Build(deps): Bump fast-xml-builder from 1.1.4 to 1.3.1

[dependabot]

Bumps fast-xml-builder from 1.1.4 to 1.3.1.

Release notes

Sourced from fast-xml-builder's releases.

v1.3.1

What's Changed

• fix: preserve negative zero sign when stringifying values by @​rajanpanth in NaturalIntelligence/fast-xml-builder#22

New Contributors

• @​rajanpanth made their first contribution in NaturalIntelligence/fast-xml-builder#22

Full Changelog: NaturalIntelligence/fast-xml-builder@v1.3.0...v1.3.1

Changelog

Sourced from fast-xml-builder's changelog.

1.3.1 (2026-08-14)

• fix: preserve negative sign for zero (By rajanpanth)

1.3.0 (2026-07-11)

• upgrade:
  • xml-naming v0.3.0: cache support
  • PEM v1.6.2: sibling bug fix

1.2.1 (2026-07-03)

• fix: escape quotes in stopNode attribute values (By greymoth)
• fix: neutralize double hyphen in multi-key comment object (By spokodev)

1.2.0 (2026-05-08)

• Add support for sanitizeName option
• Support xml-naming for validating and sanitizing tag and attribute names

1.1.9 (2026-05-06)

• fix: format output for preserve order when indent by is set to empty string

1.1.8 (2026-05-05)

• fix: skip text property for PI tags
• improve typings

1.1.7 (2026--05-04)

• fix security issues when attribute value contains quotes

1.1.6 (2026--05-04)

• fix security issues related to comment
• skip comment with null value

1.1.5 (2026-04-17)

• fix security issues related to comment and cdata

1.1.4 (2026-03-16)

• support maxNestedTags option

1.1.3 (2026-03-13)

• declare Matcher & Expression as unknown so user is not forced to install path-expression-matcher

1.1.2 (2026-03-11)

• fix typings

1.1.1 (2026-03-11)

• upgrade path-expression-matcher to 1.1.3

1.1.0 (2026-03-10)

... (truncated)

Commits

• d7d1d7b 1.3.1
• c776d83 update for release
• e9e8db6 Merge pull request #22 from rajanpanth/fix/negative-zero-stringify
• 4db0657 fix: preserve negative zero sign when stringifying values
• a27584b npm publish github actions
• 11829bf 1.3.0
• 60774c1 browser bundle
• 740bd54 update dependency
• ed22f02 1.2.1
• 9dc1fc9 update release info
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for fast-xml-builder since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[github-actions]

❌MegaLinter analysis: Error

Descriptor	Linter	Files	Fixed	Errors	Warnings	Elapsed time
✅ ACTION	actionlint	5		0	0	0.15s
❌ ACTION	zizmor	5		1	0	0.4s
❌ JAVASCRIPT	eslint	19		19	0	10.38s
✅ JAVASCRIPT	prettier	19		0	0	0.57s
✅ JSON	npm-package-json-lint	yes		no	no	0.28s
✅ JSON	prettier	29		0	0	0.61s
✅ MARKDOWN	markdownlint	10		0	0	0.4s
✅ REPOSITORY	betterleaks	yes		no	no	0.68s
✅ REPOSITORY	checkov	yes		no	no	33.44s
✅ REPOSITORY	gitleaks	yes		no	no	1.08s
✅ REPOSITORY	git_diff	yes		no	no	0.02s
❌ REPOSITORY	grype	yes		25	no	70.92s
❌ REPOSITORY	osv-scanner	yes		49	no	2.12s
✅ REPOSITORY	secretlint	yes		no	no	0.77s
✅ REPOSITORY	syft	yes		no	no	3.53s
❌ REPOSITORY	trivy	yes		1	no	15.37s
✅ REPOSITORY	trivy-sbom	yes		no	no	2.87s
✅ REPOSITORY	trufflehog	yes		no	no	20.09s
❌ TYPESCRIPT	eslint	108		26	0	7.88s
✅ TYPESCRIPT	prettier	108		0	0	2.72s
✅ YAML	prettier	25		0	0	0.68s
✅ YAML	yamllint	25		0	0	0.82s

Detailed Issues

❌ JAVASCRIPT / eslint - 19 errors

__fixtures__/javascript-esm/no-import/src/index.js
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/javascript-esm/no-import/src/index.js

__fixtures__/javascript-esm/no-import/src/main.js
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/javascript-esm/no-import/src/main.js

__fixtures__/javascript-esm/success/post/index.js
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/javascript-esm/success/post/index.js

__fixtures__/javascript-esm/success/post/main.js
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/javascript-esm/success/post/main.js

__fixtures__/javascript-esm/success/pre/index.js
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/javascript-esm/success/pre/index.js

__fixtures__/javascript-esm/success/pre/main.js
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/javascript-esm/success/pre/main.js

__fixtures__/javascript-esm/success/src/index.js
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/javascript-esm/success/src/index.js

__fixtures__/javascript-esm/success/src/main.js
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/javascript-esm/success/src/main.js

__fixtures__/javascript/no-export/src/index.js
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/javascript/no-export/src/index.js

__fixtures__/javascript/no-export/src/main.js
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/javascript/no-export/src/main.js

__fixtures__/javascript/no-import/src/index.js
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/javascript/no-import/src/index.js

__fixtures__/javascript/no-import/src/main.js
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/javascript/no-import/src/main.js

__fixtures__/javascript/success/post/index.js
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/javascript/success/post/index.js

__fixtures__/javascript/success/post/main.js
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/javascript/success/post/main.js

__fixtures__/javascript/success/pre/index.js
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/javascript/success/pre/index.js

__fixtures__/javascript/success/pre/main.js
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/javascript/success/pre/main.js

__fixtures__/javascript/success/src/index.js
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/javascript/success/src/index.js

__fixtures__/javascript/success/src/main.js
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/javascript/success/src/main.js

bin/local-action.js
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): bin/local-action.js

✖ 19 problems (19 errors, 0 warnings)

❌ TYPESCRIPT / eslint - 26 errors

has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript-esm/no-export/src/index.ts

__fixtures__/typescript-esm/no-export/src/main.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript-esm/no-export/src/main.ts

__fixtures__/typescript-esm/no-import/src/index.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript-esm/no-import/src/index.ts

__fixtures__/typescript-esm/no-import/src/main.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript-esm/no-import/src/main.ts

__fixtures__/typescript-esm/success/post/index.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript-esm/success/post/index.ts

__fixtures__/typescript-esm/success/post/main.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript-esm/success/post/main.ts

__fixtures__/typescript-esm/success/pre/index.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript-esm/success/pre/index.ts

__fixtures__/typescript-esm/success/pre/main.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript-esm/success/pre/main.ts

__fixtures__/typescript-esm/success/src/index.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript-esm/success/src/index.ts

__fixtures__/typescript-esm/success/src/main.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript-esm/success/src/main.ts

__fixtures__/typescript-esm/tsconfig-comments/src/index.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript-esm/tsconfig-comments/src/index.ts

__fixtures__/typescript-esm/tsconfig-comments/src/main.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript-esm/tsconfig-comments/src/main.ts

__fixtures__/typescript/no-import/src/index.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript/no-import/src/index.ts

__fixtures__/typescript/no-import/src/main.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript/no-import/src/main.ts

__fixtures__/typescript/success-yaml/post/index.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript/success-yaml/post/index.ts

__fixtures__/typescript/success-yaml/post/main.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript/success-yaml/post/main.ts

__fixtures__/typescript/success-yaml/pre/index.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript/success-yaml/pre/index.ts

__fixtures__/typescript/success-yaml/pre/main.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript/success-yaml/pre/main.ts

__fixtures__/typescript/success-yaml/src/index.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript/success-yaml/src/index.ts

__fixtures__/typescript/success-yaml/src/main.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript/success-yaml/src/main.ts

__fixtures__/typescript/success/post/index.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript/success/post/index.ts

__fixtures__/typescript/success/post/main.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript/success/post/main.ts

__fixtures__/typescript/success/pre/index.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript/success/pre/index.ts

__fixtures__/typescript/success/pre/main.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript/success/pre/main.ts

__fixtures__/typescript/success/src/index.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript/success/src/index.ts

__fixtures__/typescript/success/src/main.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript/success/src/main.ts

✖ 26 problems (26 errors, 0 warnings)

(Truncated to last 6666 characters out of 6769)

❌ REPOSITORY / grype - 25 errors

[0000]  WARN no explicit name and version provided for directory source, deriving artifact ID from the given path (which is not ideal) from=syft
NAME             INSTALLED  FIXED IN  TYPE  VULNERABILITY        SEVERITY  EPSS         RISK   
lodash           4.17.23    4.18.0    npm   GHSA-r5fr-rjxr-66jc  High      2.6% (83rd)  2.0    
undici           7.24.4     7.28.0    npm   GHSA-vxpw-j846-p89q  High      0.8% (53rd)  0.6    
undici           7.24.4     7.28.0    npm   GHSA-vmh5-mc38-953g  High      0.5% (37th)  0.3    
brace-expansion  1.1.12     1.1.18    npm   GHSA-rgw5-rvv9-x895  High      0.4% (34th)  0.3    
brace-expansion  2.0.2      2.1.4     npm   GHSA-rgw5-rvv9-x895  High      0.4% (34th)  0.3    
undici           7.24.4     7.28.0    npm   GHSA-hm92-r4w5-c3mj  High      0.3% (27th)  0.3    
brace-expansion  1.1.12     1.1.17    npm   GHSA-mh99-v99m-4gvg  High      0.3% (26th)  0.3    
brace-expansion  2.0.2      2.1.3     npm   GHSA-mh99-v99m-4gvg  High      0.3% (26th)  0.3    
brace-expansion  1.1.12     1.1.13    npm   GHSA-f886-m6hf-6m8v  Medium    0.4% (35th)  0.2    
brace-expansion  2.0.2      2.0.3     npm   GHSA-f886-m6hf-6m8v  Medium    0.4% (35th)  0.2    
brace-expansion  1.1.12     1.1.16    npm   GHSA-3jxr-9vmj-r5cp  High      0.3% (27th)  0.2    
brace-expansion  2.0.2      2.1.2     npm   GHSA-3jxr-9vmj-r5cp  High      0.3% (27th)  0.2    
undici           7.24.4     7.29.0    npm   GHSA-4cwx-7wf7-3272  High      0.3% (25th)  0.2    
yaml             2.8.2      2.8.3     npm   GHSA-48c2-rrv3-qjmp  Medium    0.5% (38th)  0.2    
undici           7.24.4     7.28.0    npm   GHSA-pr7r-676h-xcf6  Medium    0.4% (29th)  0.2    
lodash           4.17.23    4.18.0    npm   GHSA-f23m-r3pf-42rh  Medium    0.3% (24th)  0.2    
undici           7.24.4     7.28.0    npm   GHSA-p88m-4jfj-68fv  Medium    0.3% (17th)  0.1    
fast-xml-parser  5.5.7      5.7.0     npm   GHSA-gh4j-gqv2-49f6  Medium    0.2% (15th)  0.1    
undici           7.24.4     7.29.0    npm   GHSA-jr45-8vmc-qm54  Medium    0.2% (14th)  0.1    
undici           7.24.4     7.29.0    npm   GHSA-8xcm-r25x-g524  Medium    0.2% (7th)   < 0.1  
undici           7.24.4     7.29.0    npm   GHSA-v3r7-h72x-cjcm  Medium    0.2% (6th)   < 0.1  
undici           7.24.4     7.28.0    npm   GHSA-g8m3-5g58-fq7m  Low       0.2% (15th)  < 0.1  
undici           7.24.4     7.28.0    npm   GHSA-35p6-xmwp-9g52  Low       0.2% (12th)  < 0.1  
undici           7.24.4     7.29.0    npm   GHSA-m8rv-5g2x-5cg5  Medium    0.2% (5th)   < 0.1  
esbuild          0.27.3     0.28.1    npm   GHSA-g7r4-m6w7-qqqr  Low       N/A          N/A
[0070] ERROR discovered vulnerabilities at or above the severity threshold

❌ REPOSITORY / osv-scanner - 49 errors

VSS | ECOSYSTEM | PACKAGE               | VERSION | FIXED VERSION | SOURCE            |
+-------------------------------------+------+-----------+-----------------------+---------+---------------+-------------------+
| https://osv.dev/GHSA-4x5r-pxfx-6jf8 | 3.2  | npm       | @babel/core (dev)     | 7.29.0  | 7.29.6        | package-lock.json |
| https://osv.dev/GHSA-3jxr-9vmj-r5cp | 7.7  | npm       | brace-expansion       | 1.1.12  | 1.1.16        | package-lock.json |
| https://osv.dev/GHSA-f886-m6hf-6m8v | 6.5  | npm       | brace-expansion       | 1.1.12  | 1.1.13        | package-lock.json |
| https://osv.dev/GHSA-mh99-v99m-4gvg | 7.5  | npm       | brace-expansion       | 1.1.12  | 1.1.17        | package-lock.json |
| https://osv.dev/GHSA-rgw5-rvv9-x895 | 7.5  | npm       | brace-expansion       | 1.1.12  | 1.1.18        | package-lock.json |
| https://osv.dev/GHSA-3jxr-9vmj-r5cp | 7.7  | npm       | brace-expansion       | 2.0.2   | 2.1.2         | package-lock.json |
| https://osv.dev/GHSA-f886-m6hf-6m8v | 6.5  | npm       | brace-expansion       | 2.0.2   | 2.0.3         | package-lock.json |
| https://osv.dev/GHSA-mh99-v99m-4gvg | 7.5  | npm       | brace-expansion       | 2.0.2   | 2.1.3         | package-lock.json |
| https://osv.dev/GHSA-rgw5-rvv9-x895 | 7.5  | npm       | brace-expansion       | 2.0.2   | 2.1.4         | package-lock.json |
| https://osv.dev/GHSA-3jxr-9vmj-r5cp | 7.7  | npm       | brace-expansion (dev) | 5.0.2   | 5.0.7         | package-lock.json |
| https://osv.dev/GHSA-f886-m6hf-6m8v | 6.5  | npm       | brace-expansion (dev) | 5.0.2   | 5.0.5         | package-lock.json |
| https://osv.dev/GHSA-jxxr-4gwj-5jf2 | 6.5  | npm       | brace-expansion (dev) | 5.0.2   | 5.0.6         | package-lock.json |
| https://osv.dev/GHSA-mh99-v99m-4gvg | 7.5  | npm       | brace-expansion (dev) | 5.0.2   | 5.0.8         | package-lock.json |
| https://osv.dev/GHSA-rgw5-rvv9-x895 | 7.5  | npm       | brace-expansion (dev) | 5.0.2   | 5.0.9         | package-lock.json |
| https://osv.dev/GHSA-3jxr-9vmj-r5cp | 7.7  | npm       | brace-expansion (dev) | 5.0.4   | 5.0.7         | package-lock.json |
| https://osv.dev/GHSA-f886-m6hf-6m8v | 6.5  | npm       | brace-expansion (dev) | 5.0.4   | 5.0.5         | package-lock.json |
| https://osv.dev/GHSA-jxxr-4gwj-5jf2 | 6.5  | npm       | brace-expansion (dev) | 5.0.4   | 5.0.6         | package-lock.json |
| https://osv.dev/GHSA-mh99-v99m-4gvg | 7.5  | npm       | brace-expansion (dev) | 5.0.4   | 5.0.8         | package-lock.json |
| https://osv.dev/GHSA-rgw5-rvv9-x895 | 7.5  | npm       | brace-expansion (dev) | 5.0.4   | 5.0.9         | package-lock.json |
| https://osv.dev/GHSA-g7r4-m6w7-qqqr | 2.5  | npm       | esbuild               | 0.27.3  | 0.28.1        | package-lock.json |
| https://osv.dev/GHSA-gh4j-gqv2-49f6 | 6.1  | npm       | fast-xml-parser       | 5.5.7   | 5.7.0         | package-lock.json |
| https://osv.dev/GHSA-25h7-pfq9-p65f | 7.5  | npm       | flatted (dev)         | 3.3.3   | 3.4.0         | package-lock.json |
| https://osv.dev/GHSA-rf6f-7fwh-wjgh | 8.9  | npm       | flatted (dev)         | 3.3.3   | 3.4.2         | package-lock.json |
| https://osv.dev/GHSA-52cp-r559-cp3m | 7.5  | npm       | js-yaml (dev)         | 3.14.2  | 3.15.0        | package-lock.json |
| https://osv.dev/GHSA-5p4m-2wfm-xmqj | 7.5  | npm       | js-yaml (dev)         | 3.14.2  | 3.15.1        | package-lock.json |
| https://osv.dev/GHSA-h67p-54hq-rp68 | 5.3  | npm       | js-yaml (dev)         | 3.14.2  | 3.15.0        | package-lock.json |
| https://osv.dev/GHSA-52cp-r559-cp3m | 7.5  | npm       | js-yaml (dev)         | 4.1.1   | 4.3.0         | package-lock.json |
| https://osv.dev/GHSA-5p4m-2wfm-xmqj | 7.5  | npm       | js-yaml (dev)         | 4.1.1   | 4.3.1         | package-lock.json |
| https://osv.dev/GHSA-h67p-54hq-rp68 | 5.3  | npm       | js-yaml (dev)         | 4.1.1   | 4.2.0         | package-lock.json |
| https://osv.dev/GHSA-f23m-r3pf-42rh | 6.5  | npm       | lodash                | 4.17.23 | 4.18.0        | package-lock.json |
| https://osv.dev/GHSA-r5fr-rjxr-66jc | 8.1  | npm       | lodash                | 4.17.23 | 4.18.0        | package-lock.json |
| https://osv.dev/GHSA-3v7f-55p6-f55p | 5.3  | npm       | picomatch (dev)       | 2.3.1   | 2.3.2         | package-lock.json |
| https://osv.dev/GHSA-c2c7-rcm5-vvqj | 7.5  | npm       | picomatch (dev)       | 2.3.1   | 2.3.2         | package-lock.json |
| https://osv.dev/GHSA-3v7f-55p6-f55p | 5.3  | npm       | picomatch (dev)       | 4.0.3   | 4.0.4         | package-lock.json |
| https://osv.dev/GHSA-c2c7-rcm5-vvqj | 7.5  | npm       | picomatch (dev)       | 4.0.3   | 4.0.4         | package-lock.json |
| https://osv.dev/GHSA-35p6-xmwp-9g52 | 3.7  | npm       | undici                | 7.24.4  | 7.28.0        | package-lock.json |
| https://osv.dev/GHSA-4cwx-7wf7-3272 | 7.4  | npm       | undici                | 7.24.4  | 7.29.0        | package-lock.json |
| https://osv.dev/GHSA-8xcm-r25x-g524 | 4.8  | npm       | undici                | 7.24.4  | 7.29.0        | package-lock.json |
| https://osv.dev/GHSA-g8m3-5g58-fq7m | 3.7  | npm       | undici                | 7.24.4  | 7.28.0        | package-lock.json |
| https://osv.dev/GHSA-hm92-r4w5-c3mj | 7.5  | npm       | undici                | 7.24.4  | 7.28.0        | package-lock.json |
| https://osv.dev/GHSA-jr45-8vmc-qm54 | 5.9  | npm       | undici                | 7.24.4  | 7.29.0        | package-lock.json |
| https://osv.dev/GHSA-m8rv-5g2x-5cg5 | 4.2  | npm       | undici                | 7.24.4  | 7.29.0        | package-lock.json |
| https://osv.dev/GHSA-p88m-4jfj-68fv | 5.9  | npm       | undici                | 7.24.4  | 7.28.0        | package-lock.json |
| https://osv.dev/GHSA-pr7r-676h-xcf6 | 5.9  | npm       | undici                | 7.24.4  | 7.28.0        | package-lock.json |
| https://osv.dev/GHSA-v3r7-h72x-cjcm | 4.8  | npm       | undici                | 7.24.4  | 7.29.0        | package-lock.json |
| https://osv.dev/GHSA-vmh5-mc38-953g | 7.4  | npm       | undici                | 7.24.4  | 7.28.0        | package-lock.json |
| https://osv.dev/GHSA-vxpw-j846-p89q | 7.5  | npm       | undici                | 7.24.4  | 7.28.0        | package-lock.json |
| https://osv.dev/GHSA-w5hq-g745-h8pq | 7.5  | npm       | uuid (dev)            | 8.3.2   | 11.1.1        | package-lock.json |
| https://osv.dev/GHSA-48c2-rrv3-qjmp | 4.3  | npm       | yaml                  | 2.8.2   | 2.8.3         | package-lock.json |
+-------------------------------------+------+-----------+-----------------------+---------+---------------+-------------------+

(Truncated to last 6666 characters out of 7211)

❌ REPOSITORY / trivy - 1 error

6-9697                    │
│                 ├─────────────────────┼──────────┤        │                   ├─────────────────────────────┼──────────────────────────────────────────────────────────────┤
│                 │ CVE-2026-14643      │ MEDIUM   │        │                   │ 7.29.0, 8.9.0               │ undici: undici: Cross-user information disclosure due to     │
│                 │                     │          │        │                   │                             │ improper Cache-Control directive parsing                     │
│                 │                     │          │        │                   │                             │ https://avd.aquasec.com/nvd/cve-2026-14643                   │
│                 ├─────────────────────┤          │        │                   ├─────────────────────────────┼──────────────────────────────────────────────────────────────┤
│                 │ CVE-2026-15157      │          │        │                   │ 6.28.0, 7.29.0, 8.9.0       │ undici: undici: HTTP header injection via unvalidated        │
│                 │                     │          │        │                   │                             │ blob-like body type property                                 │
│                 │                     │          │        │                   │                             │ https://avd.aquasec.com/nvd/cve-2026-15157                   │
│                 ├─────────────────────┤          │        │                   │                             ├──────────────────────────────────────────────────────────────┤
│                 │ CVE-2026-16728      │          │        │                   │                             │ undici: undici: Response desynchronization via retry         │
│                 │                     │          │        │                   │                             │ interceptor with mismatched Content-Length                   │
│                 │                     │          │        │                   │                             │ https://avd.aquasec.com/nvd/cve-2026-16728                   │
│                 ├─────────────────────┤          │        │                   │                             ├──────────────────────────────────────────────────────────────┤
│                 │ CVE-2026-16729      │          │        │                   │                             │ undici: Undici: Cookie attribute injection allows bypassing  │
│                 │                     │          │        │                   │                             │ security protections                                         │
│                 │                     │          │        │                   │                             │ https://avd.aquasec.com/nvd/cve-2026-16729                   │
│                 ├─────────────────────┤          │        │                   ├─────────────────────────────┼──────────────────────────────────────────────────────────────┤
│                 │ CVE-2026-9678       │          │        │                   │ 7.28.0, 8.5.0               │ undici: Undici: Information disclosure due to improper       │
│                 │                     │          │        │                   │                             │ cache-control header parsing                                 │
│                 │                     │          │        │                   │                             │ https://avd.aquasec.com/nvd/cve-2026-9678                    │
│                 ├─────────────────────┤          │        │                   ├─────────────────────────────┼──────────────────────────────────────────────────────────────┤
│                 │ CVE-2026-9679       │          │        │                   │ 6.27.0, 7.28.0, 8.5.0       │ undici: undici vulnerable to HTTP header injection via       │
│                 │                     │          │        │                   │                             │ Set-Cookie percent-decoding                                  │
│                 │                     │          │        │                   │                             │ https://avd.aquasec.com/nvd/cve-2026-9679                    │
│                 ├─────────────────────┼──────────┤        │                   │                             ├──────────────────────────────────────────────────────────────┤
│                 │ CVE-2026-11525      │ LOW      │        │                   │                             │ undici: undici: Weakening of cookie SameSite policy due to   │
│                 │                     │          │        │                   │                             │ incorrect parsing of...                                      │
│                 │                     │          │        │                   │                             │ https://avd.aquasec.com/nvd/cve-2026-11525                   │
│                 ├─────────────────────┤          │        │                   │                             ├──────────────────────────────────────────────────────────────┤
│                 │ CVE-2026-6733       │          │        │                   │                             │ undici: Undici: Response queue poisoning on reused           │
│                 │                     │          │        │                   │                             │ keep-alive sockets can lead to...                            │
│                 │                     │          │        │                   │                             │ https://avd.aquasec.com/nvd/cve-2026-6733                    │
├─────────────────┼─────────────────────┼──────────┤        ├───────────────────┼─────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ yaml            │ CVE-2026-33532      │ MEDIUM   │        │ 2.8.2             │ 2.8.3, 1.10.3               │ yaml: yaml: Denial of Service via deeply nested YAML         │
│                 │                     │          │        │                   │                             │ document parsing                                             │
│                 │                     │          │        │                   │                             │ https://avd.aquasec.com/nvd/cve-2026-33532                   │
└─────────────────┴─────────────────────┴──────────┴────────┴───────────────────┴─────────────────────────────┴──────────────────────────────────────────────────────────────┘

📣 Notices:
  - Version 0.74.0 of Trivy is now available, current version is 0.71.2

To suppress version checks, run Trivy scans with the --skip-version-check flag

(Truncated to last 6666 characters out of 23687)

❌ ACTION / zizmor - 1 error

INFO zizmor: 🌈 zizmor v1.25.0
fatal: no audit was performed
'ref-confusion' audit failed on file://.github/workflows/codeql-analysis.yml

Caused by:
    0: error in 'ref-confusion' audit
    1: couldn't list branches for actions/checkout
    2: request error while accessing GitHub API
    3: HTTP status client error (401 Unauthorized) for url (https://github.com/actions/checkout.git/git-upload-pack)


[ACTION_ZIZMOR_ERROR_GITHUB_API_UNREACHABLE] Zizmor could not access a repository referenced by a `uses:` clause via the GitHub API (missing token, insufficient scope, or cross-repo private access).
To allow zizmor to authenticate with GITHUB_TOKEN (or a PAT with `Contents: read-only`), whitelist the variable in your .mega-linter.yml:
ACTION_ZIZMOR_UNSECURED_ENV_VARIABLES:
  - GITHUB_TOKEN
If the referenced workflow is in a private repo outside the current one, provide a PAT with cross-repo access instead of the default GITHUB_TOKEN, or run zizmor in offline mode.

Notices

📣 MegaLinter 9.5.0 is out! Discover the new features and security recommendations in the release announcement. (Skip this info by defining SECURITY_SUGGESTIONS: false)

See detailed reports in MegaLinter artifacts

Show us your support by starring ⭐ the repository