Node security: 7 dependency updates, 6 security fixes by github-actions[bot] · Pull Request #283 · omry/reploy

github-actions · 2026-10-26T07:26:39Z

7 dependency updates · 6 security fixes · Validation passed

Validation

Frozen install: passed.
Project checks: passed.

Security status

6 security fixes · 33 affected package entries remain (16 critical).

Security fixes

🟢 Fixes in 6 packages

Package	Affected package entries	Action / blocker	Advisories
🟢 `body-parser`	1 fixed	Resolved.	GHSA-27r3-jxmh-p828
🟢 `dompurify`	1 fixed	Resolved.	GHSA-c6gr-qvv4-5v3f (+2 additional advisories; see full audit details)
🟢 `fast-uri`	1 fixed	Resolved.	GHSA-333x-w4r6-6crp (+3 additional advisories; see full audit details)
🟢 `launch-editor`	1 fixed	Resolved.	GHSA-587h-7wmj-h5pm (+2 additional advisories; see full audit details)
🟢 `postcss-selector-parser`	1 fixed	Resolved.	GHSA-rj75-hqrm-r3gf
🟢 `qs`	1 fixed	Resolved.	GHSA-6pq8-jhm2-2vcw

All dependency changes

body-parser: 1.20.8 → 1.20.9
dompurify: 3.4.16 → 3.4.17
fast-uri: 3.1.8 → 3.1.9
launch-editor: 2.14.1 → 2.14.2
postcss-selector-parser: 6.1.4, 7.1.6 → 6.1.5, 7.1.6
qs: 6.16.0 → 6.16.1
webpack-dev-server: 5.2.6 → 5.2.7

Security findings and blockers

🟢 Fixes in 6 packages · 🟠 15 packages need your review · ⚪ 18 packages need verification

Package	Affected package entries	Action / blocker
🟢 `body-parser`	1 fixed	Resolved.
🟢 `dompurify`	1 fixed	Resolved.
🟢 `fast-uri`	1 fixed	Resolved.
🟢 `launch-editor`	1 fixed	Resolved.
🟢 `postcss-selector-parser`	1 fixed	Resolved.
🟢 `qs`	1 fixed	Resolved.
🟠 `@docusaurus/core`	1 pending	The offered fix requires a major upgrade.
🟠 `@docusaurus/theme-mermaid`	1 pending	The offered fix requires a major upgrade.
🟠 `tinypool`	1 pending	The offered fix requires a major upgrade.
🟠 `serialize-javascript`	1 pending	The offered fix requires a major upgrade.
🟠 `@docusaurus/bundler`	1 pending	The offered fix requires a major upgrade.
🟠 `copy-webpack-plugin`	1 pending	The offered fix requires a major upgrade.
🟠 `css-minimizer-webpack-plugin`	1 pending	The offered fix requires a major upgrade.
🟠 `minimatch`	1 pending	The offered fix requires a major upgrade.
🟠 `serve-handler`	1 pending	The offered fix requires a major upgrade.
🟠 `sockjs`	1 pending	The offered fix requires a major upgrade.
🟠 `uuid`	1 pending	The offered fix requires a major upgrade.
🟠 `webpack-dev-server`	1 pending	The offered fix requires a major upgrade.
🟠 `@mermaid-js/layout-elk`	1 pending	The offered fix requires a major upgrade.
🟠 `katex`	1 pending	The offered fix requires a major upgrade.
🟠 `mermaid`	1 pending	The offered fix requires a major upgrade.
⚪ `@docusaurus/plugin-content-blog`	1 pending	Fix availability or resolution is unconfirmed.
⚪ `@docusaurus/plugin-content-docs`	1 pending	Fix availability or resolution is unconfirmed.
⚪ `@docusaurus/plugin-content-pages`	1 pending	Fix availability or resolution is unconfirmed.
⚪ `@docusaurus/plugin-css-cascade-layers`	1 pending	Fix availability or resolution is unconfirmed.
⚪ `@docusaurus/plugin-debug`	1 pending	Fix availability or resolution is unconfirmed.
⚪ `@docusaurus/plugin-google-analytics`	1 pending	Fix availability or resolution is unconfirmed.
⚪ `@docusaurus/plugin-google-gtag`	1 pending	Fix availability or resolution is unconfirmed.
⚪ `@docusaurus/plugin-google-tag-manager`	1 pending	Fix availability or resolution is unconfirmed.
⚪ `@docusaurus/plugin-sitemap`	1 pending	Fix availability or resolution is unconfirmed.
⚪ `@docusaurus/plugin-svgr`	1 pending	Fix availability or resolution is unconfirmed.
⚪ `@docusaurus/preset-classic`	1 pending	Fix availability or resolution is unconfirmed.
⚪ `@docusaurus/theme-classic`	1 pending	Fix availability or resolution is unconfirmed.
⚪ `@docusaurus/theme-search-algolia`	1 pending	Fix availability or resolution is unconfirmed.
⚪ `follow-redirects`	1 pending	Fix availability or resolution is unconfirmed.
⚪ `joi`	1 pending	Fix availability or resolution is unconfirmed.
⚪ `@svgr/plugin-svgo`	1 pending	Fix availability or resolution is unconfirmed.
⚪ `@svgr/webpack`	1 pending	Fix availability or resolution is unconfirmed.
⚪ `deepmerge`	1 pending	Fix availability or resolution is unconfirmed.

Additional dependency change details

Security findings and fixes

qs: 6.16.0 → 6.16.1; no longer reported by npm.
webpack-dev-server: 5.2.6 → 5.2.7; still reported by npm.
body-parser: 1.20.8 → 1.20.9; no longer reported by npm.
dompurify: 3.4.16 → 3.4.17; no longer reported by npm.
launch-editor: 2.14.1 → 2.14.2; no longer reported by npm.
postcss-selector-parser: 6.1.4, 7.1.6 → 6.1.5, 7.1.6; no longer reported by npm.
fast-uri: 3.1.8 → 3.1.9; no longer reported by npm.

Full before/after npm audit

Remaining advisories

Affected package entries: info: 0, low: 6, moderate: 8, high: 3, critical: 16, total: 33

@docusaurus/core: critical; locked versions 3.10.2; affected range *; npm fix candidate @docusaurus/theme-mermaid@3.7.0; requires breaking changes; manual review.
- Depends on affected @docusaurus/bundler (see its entry).
- Depends on affected serve-handler (see its entry).
- Depends on affected tinypool (see its entry).
- Depends on affected webpack-dev-server (see its entry).
@docusaurus/plugin-content-blog: critical; locked versions 3.10.2; affected range 3.8.0-canary-6324 - 3.10.2; npm fix candidate available.
- Depends on affected @docusaurus/core (see its entry).
@docusaurus/plugin-content-docs: critical; locked versions 3.10.2; affected range 3.8.0-canary-6324 - 3.10.2; npm fix candidate available.
- Depends on affected @docusaurus/core (see its entry).
@docusaurus/plugin-content-pages: critical; locked versions 3.10.2; affected range 3.8.0-canary-6324 - 3.10.2; npm fix candidate available.
- Depends on affected @docusaurus/core (see its entry).
@docusaurus/plugin-css-cascade-layers: critical; locked versions 3.10.2; affected range <=3.10.2; npm fix candidate available.
- Depends on affected @docusaurus/core (see its entry).
@docusaurus/plugin-debug: critical; locked versions 3.10.2; affected range 3.8.0-canary-6324 - 3.10.2; npm fix candidate available.
- Depends on affected @docusaurus/core (see its entry).
@docusaurus/plugin-google-analytics: critical; locked versions 3.10.2; affected range >=3.8.0-canary-6324; npm fix candidate available.
- Depends on affected @docusaurus/core (see its entry).
@docusaurus/plugin-google-gtag: critical; locked versions 3.10.2; affected range 3.8.0-canary-6324 - 3.10.2; npm fix candidate available.
- Depends on affected @docusaurus/core (see its entry).
@docusaurus/plugin-google-tag-manager: critical; locked versions 3.10.2; affected range 3.8.0-canary-6324 - 3.10.2; npm fix candidate available.
- Depends on affected @docusaurus/core (see its entry).
@docusaurus/plugin-sitemap: critical; locked versions 3.10.2; affected range 3.8.0-canary-6324 - 3.10.2; npm fix candidate available.
- Depends on affected @docusaurus/core (see its entry).
@docusaurus/plugin-svgr: critical; locked versions 3.10.2; affected range *; npm fix candidate available.
- Depends on affected @docusaurus/core (see its entry).
- Depends on affected @svgr/webpack (see its entry).
@docusaurus/preset-classic: critical; locked versions 3.10.2; affected range 3.8.0-canary-6324 - 3.10.2; npm fix candidate available.
- Depends on affected @docusaurus/core (see its entry).
- Depends on affected @docusaurus/plugin-content-blog (see its entry).
- Depends on affected @docusaurus/plugin-content-docs (see its entry).
- Depends on affected @docusaurus/plugin-content-pages (see its entry).
- Depends on affected @docusaurus/plugin-css-cascade-layers (see its entry).
- Depends on affected @docusaurus/plugin-debug (see its entry).
- Depends on affected @docusaurus/plugin-google-analytics (see its entry).
- Depends on affected @docusaurus/plugin-google-gtag (see its entry).
- Depends on affected @docusaurus/plugin-google-tag-manager (see its entry).
- Depends on affected @docusaurus/plugin-sitemap (see its entry).
- Depends on affected @docusaurus/plugin-svgr (see its entry).
- Depends on affected @docusaurus/theme-classic (see its entry).
- Depends on affected @docusaurus/theme-search-algolia (see its entry).
@docusaurus/theme-classic: critical; locked versions 3.10.2; affected range 3.8.0-canary-6324 - 3.10.2; npm fix candidate available.
- Depends on affected @docusaurus/core (see its entry).
- Depends on affected @docusaurus/plugin-content-blog (see its entry).
- Depends on affected @docusaurus/plugin-content-docs (see its entry).
- Depends on affected @docusaurus/plugin-content-pages (see its entry).
@docusaurus/theme-mermaid: critical; locked versions 3.10.2; affected range 3.8.0-canary-6324 - 4.0.0-canary-6810; npm fix candidate @docusaurus/theme-mermaid@3.7.0; requires breaking changes; manual review.
- Depends on affected @docusaurus/core (see its entry).
- Depends on affected @mermaid-js/layout-elk (see its entry).
@docusaurus/theme-search-algolia: critical; locked versions 3.10.2; affected range 3.8.0-canary-6324 - 3.10.2; npm fix candidate available.
- Depends on affected @docusaurus/core (see its entry).
- Depends on affected @docusaurus/plugin-content-docs (see its entry).
tinypool: critical; locked versions 1.1.1; affected range <=2.1.1; npm fix candidate @docusaurus/theme-mermaid@3.7.0; requires breaking changes; manual review.
- Tinypool: Prototype Pollution gadget in worker options leads to Remote Code Execution; critical; affected range <=2.1.0.
- Tinypool: Prototype Pollution Gadget to RCE in run() options; critical; affected range <2.1.2.
follow-redirects: high; locked versions 1.16.0; affected range 1.16.0 - 1.16.1; npm fix candidate available.
- follow-redirects array-form headers bypass cross-origin credential stripping; high; affected range >=1.16.0 <1.16.1.
- follow-redirects sensitiveHeaders regex escaping can expose credential headers; high; affected range >=1.16.0 <1.16.1.
- follow-redirects: Cross-realm sensitiveHeaders arrays are discarded and custom credentials can follow redirects; high; affected range >=1.16.0 <=1.16.1.
joi: high; locked versions 17.13.8; affected range 17.1.1 - 17.13.8; npm fix candidate available.
- joi: quadratic-time split in string().email({ multiple: true }) allows denial of service; high; affected range >=17.1.1 <17.13.9.
serialize-javascript: high; locked versions 6.0.2; affected range <=7.1.2; npm fix candidate @docusaurus/theme-mermaid@3.7.0; requires breaking changes; manual review.
- Serialize JavaScript is Vulnerable to RCE via RegExp.flags and Date.prototype.toISOString(); high; affected range <=7.0.2.
- Serialize JavaScript has CPU Exhaustion Denial of Service via crafted array-like objects; moderate; affected range >=5.0.0 <7.0.5.
- Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script at the end of a serialized function body; low; affected range <7.1.3.
@docusaurus/bundler: moderate; locked versions 3.10.2; affected range <=3.10.2; npm fix candidate @docusaurus/theme-mermaid@3.7.0; requires breaking changes; manual review.
- Depends on affected copy-webpack-plugin (see its entry).
- Depends on affected css-minimizer-webpack-plugin (see its entry).
copy-webpack-plugin: moderate; locked versions 11.0.0; affected range 6.1.1 - 13.0.1; npm fix candidate @docusaurus/theme-mermaid@3.7.0; requires breaking changes; manual review.
- Depends on affected serialize-javascript (see its entry).
css-minimizer-webpack-plugin: moderate; locked versions 5.0.1; affected range 1.1.4 - 7.0.4; npm fix candidate @docusaurus/theme-mermaid@3.7.0; requires breaking changes; manual review.
- Depends on affected serialize-javascript (see its entry).
minimatch: moderate; locked versions 3.1.5; affected range <11.0.1; npm fix candidate @docusaurus/theme-mermaid@3.7.0; requires breaking changes; manual review.
- minimatch has potential denial of service via globparts amplification; moderate; affected range <11.0.1.
serve-handler: moderate; locked versions 6.1.7; affected range >=1.1.0; npm fix candidate @docusaurus/theme-mermaid@3.7.0; requires breaking changes; manual review.
- Depends on affected minimatch (see its entry).
sockjs: moderate; locked versions 0.3.24; affected range >=0.3.17; npm fix candidate @docusaurus/theme-mermaid@3.7.0; requires breaking changes; manual review.
- Depends on affected uuid (see its entry).
uuid: moderate; locked versions 8.3.2; affected range <11.1.1; npm fix candidate @docusaurus/theme-mermaid@3.7.0; requires breaking changes; manual review.
- uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided; moderate; affected range <11.1.1.
webpack-dev-server: moderate; locked versions 5.2.7; affected range 2.0.0-beta - 5.2.7; npm fix candidate @docusaurus/theme-mermaid@3.7.0; requires breaking changes; manual review.
- Depends on affected sockjs (see its entry).
@mermaid-js/layout-elk: low; locked versions 0.1.9; affected range <=0.2.3; npm fix candidate @mermaid-js/layout-elk@1.0.1; requires breaking changes; manual review.
- Depends on affected mermaid (see its entry).
@svgr/plugin-svgo: low; locked versions 8.1.0; affected range >=5.5.0; npm fix candidate available.
- Depends on affected deepmerge (see its entry).
@svgr/webpack: low; locked versions 8.1.0; affected range >=5.5.0; npm fix candidate available.
- Depends on affected @svgr/plugin-svgo (see its entry).
deepmerge: low; locked versions 4.3.1; affected range >=4.2.0; npm fix candidate available.
- deepmerge mergeObject() allows prototype poisoning of returned objects; low; affected range >=4.2.0 <=4.3.1.
katex: low; locked versions 0.16.47; affected range 0.11.0 - 0.18.1; npm fix candidate @mermaid-js/layout-elk@1.0.1; requires breaking changes; manual review.
- KaTeX: Existing prototype pollution can bypass trust restrictions; low; affected range >=0.11.0 <0.18.2.
mermaid: low; locked versions 11.17.2; affected range 10.9.0-rc.1 - 12.1.0; npm fix candidate @mermaid-js/layout-elk@1.0.1; requires breaking changes; manual review.
- Depends on affected katex (see its entry).

Before

info: 0, low: 6, moderate: 11, high: 5, critical: 17, total: 39

@docusaurus/core: critical; locked versions 3.10.2; affected range *; npm fix candidate @docusaurus/theme-mermaid@3.7.0; requires breaking changes; manual review.
- Depends on affected @docusaurus/bundler (see its entry).
- Depends on affected serve-handler (see its entry).
- Depends on affected tinypool (see its entry).
- Depends on affected webpack-dev-server (see its entry).
@docusaurus/plugin-content-blog: critical; locked versions 3.10.2; affected range 3.8.0-canary-6324 - 3.10.2; npm fix candidate available.
- Depends on affected @docusaurus/core (see its entry).
@docusaurus/plugin-content-docs: critical; locked versions 3.10.2; affected range 3.8.0-canary-6324 - 3.10.2; npm fix candidate available.
- Depends on affected @docusaurus/core (see its entry).
@docusaurus/plugin-content-pages: critical; locked versions 3.10.2; affected range 3.8.0-canary-6324 - 3.10.2; npm fix candidate available.
- Depends on affected @docusaurus/core (see its entry).
@docusaurus/plugin-css-cascade-layers: critical; locked versions 3.10.2; affected range <=3.10.2; npm fix candidate available.
- Depends on affected @docusaurus/core (see its entry).
@docusaurus/plugin-debug: critical; locked versions 3.10.2; affected range 3.8.0-canary-6324 - 3.10.2; npm fix candidate available.
- Depends on affected @docusaurus/core (see its entry).
@docusaurus/plugin-google-analytics: critical; locked versions 3.10.2; affected range >=3.8.0-canary-6324; npm fix candidate available.
- Depends on affected @docusaurus/core (see its entry).
@docusaurus/plugin-google-gtag: critical; locked versions 3.10.2; affected range 3.8.0-canary-6324 - 3.10.2; npm fix candidate available.
- Depends on affected @docusaurus/core (see its entry).
@docusaurus/plugin-google-tag-manager: critical; locked versions 3.10.2; affected range 3.8.0-canary-6324 - 3.10.2; npm fix candidate available.
- Depends on affected @docusaurus/core (see its entry).
@docusaurus/plugin-sitemap: critical; locked versions 3.10.2; affected range 3.8.0-canary-6324 - 3.10.2; npm fix candidate available.
- Depends on affected @docusaurus/core (see its entry).
@docusaurus/plugin-svgr: critical; locked versions 3.10.2; affected range *; npm fix candidate available.
- Depends on affected @docusaurus/core (see its entry).
- Depends on affected @svgr/webpack (see its entry).
@docusaurus/preset-classic: critical; locked versions 3.10.2; affected range 3.8.0-canary-6324 - 3.10.2; npm fix candidate available.
- Depends on affected @docusaurus/core (see its entry).
- Depends on affected @docusaurus/plugin-content-blog (see its entry).
- Depends on affected @docusaurus/plugin-content-docs (see its entry).
- Depends on affected @docusaurus/plugin-content-pages (see its entry).
- Depends on affected @docusaurus/plugin-css-cascade-layers (see its entry).
- Depends on affected @docusaurus/plugin-debug (see its entry).
- Depends on affected @docusaurus/plugin-google-analytics (see its entry).
- Depends on affected @docusaurus/plugin-google-gtag (see its entry).
- Depends on affected @docusaurus/plugin-google-tag-manager (see its entry).
- Depends on affected @docusaurus/plugin-sitemap (see its entry).
- Depends on affected @docusaurus/plugin-svgr (see its entry).
- Depends on affected @docusaurus/theme-classic (see its entry).
- Depends on affected @docusaurus/theme-search-algolia (see its entry).
@docusaurus/theme-classic: critical; locked versions 3.10.2; affected range 3.8.0-canary-6324 - 3.10.2; npm fix candidate available.
- Depends on affected @docusaurus/core (see its entry).
- Depends on affected @docusaurus/plugin-content-blog (see its entry).
- Depends on affected @docusaurus/plugin-content-docs (see its entry).
- Depends on affected @docusaurus/plugin-content-pages (see its entry).
@docusaurus/theme-mermaid: critical; locked versions 3.10.2; affected range 3.8.0-canary-6324 - 4.0.0-canary-6810; npm fix candidate @docusaurus/theme-mermaid@3.7.0; requires breaking changes; manual review.
- Depends on affected @docusaurus/core (see its entry).
- Depends on affected @mermaid-js/layout-elk (see its entry).
@docusaurus/theme-search-algolia: critical; locked versions 3.10.2; affected range 3.8.0-canary-6324 - 3.10.2; npm fix candidate available.
- Depends on affected @docusaurus/core (see its entry).
- Depends on affected @docusaurus/plugin-content-docs (see its entry).
dompurify: critical; locked versions 3.4.16; affected range <=3.4.16; npm fix candidate available.
- DOMPurify SAFE_FOR_TEMPLATES bypass: split template expressions survive in attached shadow root content on DOM output modes; critical; affected range >=3.4.4 <=3.4.16.
- DOMPurify IN_PLACE: hook that removes a parent or sibling leaves the detached subtree's event handlers armed (incomplete fix for GHSA-p98j-92pf-mc4p); high; affected range <=3.4.16.
- DOMPurify: SMIL attributeName=href guard is skipped when PARSER_MEDIA_TYPE is application/xhtml+xml; low; affected range <=3.4.16.
tinypool: critical; locked versions 1.1.1; affected range <=2.1.1; npm fix candidate @docusaurus/theme-mermaid@3.7.0; requires breaking changes; manual review.
- Tinypool: Prototype Pollution gadget in worker options leads to Remote Code Execution; critical; affected range <=2.1.0.
- Tinypool: Prototype Pollution Gadget to RCE in run() options; critical; affected range <2.1.2.
body-parser: high; locked versions 1.20.8; affected range <1.20.9; npm fix candidate available.
- body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body; high; affected range <1.20.9.
follow-redirects: high; locked versions 1.16.0; affected range 1.16.0 - 1.16.1; npm fix candidate available.
- follow-redirects array-form headers bypass cross-origin credential stripping; high; affected range >=1.16.0 <1.16.1.
- follow-redirects sensitiveHeaders regex escaping can expose credential headers; high; affected range >=1.16.0 <1.16.1.
- follow-redirects: Cross-realm sensitiveHeaders arrays are discarded and custom credentials can follow redirects; high; affected range >=1.16.0 <=1.16.1.
joi: high; locked versions 17.13.8; affected range 17.1.1 - 17.13.8; npm fix candidate available.
- joi: quadratic-time split in string().email({ multiple: true }) allows denial of service; high; affected range >=17.1.1 <17.13.9.
launch-editor: high; locked versions 2.14.1; affected range <=2.14.1; npm fix candidate available.
- launch-editor: escapeCmdArgs() omits % escaping on Windows; moderate; affected range <=2.14.1.
- launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors; moderate; affected range <=2.14.1.
- launch-editor: fs.existsSync() existence check can be bypassed on Windows; high; affected range <=2.14.1.
serialize-javascript: high; locked versions 6.0.2; affected range <=7.1.2; npm fix candidate @docusaurus/theme-mermaid@3.7.0; requires breaking changes; manual review.
- Serialize JavaScript is Vulnerable to RCE via RegExp.flags and Date.prototype.toISOString(); high; affected range <=7.0.2.
- Serialize JavaScript has CPU Exhaustion Denial of Service via crafted array-like objects; moderate; affected range >=5.0.0 <7.0.5.
- Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script at the end of a serialized function body; low; affected range <7.1.3.
@docusaurus/bundler: moderate; locked versions 3.10.2; affected range <=3.10.2; npm fix candidate @docusaurus/theme-mermaid@3.7.0; requires breaking changes; manual review.
- Depends on affected copy-webpack-plugin (see its entry).
- Depends on affected css-minimizer-webpack-plugin (see its entry).
copy-webpack-plugin: moderate; locked versions 11.0.0; affected range 6.1.1 - 13.0.1; npm fix candidate @docusaurus/theme-mermaid@3.7.0; requires breaking changes; manual review.
- Depends on affected serialize-javascript (see its entry).
css-minimizer-webpack-plugin: moderate; locked versions 5.0.1; affected range 1.1.4 - 7.0.4; npm fix candidate @docusaurus/theme-mermaid@3.7.0; requires breaking changes; manual review.
- Depends on affected serialize-javascript (see its entry).
fast-uri: moderate; locked versions 3.1.8; affected range 3.0.0 - 3.1.8; npm fix candidate available.
- fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decoding; moderate; affected range >=3.0.0 <3.1.9.
- fast-uri vulnerable to improper path equivalence in relative reference normalization; low; affected range >=3.0.0 <3.1.9.
- fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalization; moderate; affected range >=3.1.3 <3.1.9.
- fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix references; low; affected range >=3.0.0 <3.1.9.
minimatch: moderate; locked versions 3.1.5; affected range <11.0.1; npm fix candidate @docusaurus/theme-mermaid@3.7.0; requires breaking changes; manual review.
- minimatch has potential denial of service via globparts amplification; moderate; affected range <11.0.1.
postcss-selector-parser: moderate; locked versions 6.1.4; affected range <6.1.5; npm fix candidate available.
- PostCSS: Quadratic complexity in flat selector parsing allows CPU exhaustion; moderate; affected range <6.1.5.
qs: moderate; locked versions 6.16.0; affected range 6.7.0 - 6.16.0; npm fix candidate available.
- qs : qs.stringify with arrayFormat 'comma' throws an uncaught TypeError on array elements carrying a non-callable own toString (DoS); moderate; affected range >=6.7.0 <=6.16.0.
serve-handler: moderate; locked versions 6.1.7; affected range >=1.1.0; npm fix candidate @docusaurus/theme-mermaid@3.7.0; requires breaking changes; manual review.
- Depends on affected minimatch (see its entry).
sockjs: moderate; locked versions 0.3.24; affected range >=0.3.17; npm fix candidate @docusaurus/theme-mermaid@3.7.0; requires breaking changes; manual review.
- Depends on affected uuid (see its entry).
uuid: moderate; locked versions 8.3.2; affected range <11.1.1; npm fix candidate @docusaurus/theme-mermaid@3.7.0; requires breaking changes; manual review.
- uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided; moderate; affected range <11.1.1.
webpack-dev-server: moderate; locked versions 5.2.6; affected range 2.0.0-beta - 5.2.7; npm fix candidate @docusaurus/theme-mermaid@3.7.0; requires breaking changes; manual review.
- Depends on affected sockjs (see its entry).
@mermaid-js/layout-elk: low; locked versions 0.1.9; affected range <=0.2.3; npm fix candidate @mermaid-js/layout-elk@1.0.1; requires breaking changes; manual review.
- Depends on affected mermaid (see its entry).
@svgr/plugin-svgo: low; locked versions 8.1.0; affected range >=5.5.0; npm fix candidate available.
- Depends on affected deepmerge (see its entry).
@svgr/webpack: low; locked versions 8.1.0; affected range >=5.5.0; npm fix candidate available.
- Depends on affected @svgr/plugin-svgo (see its entry).
deepmerge: low; locked versions 4.3.1; affected range >=4.2.0; npm fix candidate available.
- deepmerge mergeObject() allows prototype poisoning of returned objects; low; affected range >=4.2.0 <=4.3.1.
katex: low; locked versions 0.16.47; affected range 0.11.0 - 0.18.1; npm fix candidate @mermaid-js/layout-elk@1.0.1; requires breaking changes; manual review.
- KaTeX: Existing prototype pollution can bypass trust restrictions; low; affected range >=0.11.0 <0.18.2.
mermaid: low; locked versions 11.17.2; affected range 10.9.0-rc.1 - 12.1.0; npm fix candidate @mermaid-js/layout-elk@1.0.1; requires breaking changes; manual review.
- Depends on affected katex (see its entry).

Run configuration and audit evidence

website · npm

Routine upgrades disabled. Maintenance: 0 additional package updates (7 total).

Validation script: build · Maintenance: security-only · Routine direct upgrade scope: major

Run: 2026-11-02T08:54:33.383239+00:00

npm counts affected package entries, including propagated findings in parent packages. These are not counts of distinct advisories or demonstrated exploit paths.

Initial security fix returned exit 1; remaining findings or a tool error require manual review.

Candidate dependency files (SHA-256)

package.json: 368b1db0c6026d77436c167977eb5a113988fab1284d39624722a9877c974e2f
package-lock.json: f3b976ec78c7267909189a8a36680d873e62b97fadd93d3bc2f34c6100ad616e

Workflow run

Node dependency audit and upgrades

9c67764

github-actions Bot force-pushed the maintenance/node-security branch from 69abf63 to 9c67764 Compare November 2, 2026 08:55

github-actions Bot changed the title ~~Node security: 3 dependency updates, 3 security fixes~~ Node security: 7 dependency updates, 6 security fixes Nov 2, 2026

Navigation Menu

Repository navigation

Node security: 7 dependency updates, 6 security fixes - #283

Node security: 7 dependency updates, 6 security fixes#283
github-actions[bot] wants to merge 1 commit into
mainfrom
maintenance/node-security

github-actions Bot commented Oct 26, 2026 •

edited

Loading

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

github-actions Bot commented Oct 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Validation

Security status

Security fixes

Security findings and fixes

Remaining advisories

Before

Candidate dependency files (SHA-256)

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

github-actions Bot commented Oct 26, 2026 •

edited

Loading