Build(deps-dev): Bump handlebars from 4.7.9 to 4.7.10

[dependabot]

Bumps handlebars from 4.7.9 to 4.7.10.

Release notes

Sourced from handlebars's releases.

v4.7.10

• security: Sanitize the source map URL when minifying - f37c599
• security: Iterate lazily in #each and strip whitespace in linear time - 812c226
• security: Escape <!-- and <script in precompiled output - 609d1b1 GHSA-xw65-4hp5-5hc7
• security: Don't trust special properties on context data - ceec388 GHSA-p8wg-vrv2-v86f
• security: Only compile partials that are template strings - c28ee7a
• security: Only dispatch known node types in the Compiler and Visitor - 7d501a5
• security: Validate AST values in the compiler instead of the parser - 703fdcc GHSA-8r5x-fm3f-whwj
• Clarify that --root does not restrict filesystem access - 0fcf25c
• Bump minimist to ^1.2.8 - ea8ed82
• Fix Ruby component publishing documentation - d069c1c
• Fix Composer component definition - 6714e07

Compatibility notes:

• {{#each}} iterates iterables such as Map, Set and generators lazily, like for...of, instead of copying them into an array first. Values added to the iterable while the block renders are now visited too.

Commits

Changelog

Sourced from handlebars's changelog.

v4.7.10 - October 5th, 2026

• security: Sanitize the source map URL when minifying - f37c599
• security: Iterate lazily in #each and strip whitespace in linear time - 812c226
• security: Escape <!-- and <script in precompiled output - 609d1b1 GHSA-xw65-4hp5-5hc7
• security: Don't trust special properties on context data - ceec388 GHSA-p8wg-vrv2-v86f
• security: Only compile partials that are template strings - c28ee7a
• security: Only dispatch known node types in the Compiler and Visitor - 7d501a5
• security: Validate AST values in the compiler instead of the parser - 703fdcc GHSA-8r5x-fm3f-whwj
• Clarify that --root does not restrict filesystem access - 0fcf25c
• Bump minimist to ^1.2.8 - ea8ed82
• Fix Ruby component publishing documentation - d069c1c
• Fix Composer component definition - 6714e07

Compatibility notes:

• {{#each}} iterates iterables such as Map, Set and generators lazily, like for...of, instead of copying them into an array first. Values added to the iterable while the block renders are now visited too.

Commits

Commits

• 45ce152 v4.7.10
• e47b236 Update release notes
• f37c599 Sanitize the source map URL when minifying
• 812c226 Iterate lazily in #each and strip whitespace in linear time
• 609d1b1 Escape <!-- and <script in precompiled output
• ceec388 Don't trust special properties on context data
• c28ee7a Only compile partials that are template strings
• 7d501a5 Only dispatch known node types in the Compiler and Visitor
• 703fdcc Validate AST values in the compiler instead of the parser
• 0fcf25c Clarify that --root does not restrict filesystem access
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[github-actions]

❌MegaLinter analysis: Error

Descriptor	Linter	Files	Fixed	Errors	Warnings	Elapsed time
✅ ACTION	actionlint	5		0	0	0.12s
❌ ACTION	zizmor	5		1	0	0.4s
❌ JAVASCRIPT	eslint	19		19	0	6.96s
✅ JAVASCRIPT	prettier	19		0	0	0.94s
✅ JSON	npm-package-json-lint	yes		no	no	0.51s
✅ JSON	prettier	29		0	0	1.17s
✅ MARKDOWN	markdownlint	10		0	0	0.4s
✅ REPOSITORY	betterleaks	yes		no	no	0.57s
✅ REPOSITORY	checkov	yes		no	no	16.4s
✅ REPOSITORY	gitleaks	yes		no	no	0.61s
✅ REPOSITORY	git_diff	yes		no	no	0.01s
❌ REPOSITORY	grype	yes		42	no	98.67s
❌ REPOSITORY	osv-scanner	yes		80	no	1.82s
✅ REPOSITORY	secretlint	yes		no	no	0.74s
✅ REPOSITORY	syft	yes		no	no	1.92s
❌ REPOSITORY	trivy	yes		1	no	17.02s
✅ REPOSITORY	trivy-sbom	yes		no	no	2.31s
✅ REPOSITORY	trufflehog	yes		no	no	24.51s
❌ TYPESCRIPT	eslint	108		26	0	6.99s
✅ TYPESCRIPT	prettier	108		0	0	2.19s
✅ YAML	prettier	25		0	0	0.63s
✅ YAML	yamllint	25		0	0	0.63s

Detailed Issues

❌ JAVASCRIPT / eslint - 19 errors

__fixtures__/javascript-esm/no-import/src/index.js
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/javascript-esm/no-import/src/index.js

__fixtures__/javascript-esm/no-import/src/main.js
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/javascript-esm/no-import/src/main.js

__fixtures__/javascript-esm/success/post/index.js
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/javascript-esm/success/post/index.js

__fixtures__/javascript-esm/success/post/main.js
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/javascript-esm/success/post/main.js

__fixtures__/javascript-esm/success/pre/index.js
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/javascript-esm/success/pre/index.js

__fixtures__/javascript-esm/success/pre/main.js
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/javascript-esm/success/pre/main.js

__fixtures__/javascript-esm/success/src/index.js
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/javascript-esm/success/src/index.js

__fixtures__/javascript-esm/success/src/main.js
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/javascript-esm/success/src/main.js

__fixtures__/javascript/no-export/src/index.js
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/javascript/no-export/src/index.js

__fixtures__/javascript/no-export/src/main.js
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/javascript/no-export/src/main.js

__fixtures__/javascript/no-import/src/index.js
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/javascript/no-import/src/index.js

__fixtures__/javascript/no-import/src/main.js
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/javascript/no-import/src/main.js

__fixtures__/javascript/success/post/index.js
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/javascript/success/post/index.js

__fixtures__/javascript/success/post/main.js
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/javascript/success/post/main.js

__fixtures__/javascript/success/pre/index.js
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/javascript/success/pre/index.js

__fixtures__/javascript/success/pre/main.js
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/javascript/success/pre/main.js

__fixtures__/javascript/success/src/index.js
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/javascript/success/src/index.js

__fixtures__/javascript/success/src/main.js
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/javascript/success/src/main.js

bin/local-action.js
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): bin/local-action.js

✖ 19 problems (19 errors, 0 warnings)

❌ TYPESCRIPT / eslint - 26 errors

has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript-esm/no-export/src/index.ts

__fixtures__/typescript-esm/no-export/src/main.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript-esm/no-export/src/main.ts

__fixtures__/typescript-esm/no-import/src/index.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript-esm/no-import/src/index.ts

__fixtures__/typescript-esm/no-import/src/main.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript-esm/no-import/src/main.ts

__fixtures__/typescript-esm/success/post/index.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript-esm/success/post/index.ts

__fixtures__/typescript-esm/success/post/main.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript-esm/success/post/main.ts

__fixtures__/typescript-esm/success/pre/index.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript-esm/success/pre/index.ts

__fixtures__/typescript-esm/success/pre/main.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript-esm/success/pre/main.ts

__fixtures__/typescript-esm/success/src/index.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript-esm/success/src/index.ts

__fixtures__/typescript-esm/success/src/main.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript-esm/success/src/main.ts

__fixtures__/typescript-esm/tsconfig-comments/src/index.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript-esm/tsconfig-comments/src/index.ts

__fixtures__/typescript-esm/tsconfig-comments/src/main.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript-esm/tsconfig-comments/src/main.ts

__fixtures__/typescript/no-import/src/index.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript/no-import/src/index.ts

__fixtures__/typescript/no-import/src/main.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript/no-import/src/main.ts

__fixtures__/typescript/success-yaml/post/index.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript/success-yaml/post/index.ts

__fixtures__/typescript/success-yaml/post/main.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript/success-yaml/post/main.ts

__fixtures__/typescript/success-yaml/pre/index.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript/success-yaml/pre/index.ts

__fixtures__/typescript/success-yaml/pre/main.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript/success-yaml/pre/main.ts

__fixtures__/typescript/success-yaml/src/index.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript/success-yaml/src/index.ts

__fixtures__/typescript/success-yaml/src/main.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript/success-yaml/src/main.ts

__fixtures__/typescript/success/post/index.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript/success/post/index.ts

__fixtures__/typescript/success/post/main.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript/success/post/main.ts

__fixtures__/typescript/success/pre/index.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript/success/pre/index.ts

__fixtures__/typescript/success/pre/main.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript/success/pre/main.ts

__fixtures__/typescript/success/src/index.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript/success/src/index.ts

__fixtures__/typescript/success/src/main.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript/success/src/main.ts

✖ 26 problems (26 errors, 0 warnings)

(Truncated to last 6666 characters out of 6769)

❌ REPOSITORY / grype - 42 errors

[0000]  WARN no explicit name and version provided for directory source, deriving artifact ID from the given path (which is not ideal) from=syft
NAME              INSTALLED  FIXED IN  TYPE  VULNERABILITY        SEVERITY  EPSS         RISK   
lodash            4.17.23    4.18.0    npm   GHSA-r5fr-rjxr-66jc  High      2.6% (85th)  2.0    
undici            7.24.4     7.28.0    npm   GHSA-vxpw-j846-p89q  High      0.8% (55th)  0.6    
brace-expansion   1.1.12     1.1.18    npm   GHSA-rgw5-rvv9-x895  High      0.6% (49th)  0.5    
brace-expansion   2.0.2      2.1.4     npm   GHSA-rgw5-rvv9-x895  High      0.6% (49th)  0.5    
brace-expansion   1.1.12     1.1.17    npm   GHSA-mh99-v99m-4gvg  High      0.6% (49th)  0.5    
brace-expansion   2.0.2      2.1.3     npm   GHSA-mh99-v99m-4gvg  High      0.6% (49th)  0.5    
undici            7.24.4     7.29.0    npm   GHSA-4cwx-7wf7-3272  High      0.6% (45th)  0.4    
undici            7.24.4     7.28.0    npm   GHSA-vmh5-mc38-953g  High      0.6% (45th)  0.4    
brace-expansion   1.1.12     1.1.13    npm   GHSA-f886-m6hf-6m8v  Medium    0.6% (48th)  0.4    
brace-expansion   2.0.2      2.0.3     npm   GHSA-f886-m6hf-6m8v  Medium    0.6% (48th)  0.4    
figlet            1.10.0     1.11.3    npm   GHSA-62ch-8vmq-8xm7  High      0.4% (33rd)  0.3    
undici            7.24.4     7.29.1    npm   GHSA-rfgv-xxqx-mfg5  High      0.4% (31st)  0.3    
undici            7.24.4     7.28.0    npm   GHSA-hm92-r4w5-c3mj  High      0.4% (31st)  0.3    
brace-expansion   1.1.12     1.1.19    npm   GHSA-6j4f-fj2g-mc7p  High      0.4% (27th)  0.3    
brace-expansion   1.1.12     1.1.20    npm   GHSA-qhr7-859c-m2p7  High      0.4% (27th)  0.3    
brace-expansion   2.0.2      2.1.5     npm   GHSA-6j4f-fj2g-mc7p  High      0.4% (27th)  0.3    
brace-expansion   2.0.2      2.1.6     npm   GHSA-qhr7-859c-m2p7  High      0.4% (27th)  0.3    
brace-expansion   1.1.12     1.1.16    npm   GHSA-3jxr-9vmj-r5cp  High      0.4% (28th)  0.3    
brace-expansion   2.0.2      2.1.2     npm   GHSA-3jxr-9vmj-r5cp  High      0.4% (28th)  0.3    
yaml              2.8.2      2.8.3     npm   GHSA-48c2-rrv3-qjmp  Medium    0.5% (43rd)  0.2    
lodash            4.17.23    4.18.0    npm   GHSA-f23m-r3pf-42rh  Medium    0.4% (32nd)  0.2    
undici            7.24.4     7.28.0    npm   GHSA-pr7r-676h-xcf6  Medium    0.4% (34th)  0.2    
undici            7.24.4     7.29.1    npm   GHSA-3xpg-4rpp-hhhm  Medium    0.4% (33rd)  0.2    
undici            7.24.4     7.29.0    npm   GHSA-jr45-8vmc-qm54  Medium    0.4% (32nd)  0.2    
undici            7.24.4     7.29.1    npm   GHSA-rx4f-c7p8-82vq  Medium    0.4% (29th)  0.2    
undici            7.24.4     7.29.1    npm   GHSA-pmjh-fq2x-6v4x  Medium    0.4% (28th)  0.2    
fast-xml-builder  1.1.4      1.1.7     npm   GHSA-5wm8-gmm8-39j9  High      0.3% (15th)  0.2    
undici            7.24.4     7.28.0    npm   GHSA-p88m-4jfj-68fv  Medium    0.3% (24th)  0.2    
undici            7.24.4     7.29.1    npm   GHSA-2jfj-6hjv-fm6j  Medium    0.3% (21st)  0.2    
brace-expansion   1.1.12     1.1.21    npm   GHSA-q2hr-2g5m-vwhr  Medium    0.3% (21st)  0.2    
brace-expansion   2.0.2      2.1.7     npm   GHSA-q2hr-2g5m-vwhr  Medium    0.3% (21st)  0.2    
fast-xml-parser   5.5.7      5.7.0     npm   GHSA-gh4j-gqv2-49f6  Medium    0.3% (18th)  0.2    
undici            7.24.4     7.29.1    npm   GHSA-w293-vg96-wgc3  High      0.1% (3rd)   0.1    
undici            7.24.4     7.29.0    npm   GHSA-v3r7-h72x-cjcm  Medium    0.2% (8th)   < 0.1  
undici            7.24.4     7.28.0    npm   GHSA-35p6-xmwp-9g52  Low       0.3% (17th)  < 0.1  
undici            7.24.4     7.29.0    npm   GHSA-m8rv-5g2x-5cg5  Medium    0.2% (8th)   < 0.1  
undici            7.24.4     7.29.0    npm   GHSA-8xcm-r25x-g524  Medium    0.2% (6th)   < 0.1  
undici            7.24.4     7.29.1    npm   GHSA-r53p-7pc4-xj5r  Low       0.2% (13th)  < 0.1  
undici            7.24.4     7.28.0    npm   GHSA-g8m3-5g58-fq7m  Low       0.2% (13th)  < 0.1  
undici            7.24.4     7.29.1    npm   GHSA-2gqq-gqf2-x968  Low       0.2% (8th)   < 0.1  
undici            7.24.4     7.29.1    npm   GHSA-8436-99hf-9mmv  Low       0.1% (1st)   < 0.1  
esbuild           0.27.3     0.28.1    npm   GHSA-g7r4-m6w7-qqqr  Low       N/A          N/A
[0098] ERROR discovered vulnerabilities at or above the severity threshold

❌ REPOSITORY / osv-scanner - 80 errors

.4   | 5.0.9         | package-lock.json |
| https://osv.dev/GHSA-vfj7-8cjw-p6xm | 8.7  | npm       | braces (dev)                   | 3.0.3   | --            | package-lock.json |
| https://osv.dev/GHSA-73wf-gq98-2v4g | 7.5  | npm       | browserslist (dev)             | 4.28.1  | 4.28.7        | package-lock.json |
| https://osv.dev/GHSA-c83g-rgw3-j3cx | 7.5  | npm       | browserslist (dev)             | 4.28.1  | 4.28.7        | package-lock.json |
| https://osv.dev/GHSA-g7r4-m6w7-qqqr | 2.5  | npm       | esbuild                        | 0.27.3  | 0.28.1        | package-lock.json |
| https://osv.dev/GHSA-5wm8-gmm8-39j9 | 8.7  | npm       | fast-xml-builder               | 1.1.4   | 1.1.7         | package-lock.json |
| https://osv.dev/GHSA-gh4j-gqv2-49f6 | 6.1  | npm       | fast-xml-parser                | 5.5.7   | 5.7.0         | package-lock.json |
| https://osv.dev/GHSA-62ch-8vmq-8xm7 | 8.2  | npm       | figlet                         | 1.10.0  | 1.11.3        | package-lock.json |
| https://osv.dev/GHSA-25h7-pfq9-p65f | 7.5  | npm       | flatted (dev)                  | 3.3.3   | 3.4.0         | package-lock.json |
| https://osv.dev/GHSA-rf6f-7fwh-wjgh | 8.9  | npm       | flatted (dev)                  | 3.3.3   | 3.4.2         | package-lock.json |
| https://osv.dev/GHSA-2883-xcg3-v3hh | 7.5  | npm       | js-yaml (dev)                  | 3.14.2  | 3.15.2        | package-lock.json |
| https://osv.dev/GHSA-52cp-r559-cp3m | 7.5  | npm       | js-yaml (dev)                  | 3.14.2  | 3.15.0        | package-lock.json |
| https://osv.dev/GHSA-5p4m-2wfm-xmqj | 7.5  | npm       | js-yaml (dev)                  | 3.14.2  | 3.15.1        | package-lock.json |
| https://osv.dev/GHSA-h67p-54hq-rp68 | 5.3  | npm       | js-yaml (dev)                  | 3.14.2  | 3.15.0        | package-lock.json |
| https://osv.dev/GHSA-2883-xcg3-v3hh | 7.5  | npm       | js-yaml (dev)                  | 4.1.1   | 4.3.2         | package-lock.json |
| https://osv.dev/GHSA-52cp-r559-cp3m | 7.5  | npm       | js-yaml (dev)                  | 4.1.1   | 4.3.0         | package-lock.json |
| https://osv.dev/GHSA-5p4m-2wfm-xmqj | 7.5  | npm       | js-yaml (dev)                  | 4.1.1   | 4.3.1         | package-lock.json |
| https://osv.dev/GHSA-h67p-54hq-rp68 | 5.3  | npm       | js-yaml (dev)                  | 4.1.1   | 4.2.0         | package-lock.json |
| https://osv.dev/GHSA-f23m-r3pf-42rh | 6.5  | npm       | lodash                         | 4.17.23 | 4.18.0        | package-lock.json |
| https://osv.dev/GHSA-r5fr-rjxr-66jc | 8.1  | npm       | lodash                         | 4.17.23 | 4.18.0        | package-lock.json |
| https://osv.dev/GHSA-3v7f-55p6-f55p | 5.3  | npm       | picomatch (dev)                | 2.3.1   | 2.3.2         | package-lock.json |
| https://osv.dev/GHSA-c2c7-rcm5-vvqj | 7.5  | npm       | picomatch (dev)                | 2.3.1   | 2.3.2         | package-lock.json |
| https://osv.dev/GHSA-3v7f-55p6-f55p | 5.3  | npm       | picomatch (dev)                | 4.0.3   | 4.0.4         | package-lock.json |
| https://osv.dev/GHSA-c2c7-rcm5-vvqj | 7.5  | npm       | picomatch (dev)                | 4.0.3   | 4.0.4         | package-lock.json |
| https://osv.dev/GHSA-hp3w-g68c-fv3c | 6.9  | npm       | sprintf-js (dev)               | 1.0.3   | --            | package-lock.json |
| https://osv.dev/GHSA-2gqq-gqf2-x968 | 3.7  | npm       | undici                         | 7.24.4  | 7.29.1        | package-lock.json |
| https://osv.dev/GHSA-2jfj-6hjv-fm6j | 6.5  | npm       | undici                         | 7.24.4  | 7.29.1        | package-lock.json |
| https://osv.dev/GHSA-35p6-xmwp-9g52 | 3.7  | npm       | undici                         | 7.24.4  | 7.28.0        | package-lock.json |
| https://osv.dev/GHSA-3xpg-4rpp-hhhm | 5.9  | npm       | undici                         | 7.24.4  | 7.29.1        | package-lock.json |
| https://osv.dev/GHSA-4cwx-7wf7-3272 | 7.4  | npm       | undici                         | 7.24.4  | 7.29.0        | package-lock.json |
| https://osv.dev/GHSA-8436-99hf-9mmv | 3.7  | npm       | undici                         | 7.24.4  | 7.29.1        | package-lock.json |
| https://osv.dev/GHSA-8xcm-r25x-g524 | 4.8  | npm       | undici                         | 7.24.4  | 7.29.0        | package-lock.json |
| https://osv.dev/GHSA-g8m3-5g58-fq7m | 3.7  | npm       | undici                         | 7.24.4  | 7.28.0        | package-lock.json |
| https://osv.dev/GHSA-hm92-r4w5-c3mj | 7.5  | npm       | undici                         | 7.24.4  | 7.28.0        | package-lock.json |
| https://osv.dev/GHSA-jr45-8vmc-qm54 | 5.9  | npm       | undici                         | 7.24.4  | 7.29.0        | package-lock.json |
| https://osv.dev/GHSA-m8rv-5g2x-5cg5 | 4.2  | npm       | undici                         | 7.24.4  | 7.29.0        | package-lock.json |
| https://osv.dev/GHSA-p88m-4jfj-68fv | 5.9  | npm       | undici                         | 7.24.4  | 7.28.0        | package-lock.json |
| https://osv.dev/GHSA-pmjh-fq2x-6v4x | 5.9  | npm       | undici                         | 7.24.4  | 7.29.1        | package-lock.json |
| https://osv.dev/GHSA-pr7r-676h-xcf6 | 5.9  | npm       | undici                         | 7.24.4  | 7.28.0        | package-lock.json |
| https://osv.dev/GHSA-r53p-7pc4-xj5r | 3.7  | npm       | undici                         | 7.24.4  | 7.29.1        | package-lock.json |
| https://osv.dev/GHSA-rfgv-xxqx-mfg5 | 7.5  | npm       | undici                         | 7.24.4  | 7.29.1        | package-lock.json |
| https://osv.dev/GHSA-rx4f-c7p8-82vq | 5.9  | npm       | undici                         | 7.24.4  | 7.29.1        | package-lock.json |
| https://osv.dev/GHSA-v3r7-h72x-cjcm | 4.8  | npm       | undici                         | 7.24.4  | 7.29.0        | package-lock.json |
| https://osv.dev/GHSA-vmh5-mc38-953g | 7.4  | npm       | undici                         | 7.24.4  | 7.28.0        | package-lock.json |
| https://osv.dev/GHSA-vxpw-j846-p89q | 7.5  | npm       | undici                         | 7.24.4  | 7.28.0        | package-lock.json |
| https://osv.dev/GHSA-w293-vg96-wgc3 | 7.4  | npm       | undici                         | 7.24.4  | 7.29.1        | package-lock.json |
| https://osv.dev/GHSA-w5hq-g745-h8pq | 7.5  | npm       | uuid (dev)                     | 8.3.2   | 11.1.1        | package-lock.json |
| https://osv.dev/GHSA-48c2-rrv3-qjmp | 4.3  | npm       | yaml                           | 2.8.2   | 2.8.3         | package-lock.json |
+-------------------------------------+------+-----------+--------------------------------+---------+---------------+-------------------+

(Truncated to last 6666 characters out of 11965)

❌ REPOSITORY / trivy - 1 error

│        │                   │                              ├──────────────────────────────────────────────────────────────┤
│                  │ CVE-2026-85014      │          │        │                   │                              │ undici: undici: Denial of Service via WebSocketStream        │
│                  │                     │          │        │                   │                              │ unclean close                                                │
│                  │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-85014                   │
│                  ├─────────────────────┤          │        │                   ├──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│                  │ CVE-2026-9678       │          │        │                   │ 7.28.0, 8.5.0                │ undici: Undici: Information disclosure due to improper       │
│                  │                     │          │        │                   │                              │ cache-control header parsing                                 │
│                  │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-9678                    │
│                  ├─────────────────────┤          │        │                   ├──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│                  │ CVE-2026-9679       │          │        │                   │ 6.27.0, 7.28.0, 8.5.0        │ undici: undici vulnerable to HTTP header injection via       │
│                  │                     │          │        │                   │                              │ Set-Cookie percent-decoding                                  │
│                  │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-9679                    │
│                  ├─────────────────────┼──────────┤        │                   │                              ├──────────────────────────────────────────────────────────────┤
│                  │ CVE-2026-11525      │ LOW      │        │                   │                              │ undici: undici: Weakening of cookie SameSite policy due to   │
│                  │                     │          │        │                   │                              │ incorrect parsing of...                                      │
│                  │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-11525                   │
│                  ├─────────────────────┤          │        │                   ├──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│                  │ CVE-2026-18540      │          │        │                   │ 6.28.1, 7.29.1, 8.10.2       │ undici: undici: HTTP response splitting via retry            │
│                  │                     │          │        │                   │                              │ interceptor                                                  │
│                  │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-18540                   │
│                  ├─────────────────────┤          │        │                   ├──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│                  │ CVE-2026-6733       │          │        │                   │ 6.27.0, 7.28.0, 8.5.0        │ undici: Undici: Response queue poisoning on reused           │
│                  │                     │          │        │                   │                              │ keep-alive sockets can lead to...                            │
│                  │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-6733                    │
│                  ├─────────────────────┤          │        │                   ├──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│                  │ CVE-2026-84947      │          │        │                   │ 7.29.1, 8.10.2               │ undici: Undici: Response truncation and connection           │
│                  │                     │          │        │                   │                              │ termination                                                  │
│                  │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-84947                   │
│                  ├─────────────────────┤          │        │                   │                              ├──────────────────────────────────────────────────────────────┤
│                  │ CVE-2026-85008      │          │        │                   │                              │ undici: undici: Integrity failure due to caching of unsafe   │
│                  │                     │          │        │                   │                              │ HTTP method responses...                                     │
│                  │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-85008                   │
├──────────────────┼─────────────────────┼──────────┤        ├───────────────────┼──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ yaml             │ CVE-2026-33532      │ MEDIUM   │        │ 2.8.2             │ 2.8.3, 1.10.3                │ yaml: yaml: Denial of Service via deeply nested YAML         │
│                  │                     │          │        │                   │                              │ document parsing                                             │
│                  │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-33532                   │
└──────────────────┴─────────────────────┴──────────┴────────┴───────────────────┴──────────────────────────────┴──────────────────────────────────────────────────────────────┘

📣 Notices:
  - Version 0.76.0 of Trivy is now available, current version is 0.71.2

To suppress version checks, run Trivy scans with the --skip-version-check flag

(Truncated to last 6666 characters out of 35341)

❌ ACTION / zizmor - 1 error

INFO zizmor: 🌈 zizmor v1.25.0
fatal: no audit was performed
'ref-confusion' audit failed on file://.github/workflows/codeql-analysis.yml

Caused by:
    0: error in 'ref-confusion' audit
    1: couldn't list branches for actions/checkout
    2: request error while accessing GitHub API
    3: HTTP status client error (401 Unauthorized) for url (https://github.com/actions/checkout.git/git-upload-pack)


[ACTION_ZIZMOR_ERROR_GITHUB_API_UNREACHABLE] Zizmor could not access a repository referenced by a `uses:` clause via the GitHub API (missing token, insufficient scope, or cross-repo private access).
To allow zizmor to authenticate with GITHUB_TOKEN (or a PAT with `Contents: read-only`), whitelist the variable in your .mega-linter.yml:
ACTION_ZIZMOR_UNSECURED_ENV_VARIABLES:
  - GITHUB_TOKEN
If the referenced workflow is in a private repo outside the current one, provide a PAT with cross-repo access instead of the default GITHUB_TOKEN, or run zizmor in offline mode.

Notices

📣 MegaLinter 9.5.0 is out! Discover the new features and security recommendations in the release announcement. (Skip this info by defining SECURITY_SUGGESTIONS: false)

See detailed reports in MegaLinter artifacts

Show us your support by starring ⭐ the repository