Repository navigation
chore: weekly dependency security update 2026-10-26 - #255
Open
github-actions[bot] wants to merge 1 commit into
Open
github-actions[bot] wants to merge 1 commit into
github-actions[bot] wants to merge 1 commit into
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Weekly Dependency Security Update
This PR was automatically generated by the weekly dependency update workflow.
Audit Results
Frontend
npm audit report
follow-redirects 1.16.0
Severity: high
follow-redirects array-form headers bypass cross-origin credential stripping - GHSA-q3jh-wrc6-jgq8
follow-redirects sensitiveHeaders regex escaping can expose credential headers - GHSA-8r9p-f939-6h3c
fix available via
npm audit fixnode_modules/follow-redirects
postcss <=8.5.22
Severity: high
PostCSS has XSS via Unescaped </style> in its CSS Stringify Output - GHSA-qx2v-qp2m-jg93
PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments - GHSA-6g55-p6wh-862q
PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when
fromis unset - GHSA-fxqj-rqcc-2cmpPostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure - GHSA-r28c-9q8g-f849
fix available via
npm audit fix --forceWill install next@16.4.3, which is a breaking change
node_modules/next/node_modules/postcss
next 9.3.4-canary.0 - 16.3.0-preview.10
Depends on vulnerable versions of postcss
node_modules/next
postcss-selector-parser <7.1.6
Severity: moderate
PostCSS: Quadratic complexity in flat selector parsing allows CPU exhaustion - GHSA-rj75-hqrm-r3gf
fix available via
npm audit fix --forceWill install @tailwindcss/typography@0.5.4, which is a breaking change
node_modules/postcss-nested/node_modules/postcss-selector-parser
node_modules/postcss-selector-parser
node_modules/tailwindcss/node_modules/postcss-selector-parser
@tailwindcss/typography <=0.4.0 || >=0.5.0-alpha.1
Depends on vulnerable versions of postcss-selector-parser
Depends on vulnerable versions of tailwindcss
node_modules/@tailwindcss/typography
postcss-nested 2.0.3 - 6.2.0
Depends on vulnerable versions of postcss-selector-parser
node_modules/postcss-nested
tailwindcss <=0.0.0-oxide-insiders.ff2c25f || 0.5.0 - 3.4.19
Depends on vulnerable versions of postcss-nested
Depends on vulnerable versions of postcss-selector-parser
node_modules/tailwindcss
7 vulnerabilities (5 moderate, 2 high)
To address issues that do not require attention, run:
npm audit fix
To address all issues (including breaking changes), run:
npm audit fix --force
Backend
npm audit report
body-parser <1.20.9
Severity: high
body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body - GHSA-27r3-jxmh-p828
fix available via
npm audit fixnode_modules/body-parser
esbuild 0.27.3 - 0.28.0
esbuild allows arbitrary file read when running the development server on Windows - GHSA-g7r4-m6w7-qqqr
fix available via
npm audit fixnode_modules/esbuild
follow-redirects 1.16.0
Severity: high
follow-redirects array-form headers bypass cross-origin credential stripping - GHSA-q3jh-wrc6-jgq8
follow-redirects sensitiveHeaders regex escaping can expose credential headers - GHSA-8r9p-f939-6h3c
fix available via
npm audit fixnode_modules/follow-redirects
multer 2.0.0 - 2.4.0
Severity: high
multer vulnerable to Denial of Service via a pending asynchronous fileFilter after request teardown - GHSA-q7qp-rjg7-q26m
fix available via
npm audit fixnode_modules/multer
qs 2.2.5 - 6.15.3
Severity: moderate
qs has a remotely triggerable DoS: qs.stringify crashes with TypeError on null/undefined entries in comma-format arrays when encodeValuesOnly is set - GHSA-q8mj-m7cp-5q26
qs array-limit bypass via bracket-key comma parsing - GHSA-x5fp-wj9c-mxmx
qs: Denial of Service via Attacker Controlled isBuffer - GHSA-4mjr-xmp4-gh2g
fix available via
npm audit fixnode_modules/qs
5 vulnerabilities (1 low, 1 moderate, 3 high)
To address all issues, run:
npm audit fix
Package.json Changes
No direct dependency changes in package.json (only lockfile updated).
Review
Please review the updated
package.jsonandpackage-lock.jsonfiles before merging.