Skip to content

chore(deps): update dependency @faker-js/faker to v10 [security] - #1876

Open
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/npm-faker-js-faker-vulnerability
Open

chore(deps): update dependency @faker-js/faker to v10 [security]#1876
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/npm-faker-js-faker-vulnerability

Conversation

@renovate

@renovate renovate Bot commented Sep 3, 2026

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Change Age Confidence
@faker-js/faker (source) 9.9.0 → 10.5.0 age confidence

Faker: helpers.fake exploitable into arbritary code execution

CVE-2026-73231 / GHSA-qxc2-j82w-r537

More information

Details

Summary

faker.helpers.fake can be tricked into arbritary code execution.

Details

fakeEval.resolveProperty resolves properties on functions itself instead of resolving the nested function first.
This can be addressed by recursively calling resolveProperty instead of accessing the property after one iteration.

PoC

Go to https://fakerjs.dev/
Open Browser console and run

await enableFaker(); // or import faker
faker.rawDefinitions.test = (() => () => {}); // Any function that returns a function
faker.helpers.fake(`{{test.constructor(alert('PowerLevel: Eval'))}}`);
Impact

The Fake method claims:

It is also NOT possible to use any non-faker methods or plain javascript in such patterns.

Which is objectively false, since any global gets fully accessible in the fake string.

Severity

  • CVSS Score: 7.8 / 10 (High)
  • Vector String: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

faker-js/faker (@​faker-js/faker)

v10.5.0

Compare Source

New Locales
Features
Bug Fixes

v10.4.0

Compare Source

New Locales
Features
Changed Locales
  • locale: filter and cleanup PersonEntryDefintions data (#​3266) (67defc8)
Bug Fixes
  • locales: correct typos and capitalization in es_MX street names (#​3737) (2b32c28)

v10.3.0

Compare Source

New Locales
Features
Changed Locales
Bug Fixes

v10.2.0

Compare Source

New Locales
Features
Bug Fixes

v10.1.0

Compare Source

New Locales
Bug Fixes

v10.0.0

Compare Source

New Locales
Features
  • locales: add animal vocabulary(bear, bird, cat, rabbit, pet_name) in Korean (#​3535) (0d2143c)
Changed Locales

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot added the automerge Auto merge PR with Kodiak label Sep 3, 2026
@renovate
renovate Bot enabled auto-merge (rebase) September 3, 2026 01:06
@github-actions

github-actions Bot commented Sep 3, 2026 •
edited
Loading

Copy link
Copy Markdown

❌MegaLinter analysis: Error

Descriptor Linter Files Fixed Errors Max errors Warnings Elapsed time
✅ COPYPASTE jscpd yes no no 1.27s
✅ EDITORCONFIG editorconfig-checker 2 0 0 0.02s
✅ JSON jsonlint 1 0 0 0.12s
✅ JSON npm-package-json-lint yes no no 0.38s
⚠️ JSON prettier 1 0 1 0 0.49s
✅ JSON v8r 1 0 0 6.89s
❌ REPOSITORY betterleaks yes 2 no 0.84s
❌ REPOSITORY checkov yes 1 no 25.98s
❌ REPOSITORY devskim yes 45 no 6.19s
✅ REPOSITORY dustilock yes no no 2.33s
✅ REPOSITORY git_diff yes no no 0.02s
❌ REPOSITORY grype yes 113 no 74.2s
❌ REPOSITORY kingfisher yes 1 no 24.88s
❌ REPOSITORY osv-scanner yes 118 no 2.09s
❌ REPOSITORY secretlint yes 1 no 2.69s
✅ REPOSITORY syft yes no no 6.68s
⚠️ REPOSITORY trivy yes 1 no 13.14s
✅ REPOSITORY trivy-sbom yes no no 2.37s
✅ REPOSITORY trufflehog yes no no 5.01s
✅ SPELL cspell 3 0 0 3.67s
❌ SPELL lychee 2 1 0 0.8s
✅ YAML prettier 1 0 0 0 0.23s
✅ YAML v8r 1 0 0 1.31s
❌ YAML yamllint 1 8 0 4.39s

Detailed Issues

❌ REPOSITORY / betterleaks - 2 errors 
+ ○
   ▾
 betterleaks 1.7.3

┌─generic-api-key──○
│
│ 63 │           POSTGRES_PASSWORD: REDACTED
│    │                              ^^^^^^^^
│
│ attributes:
│   path .......... .github/workflows/ci.yml
│   resource ...... fs.content
└○


┌─generic-api-key──○
│
│ 9 │ SECRET=REDACTED
│   │        ^^^^^^^^
│
│ attributes:
│   path .......... .env.example
│   resource ...... fs.content
└○


1:10AM INF scanned ~417615 bytes (417.61 KB) in 814ms
1:10AM WRN leaks found: 2
❌ REPOSITORY / checkov - 1 error 
dockerfile scan results:

Passed checks: 77, Failed checks: 1, Skipped checks: 0

Check: CKV_DOCKER_3: "Ensure that a user for the container has been created"
	FAILED for resource: /Dockerfile.
	File: /Dockerfile:1-47
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/docker-policies/docker-policy-index/ensure-that-a-user-for-the-container-has-been-created

		1  | ARG NODE_VERSION=lts-slim
		2  | 
		3  | FROM node:${NODE_VERSION} AS dependencies
		4  | 
		5  | WORKDIR /app
		6  | 
		7  | ENV PNPM_HOME="/pnpm"
		8  | ENV PATH="$PNPM_HOME:$PATH"
		9  | 
		10 | RUN --mount=type=cache,id=pnpm-store,target=/pnpm/store \
		11 |     --mount=type=bind,source=package.json,target=/app/package.json \
		12 |     --mount=type=bind,source=pnpm-lock.yaml,target=/app/pnpm-lock.yaml \
		13 |     corepack enable && \
		14 |     pnpm install --frozen-lockfile --strict-peer-dependencies
		15 | 
		16 | FROM dependencies AS builder
		17 | 
		18 | COPY --chown=node:node src/ /app/src
		19 | 
		20 | RUN --mount=type=bind,source=package.json,target=/app/package.json \
		21 |     --mount=type=bind,source=nest-cli.json,target=/app/nest-cli.json \
		22 |     --mount=type=bind,source=tsconfig.json,target=/app/tsconfig.json \
		23 |     --mount=type=bind,source=tsconfig.build.json,target=/app/tsconfig.build.json \
		24 |     pnpm build
		25 | 
		26 | FROM builder AS pruner
		27 | 
		28 | RUN --mount=type=cache,id=pnpm-store,target=/pnpm/store \
		29 |     --mount=type=bind,source=package.json,target=/app/package.json \
		30 |     --mount=type=bind,source=pnpm-lock.yaml,target=/app/pnpm-lock.yaml \
		31 |     pnpm prune --prod --ignore-scripts
		32 | 
		33 | FROM gcr.io/distroless/nodejs22-debian12:nonroot
		34 | 
		35 | WORKDIR /app
		36 | 
		37 | ENV PORT=3000
		38 | 
		39 | COPY --chown=nonroot:nonroot --from=pruner /app/node_modules ./node_modules
		40 | COPY --chown=nonroot:nonroot --from=builder /app/dist .
		41 | COPY --chown=nonroot:nonroot CHANGELOG.md LICENSE package.json /app/
		42 | 
		43 | EXPOSE ${PORT}
		44 | 
		45 | HEALTHCHECK --interval=30s --timeout=2s --start-period=10s --retries=2 CMD [ "/nodejs/bin/node", "bin/health-checker.js" ]
		46 | 
		47 | CMD ["main.js"]
❌ REPOSITORY / devskim - 45 errors 
gorithm"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"pnpm-lock.yaml"},"region":{"startLine":954,"startColumn":91,"endLine":954,"endColumn":94,"charOffset":44838,"charLength":3,"snippet":{"text":"mD5","rendered":{"text":"mD5","markdown":"`mD5`"}},"sourceLanguage":"yaml"}}}],"fixes":[],"properties":{"tags":["Cryptography.BannedHashAlgorithm"],"DevSkimSeverity":"Critical","DevSkimConfidence":"High"}},{"ruleId":"DS126858","level":"error","message":{"text":"Weak/Broken Hash Algorithm"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"pnpm-lock.yaml"},"region":{"startLine":906,"startColumn":61,"endLine":906,"endColumn":64,"charOffset":42585,"charLength":3,"snippet":{"text":"Md5","rendered":{"text":"Md5","markdown":"`Md5`"}},"sourceLanguage":"yaml"}}}],"fixes":[],"properties":{"tags":["Cryptography.BannedHashAlgorithm"],"DevSkimSeverity":"Critical","DevSkimConfidence":"High"}},{"ruleId":"DS162092","level":"note","message":{"text":"Do not leave debug code in production"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":".github/workflows/ci.yml"},"region":{"startLine":100,"startColumn":43,"endLine":100,"endColumn":52,"charOffset":3304,"charLength":9,"snippet":{"text":"localhost","rendered":{"text":"localhost","markdown":"`localhost`"}},"sourceLanguage":"yaml"}}}],"properties":{"tags":["Hygiene.Network.AccessingLocalhost"],"DevSkimSeverity":"ManualReview","DevSkimConfidence":"High"}},{"ruleId":"DS162092","level":"note","message":{"text":"Do not leave debug code in production"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":".github/workflows/ci.yml"},"region":{"startLine":95,"startColumn":60,"endLine":95,"endColumn":69,"charOffset":3041,"charLength":9,"snippet":{"text":"localhost","rendered":{"text":"localhost","markdown":"`localhost`"}},"sourceLanguage":"yaml"}}}],"properties":{"tags":["Hygiene.Network.AccessingLocalhost"],"DevSkimSeverity":"ManualReview","DevSkimConfidence":"High"}},{"ruleId":"DS162092","level":"note","message":{"text":"Do not leave debug code in production"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":".github/workflows/ci.yml"},"region":{"startLine":89,"startColumn":60,"endLine":89,"endColumn":69,"charOffset":2710,"charLength":9,"snippet":{"text":"localhost","rendered":{"text":"localhost","markdown":"`localhost`"}},"sourceLanguage":"yaml"}}}],"properties":{"tags":["Hygiene.Network.AccessingLocalhost"],"DevSkimSeverity":"ManualReview","DevSkimConfidence":"High"}},{"ruleId":"DS162092","level":"note","message":{"text":"Do not leave debug code in production"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"test/auth.end2end.spec.ts"},"region":{"startLine":188,"startColumn":20,"endLine":188,"endColumn":29,"charOffset":5337,"charLength":9,"snippet":{"text":"localhost","rendered":{"text":"localhost","markdown":"`localhost`"}},"sourceLanguage":"typescript"}}}],"properties":{"tags":["Hygiene.Network.AccessingLocalhost"],"DevSkimSeverity":"ManualReview","DevSkimConfidence":"High"}},{"ruleId":"DS197836","level":"error","message":{"text":"Do not take the hash of low-entropy content."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"pnpm-lock.yaml"},"region":{"startLine":718,"startColumn":28,"endLine":718,"endColumn":53,"charOffset":33287,"charLength":25,"snippet":{"text":"sha512-hO+ga+uYZ/WA4OtiME","rendered":{"text":"sha512-hO+ga+uYZ/WA4OtiME","markdown":"`sha512-hO+ga+uYZ/WA4OtiME`"}},"sourceLanguage":"yaml"}}}],"properties":{"tags":["Cryptography.HashAlgorithm.InsufficientEntropy"],"DevSkimSeverity":"Important","DevSkimConfidence":"High"}}],"columnKind":"utf16CodeUnits"}]}

(Truncated to last 3636 characters out of 313204)
❌ REPOSITORY / grype - 113 errors 
Medium    0.3% (19th)  0.1    
undici                6.14.1     6.27.0    npm   GHSA-p88m-4jfj-68fv  Medium    0.3% (17th)  0.1    
undici                6.23.0     6.27.0    npm   GHSA-p88m-4jfj-68fv  Medium    0.3% (17th)  0.1    
undici                7.22.0     7.28.0    npm   GHSA-p88m-4jfj-68fv  Medium    0.3% (17th)  0.1    
brace-expansion       1.1.11     1.1.12    npm   GHSA-v6h2-p8h4-qcjw  Low       0.5% (42nd)  0.1    
brace-expansion       2.0.1      2.0.2     npm   GHSA-v6h2-p8h4-qcjw  Low       0.5% (42nd)  0.1    
body-parser           1.20.4     1.20.6    npm   GHSA-v422-hmwv-36x6  Low       0.4% (34th)  0.1    
undici                6.14.1     6.24.0    npm   GHSA-4992-7rv2-5pvq  Medium    0.3% (19th)  0.1    
undici                6.23.0     6.24.0    npm   GHSA-4992-7rv2-5pvq  Medium    0.3% (19th)  0.1    
undici                7.22.0     7.24.0    npm   GHSA-4992-7rv2-5pvq  Medium    0.3% (19th)  0.1    
@nestjs/core          10.4.22    11.1.18   npm   GHSA-36xv-jgw5-4q75  Medium    0.2% (14th)  0.1    
undici                6.14.1     6.19.2    npm   GHSA-3g92-w8c5-73pq  Low       0.5% (38th)  0.1    
undici                6.14.1     6.28.0    npm   GHSA-v3r7-h72x-cjcm  Medium    0.2% (8th)   < 0.1  
undici                6.23.0     6.28.0    npm   GHSA-v3r7-h72x-cjcm  Medium    0.2% (8th)   < 0.1  
undici                7.22.0     7.29.0    npm   GHSA-v3r7-h72x-cjcm  Medium    0.2% (8th)   < 0.1  
tmp                   0.0.33     0.2.4     npm   GHSA-52f5-9888-hmc6  Low       0.3% (26th)  < 0.1  
undici                6.14.1     6.21.2    npm   GHSA-cxrh-j4jr-qwg3  Low       0.3% (22nd)  < 0.1  
undici                6.14.1     6.28.0    npm   GHSA-m8rv-5g2x-5cg5  Medium    0.2% (9th)   < 0.1  
undici                6.23.0     6.28.0    npm   GHSA-m8rv-5g2x-5cg5  Medium    0.2% (9th)   < 0.1  
undici                7.22.0     7.29.0    npm   GHSA-m8rv-5g2x-5cg5  Medium    0.2% (9th)   < 0.1  
undici                6.14.1     6.28.0    npm   GHSA-8xcm-r25x-g524  Medium    0.2% (7th)   < 0.1  
undici                6.23.0     6.28.0    npm   GHSA-8xcm-r25x-g524  Medium    0.2% (7th)   < 0.1  
undici                7.22.0     7.29.0    npm   GHSA-8xcm-r25x-g524  Medium    0.2% (7th)   < 0.1  
undici                6.14.1     6.27.0    npm   GHSA-g8m3-5g58-fq7m  Low       0.2% (14th)  < 0.1  
undici                6.23.0     6.27.0    npm   GHSA-g8m3-5g58-fq7m  Low       0.2% (14th)  < 0.1  
undici                7.22.0     7.28.0    npm   GHSA-g8m3-5g58-fq7m  Low       0.2% (14th)  < 0.1  
undici                6.14.1     6.27.0    npm   GHSA-35p6-xmwp-9g52  Low       0.2% (12th)  < 0.1  
undici                6.23.0     6.27.0    npm   GHSA-35p6-xmwp-9g52  Low       0.2% (12th)  < 0.1  
undici                7.22.0     7.28.0    npm   GHSA-35p6-xmwp-9g52  Low       0.2% (12th)  < 0.1  
webpack               5.97.1     5.104.0   npm   GHSA-38r7-794h-5758  Low       0.2% (9th)   < 0.1  
webpack               5.97.1     5.104.1   npm   GHSA-8fgc-7cc6-rx7x  Low       0.2% (9th)   < 0.1  
@babel/core           7.27.4     7.29.6    npm   GHSA-4x5r-pxfx-6jf8  Low       0.1% (2nd)   < 0.1  
js-yaml               3.14.1     3.15.1    npm   GHSA-5p4m-2wfm-xmqj  High      N/A          N/A    
js-yaml               4.1.0      4.3.1     npm   GHSA-5p4m-2wfm-xmqj  High      N/A          N/A    
serialize-javascript  6.0.1      7.0.3     npm   GHSA-5c6j-r48x-rmvq  High      N/A          N/A    
follow-redirects      1.15.9     1.16.0    npm   GHSA-r4q5-vmmm-2653  Medium    N/A          N/A
[0074] ERROR discovered vulnerabilities at or above the severity threshold

(Truncated to last 3636 characters out of 11729)
❌ REPOSITORY / kingfisher - 1 error 
New Kingfisher release 2.1.0 available
 INFO kingfisher: Launching with 4 concurrent scan jobs. Use --jobs to override.
 INFO kingfisher::rule_loader: Loaded 1055 rules
 INFO kingfisher::scanner::runner: Using Vectorscan rule cache cache_dir=/github/home/.cache/kingfisher/rule-cache
 INFO kingfisher::scanner::runner: Starting secret validation phase...
POSTGRES URL WITH HARDCODED PASSWORD => [KINGFISHER.POSTGRES.1]
 |Finding.......: [REDACTED:32ecf036]
 |Fingerprint...: 2034115162828868254
 |Confidence....: medium
 |Entropy.......: 3.87
 |Validation....: Inactive Credential
 |__Response....: [REDACTED:24b27902]
 |Language......: YAML
 |Line Num......: 24
 |Path..........: ./.devcontainer/docker-compose.yml


==========================================
Scan Summary:
==========================================
 |Findings....................: 1
 |__Successful Validations....: 0
 |__Failed Validations........: 1
 |__Skipped Validations.......: 0
 |Rules Applied...............: 1,055
 |__Blobs Scanned.............: 157
 |Bytes Scanned...............: 888.42 KiB
 |Scan Duration...............: 80ms 941us 211ns
 |Scan Date...................: 2026-09-03 01:10:46 +00:00
 |Kingfisher Version..........: 1.112.0
 |__Latest Version............: 2.1.0
New Kingfisher release 2.1.0 available
❌ SPELL / lychee - 1 error 
📝 Summary
---------------------
🔍 Total............7
🔗 Unique...........4
✅ Successful.......1
⏳ Timeouts.........0
🔀 Redirected.......1
👻 Excluded.........5
❓ Unknown..........0
🚫 Errors...........1
⛔ Unsupported......1

Errors in pnpm-lock.yaml
[403] https://www.npmjs.com/support (at 2287:65) | Rejected status code: 403 Forbidden

Hint: Followed 1 redirect. You might want to consider replacing redirecting URLs with the resolved URLs. Use verbose mode (`-v`/`-vv`) to see redirection details.
Hint: You can configure accepted/rejected response codes with `-a` or `--accept`
❌ REPOSITORY / osv-scanner - 118 errors 
lock.yaml |
| https://osv.dev/GHSA-g8m3-5g58-fq7m | 3.7  | npm       | undici               | 6.23.0  | 6.27.0        | pnpm-lock.yaml |
| https://osv.dev/GHSA-m8rv-5g2x-5cg5 | 4.2  | npm       | undici               | 6.23.0  | 6.28.0        | pnpm-lock.yaml |
| https://osv.dev/GHSA-p88m-4jfj-68fv | 5.9  | npm       | undici               | 6.23.0  | 6.27.0        | pnpm-lock.yaml |
| https://osv.dev/GHSA-v3r7-h72x-cjcm | 4.8  | npm       | undici               | 6.23.0  | 6.28.0        | pnpm-lock.yaml |
| https://osv.dev/GHSA-v9p9-hfj2-hcw8 | 7.5  | npm       | undici               | 6.23.0  | 6.24.0        | pnpm-lock.yaml |
| https://osv.dev/GHSA-vrm6-8vpv-qv8q | 7.5  | npm       | undici               | 6.23.0  | 6.24.0        | pnpm-lock.yaml |
| https://osv.dev/GHSA-vxpw-j846-p89q | 7.5  | npm       | undici               | 6.23.0  | 6.27.0        | pnpm-lock.yaml |
| https://osv.dev/GHSA-2mjp-6q6p-2qxm | 6.5  | npm       | undici               | 7.22.0  | 7.24.0        | pnpm-lock.yaml |
| https://osv.dev/GHSA-35p6-xmwp-9g52 | 3.7  | npm       | undici               | 7.22.0  | 7.28.0        | pnpm-lock.yaml |
| https://osv.dev/GHSA-4992-7rv2-5pvq | 4.6  | npm       | undici               | 7.22.0  | 7.24.0        | pnpm-lock.yaml |
| https://osv.dev/GHSA-4cwx-7wf7-3272 | 7.4  | npm       | undici               | 7.22.0  | 7.29.0        | pnpm-lock.yaml |
| https://osv.dev/GHSA-8xcm-r25x-g524 | 4.8  | npm       | undici               | 7.22.0  | 7.29.0        | pnpm-lock.yaml |
| https://osv.dev/GHSA-f269-vfmq-vjvj | 7.5  | npm       | undici               | 7.22.0  | 7.24.0        | pnpm-lock.yaml |
| https://osv.dev/GHSA-g8m3-5g58-fq7m | 3.7  | npm       | undici               | 7.22.0  | 7.28.0        | pnpm-lock.yaml |
| https://osv.dev/GHSA-jr45-8vmc-qm54 | 5.9  | npm       | undici               | 7.22.0  | 7.29.0        | pnpm-lock.yaml |
| https://osv.dev/GHSA-m8rv-5g2x-5cg5 | 4.2  | npm       | undici               | 7.22.0  | 7.29.0        | pnpm-lock.yaml |
| https://osv.dev/GHSA-p88m-4jfj-68fv | 5.9  | npm       | undici               | 7.22.0  | 7.28.0        | pnpm-lock.yaml |
| https://osv.dev/GHSA-phc3-fgpg-7m6h | 5.9  | npm       | undici               | 7.22.0  | 7.24.0        | pnpm-lock.yaml |
| https://osv.dev/GHSA-pr7r-676h-xcf6 | 5.9  | npm       | undici               | 7.22.0  | 7.28.0        | pnpm-lock.yaml |
| https://osv.dev/GHSA-v3r7-h72x-cjcm | 4.8  | npm       | undici               | 7.22.0  | 7.29.0        | pnpm-lock.yaml |
| https://osv.dev/GHSA-v9p9-hfj2-hcw8 | 7.5  | npm       | undici               | 7.22.0  | 7.24.0        | pnpm-lock.yaml |
| https://osv.dev/GHSA-vrm6-8vpv-qv8q | 7.5  | npm       | undici               | 7.22.0  | 7.24.0        | pnpm-lock.yaml |
| https://osv.dev/GHSA-vxpw-j846-p89q | 7.5  | npm       | undici               | 7.22.0  | 7.28.0        | pnpm-lock.yaml |
| https://osv.dev/GHSA-w5hq-g745-h8pq | 7.5  | npm       | uuid                 | 9.0.1   | 11.1.1        | pnpm-lock.yaml |
| https://osv.dev/GHSA-38r7-794h-5758 | 3.7  | npm       | webpack              | 5.97.1  | 5.104.0       | pnpm-lock.yaml |
| https://osv.dev/GHSA-8fgc-7cc6-rx7x | 3.7  | npm       | webpack              | 5.97.1  | 5.104.1       | pnpm-lock.yaml |
| https://osv.dev/GHSA-58qx-3vcg-4xpx | 4.4  | npm       | ws                   | 8.18.1  | 8.20.1        | pnpm-lock.yaml |
| https://osv.dev/GHSA-96hv-2xvq-fx4p | 7.5  | npm       | ws                   | 8.18.1  | 8.21.0        | pnpm-lock.yaml |
+-------------------------------------+------+-----------+----------------------+---------+---------------+----------------+

(Truncated to last 3636 characters out of 15624)
❌ REPOSITORY / secretlint - 1 error 
.github/workflows/ci.yml
  89:24  error  [PostgreSQLConnection] found PostgreSQL connection string: *************************************************  @secretlint/secretlint-rule-preset-recommend > @secretlint/secretlint-rule-database-connection-string
  95:24  error  [PostgreSQLConnection] found PostgreSQL connection string: *************************************************  @secretlint/secretlint-rule-preset-recommend > @secretlint/secretlint-rule-database-connection-string

✖ 2 problems (2 errors, 0 warnings, 0 infos)
❌ YAML / yamllint - 8 errors 
pnpm-lock.yaml
  1:1       warning  missing document start "---"  (document-start)
  40:501    error    line too long (629 > 500 characters)  (line-length)
  173:501   error    line too long (738 > 500 characters)  (line-length)
  9986:501  error    line too long (679 > 500 characters)  (line-length)
  9988:501  error    line too long (867 > 500 characters)  (line-length)
  10100:501 error    line too long (679 > 500 characters)  (line-length)
  10122:501 error    line too long (679 > 500 characters)  (line-length)
  10123:501 error    line too long (958 > 500 characters)  (line-length)
⚠️ JSON / prettier - 1 error 
[error] Cannot find package 'prettier-plugin-toml' imported from noop.js
⚠️ REPOSITORY / trivy - 1 error 
│                   │ 6.27.0, 7.28.0, 8.5.0      │ undici: undici: Weakening of cookie SameSite policy due to   │
│                │                │          │        │                   │                            │ incorrect parsing of...                                      │
│                │                │          │        │                   │                            │ https://avd.aquasec.com/nvd/cve-2026-11525                   │
│                ├────────────────┤          │        │                   │                            ├──────────────────────────────────────────────────────────────┤
│                │ CVE-2026-6733  │          │        │                   │                            │ undici: Undici: Response queue poisoning on reused           │
│                │                │          │        │                   │                            │ keep-alive sockets can lead to...                            │
│                │                │          │        │                   │                            │ https://avd.aquasec.com/nvd/cve-2026-6733                    │
├────────────────┼────────────────┼──────────┤        ├───────────────────┼────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ uuid           │ CVE-2026-41907 │ MEDIUM   │        │ 9.0.1             │ 11.1.1, 12.0.1, 13.0.1     │ uuid: uuid: Out-of-bounds write vulnerability impacts data   │
│                │                │          │        │                   │                            │ integrity and confidentiality                                │
│                │                │          │        │                   │                            │ https://avd.aquasec.com/nvd/cve-2026-41907                   │
└────────────────┴────────────────┴──────────┴────────┴───────────────────┴────────────────────────────┴──────────────────────────────────────────────────────────────┘

.devcontainer/Dockerfile (dockerfile)
=====================================
Tests: 27 (SUCCESSES: 25, FAILURES: 2)
Failures: 2 (UNKNOWN: 0, LOW: 1, MEDIUM: 0, HIGH: 1, CRITICAL: 0)

DS-0002 (HIGH): Specify at least 1 USER command in Dockerfile with non-root user as argument
════════════════════════════════════════
Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile.

See https://avd.aquasec.com/misconfig/ds-0002
────────────────────────────────────────


DS-0026 (LOW): Add HEALTHCHECK instruction in your Dockerfile
════════════════════════════════════════
You should add HEALTHCHECK instruction in your docker container images to perform the health check on running containers.

See https://avd.aquasec.com/misconfig/ds-0026
────────────────────────────────────────



Dockerfile (dockerfile)
=======================
Tests: 27 (SUCCESSES: 26, FAILURES: 1)
Failures: 1 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 1, CRITICAL: 0)

DS-0002 (HIGH): Specify at least 1 USER command in Dockerfile with non-root user as argument
════════════════════════════════════════
Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile.

See https://avd.aquasec.com/misconfig/ds-0002
────────────────────────────────────────



📣 Notices:
  - Version 0.74.0 of Trivy is now available, current version is 0.73.0

To suppress version checks, run Trivy scans with the --skip-version-check flag

(Truncated to last 3636 characters out of 30077)

Notices

⚠️ Your configuration references items that have been removed from MegaLinter and are ignored: REPOSITORY_GITLEAKS. See Removed linters to find their replacements.

See detailed reports in MegaLinter artifacts
Set VALIDATE_ALL_CODEBASE: true in mega-linter.yml to validate all sources, not only the diff

MegaLinter is provided by OX Security
Show us your support by starring ⭐ the repository

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@kodiakhq kodiakhq[bot] kodiakhq[bot] approved these changes

Assignees

No one assigned

Labels

automerge Auto merge PR with Kodiak

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants