too long (867 > 500 characters)  (line-length)
  10096:501 error    line too long (679 > 500 characters)  (line-length)
  10118:501 error    line too long (679 > 500 characters)  (line-length)
  10119:501 error    line too long (958 > 500 characters)  (line-length)

⚠️ JSON / prettier - 1 error

[error] Cannot find package 'prettier-plugin-toml' imported from noop.js

⚠️ REPOSITORY / trivy - 1 error

│                   │ 6.27.0, 7.28.0, 8.5.0      │ undici: undici: Weakening of cookie SameSite policy due to   │
│                │                │          │        │                   │                            │ incorrect parsing of...                                      │
│                │                │          │        │                   │                            │ https://avd.aquasec.com/nvd/cve-2026-11525                   │
│                ├────────────────┤          │        │                   │                            ├──────────────────────────────────────────────────────────────┤
│                │ CVE-2026-6733  │          │        │                   │                            │ undici: Undici: Response queue poisoning on reused           │
│                │                │          │        │                   │                            │ keep-alive sockets can lead to...                            │
│                │                │          │        │                   │                            │ https://avd.aquasec.com/nvd/cve-2026-6733                    │
├────────────────┼────────────────┼──────────┤        ├───────────────────┼────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ uuid           │ CVE-2026-41907 │ MEDIUM   │        │ 9.0.1             │ 11.1.1, 12.0.1, 13.0.1     │ uuid: uuid: Out-of-bounds write vulnerability impacts data   │
│                │                │          │        │                   │                            │ integrity and confidentiality                                │
│                │                │          │        │                   │                            │ https://avd.aquasec.com/nvd/cve-2026-41907                   │
└────────────────┴────────────────┴──────────┴────────┴───────────────────┴────────────────────────────┴──────────────────────────────────────────────────────────────┘

.devcontainer/Dockerfile (dockerfile)
=====================================
Tests: 27 (SUCCESSES: 25, FAILURES: 2)
Failures: 2 (UNKNOWN: 0, LOW: 1, MEDIUM: 0, HIGH: 1, CRITICAL: 0)

DS-0002 (HIGH): Specify at least 1 USER command in Dockerfile with non-root user as argument
════════════════════════════════════════
Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile.

See https://avd.aquasec.com/misconfig/ds-0002
────────────────────────────────────────


DS-0026 (LOW): Add HEALTHCHECK instruction in your Dockerfile
════════════════════════════════════════
You should add HEALTHCHECK instruction in your docker container images to perform the health check on running containers.

See https://avd.aquasec.com/misconfig/ds-0026
────────────────────────────────────────



Dockerfile (dockerfile)
=======================
Tests: 27 (SUCCESSES: 26, FAILURES: 1)
Failures: 1 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 1, CRITICAL: 0)

DS-0002 (HIGH): Specify at least 1 USER command in Dockerfile with non-root user as argument
════════════════════════════════════════
Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile.

See https://avd.aquasec.com/misconfig/ds-0002
────────────────────────────────────────



📣 Notices:
  - Version 0.74.0 of Trivy is now available, current version is 0.73.0

To suppress version checks, run Trivy scans with the --skip-version-check flag

(Truncated to last 3636 characters out of 29405)

Notices

⚠️ Your configuration references items that have been removed from MegaLinter and are ignored: REPOSITORY_GITLEAKS. See Removed linters to find their replacements.

See detailed reports in MegaLinter artifacts
Set VALIDATE_ALL_CODEBASE: true in mega-linter.yml to validate all sources, not only the diff

Show us your support by starring ⭐ the repository