build(deps): bump qs from 6.15.3 to 6.16.0 in /frontend - #120
Open
dependabot[bot] wants to merge 1 commit into
Open
build(deps): bump qs from 6.15.3 to 6.16.0 in /frontend#120dependabot[bot] wants to merge 1 commit into
dependabot[bot] wants to merge 1 commit into
Conversation
dependabot
Bot
added
dependencies
WolfTasks
pushed a commit
that referenced
this pull request
Sep 6, 2026
…26-14456) The backend-docker Trivy gate blocks on CVE-2026-14456 (HIGH) in openssl and libssl3 3.5.7-r0, shipped by the eclipse-temurin Alpine base layer. Alpine already ships the patched 3.5.8-r0, so extend the existing `apk upgrade` line rather than chasing a new base-image digest. Verified by building the image locally: before: openssl-3.5.7-r0 / libssl3-3.5.7-r0 after: openssl-3.5.8-r0 / libssl3-3.5.8-r0 Pre-existing failure, not introduced by the tomcat bump — backend-docker was already red on PRs #118 and #120. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
WolfTasks
pushed a commit
that referenced
this pull request
Sep 6, 2026
The frontend npm-audit gate blocks on GHSA-2v37-7h3g-55p8 (high): custom generators can loop indefinitely when size is zero. nanoid is a dev-only transitive of postcss (`^3.3.12`), so the 3.3.18 patch fits the existing range — no postcss major bump needed. `node .github/scripts/audit-gate.mjs` passes locally and `npm run build` is green. Also normalises a pre-existing drift: package-lock.json still carried project version 1.0.13 while package.json is at 1.0.15 (the v1.0.15 release bumped package.json only). package.json itself is untouched. Pre-existing failure, not introduced by the tomcat bump — frontend-build was already red on PR #120. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
WolfTasks
added a commit
that referenced
this pull request
Sep 6, 2026
…locks nightly + CI) (#123) * fix(security): bump tomcat-embed 10.1.55 -> 10.1.59 (3 CRITICAL CVEs) Nightly Trivy scan has been failing since 2026-09-03 on three CRITICAL auth-bypass CVEs in org.apache.tomcat.embed:tomcat-embed-core 10.1.55: CVE-2026-68525 FORM authentication bypass -> unauthorized resource access CVE-2026-65905 DIGEST authenticator replay -> authentication bypass CVE-2026-65182 security constraint bypass (improper access control) tomcat-embed-core is transitive-only (Spring Boot BOM -> starter-tomcat), so Dependabot's direct-only security update could not patch it and failed with security_update_dependency_not_found. Spring Boot 3.5.16 is already the latest 3.5.x and still pins 10.1.55, so a BOM property override is the fix -- same pattern as the existing jackson/logback/postgresql overrides. The advisories name 10.1.58 as the fixed version, but that release was never published to Maven Central (404); 10.1.59 is the first available release carrying the fixes. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(ci): upgrade openssl/libssl3 to 3.5.8-r0 in backend image (CVE-2026-14456) The backend-docker Trivy gate blocks on CVE-2026-14456 (HIGH) in openssl and libssl3 3.5.7-r0, shipped by the eclipse-temurin Alpine base layer. Alpine already ships the patched 3.5.8-r0, so extend the existing `apk upgrade` line rather than chasing a new base-image digest. Verified by building the image locally: before: openssl-3.5.7-r0 / libssl3-3.5.7-r0 after: openssl-3.5.8-r0 / libssl3-3.5.8-r0 Pre-existing failure, not introduced by the tomcat bump — backend-docker was already red on PRs #118 and #120. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(ci): bump nanoid 3.3.16 -> 3.3.18 (GHSA-2v37-7h3g-55p8) The frontend npm-audit gate blocks on GHSA-2v37-7h3g-55p8 (high): custom generators can loop indefinitely when size is zero. nanoid is a dev-only transitive of postcss (`^3.3.12`), so the 3.3.18 patch fits the existing range — no postcss major bump needed. `node .github/scripts/audit-gate.mjs` passes locally and `npm run build` is green. Also normalises a pre-existing drift: package-lock.json still carried project version 1.0.13 while package.json is at 1.0.15 (the v1.0.15 release bumped package.json only). package.json itself is untouched. Pre-existing failure, not introduced by the tomcat bump — frontend-build was already red on PR #120. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(ci): upgrade libssl3/libcrypto3 + libuuid in frontend image (9 HIGH CVEs) The frontend-docker Trivy gate blocks on nine HIGH CVEs in the nginx Alpine base layer: libuuid 2.42.1-r0 -> 2.42.3-r1 CVE-2026-78408/78409/78410, -76642, CVE-2026-53612/53613/53614 libssl3 3.5.7-r0 -> 3.5.8-r0 CVE-2026-14456 libcrypto3 3.5.7-r0 -> 3.5.8-r0 CVE-2026-14456 CVE-2026-14456 is the same openssl flaw already patched in backend/Dockerfile; Alpine names the packages differently in the nginx image (libcrypto3 rather than openssl). Extends the existing `apk upgrade` line, consistent with the libexpat / c-ares / curl entries already there. This gate was previously masked: frontend-docker depends on frontend-build, which was failing on the nanoid advisory, so the job was skipped rather than run. It was already red on PR #118. Verified by running the exact apk upgrade line against the pinned base image digest — all targets reached (libuuid resolves to 2.42.3-r1, newer than the 2.42.3-r0 named in the advisories). Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> --------- Co-authored-by: Wolfgang Kozian <kozian.wolfgang@gmail.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
dependabot
Bot
force-pushed
the
dependabot/npm_and_yarn/frontend/qs-6.16.0
branch
from
September 6, 2026 01:29
f0c676a to
2d47de0
Compare
Bumps [qs](https://github.com/ljharb/qs) from 6.15.3 to 6.16.0. - [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md) - [Commits](ljharb/qs@v6.15.3...v6.16.0) --- updated-dependencies: - dependency-name: qs dependency-version: 6.16.0 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
force-pushed
the
dependabot/npm_and_yarn/frontend/qs-6.16.0
branch
from
September 6, 2026 02:11
2d47de0 to
9ec5ccb
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps qs from 6.15.3 to 6.16.0.
Changelog
Sourced from qs's changelog.
Commits
bb9379ev6.16.062fd254[Fix] stringify: serialize Date values when a filter is provided8859c37[Fix]parse: enforcearrayLimiton comma groups under[]=when `throwOn...8079adc[Tests]parse: remove a test that pinned[]=comma groups escaping `array...d56f48c[Fix]parse: flatten a collection appended to an overflowed arraye83d321[Fix]utils:isBuffer: do not invoke a non-callableconstructor.isBuffer7e87a07[Dev Deps] update@ljharb/eslint-config,eslint9a76af2[Dev Deps] updateeslint,evalmd3a890d4[Dev Deps] updateeslint,evalmdb433a9b[Fix]stringify: do not letallowEmptyArraysskip cycle detection (or dro...