chore(deps)(deps): bump the web-dependencies group in /web with 18 updates by dependabot[bot] · Pull Request #79 · PatrickFanella/subcults

dependabot · 2026-08-31T09:18:56Z

Bumps the web-dependencies group in /web with 18 updates:

Package	From	To
@fontsource/space-mono	`5.2.9`	`5.3.0`
i18next-browser-languagedetector	`8.2.0`	`8.2.1`
livekit-client	`2.16.0`	`2.22.1`
zustand	`5.0.9`	`5.0.15`
@playwright/test	`1.58.0`	`1.62.1`
@testing-library/react	`16.3.0`	`16.3.3`
@testing-library/user-event	`14.6.1`	`14.6.6`
@vitest/coverage-v8	`4.0.18`	`4.1.11`
@vitest/ui	`4.0.18`	`4.1.11`
autoprefixer	`10.4.22`	`10.5.4`
axe-core	`4.11.1`	`4.13.0`
eslint-plugin-react-hooks	`7.0.1`	`7.1.1`
eslint-plugin-react-refresh	`0.4.24`	`0.5.5`
msw	`2.12.7`	`2.15.0`
playwright	`1.58.0`	`1.62.1`
postcss	`8.5.6`	`8.5.26`
typescript-eslint	`8.49.0`	`8.68.0`
vitest	`4.0.18`	`4.1.11`

Updates @fontsource/space-mono from 5.2.9 to 5.3.0

Commits

See full diff in compare view

Updates i18next-browser-languagedetector from 8.2.0 to 8.2.1

Changelog

Sourced from i18next-browser-languagedetector's changelog.

8.2.1

Add missing typescript definition for hash options 33154

Commits

7164126 8.2.1
6df69c7 release
1ffa1cf Add missing typescript definition for hash options (#315)
697d89b Bump js-yaml (#313)
ce82da9 Bump lodash from 4.17.21 to 4.17.23 (#312)
d05fe5a fix url in readme
9d1d7d2 Bump tmp from 0.2.1 to 0.2.5 (#309)
32f0429 Bump cipher-base from 1.0.4 to 1.0.6 (#307)
9c0db8f Bump sha.js from 2.4.11 to 2.4.12 (#308)
3ad9ac5 Bump pbkdf2 from 3.1.2 to 3.1.3 (#306)
Additional commits viewable in compare view

Updates livekit-client from 2.16.0 to 2.22.1

Release notes

Sourced from livekit-client's releases.

v2.22.1

Patch Changes

Forward DisconnectReason to the ParticipantDisconnected event - #2055 (@seonghunYang)

chore: periodically log webrtc stats - #2064 (@lukasIO)

fix: enqueue signal requests until queue has been drained - #2061 (@lukasIO)

Add roomOptions.dataStream.maxPayloadByteLength to control max data stream size - #2060 (@1egoman)

chore: signalling state machine - #2046 (@lukasIO)

fix: catch unhandled ws signal errors - #2065 (@lukasIO)

Fix supportsAdaptiveStream always returning true by comparing typeof against the 'undefined' string. It now returns false in environments without ResizeObserver or IntersectionObserver. - #2059 (@mrpmohiburrahman)

Treat TokenSource JWTs without exp as expired, and still honor exp when nbf is absent - #2057 (@SashaMIT)

Convert internal exports to be external in examples/demo - #2067 (@1egoman)

v2.22.0

Minor Changes

introduce DevelopmentTokenServer and deprecate SandboxTokenServer - #2032 (@lukasIO)

Patch Changes

Decode text data streams without TextDecoder fatal mode for broader runtime support - #2037 (@JoelTowell)

fix: ensure buffered events are flushed on signal reconnection - #2043 (@lukasIO)

fix: cancel pending onTrack callbacks when subscription fails - #2019 (@lukasIO)

fix: match opus fmtp parameters by exact token and look up the opus codec case-insensitively when munging SDP - #2036 (@lukasIO)

Only run the TrackEvent.TimeSyncUpdate animation frame loop while something is subscribed to the event, and clear the frame handle when a track's monitor is stopped so the loop can be restarted - #2038 (@U-OK)

fix: emit TrackStreamStateChanged again by reading the previous stream state before overwriting it - #2039 (@tomkail)

Apply the resolved degradation preference to the backup codec's sender - #2040 (@xianshijing-lk)

Degradation preference is a property of the sender, not of the track, and a backup codec publishes over its own sender. Previously only the primary sender was configured, so the backup encoder resolved a preference implicitly and could adapt along a different axis than the primary.

fix: recover broken publish paths — act on local ConnectionQuality.Lost, recreate the peer connection when an ICE restart has no remote description, bound how long a transport may stay connecting, and reconnect (instead of disconnecting) on a detected connection state mismatch - #2030 (@lukasIO)

fix: enable Terser mangle.safari10 to fix scoping issues for variables in react-native - #2028 (@davidliu)

fix: ensure dd extension also for recvonly - #2052 (@lukasIO)

... (truncated)

Changelog

Sourced from livekit-client's changelog.

2.22.1

Patch Changes

Forward DisconnectReason to the ParticipantDisconnected event - #2055 (@seonghunYang)

chore: periodically log webrtc stats - #2064 (@lukasIO)

fix: enqueue signal requests until queue has been drained - #2061 (@lukasIO)

Add roomOptions.dataStream.maxPayloadByteLength to control max data stream size - #2060 (@1egoman)

chore: signalling state machine - #2046 (@lukasIO)

fix: catch unhandled ws signal errors - #2065 (@lukasIO)

Fix supportsAdaptiveStream always returning true by comparing typeof against the 'undefined' string. It now returns false in environments without ResizeObserver or IntersectionObserver. - #2059 (@mrpmohiburrahman)

Treat TokenSource JWTs without exp as expired, and still honor exp when nbf is absent - #2057 (@SashaMIT)

Convert internal exports to be external in examples/demo - #2067 (@1egoman)

2.22.0

Minor Changes

introduce DevelopmentTokenServer and deprecate SandboxTokenServer - #2032 (@lukasIO)

Patch Changes

Decode text data streams without TextDecoder fatal mode for broader runtime support - #2037 (@JoelTowell)

fix: ensure buffered events are flushed on signal reconnection - #2043 (@lukasIO)

fix: cancel pending onTrack callbacks when subscription fails - #2019 (@lukasIO)

fix: match opus fmtp parameters by exact token and look up the opus codec case-insensitively when munging SDP - #2036 (@lukasIO)

Only run the TrackEvent.TimeSyncUpdate animation frame loop while something is subscribed to the event, and clear the frame handle when a track's monitor is stopped so the loop can be restarted - #2038 (@U-OK)

fix: emit TrackStreamStateChanged again by reading the previous stream state before overwriting it - #2039 (@tomkail)

Apply the resolved degradation preference to the backup codec's sender - #2040 (@xianshijing-lk)

Degradation preference is a property of the sender, not of the track, and a backup codec publishes over its own sender. Previously only the primary sender was configured, so the backup encoder resolved a preference implicitly and could adapt along a different axis than the primary.

fix: recover broken publish paths — act on local ConnectionQuality.Lost, recreate the peer connection when an ICE restart has no remote description, bound how long a transport may stay connecting, and reconnect (instead of disconnecting) on a detected connection state mismatch - #2030 (@lukasIO)

fix: enable Terser mangle.safari10 to fix scoping issues for variables in react-native - #2028 (@davidliu)

... (truncated)

Commits

0b90d0c Version Packages (#2056)
9bfade5 fix: catch unhandled ws signal errors (#2065)
123d97a Address example imports being incorrect (#2067)
a515cc3 chore: periodically log webrtc stats (#2064)
f3732d1 fix: enqueue signal requests until queue has been drained (#2061)
33aadf8 Add roomOptions.dataStream.maxPayloadByteLength (#2060)
016cf1c chore: initial state machine plumbing (#2046)
99c2396 fix: compare typeof against 'undefined' string in supportsAdaptiveStream (#2059)
59aa068 fix: treat TokenSource JWTs without exp as expired (#2057)
0a2110d Forward DisconnectReason to ParticipantDisconnected event (#2055)
Additional commits viewable in compare view

Updates zustand from 5.0.9 to 5.0.15

Release notes

Sourced from zustand's releases.

v5.0.15

Fix some issues in devtools and persist middleware.

What's Changed

fix(devtools): correct V8 stack regex when source path contains spaces by @dai-shi with @Copilot in pmndrs/zustand#3531

fix(persist): clearStorage() should invalidate concurrent async rehydration by @dai-shi with @Copilot in pmndrs/zustand#3555

Full Changelog: pmndrs/zustand@v5.0.14...v5.0.15

v5.0.14

This release fixes a type issue in devtools.

What's Changed

fix(devtools): improve type inference for Devtools initializer by @dbritto-dev in pmndrs/zustand#3511

New Contributors

@TheSeydiCharyyev made their first contribution in pmndrs/zustand#3487

@brofrong made their first contribution in pmndrs/zustand#3496

@hyun907 made their first contribution in pmndrs/zustand#3506

Full Changelog: pmndrs/zustand@v5.0.13...v5.0.14

v5.0.13

This release includes an improvement in the devtools middleware.

What's Changed

refactor(devtools): remove duplicate module augmentation by @mahmoodhamdi in pmndrs/zustand#3443

fix(devtools): support Firefox/Safari stack format in findCallerName by @SBolsec in pmndrs/zustand#3469

New Contributors

@mahmoodhamdi made their first contribution in pmndrs/zustand#3443

@FelixEckl-vireq made their first contribution in pmndrs/zustand#3466

@KimHyeongRae0 made their first contribution in pmndrs/zustand#3471

@lstak made their first contribution in pmndrs/zustand#3483

@AlexRixten made their first contribution in pmndrs/zustand#3474

@SBolsec made their first contribution in pmndrs/zustand#3469

Full Changelog: pmndrs/zustand@v5.0.12...v5.0.13

v5.0.12

Two small fixes.

What's Changed

fix(persist): use latest state in post-rehydration callback by @Shohjahon-n in pmndrs/zustand#3391

fix(devtools): correct redux devtools config type extension by @grigoriy-reshetniak in pmndrs/zustand#3414

New Contributors

@pavan-sh made their first contribution in pmndrs/zustand#3378

@Copilot made their first contribution in pmndrs/zustand#3395

... (truncated)

Commits

2115efb v5.0.15
1f531ba chore(deps): update dev dependencies (#3560)
aa6d2a1 docs: add zustand-devtools-bridge (#3559)
3febf8c fix(persist): clearStorage() should invalidate concurrent async rehydration (...
f44cecc fix(devtools): correct V8 stack regex when source path contains spaces (#3531)
beca84e fix: update broken README links from docs/guides/ to docs/learn/guides/ (#3542)
038f496 docs(persist): clarify createJSONStorage behavior and warn about production u...
a1f685c docs: fix missing code highlights in tic-tac-toe tutorial (#3527)
07cee61 docs: fix missing highlight on setXIsNext line in tic-tac-toe tutorial (#3524)
566b5bf Fix dead link in README.md: update immer guide path (#3519)
Additional commits viewable in compare view

Updates @playwright/test from 1.58.0 to 1.62.1

Release notes

Sourced from @playwright/test's releases.

v1.62.1

Bug Fixes

#41989 [Regression]: tsconfig "extends" bare specifier isn't resolved via node_modules walk-up like tsc (fatal since 1.62)

#41998 [Regression]: directory-form tsconfig project references ("path": "../pkg") fail to resolve (fatal since 1.62)

#41985 Accessibility snapshot drops button name when text is nested inside spans with aria-hidden SVG

#42000 [Regression]: page.evaluate() arg of a branded primitive type (string & { brand }) no longer type-checks since 1.62

#42013 [BUG]Image-type actionable elements are not presented in the snapshot.

v1.62.0

🧱 New component testing model

Component testing moves to a stories and galleries model. A story wraps your component in one specific scenario — hard-coded props, mock data, providers — and a gallery page that you serve renders stories on demand. The new fixtures.mount() fixture navigates to the gallery, mounts a story by id, and returns a Locator scoped to the story's root element:
test('click should expand', async ({ mount }) => {
  const component = await mount('components/Expandable/Stateful');
  await component.getByRole('button').click();
  await expect(component.getByTestId('expanded')).toHaveValue('true');
});
Pass a story type as a template argument to type-check its props, and use update(props) / unmount() on the returned locator to re-render or tear down within a test.

🛑 Cancel operations with AbortSignal

Most operations and web-first assertions now accept a signal option that takes an AbortSignal, letting you cancel long-running actions, navigations, waits, and assertions:
const controller = new AbortController();
setTimeout(() => controller.abort(), 1000);
await page.getByRole('button', { name: 'Submit' }).click({ signal: controller.signal });
await expect(page.getByText('Done')).toBeVisible({ signal: controller.signal });
Providing a signal does not disable the default timeout; pass timeout: 0 to disable it.

🖼️ WebP screenshots

expect(page).toHaveScreenshot() and expect(locator).toHaveScreenshot() can now store snapshots in the WebP format — just give the snapshot a .webp name:
// Visual comparisons store the golden snapshot as lossless WebP.
await expect(page).toHaveScreenshot('homepage.webp');
// Standalone screenshots can trade quality for size with lossy WebP.
await page.screenshot({ path: 'homepage.webp', quality: 50 });
</tr></table>

... (truncated)

Commits

26a9e47 cherry-pick(#42043): docs: release notes for v1.62 Python, Java, and .NET (#4...
0a81d5d cherry-pick(#42040): docs(release-notes): mention the isolated headless clipb...
8376826 cherry-pick(#42034): fix(aria): keep icon-only clickable elements in ai snaps...
66c5cc9 chore: mark v1.62.1 (#42020)
9672bc3 cherry-pick(#42009): fix(types): support branded primitives in evaluate argum...
4325804 cherry-pick(#41988): fix(aria): preserve names from collapsed text contributors
9632f8e cherry-pick(#42005): fix(tsconfig): do not throw when "extends"/"references" ...
e3950d9 chore: mark v1.62.0 (#41981)
f07e0f7 cherry-pick(#41940): docs: release notes for v1.62 (#41967)
05a306c cherry-pick(#41964): Revert "feat(routeFromHar): add interceptAPIRequests opt...
Additional commits viewable in compare view

Updates @testing-library/react from 16.3.0 to 16.3.3

Release notes

Sourced from @testing-library/react's releases.

v16.3.3

16.3.3 (2026-08-27)

Bug Fixes

Avoid act() re-entrant when dispatching events (#1468) (20ce75f)

v16.3.2

16.3.2 (2026-01-19)

Bug Fixes

Update 'onCaughtError' type inference in 'RenderOptions' to work with React v19 (#1438) (f32bd1b)

v16.3.1

16.3.1 (2025-12-15)

Bug Fixes

Switch to trusted publishing (#1437) (a2d37ff)

Commits

20ce75f fix: Avoid act() re-entrant when dispatching events (#1468)
be9d81d docs: fix typos in comments and types (#1446)
f32bd1b fix: Update 'onCaughtError' type inference in 'RenderOptions' to work with Re...
a2d37ff fix: Switch to trusted publishing (#1437)
cd6a175 chore: fix action permissions (#1436)
22b8c28 chore: fix release (#1435)
d996673 chore: new release workflow (#1434)
205ce17 chore: fix typo in jest.config.js (#1427)
aba5740 [test] Fix tests for react@experimental (#1424)
590bc18 [test] Fix npm run typecheck (#1423)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @testing-library/react since your current version.

Updates @testing-library/user-event from 14.6.1 to 14.6.6

Release notes

Sourced from @testing-library/user-event's releases.

v14.6.6

14.6.6 (2026-08-22)

Bug Fixes

default pointer event pointerType to empty string instead of the string "undefined" (#1325) (71a5475)

v14.6.5

14.6.5 (2026-08-18)

Bug Fixes

tab retargeting if focus moved during keydown (#1296) (43efda7)

v14.6.4

14.6.4 (2026-08-11)

Bug Fixes

keyboard event repeat property (#1312) (d7e80e3)

v14.6.3

14.6.3 (2026-08-03)

Bug Fixes

release: manually release a patch version (#1321) (1d18b1f), closes #1317

v14.6.2

14.6.2 (2026-08-03)

Commits

71a5475 fix: default pointer event pointerType to empty string instead of the string ...
43efda7 fix: tab retargeting if focus moved during keydown (#1296)
d7e80e3 fix: keyboard event repeat property (#1312)
43d8e6c ci: remove broken npm backfill step (#1322)
1d18b1f fix(release): manually release a patch version (#1321)
232f3e6 docs: add migration note and clean up README badges (#1320)
83e2b22 ci: remove deprecated CodeSandbox CI (#1318)
e8da819 ci: publish to npm via OIDC trusted publishing (#1317)
13fa4bc ci: stop lint errors from blocking release (#1316)
c3cec18 chore(ci): make releases work with full git history (#1315)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @testing-library/user-event since your current version.

Updates @vitest/coverage-v8 from 4.0.18 to 4.1.11

Release notes

Sourced from @vitest/coverage-v8's releases.

v4.1.11

   🐞 Bug Fixes

Revive global concurrency limit for test lifecycle [backport to v4] - by @sheremet-va and @hi-ogawa in vitest-dev/vitest#10992 (5146d)

browser:

Encode iframeId in tester iframe URL [backport to v4] - by @sheremet-va, Pduhard and Claude Opus 4.8 in vitest-dev/vitest#10955 (10b2c)

Trigger playwright/chromium gc on lower disk availability [backport to v4] - by @hi-ogawa, Hiroshi Ogawa and OpenCode in vitest-dev/vitest#10951 (9851d)

mocker:

Restrict redirect mocks to the fs allowlist [backport to v4] - by @sheremet-va in vitest-dev/vitest#10974 (fe5a1)

    View changes on GitHub

v4.1.10

   🐞 Bug Fixes

browser: Check fs access in builtin commands [backport to v4] - by @hi-ogawa, Hiroshi Ogawa and OpenCode (claude-opus-4-8) in vitest-dev/vitest#10680 (5c18d)

vm: Fix external module resolve error with deps optimizer query for encoded URI [backport to v4] - by @SveLil and @hi-ogawa in vitest-dev/vitest#10661 (bae52)

    View changes on GitHub

v4.1.9

🐞 Bug Fixes

Fix importOriginal with optimizer and query import [backport to v4] - by Hiroshi Ogawa, David Harris, Codexand Vladimir in vitest-dev/vitest#10546 (a5180)

browser:

Wait for orchestrator readiness before resolving browser sessions [backport to v4] - by Vladimir and Séamus O'Connor in vitest-dev/vitest#10555 (7fb29)

Wait for iframe tester readiness before preparing [backport to v4] - by Vladimir and Séamus O'Connor in vitest-dev/vitest#10497 and vitest-dev/vitest#10556 (fbc62)

mocker:

Hoist vi.mock() for vite-plus/test imports [backport to v4] - by Hiroshi Ogawa, LongYinan, Claude Opus 4.8 and Vladimir in vitest-dev/vitest#10548 (2c955)

pool:

Prevent test run hang on worker crash [backport to v4] - by Ari Perkkiö and Jattioui Ismail in vitest-dev/vitest#10543 and vitest-dev/vitest#10564 (934b0)

View changes on GitHub

v4.1.8

   🐞 Bug Fixes

browser:

Disable client cdp API when allowWrite/allowExec: false [backport to v4] - by @hi-ogawa and Codex in vitest-dev/vitest#10450 (e4067)

Remove orphaned Playwright route when same module is mocked via multiple ids [backport to v4] - by @toxik and @Zelys-DFKH in vitest-dev/vitest#10474 (675b4)

    View changes on GitHub

v4.1.7

   🐞 Bug Fixes

runner: Limit concurrency per task branch in addition to per leaf callbacks (backport) - by @hi-ogawa in vitest-dev/vitest#10384 (4f0f2)

    View changes on GitHub

... (truncated)

Commits

9bd8d46 chore: release v4.1.11 (#10995)
db616d2 chore: release v4.1.10 (#10718)
a7a61e7 chore: release v4.1.9 (#10598)
e61f2dd chore: release v4.1.8
e4067b3 fix(browser): disable client cdp API when allowWrite/allowExec: false [ba...
a09d472 chore: release v4.1.7
a8fd24c chore: release v4.1.6
e399846 chore: release v4.1.5
ac04bac chore: release v4.1.4
2dc0d62 chore: release v4.1.3
Additional commits viewable in compare view

Updates @vitest/ui from 4.0.18 to 4.1.11

Release notes

Sourced from @vitest/ui's releases.

v4.1.11

   🐞 Bug Fixes

Revive global concurrency limit for test lifecycle [backport to v4] - by @sheremet-va and @hi-ogawa in vitest-dev/vitest#10992 (5146d)

browser:

Encode iframeId in tester iframe URL [backport to v4] - by @sheremet-va, Pduhard and Claude Opus 4.8 in vitest-dev/vitest#10955 (10b2c)

Trigger playwright/chromium gc on lower disk availability [backport to v4] - by @hi-ogawa, Hiroshi Ogawa and OpenCode in vitest-dev/vitest#10951 (9851d)

mocker:

Restrict redirect mocks to the fs allowlist [backport to v4] - by @sheremet-va in vitest-dev/vitest#10974 (fe5a1)

    View changes on GitHub

v4.1.10

   🐞 Bug Fixes

browser: Check fs access in builtin commands [backport to v4] - by @hi-ogawa, Hiroshi Ogawa and OpenCode (claude-opus-4-8) in vitest-dev/vitest#10680 (5c18d)

vm: Fix external module resolve error with deps optimizer query for encoded URI [backport to v4] - by @SveLil and @hi-ogawa in vitest-dev/vitest#10661 (bae52)

    View changes on GitHub

v4.1.9

🐞 Bug Fixes

Fix importOriginal with optimizer and query import [backport to v4] - by Hiroshi Ogawa, David Harris, Codexand Vladimir in vitest-dev/vitest#10546 (a5180)

browser:

Wait for orchestrator readiness before resolving browser sessions [backport to v4] - by Vladimir and Séamus O'Connor in vitest-dev/vitest#10555 (7fb29)

Wait for iframe tester readiness before preparing [backport to v4] - by Vladimir and Séamus O'Connor in vitest-dev/vitest#10497 and vitest-dev/vitest#10556 (fbc62)

mocker:

Hoist vi.mock() for vite-plus/test imports [backport to v4] - by Hiroshi Ogawa, LongYinan, Claude Opus 4.8 and Vladimir in vitest-dev/vitest#10548 (2c955)

pool:

Prevent test run hang on worker crash [backport to v4] - by Ari Perkkiö and Jattioui Ismail in vitest-dev/vitest#10543 and vitest-dev/vitest#10564 (934b0)

View changes on GitHub

v4.1.8

   🐞 Bug Fixes

browser:

Disable client cdp API when allowWrite/allowExec: false [backport to v4] - by @hi-ogawa and Codex in vitest-dev/vitest#10450 (e4067)

Remove orphaned Playwright route when same module is mocked via multiple ids [backport to v4] - by @toxik and @Zelys-DFKH in vitest-dev/vitest#10474 (675b4)

    View changes on GitHub

v4.1.7

   🐞 Bug Fixes

runner: Limit concurrency per task branch in addition to per leaf callbacks (backport) - by @hi-ogawa in vitest-dev/vitest#10384 (4f0f2)

    View changes on GitHub

... (truncated)

Commits

9bd8d46 chore: release v4.1.11 (#10995)
db616d2 chore: release v4.1.10 (#10718)
a7a61e7 chore: release v4.1.9 (#10598)
e61f2dd chore: release v4.1.8
a09d472 chore: release v4.1.7
a8fd24c chore: release v4.1.6
e399846 chore: release v4.1.5
596f739 fix: project color label on html reporter (#10142)
f1b1f6c fix(ui): fix jsx/tsx syntax highlight (#10152)
ac04bac chore: release v4.1.4
Additional commits viewable in compare view

Updates autoprefixer from 10.4.22 to 10.5.4

Release notes

Sourced from autoprefixer's releases.

10.5.4

Fixed prefixed rule duplication (by @xianjianlf2).

10.5.3

Fixed brackets and gradient parser (@alanturing881).

10.5.2

Moved -webkit-fill-available before -moz-available, so Firefox will use -webkit- version which is closer to stretch.

10.5.1

Fixed grid-areaDescription has been truncated

Bumps the web-dependencies group in /web with 18 updates: | Package | From | To | | --- | --- | --- | | [@fontsource/space-mono](https://github.com/fontsource/font-files/tree/HEAD/fonts/google/space-mono) | `5.2.9` | `5.3.0` | | [i18next-browser-languagedetector](https://github.com/i18next/i18next-browser-languageDetector) | `8.2.0` | `8.2.1` | | [livekit-client](https://github.com/livekit/client-sdk-js) | `2.16.0` | `2.22.1` | | [zustand](https://github.com/pmndrs/zustand) | `5.0.9` | `5.0.15` | | [@playwright/test](https://github.com/microsoft/playwright) | `1.58.0` | `1.62.1` | | [@testing-library/react](https://github.com/testing-library/react-testing-library) | `16.3.0` | `16.3.3` | | [@testing-library/user-event](https://github.com/testing-library/user-event) | `14.6.1` | `14.6.6` | | [@vitest/coverage-v8](https://github.com/vitest-dev/vitest/tree/HEAD/packages/coverage-v8) | `4.0.18` | `4.1.11` | | [@vitest/ui](https://github.com/vitest-dev/vitest/tree/HEAD/packages/ui) | `4.0.18` | `4.1.11` | | [autoprefixer](https://github.com/postcss/autoprefixer) | `10.4.22` | `10.5.4` | | [axe-core](https://github.com/dequelabs/axe-core) | `4.11.1` | `4.13.0` | | [eslint-plugin-react-hooks](https://github.com/facebook/react/tree/HEAD/packages/eslint-plugin-react-hooks) | `7.0.1` | `7.1.1` | | [eslint-plugin-react-refresh](https://github.com/ArnaudBarre/eslint-plugin-react-refresh) | `0.4.24` | `0.5.5` | | [msw](https://github.com/mswjs/msw) | `2.12.7` | `2.15.0` | | [playwright](https://github.com/microsoft/playwright) | `1.58.0` | `1.62.1` | | [postcss](https://github.com/postcss/postcss) | `8.5.6` | `8.5.26` | | [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint) | `8.49.0` | `8.68.0` | | [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `4.0.18` | `4.1.11` | Updates `@fontsource/space-mono` from 5.2.9 to 5.3.0 - [Changelog](https://github.com/fontsource/font-files/blob/main/CHANGELOG.md) - [Commits](https://github.com/fontsource/font-files/commits/HEAD/fonts/google/space-mono) Updates `i18next-browser-languagedetector` from 8.2.0 to 8.2.1 - [Changelog](https://github.com/i18next/i18next-browser-languageDetector/blob/master/CHANGELOG.md) - [Commits](i18next/i18next-browser-languageDetector@v8.2.0...v8.2.1) Updates `livekit-client` from 2.16.0 to 2.22.1 - [Release notes](https://github.com/livekit/client-sdk-js/releases) - [Changelog](https://github.com/livekit/client-sdk-js/blob/main/CHANGELOG.md) - [Commits](livekit/client-sdk-js@v2.16.0...v2.22.1) Updates `zustand` from 5.0.9 to 5.0.15 - [Release notes](https://github.com/pmndrs/zustand/releases) - [Commits](pmndrs/zustand@v5.0.9...v5.0.15) Updates `@playwright/test` from 1.58.0 to 1.62.1 - [Release notes](https://github.com/microsoft/playwright/releases) - [Commits](microsoft/playwright@v1.58.0...v1.62.1) Updates `@testing-library/react` from 16.3.0 to 16.3.3 - [Release notes](https://github.com/testing-library/react-testing-library/releases) - [Changelog](https://github.com/testing-library/react-testing-library/blob/main/CHANGELOG.md) - [Commits](testing-library/react-testing-library@v16.3.0...v16.3.3) Updates `@testing-library/user-event` from 14.6.1 to 14.6.6 - [Release notes](https://github.com/testing-library/user-event/releases) - [Changelog](https://github.com/testing-library/user-event/blob/main/CHANGELOG.md) - [Commits](testing-library/user-event@v14.6.1...v14.6.6) Updates `@vitest/coverage-v8` from 4.0.18 to 4.1.11 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.11/packages/coverage-v8) Updates `@vitest/ui` from 4.0.18 to 4.1.11 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.11/packages/ui) Updates `autoprefixer` from 10.4.22 to 10.5.4 - [Release notes](https://github.com/postcss/autoprefixer/releases) - [Changelog](https://github.com/postcss/autoprefixer/blob/main/CHANGELOG.md) - [Commits](postcss/autoprefixer@10.4.22...10.5.4) Updates `axe-core` from 4.11.1 to 4.13.0 - [Release notes](https://github.com/dequelabs/axe-core/releases) - [Changelog](https://github.com/dequelabs/axe-core/blob/develop/CHANGELOG.md) - [Commits](dequelabs/axe-core@v4.11.1...v4.13.0) Updates `eslint-plugin-react-hooks` from 7.0.1 to 7.1.1 - [Release notes](https://github.com/facebook/react/releases) - [Changelog](https://github.com/react/react/blob/main/packages/eslint-plugin-react-hooks/CHANGELOG.md) - [Commits](https://github.com/facebook/react/commits/eslint-plugin-react-hooks@7.1.1/packages/eslint-plugin-react-hooks) Updates `eslint-plugin-react-refresh` from 0.4.24 to 0.5.5 - [Release notes](https://github.com/ArnaudBarre/eslint-plugin-react-refresh/releases) - [Changelog](https://github.com/ArnaudBarre/eslint-plugin-react-refresh/blob/main/CHANGELOG.md) - [Commits](ArnaudBarre/eslint-plugin-react-refresh@v0.4.24...v0.5.5) Updates `msw` from 2.12.7 to 2.15.0 - [Release notes](https://github.com/mswjs/msw/releases) - [Changelog](https://github.com/mswjs/msw/blob/main/CHANGELOG.md) - [Commits](mswjs/msw@v2.12.7...v2.15.0) Updates `playwright` from 1.58.0 to 1.62.1 - [Release notes](https://github.com/microsoft/playwright/releases) - [Commits](microsoft/playwright@v1.58.0...v1.62.1) Updates `postcss` from 8.5.6 to 8.5.26 - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](postcss/postcss@8.5.6...8.5.26) Updates `typescript-eslint` from 8.49.0 to 8.68.0 - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.68.0/packages/typescript-eslint) Updates `vitest` from 4.0.18 to 4.1.11 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.11/packages/vitest) --- updated-dependencies: - dependency-name: "@fontsource/space-mono" dependency-version: 5.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: web-dependencies - dependency-name: i18next-browser-languagedetector dependency-version: 8.2.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: web-dependencies - dependency-name: livekit-client dependency-version: 2.22.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: web-dependencies - dependency-name: zustand dependency-version: 5.0.15 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: web-dependencies - dependency-name: "@playwright/test" dependency-version: 1.62.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: web-dependencies - dependency-name: "@testing-library/react" dependency-version: 16.3.3 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: web-dependencies - dependency-name: "@testing-library/user-event" dependency-version: 14.6.6 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: web-dependencies - dependency-name: "@vitest/coverage-v8" dependency-version: 4.1.11 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: web-dependencies - dependency-name: "@vitest/ui" dependency-version: 4.1.11 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: web-dependencies - dependency-name: autoprefixer dependency-version: 10.5.4 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: web-dependencies - dependency-name: axe-core dependency-version: 4.13.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: web-dependencies - dependency-name: eslint-plugin-react-hooks dependency-version: 7.1.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: web-dependencies - dependency-name: eslint-plugin-react-refresh dependency-version: 0.5.5 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: web-dependencies - dependency-name: msw dependency-version: 2.15.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: web-dependencies - dependency-name: playwright dependency-version: 1.62.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: web-dependencies - dependency-name: postcss dependency-version: 8.5.26 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: web-dependencies - dependency-name: typescript-eslint dependency-version: 8.68.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: web-dependencies - dependency-name: vitest dependency-version: 4.1.11 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: web-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-08-31T09:18:57Z

Labels

The following labels could not be found: frontend, npm, security. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

github-actions · 2026-08-31T09:25:54Z

NPM Vulnerability Scan Results - web

Severity	Count
Critical	0
High	8
Moderate	6
Low	1
Total	15

Click to see details

# npm audit report

@babel/core  <=7.29.0
@babel/core: Arbitrary File Read via sourceMappingURL Comment - https://github.com/advisories/GHSA-4x5r-pxfx-6jf8
fix available via `npm audit fix`
node_modules/@babel/core

@remix-run/router  1.3.0 - 1.23.2
Severity: moderate
React Router's same-origin redirect with path starting // causes open redirect via protocol-relative URL reinterpretation - https://github.com/advisories/GHSA-2j2x-hqr9-3h42
fix available via `npm audit fix`
node_modules/@remix-run/router
  react-router  6.0.0 - 7.17.0
  Depends on vulnerable versions of @remix-run/router
  node_modules/react-router
    react-router-dom  6.0.0-alpha.0 - 7.17.0
    Depends on vulnerable versions of @remix-run/router
    Depends on vulnerable versions of react-router
    node_modules/react-router-dom

ajv  <6.14.0
Severity: moderate
ajv has ReDoS when using `$data` option - https://github.com/advisories/GHSA-2g4f-4pwh-qvx6
fix available via `npm audit fix`
node_modules/ajv

brace-expansion  <=1.1.17
Severity: high
brace-expansion: Zero-step sequence causes process hang and memory exhaustion - https://github.com/advisories/GHSA-f886-m6hf-6m8v
brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups - https://github.com/advisories/GHSA-3jxr-9vmj-r5cp
brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash - https://github.com/advisories/GHSA-mh99-v99m-4gvg
brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation - https://github.com/advisories/GHSA-rgw5-rvv9-x895
fix available via `npm audit fix`
node_modules/brace-expansion

i18next-http-backend  <3.0.5
Severity: moderate
 i18next-http-backend has Path Traversal & URL Injection via Unsanitised lng/ns - https://github.com/advisories/GHSA-q89c-q3h5-w34g
fix available via `npm audit fix`
node_modules/i18next-http-backend

js-yaml  4.0.0 - 4.3.0
Severity: high
JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases - https://github.com/advisories/GHSA-h67p-54hq-rp68
js-yaml: YAML merge-key chains can force quadratic CPU consumption - https://github.com/advisories/GHSA-52cp-r559-cp3m
JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported - https://github.com/advisories/GHSA-5p4m-2wfm-xmqj
fix available via `npm audit fix`
node_modules/js-yaml

lodash-es  <=4.17.23
Severity: high
lodash vulnerable to Code Injection via `_.template` imports key names - https://github.com/advisories/GHSA-r5fr-rjxr-66jc
lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit` - https://github.com/advisories/GHSA-f23m-r3pf-42rh
fix available via `npm audit fix`
node_modules/lodash-es

minimatch  <=3.1.3
Severity: high
minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern - https://github.com/advisories/GHSA-3ppc-4f35-3m26
minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments - https://github.com/advisories/GHSA-7r86-cg39-jmmj
minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions - https://github.com/advisories/GHSA-23c5-xmqv-rm74
fix available via `npm audit fix`
node_modules/minimatch

picomatch  <=2.3.1 || 4.0.0 - 4.0.3
Severity: high
Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching - https://github.com/advisories/GHSA-3v7f-55p6-f55p
Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching - https://github.com/advisories/GHSA-3v7f-55p6-f55p
Picomatch has a ReDoS vulnerability via extglob quantifiers - https://github.com/advisories/GHSA-c2c7-rcm5-vvqj
Picomatch has a ReDoS vulnerability via extglob quantifiers - https://github.com/advisories/GHSA-c2c7-rcm5-vvqj
fix available via `npm audit fix`
node_modules/picomatch
node_modules/rollup-plugin-visualizer/node_modules/picomatch
node_modules/tinyglobby/node_modules/picomatch
node_modules/vite/node_modules/picomatch
node_modules/vitest/node_modules/picomatch

protocol-buffers-schema  <3.6.1
Severity: moderate
Mafintosh's protocol-buffers-schema is vulnerable to prototype pollution - https://github.com/advisories/GHSA-j452-xhg8-qg39
fix available via `npm audit fix`
node_modules/protocol-buffers-schema



rollup  4.0.0 - 4.58.0
Severity: high
Rollup 4 has Arbitrary File Write via Path Traversal - https://github.com/advisories/GHSA-mw96-cpmx-2vgc
fix available via `npm audit fix`
node_modules/rollup

vite  7.0.0 - 7.3.3
Severity: high
Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling - https://github.com/advisories/GHSA-4w7w-66w2-5vf9
Vite: `server.fs.deny` bypassed with queries - https://github.com/advisories/GHSA-v2wj-q39q-566r
Vite Vulnerable to Arbitrary File Read via Vite Dev Server WebSocket - https://github.com/advisories/GHSA-p9ff-h696-f583
launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows - https://github.com/advisories/GHSA-v6wh-96g9-6wx3
vite: `server.fs.deny` bypass on Windows alternate paths - https://github.com/advisories/GHSA-fx2h-pf6j-xcff
fix available via `npm audit fix`
node_modules/vite

ws  8.0.0 - 8.20.1
Severity: high
ws: Uninitialized memory disclosure - https://github.com/advisories/GHSA-58qx-3vcg-4xpx
ws: Memory exhaustion DoS from tiny fragments and data chunks - https://github.com/advisories/GHSA-96hv-2xvq-fx4p
fix available via `npm audit fix`
node_modules/ws

15 vulnerabilities (1 low, 6 moderate, 8 high)

To address all issues, run:
  npm audit fix

github-actions · 2026-08-31T09:28:08Z

Docker Image Scan Results - Dockerfile.api

Image: subcults-api:scan

Severity	Count
Critical	1
High	41
Medium	23
Low	1
Total	66

Click to see details


Report Summary

┌───────────────────────────────────┬──────────┬─────────────────┬─────────┐
│              Target               │   Type   │ Vulnerabilities │ Secrets │
├───────────────────────────────────┼──────────┼─────────────────┼─────────┤
│ subcults-api:scan (alpine 3.21.7) │  alpine  │        0        │    -    │
├───────────────────────────────────┼──────────┼─────────────────┼─────────┤
│ app/api                           │ gobinary │       66        │    -    │
└───────────────────────────────────┴──────────┴─────────────────┴─────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)


For OSS Maintainers: VEX Notice
--------------------------------
If you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement.
VEX allows you to communicate the actual status of vulnerabilities in your project, improving security transparency and reducing false positives for your users.
Learn more and start using VEX: https://trivy.dev/docs/v0.74/guide/supply-chain/vex/repo#publishing-vex-documents

To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable.


app/api (gobinary)
==================
Total: 66 (LOW: 1, MEDIUM: 23, HIGH: 41, CRITICAL: 1)

┌──────────────────────────────────────────────────────────────┬─────────────────────┬──────────┬────────┬───────────────────┬──────────────────────────────┬──────────────────────────────────────────────────────────────┐
│                           Library                            │    Vulnerability    │ Severity │ Status │ Installed Version │        Fixed Version         │                            Title                             │
├──────────────────────────────────────────────────────────────┼─────────────────────┼──────────┼────────┼───────────────────┼──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream        │ GHSA-xmrv-pmrh-hhx2 │ MEDIUM   │ fixed  │ v1.7.4            │ 1.7.8                        │ Denial of Service due to Panic in AWS SDK for Go v2...       │
│                                                              │                     │          │        │                   │                              │ https://github.com/advisories/GHSA-xmrv-pmrh-hhx2            │
├──────────────────────────────────────────────────────────────┤                     │          │        ├───────────────────┼──────────────────────────────┤                                                              │
│ github.com/aws/aws-sdk-go-v2/service/s3                      │                     │          │        │ v1.95.1           │ 1.97.3                       │                                                              │
│                                                              │                     │          │        │                   │                              │                                                              │
├──────────────────────────────────────────────────────────────┼─────────────────────┼──────────┤        ├───────────────────┼──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ github.com/go-jose/go-jose/v3                                │ CVE-2026-34986      │ HIGH     │        │ v3.0.4            │ 3.0.5                        │ github.com/go-jose/go-jose/v3:                               │
│                                                              │                     │          │        │                   │                              │ github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service    │
│                                                              │                     │          │        │                   │                              │ via crafted JSON Web Encryption...                           │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-34986                   │
├──────────────────────────────────────────────────────────────┼─────────────────────┼──────────┤        ├───────────────────┼──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ github.com/google/cel-go                                     │ GHSA-gcjh-h69q-9w9g │ MEDIUM   │        │ v0.26.1           │ 0.29.0                       │ cel-go: JSON Private Fields Exposed via NativeTypes and      │
│                                                              │                     │          │        │                   │                              │ ParseStructTag                                               │
│                                                              │                     │          │        │                   │                              │ https://github.com/advisories/GHSA-gcjh-h69q-9w9g            │
├──────────────────────────────────────────────────────────────┼─────────────────────┤          │        ├───────────────────┼──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ github.com/pion/dtls/v3                                      │ CVE-2026-26014      │          │        │ v3.0.7            │ 3.1.1, 3.0.11                │ github.com/pion/dtls: Pion DTLS uses random nonce generation │
│                                                              │                     │          │        │                   │                              │ with AES GCM ciphers risks...                                │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-26014                   │
│                                                              ├─────────────────────┤          │        │                   ├──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-54908      │          │        │                   │ 3.1.4                        │ Pion DTLS is a Go implementation of Datagram Transport Layer │
│                                                              │                     │          │        │                   │                              │ Security. ......                                             │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-54908                   │
├──────────────────────────────────────────────────────────────┼─────────────────────┤          │        ├───────────────────┼──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ github.com/pion/stun/v3                                      │ CVE-2026-54909      │          │        │ v3.0.1            │ 3.1.5                        │ pion/stun is a Go implementation of STUN. Prior to 3.1.3,    │
│                                                              │                     │          │        │                   │                              │ XORMappedAdd ......                                          │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-54909                   │
├──────────────────────────────────────────────────────────────┼─────────────────────┼──────────┤        ├───────────────────┼──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ go.opentelemetry.io/otel                                     │ CVE-2026-29181      │ HIGH     │        │ v1.38.0           │ 1.41.0                       │ github.com/open-telemetry/opentelemetry-go:                  │
│                                                              │                     │          │        │                   │                              │ OpenTelemetry-Go: Denial of Service via crafted multi-value  │
│                                                              │                     │          │        │                   │                              │ baggage headers                                              │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-29181                   │
├──────────────────────────────────────────────────────────────┼─────────────────────┼──────────┤        ├───────────────────┼──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptrace- │ CVE-2026-39882      │ MEDIUM   │        │ v1.24.0           │ 1.43.0                       │ github.com/open-telemetry/opentelemetry-go: golang:          │
│ http                                                         │                     │          │        │                   │                              │ OpenTelemetry-Go: Memory exhaustion via uncapped HTTP        │
│                                                              │                     │          │        │                   │                              │ response body reading                                        │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-39882                   │
├──────────────────────────────────────────────────────────────┼─────────────────────┼──────────┤        ├───────────────────┼──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ go.opentelemetry.io/otel/sdk                                 │ CVE-2026-24051      │ HIGH     │        │ v1.38.0           │ 1.40.0                       │ opentelemetry-go: OpenTelemetry-Go Affected by Arbitrary     │
│                                                              │                     │          │        │                   │                              │ Code Execution via PATH Hijacking                            │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-24051                   │
│                                                              ├─────────────────────┤          │        │                   ├──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-39883      │          │        │                   │ 1.43.0                       │ github.com/open-telemetry/opentelemetry-go:                  │
│                                                              │                     │          │        │                   │                              │ OpenTelemetry-Go: Arbitrary code execution via PATH          │
│                                                              │                     │          │        │                   │                              │ hijacking on BSD/Solaris                                     │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-39883                   │
├──────────────────────────────────────────────────────────────┼─────────────────────┤          │        ├───────────────────┼──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ golang.org/x/crypto                                          │ CVE-2026-39828      │          │        │ v0.45.0           │ 0.52.0                       │ golang.org/x/crypto/ssh: golang.org/x/crypto/ssh:            │
│                                                              │                     │          │        │                   │                              │ Unauthorized command execution via discarded SSH permissions │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-39828                   │
│                                                              ├─────────────────────┤          │        │                   │                              ├──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-39829      │          │        │                   │                              │ golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of  │
│                                                              │                     │          │        │                   │                              │ Service via crafted public key with excessive parameters...  │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-39829                   │
│                                                              ├─────────────────────┤          │        │                   │                              ├──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-39830      │          │        │                   │                              │ golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of  │
│                                                              │                     │          │        │                   │                              │ Service via resource leak from unsolicited SSH responses...  │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-39830                   │
│                                                              ├─────────────────────┤          │        │                   │                              ├──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-39831      │          │        │                   │                              │ golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Security   │
│                                                              │                     │          │        │                   │                              │ key bypass due to missing user presence check                │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-39831                   │
│                                                              ├─────────────────────┤          │        │                   │                              ├──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-39832      │          │        │                   │                              │ golang.org/x/crypto/ssh/agent:                               │
│                                                              │                     │          │        │                   │                              │ golang.org/x/crypto/ssh/agent: Security bypass due to        │
│                                                              │                     │          │        │                   │                              │ improper handling of key restrictions                        │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-39832                   │
│                                                              ├─────────────────────┤          │        │                   │                              ├──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-39835      │          │        │                   │                              │ golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh:    │
│                                                              │                     │          │        │                   │                              │ Denial of Service via crafted SSH certificate                │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-39835                   │
│                                                              ├─────────────────────┤          │        │                   │                              ├──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-42508      │          │        │                   │                              │ golang.org/x/crypto/ssh/knownhosts: golang:                  │
│                                                              │                     │          │        │                   │                              │ golang.org/x/crypto/ssh/knownhosts: Revocation bypass via    │
│                                                              │                     │          │        │                   │                              │ unchecked SignatureKey                                       │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-42508                   │
│                                                              ├─────────────────────┤          │        │                   │                              ├──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-46595      │          │        │                   │                              │ golang.org/x/crypto/ssh: golang.org/x/crypto/ssh:            │
│                                                              │                     │          │        │                   │                              │ Authorization bypass due to skipped source-address           │
│                                                              │                     │          │        │                   │                              │ validation                                                   │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-46595                   │
│                                                              ├─────────────────────┤          │        │                   │                              ├──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-46597      │          │        │                   │                              │ golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of  │
│                                                              │                     │          │        │                   │                              │ Service via crafted AES-GCM packet decoder inputs            │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-46597                   │
│                                                              ├─────────────────────┼──────────┤        │                   │                              ├──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-39827      │ MEDIUM   │        │                   │                              │ golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh:    │
│                                                              │                     │          │        │                   │                              │ Denial of Service via repeated rejected channel openings     │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-39827                   │
│                                                              ├─────────────────────┤          │        │                   │                              ├──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-39833      │          │        │                   │                              │ golang.org/x/crypto/ssh/agent:                               │
│                                                              │                     │          │        │                   │                              │ golang.org/x/crypto/ssh/agent: Security bypass due to        │
│                                                              │                     │          │        │                   │                              │ unenforced key confirmation                                  │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-39833                   │
│                                                              ├─────────────────────┤          │        │                   │                              ├──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-39834      │          │        │                   │                              │ golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh:    │
│                                                              │                     │          │        │                   │                              │ Denial of Service due to integer overflow in SSH...          │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-39834                   │
│                                                              ├─────────────────────┤          │        │                   │                              ├──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-46598      │          │        │                   │                              │ golang.org/x/crypto/ssh/agent: golang:                       │
│                                                              │                     │          │        │                   │                              │ golang.org/x/crypto/ssh/agent: Denial of Service via         │
│                                                              │                     │          │        │                   │                              │ malformed input                                              │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-46598                   │
├──────────────────────────────────────────────────────────────┼─────────────────────┼──────────┤        ├───────────────────┼──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ golang.org/x/mod                                             │ CVE-2026-56864      │ HIGH     │        │ v0.30.0           │ 0.40.0                       │ A malicious GOSUMDB was capable of serving arbitrary module  │
│                                                              │                     │          │        │                   │                              │ content no ......                                            │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-56864                   │
│                                                              ├─────────────────────┤          │        │                   │                              ├──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-56865      │          │        │                   │                              │ golang.org/x/mod/sumdb/tlog: golang.org/x/mod/sumdb/tlog:    │
│                                                              │                     │          │        │                   │                              │ Supply chain compromise via transparency log tile            │
│                                                              │                     │          │        │                   │                              │ verification bypass                                          │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-56865                   │
├──────────────────────────────────────────────────────────────┼─────────────────────┤          │        ├───────────────────┼──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ golang.org/x/net                                             │ CVE-2026-25681      │          │        │ v0.47.0           │ 0.55.0                       │ golang.org/x/net/html: golang.org/x/net/html: Arbitrary code │
│                                                              │                     │          │        │                   │                              │ execution via Cross-Site Scripting                           │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-25681                   │
│                                                              ├─────────────────────┤          │        │                   │                              ├──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-27136      │          │        │                   │                              │ golang.org/x/net/html: golang: golang.org/x/net/html:        │
│                                                              │                     │          │        │                   │                              │ Cross-Site Scripting via HTML parsing bypass                 │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-27136                   │
│                                                              ├─────────────────────┤          │        │                   ├──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-33814      │          │        │                   │ 0.53.0                       │ net/http/internal/http2: golang: golang.org/x/net: Go        │
│                                                              │                     │          │        │                   │                              │ HTTP/2: Denial of Service via malformed                      │
│                                                              │                     │          │        │                   │                              │ SETTINGS_MAX_FRAME_SIZE frame...                             │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-33814                   │
│                                                              ├─────────────────────┤          │        │                   ├──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-39821      │          │        │                   │ 0.55.0                       │ golang.org/x/net/idna: golang: net/http:                     │
│                                                              │                     │          │        │                   │                              │ golang.org/x/net/idna: Privilege escalation via incorrect    │
│                                                              │                     │          │        │                   │                              │ Punycode label processing                                    │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-39821                   │
│                                                              ├─────────────────────┤          │        │                   ├──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-46600      │          │        │                   │ 0.56.0                       │ golang.org/x/net/dns/dnsmessage:                             │
│                                                              │                     │          │        │                   │                              │ golang.org/x/net/dns/dnsmessage: Denial of Service via       │
│                                                              │                     │          │        │                   │                              │ invalid DNS record parsing                                   │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-46600                   │
│                                                              ├─────────────────────┼──────────┤        │                   ├──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-25680      │ MEDIUM   │        │                   │ 0.55.0                       │ golang.org/x/net/html: golang.org/x/net/html: Denial of      │
│                                                              │                     │          │        │                   │                              │ Service due to excessive HTML parsing                        │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-25680                   │
│                                                              ├─────────────────────┤          │        │                   │                              ├──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-42502      │          │        │                   │                              │ golang.org/x/net/html: golang: golang.org/x/net/html:        │
│                                                              │                     │          │        │                   │                              │ Cross-Site Scripting via unexpected HTML tree rendering      │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-42502                   │
│                                                              ├─────────────────────┤          │        │                   │                              ├──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-42506      │          │        │                   │                              │ golang.org/x/net/html: golang.org/x/net/html: Cross-Site     │
│                                                              │                     │          │        │                   │                              │ Scripting (XSS) via arbitrary HTML parsing                   │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-42506                   │
├──────────────────────────────────────────────────────────────┼─────────────────────┼──────────┤        ├───────────────────┼──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ golang.org/x/text                                            │ CVE-2026-56852      │ HIGH     │        │ v0.31.0           │ 0.39.0                       │ golang.org/x/text: golang.org/x/text: Denial of Service via  │
│                                                              │                     │          │        │                   │                              │ invalid UTF-8 input                                          │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-56852                   │
├──────────────────────────────────────────────────────────────┼─────────────────────┼──────────┤        ├───────────────────┼──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ google.golang.org/grpc                                       │ CVE-2026-33186      │ CRITICAL │        │ v1.77.0           │ 1.79.3                       │ google.golang.org/grpc/grpc-go:                              │
│                                                              │                     │          │        │                   │                              │ google.golang.org/grpc/authz: gRPC-Go: Authorization bypass  │
│                                                              │                     │          │        │                   │                              │ due to improper HTTP/2 path validation                       │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-33186                   │
│                                                              ├─────────────────────┼──────────┤        │                   ├──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│                                                              │ GHSA-hrxh-6v49-42gf │ HIGH     │        │                   │ 1.82.1                       │ gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities                 │
│                                                              │                     │          │        │                   │                              │ https://github.com/advisories/GHSA-hrxh-6v49-42gf            │
├──────────────────────────────────────────────────────────────┼─────────────────────┤          │        ├───────────────────┼──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ stdlib                                                       │ CVE-2026-25679      │          │        │ v1.24.13          │ 1.25.8, 1.26.1               │ net/url: Incorrect parsing of IPv6 host literals in net/url  │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-25679                   │
│                                                              ├─────────────────────┤          │        │                   ├──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-27145      │          │        │                   │ 1.25.11, 1.26.4              │ crypto/x509: golang: golang crypto/x509: Denial of Service   │
│                                                              │                     │          │        │                   │                              │ via excessive processing of DNS...                           │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-27145                   │
│                                                              ├─────────────────────┤          │        │                   ├──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-32280      │          │        │                   │ 1.25.9, 1.26.2               │ crypto/x509: crypto/tls: golang: Go: Denial of Service       │
│                                                              │                     │          │        │                   │                              │ vulnerability in certificate chain building...               │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-32280                   │
│                                                              ├─────────────────────┤          │        │                   │                              ├──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-32281      │          │        │                   │                              │ crypto/x509: golang: Go crypto/x509: Denial of Service via   │
│                                                              │                     │          │        │                   │                              │ inefficient certificate chain validation...                  │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-32281                   │
│                                                              ├─────────────────────┤          │        │                   │                              ├──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-32283      │          │        │                   │                              │ crypto/tls: golang: Go crypto/tls: Denial of Service via     │
│                                                              │                     │          │        │                   │                              │ multiple TLS 1.3 key...                                      │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-32283                   │
│                                                              ├─────────────────────┤          │        │                   ├──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-33811      │          │        │                   │ 1.25.10, 1.26.3              │ net: golang: Go net package: Denial of Service via long      │
│                                                              │                     │          │        │                   │                              │ CNAME response...                                            │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-33811                   │
│                                                              ├─────────────────────┤          │        │                   │                              ├──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-33814      │          │        │                   │                              │ net/http/internal/http2: golang: golang.org/x/net: Go        │
│                                                              │                     │          │        │                   │                              │ HTTP/2: Denial of Service via malformed                      │
│                                                              │                     │          │        │                   │                              │ SETTINGS_MAX_FRAME_SIZE frame...                             │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-33814                   │
│                                                              ├─────────────────────┤          │        │                   ├──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-33818      │          │        │                   │ 1.25.13, 1.26.6, 1.27.0-rc.3 │ encoding/asn1: golang: Go encoding/asn1: Denial of Service   │
│                                                              │                     │          │        │                   │                              │ via excessive recursion in Unmarshal...                      │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-33818                   │
│                                                              ├─────────────────────┤          │        │                   ├──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-39820      │          │        │                   │ 1.25.10, 1.26.3              │ net/mail: golang: Go net/mail: Denial of Service via crafted │
│                                                              │                     │          │        │                   │                              │ email inputs                                                 │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-39820                   │
│                                                              ├─────────────────────┤          │        │                   ├──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-39821      │          │        │                   │ 1.25.13, 1.26.6, 1.27.0-rc.3 │ golang.org/x/net/idna: golang: net/http:                     │
│                                                              │                     │          │        │                   │                              │ golang.org/x/net/idna: Privilege escalation via incorrect    │
│                                                              │                     │          │        │                   │                              │ Punycode label processing                                    │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-39821                   │
│                                                              ├─────────────────────┤          │        │                   ├──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-39822      │          │        │                   │ 1.25.12, 1.26.5, 1.27.0-rc.2 │ golang: Go os.Root: Symlink following vulnerability allows   │
│                                                              │                     │          │        │                   │                              │ directory traversal                                          │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-39822                   │
│                                                              ├─────────────────────┤          │        │                   ├──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-39836      │          │        │                   │ 1.25.10, 1.26.3              │ net: golang: Go net package: Denial of Service via NUL byte  │
│                                                              │                     │          │        │                   │                              │ in...                                                        │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-39836                   │
│                                                              ├─────────────────────┤          │        │                   │                              ├──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-42499      │          │        │                   │                              │ net/mail: golang: net/mail: Denial of Service via            │
│                                                              │                     │          │        │                   │                              │ pathological email address parsing                           │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-42499                   │
│                                                              ├─────────────────────┤          │        │                   ├──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-42504      │          │        │                   │ 1.25.11, 1.26.4              │ mime: golang: Golang MIME: Denial of Service via             │
│                                                              │                     │          │        │                   │                              │ maliciously-crafted MIME header                              │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-42504                   │
│                                                              ├─────────────────────┤          │        │                   ├──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-56853      │          │        │                   │ 1.25.13, 1.26.6, 1.27.0-rc.3 │ net/http: golang: Go net/http: Unencrypted HTTP/2            │
│                                                              │                     │          │        │                   │                              │ connections vulnerable to Denial of Service...               │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-56853                   │
│                                                              ├─────────────────────┤          │        │                   │                              ├──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-56858      │          │        │                   │                              │ html/template: golang: Go html/template: Cross-Site          │
│                                                              │                     │          │        │                   │                              │ Scripting via pathological input                             │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-56858                   │
│                                                              ├─────────────────────┤          │        │                   │                              ├──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-56859      │          │        │                   │                              │ encoding/xml: golang: Go: Denial of Service via XML decoding │
│                                                              │                     │          │        │                   │                              │ recursion depth issue...                                     │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-56859                   │
│                                                              ├─────────────────────┤          │        │                   │                              ├──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-56860      │          │        │                   │                              │ net/url: golang: golang net/url: Denial of Service from      │
│                                                              │                     │          │        │                   │                              │ quadratic complexity in path...                              │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-56860                   │
│                                                              ├─────────────────────┤          │        │                   │                              ├──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-56862      │          │        │                   │                              │ crypto/tls: golang: Golang crypto/tls: Denial of Service via │
│                                                              │                     │          │        │                   │                              │ indefinite KeyUpdate messages                                │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-56862                   │
│                                                              ├─────────────────────┼──────────┤        │                   ├──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-27142      │ MEDIUM   │        │                   │ 1.25.8, 1.26.1               │ html/template: URLs in meta content attribute actions are    │
│                                                              │                     │          │        │                   │                              │ not escaped in html/template...                              │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-27142                   │
│                                                              ├─────────────────────┤          │        │                   ├──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-32282      │          │        │                   │ 1.25.9, 1.26.2               │ golang: internal/syscall/unix: Root.Chmod can follow         │
│                                                              │                     │          │        │                   │                              │ symlinks out of the root                                     │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-32282                   │
│                                                              ├─────────────────────┤          │        │                   │                              ├──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-32288      │          │        │                   │                              │ archive/tar: golang: Go's archive/tar package: Denial of     │
│                                                              │                     │          │        │                   │                              │ Service via maliciously-crafted archive                      │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-32288                   │
│                                                              ├─────────────────────┤          │        │                   │                              ├──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-32289      │          │        │                   │                              │ html/template: golang: html/template: Cross-Site Scripting   │
│                                                              │                     │          │        │                   │                              │ (XSS) via improper context and brace depth...                │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-32289                   │
│                                                              ├─────────────────────┤          │        │                   ├──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-39823      │          │        │                   │ 1.25.10, 1.26.3              │ html/template: golang: Go html/template: Cross-Site          │
│                                                              │                     │          │        │                   │                              │ Scripting via improper URL escaping in meta...               │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-39823                   │
│                                                              ├─────────────────────┤          │        │                   │                              ├──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-39825      │          │        │                   │                              │ net/http/httputil: golang: net/http/httputil: ReverseProxy   │
│                                                              │                     │          │        │                   │                              │ forwards hidden query parameters, potentially bypassing      │
│                                                              │                     │          │        │                   │                              │ security controls...                                         │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-39825                   │
│                                                              ├─────────────────────┤          │        │                   │                              ├──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-39826      │          │        │                   │                              │ html/template: golang: html/template: Cross-site scripting   │
│                                                              │                     │          │        │                   │                              │ due to incorrect script tag escaping                         │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-39826                   │
│                                                              ├─────────────────────┤          │        │                   ├──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-42505      │          │        │                   │ 1.25.12, 1.26.5, 1.27.0-rc.2 │ crypto/tls: golang: Go crypto/tls: Information disclosure in │
│                                                              │                     │          │        │                   │                              │ Encrypted Client Hello                                       │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-42505                   │
│                                                              ├─────────────────────┤          │        │                   ├──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-42507      │          │        │                   │ 1.25.11, 1.26.4              │ net/textproto: golang: Golang net/textproto: Misleading      │
│                                                              │                     │          │        │                   │                              │ error messages via input injection                           │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-42507                   │
│                                                              ├─────────────────────┼──────────┤        │                   ├──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-27139      │ LOW      │        │                   │ 1.25.8, 1.26.1               │ os: FileInfo can escape from a Root in golang os module      │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-27139                   │
└──────────────────────────────────────────────────────────────┴─────────────────────┴──────────┴────────┴───────────────────┴──────────────────────────────┴──────────────────────────────────────────────────────────────┘

github-actions · 2026-08-31T09:30:10Z

Go Vulnerability Scan Results

Found 633 vulnerability/vulnerabilities

Details:

=== Symbol Results ===

Vulnerability #1: GO-2026-6218
Avoid quadratic complexity in resolvePath in net/url
More info: https://pkg.go.dev/vuln/GO-2026-6218
Standard library
Found in: net/url@go1.24.12
Fixed in: net/url@go1.25.13
Example traces found:
#1: internal/health/livekit.go:44:25: health.LiveKitChecker.HealthCheck calls http.Client.Do, which eventually calls url.URL.Parse

Vulnerability #2: GO-2026-6091
Fix Javascript regexp context tracking in html/template
More info: https://pkg.go.dev/vuln/GO-2026-6091
Standard library
Found in: html/template@go1.24.12
Fixed in: html/template@go1.25.13
Example traces found:
#1: cmd/api/main.go:1310:34: api.main calls http.Server.ListenAndServe, which eventually calls template.Template.Execute
#2: cmd/api/main.go:1310:34: api.main calls http.Server.ListenAndServe, which eventually calls template.Template.ExecuteTemplate

Vulnerability #3: GO-2026-6090
Limit handshake messages we are willing to accept post-handshake in
crypto/tls
More info: https://pkg.go.dev/vuln/GO-2026-6090
Standard library
Found in: crypto/tls@go1.24.12
Fixed in: crypto/tls@go1.25.13
Example traces found:
#1: internal/stream/quality_metrics_repository.go:209:15: stream.PostgresQualityMetricsRepository.GetParticipantsWithHighPacketLoss calls sql.Rows.Next, which eventually calls tls.Conn.Handshake
#2: internal/indexer/client.go:208:36: indexer.Client.connect calls websocket.Dialer.DialContext, which eventually calls tls.Conn.HandshakeContext
#3: internal/indexer/car.go:102:23: indexer.CARReader.ReadByte calls io.ReadFull, which eventually calls tls.Conn.Read
#4: examples/jwt-rotation-integration.go:45:12: examples.main calls fmt.Printf, which eventually calls tls.Conn.Write
#5: cmd/api/main.go:345:32: api.main calls redis.NewClient, which eventually calls tls.DialWithDialer
#6: internal/health/livekit.go:44:25: health.LiveKitChecker.HealthCheck calls http.Client.Do, which eventually calls tls.Dialer.DialContext

Vulnerability #4: GO-2026-6089
Apply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/http
More info: https://pkg.go.dev/vuln/GO-2026-6089
Standard library
Found in: net/http@go1.24.12
Fixed in: net/http@go1.25.13
Example traces found:
#1: cmd/api/main.go:1310:34: api.main calls http.Server.ListenAndServe

Vulnerability #5: GO-2026-6088
Add recursion depth guard during decode in encoding/xml
More info: https://pkg.go.dev/vuln/GO-2026-6088
Standard library
Found in: encoding/xml@go1.24.12
Fixed in: encoding/xml@go1.25.13
Example traces found:
#1: internal/upload/service.go:204:55: upload.Service.GenerateSignedURL calls s3.PresignClient.PresignPutObject, which eventually calls xml.Decoder.Decode
#2: internal/upload/service.go:204:55: upload.Service.GenerateSignedURL calls s3.PresignClient.PresignPutObject, which eventually calls xml.Decoder.Skip
#3: internal/upload/service.go:204:55: upload.Service.GenerateSignedURL calls s3.PresignClient.PresignPutObject, which eventually calls xml.Decoder.Token

Vulnerability #6: GO-2026-6061
Vulnerabilities in the xDS RBAC authorization engine and the HTTP/2
transport server implementation in google.golang.org/grpc
More info: https://pkg.go.dev/vuln/GO-2026-6061
Module: google.golang.org/grpc
Found in: google.golang.org/grpc@v1.77.0
Fixed in: google.golang.org/grpc@v1.82.1
Example traces found:
#1: internal/tracing/tracing.go:111:23: tracing.NewProvider calls trace.WithBatcher, which eventually calls transport.ClientStream.Close
#2: internal/tracing/tracing.go:111:23: tracing.NewProvider calls trace.WithBatcher, which eventually calls transport.ClientStream.Header
#3: internal/tracing/tracing.go:111:23: tracing.NewProvider calls trace.WithBatcher, which eventually calls transport.ClientStream.Read
#4: internal/tracing/tracing.go:111:23: tracing.NewProvider calls trace.WithBatcher, which eventually calls transport.ClientStream.RecvCompress
#5: internal/tracing/tracing.go:111:23: tracing.NewProvider calls trace.WithBatcher, which eventually calls transport.ClientStream.TrailersOnly
#6: internal/tracing/tracing.go:111:23: tracing.NewProvider calls trace.WithBatcher, which eventually calls transport.ClientStream.Write
#7: internal/tracing/tracing.go:225:25: tracing.Provider.Shutdown calls trace.TracerProvider.Shutdown, which eventually calls transport.NewHTTP2Client
#8: internal/tracing/tracing.go:111:23: tracing.NewProvider calls trace.WithBatcher, which eventually calls transport.Stream.ReadMessageHeader
#9: internal/tracing/tracing.go:225:25: tracing.Provider.Shutdown calls trace.TracerProvider.Shutdown, which eventually calls transport.http2Client.Close
#10: internal/tracing/tracing.go:225:25: tracing.Provider.Shutdown calls trace.TracerProvider.Shutdown, which eventually calls transport.http2Client.GracefulClose
#11: internal/tracing/tracing.go:111:23: tracing.NewProvider calls trace.WithBatcher, which eventually calls transport.http2Client.NewStream

Vulnerability #7: GO-2026-5972
Enforce maximum recursion depth in encoding/asn1
More info: https://pkg.go.dev/vuln/GO-2026-5972
Standard library
Found in: encoding/asn1@go1.24.12
Fixed in: encoding/asn1@go1.25.13
Example traces found:
#1: internal/tracing/tracing.go:225:25: tracing.Provider.Shutdown calls trace.TracerProvider.Shutdown, which eventually calls asn1.Unmarshal

Vulnerability #8: GO-2026-5856
Invoking Encrypted Client Hello privacy leak in crypto/tls
More info: https://pkg.go.dev/vuln/GO-2026-5856
Standard library
Found in: crypto/tls@go1.24.12
Fixed in: crypto/tls@go1.25.12
Example traces found:
#1: internal/stream/quality_metrics_repository.go:209:15: stream.PostgresQualityMetricsRepository.GetParticipantsWithHighPacketLoss calls sql.Rows.Next, which eventually calls tls.Conn.Handshake
#2: internal/indexer/client.go:208:36: indexer.Client.connect calls websocket.Dialer.DialContext, which eventually calls tls.Conn.HandshakeContext
#3: internal/indexer/car.go:102:23: indexer.CARReader.ReadByte calls io.ReadFull, which eventually calls tls.Conn.Read
#4: examples/jwt-rotation-integration.go:45:12: examples.main calls fmt.Printf, which eventually calls tls.Conn.Write
#5: cmd/api/main.go:345:32: api.main calls redis.NewClient, which eventually calls tls.DialWithDialer
#6: internal/health/livekit.go:44:25: health.LiveKitChecker.HealthCheck calls http.Client.Do, which eventually calls tls.Dialer.DialContext

Vulnerability #9: GO-2026-5764
DoS due to Panic in AWS SDK for Go v2 SDK EventStream Decoder in
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream
More info: https://pkg.go.dev/vuln/GO-2026-5764
Module: github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream
Found in: github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.7.4
Fixed in: github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.7.8
Example traces found:
#1: internal/indexer/repository.go:235:34: indexer.PostgresRecordRepository.DeleteRecord calls eventstream.ChecksumError.Error
#2: internal/indexer/repository.go:911:20: indexer.InMemoryRecordRepository.DeleteRecord calls fmt.Sprintf, which eventually calls eventstream.Int16Value.String
#3: internal/indexer/repository.go:911:20: indexer.InMemoryRecordRepository.DeleteRecord calls fmt.Sprintf, which eventually calls eventstream.Int32Value.String
#4: internal/indexer/repository.go:911:20: indexer.InMemoryRecordRepository.DeleteRecord calls fmt.Sprintf, which eventually calls eventstream.Int64Value.String
#5: internal/indexer/repository.go:911:20: indexer.InMemoryRecordRepository.DeleteRecord calls fmt.Sprintf, which eventually calls eventstream.Int8Value.String
#6: internal/indexer/repository.go:235:34: indexer.PostgresRecordRepository.DeleteRecord calls eventstream.LengthError.Error
#7: internal/upload/service.go:13:2: upload.init calls s3.init, which calls eventstream.init
#8: internal/indexer/repository.go:911:20: indexer.InMemoryRecordRepository.DeleteRecord calls fmt.Sprintf, which eventually calls eventstream.valueType.String
#9: internal/upload/service.go:13:2: upload.init calls s3.init, which calls eventstreamapi.init

Module: github.com/aws/aws-sdk-go-v2/service/s3
Found in: github.com/aws/aws-sdk-go-v2/service/s3@v1.95.1
Fixed in: github.com/aws/aws-sdk-go-v2/service/s3@v1.97.3
Example traces found:
#1: internal/upload/service.go:204:55: upload.Service.GenerateSignedURL calls s3.PresignClient.PresignPutObject, which eventually calls arn.ParseEndpointARN
#2: internal/upload/service.go:13:2: upload.init calls s3.init, which eventually calls arn.init
#3: internal/upload/service.go:204:55: upload.Service.GenerateSignedURL calls s3.PresignClient.PresignPutObject, which eventually calls customizations.AddExpiresOnPresignedURL.HandleBuild
#4: internal/upload/service.go:204:55: upload.Service.GenerateSignedURL calls s3.PresignClient.PresignPutObject, which eventually calls customizations.AddExpiresOnPresignedURL.ID
#5: internal/upload/service.go:204:55: upload.Service.GenerateSignedURL calls s3.PresignClient.PresignPutObject, which eventually calls customizations.ExpressIdentityResolver.GetIdentity
#6: internal/upload/service.go:204:55: upload.Service.GenerateSignedURL calls s3.PresignClient.PresignPutObject, which eventually calls customizations.ExpressSigner.SignRequest
#7: internal/upload/service.go:204:55: upload.Service.GenerateSignedURL calls s3.PresignClient.PresignPutObject, which eventually calls customizations.GetPropertiesBackend
#8: internal/upload/service.go:204:55: upload.Service.GenerateSignedURL calls s3.PresignClient.PresignPutObject, which eventually calls customizations.NewPresignHTTPRequestMiddleware
#9: internal/upload/service.go:109:38: upload.NewService calls s3.NewPresignClient, which eventually calls customizations.PresignHTTP
#10: internal/upload/service.go:204:55: upload.Service.GenerateSignedURL calls s3.PresignClient.PresignPutObject, which eventually calls customizations.PresignHTTPRequestMiddleware.HandleFinalize
#11: internal/upload/service.go:204:55: upload.Service.GenerateSignedURL calls s3.PresignClient.PresignPutObject, which eventually calls customizations.PresignHTTPRequestMiddleware.ID
#12: internal/upload/service.go:204:55: upload.Service.GenerateSignedURL calls s3.PresignClient.PresignPutObject, which eventually calls customizations.RegisterPreSigningMiddleware
#13: internal/upload/service.go:204:55: upload.Service.GenerateSignedURL calls s3.PresignClient.PresignPutObject, which eventually calls customizations.SetBucket
#14: internal/upload/service.go:204:55: upload.Service.GenerateSignedURL calls s3.PresignClient.PresignPutObject, which eventually calls customizations.SetSignerVersion
#15: internal/upload/service.go:109:38: upload.NewService calls s3.NewPresignClient, which eventually calls customizations.SignRequest
#16: internal/upload/service.go:204:55: upload.Service.GenerateSignedURL calls s3.PresignClient.PresignPutObject, which eventually calls customizations.UpdateEndpoint
#17: internal/upload/service.go:13:2: upload.init calls s3.init, which calls customizations.init
#18: internal/upload/service.go:204:55: upload.Service.GenerateSignedURL calls s3.PresignClient.PresignPutObject, which eventually calls customizations.processARNResource.HandleSerialize
#19: internal/upload/service.go:204:55: upload.Service.GenerateSignedURL calls s3.PresignClient.PresignPutObject, which eventually calls customizations.processARNResource.ID
#20: internal/upload/service.go:204:55: upload.Service.GenerateSignedURL calls s3.PresignClient.PresignPutObject, which eventually calls customizations.removeBucketFromPathMiddleware.HandleSerialize
#21: internal/upload/service.go:204:55: upload.Service.GenerateSignedURL calls s3.PresignClient.PresignPutObject, which eventually calls customizations.removeBucketFromPathMiddleware.ID
#22: internal/upload/service.go:204:55: upload.Service.GenerateSignedURL calls s3.PresignClient.PresignPutObject, which eventually calls customizations.s3ExpressCredentialsAdapter.Retrieve
#23: internal/upload/service.go:204:55: upload.Service.GenerateSignedURL calls s3.PresignClient.PresignPutObject, which eventually calls customizations.s3ExpressPresignerAdapter.PresignHTTP
#24: internal/upload/service.go:204:55: upload.Service.GenerateSignedURL calls s3.PresignClient.PresignPutObject, which eventually calls customizations.s3ObjectLambdaEndpoint.HandleSerialize
#25: internal/upload/service.go:204:55: upload.Service.GenerateSignedURL calls s3.PresignClient.PresignPutObject, which eventually calls customizations.s3ObjectLambdaEndpoint.ID
#26: internal/upload/service.go:204:55: upload.Service.GenerateSignedURL calls s3.PresignClient.PresignPutObject, which eventually calls customizations.updateEndpoint.HandleSerialize
#27: internal/upload/service.go:204:55: upload.Service.GenerateSignedURL calls s3.PresignClient.PresignPutObject, which eventually calls customizations.updateEndpoint.ID
#28: internal/upload/service.go:204:55: upload.Service.GenerateSignedURL calls s3.PresignClient.PresignPutObject, which eventually calls endpoints.GetDNSSuffix
#29: internal/upload/service.go:13:2: upload.init calls s3.init, which calls endpoints.init
#30: internal/attachment/metadata.go:124:40: attachment.MetadataService.processImage calls s3.Client.GetObject
#31: internal/attachment/metadata.go:70:42: attachment.MetadataService.EnrichAttachment calls s3.Client.HeadObject
#32: internal/attachment/metadata.go:167:31: attachment.MetadataService.processImage calls s3.Client.PutObject
#33: internal/upload/service.go:98:20: upload.NewService calls s3.New
#34: internal/upload/service.go:109:38: upload.NewService calls s3.NewPresignClient
#35: internal/upload/service.go:204:55: upload.Service.GenerateSignedURL calls s3.PresignClient.PresignPutObject
#36: internal/tracing/tracing.go:225:25: tracing.Provider.Shutdown calls trace.TracerProvider.Shutdown, which eventually calls s3.SelectObjectContentEventStream.safeClose
#37: internal/upload/service.go:13:2: upload.init calls s3.init
#38: internal/tracing/tracing.go:225:25: tracing.Provider.Shutdown calls trace.TracerProvider.Shutdown, which eventually calls s3.selectObjectContentEventStreamReader.safeClose
#39: internal/indexer/repository.go:235:34: indexer.PostgresRecordRepository.DeleteRecord calls types.BucketAlreadyExists.Error
#40: internal/indexer/repository.go:235:34: indexer.PostgresRecordRepository.DeleteRecord calls types.BucketAlreadyOwnedByYou.Error
#41: internal/indexer/repository.go:235:34: indexer.PostgresRecordRepository.DeleteRecord calls types.EncryptionTypeMismatch.Error
#42: internal/indexer/repository.go:235:34: indexer.PostgresRecordRepository.DeleteRecord calls types.IdempotencyParameterMismatch.Error
#43: internal/indexer/repository.go:235:34: indexer.PostgresRecordRepository.DeleteRecord calls types.InvalidObjectState.Error
#44: internal/indexer/repository.go:235:34: indexer.PostgresRecordRepository.DeleteRecord calls types.InvalidRequest.Error
#45: internal/indexer/repository.go:235:34: indexer.PostgresRecordRepository.DeleteRecord calls types.InvalidWriteOffset.Error
#46: internal/indexer/repository.go:235:34: indexer.PostgresRecordRepository.DeleteRecord calls types.NoSuchBucket.Error
#47: internal/indexer/repository.go:235:34: indexer.PostgresRecordRepository.DeleteRecord calls types.NoSuchKey.Error
#48: internal/indexer/repository.go:235:34: indexer.PostgresRecordRepository.DeleteRecord calls types.NoSuchUpload.Error
#49: internal/indexer/repository.go:235:34: indexer.PostgresRecordRepository.DeleteRecord calls types.NotFound.Error
#50: internal/indexer/repository.go:235:34: indexer.PostgresRecordRepository.DeleteRecord calls types.ObjectAlreadyInActiveTierError.Error
#51: internal/indexer/repository.go:235:34: indexer.PostgresRecordRepository.DeleteRecord calls types.ObjectNotInActiveTierError.Error
#52: internal/indexer/repository.go:235:34: indexer.PostgresRecordRepository.DeleteRecord calls types.TooManyParts.Error
#53: internal/upload/service.go:13:2: upload.init calls s3.init, which calls types.init

Vulnerability #10: GO-2026-5506
OpenTelemetry-Go: Multi-value baggage header extraction causes excessive
allocations in go.opentelemetry.io/otel
More info: https://pkg.go.dev/vuln/GO-2026-5506
Module: go.opentelemetry.io/otel
Found in: go.opentelemetry.io/otel@v1.38.0
Fixed in: go.opentelemetry.io/otel@v1.41.0
Example traces found:
#1: cmd/api/main.go:1310:34: api.main calls http.Server.ListenAndServe, which eventually calls baggage.New
#2: cmd/api/main.go:1310:34: api.main calls http.Server.ListenAndServe, which eventually calls baggage.Parse
#3: internal/tracing/tracing.go:111:23: tracing.NewProvider calls trace.WithBatcher, which eventually calls global.Debug
#4: internal/tracing/tracing.go:236:20: tracing.Provider.Tracer calls trace.TracerProvider.Tracer, which eventually calls global.ErrDelegator.Handle
#5: internal/tracing/tracing.go:197:26: tracing.createOTLPHTTPExporter calls otlptracehttp.New, which eventually calls global.Error
#6: internal/tracing/tracing.go:236:20: tracing.Provider.Tracer calls trace.TracerProvider.Tracer, which eventually calls global.GetErrorHandler
#7: internal/tracing/tracing.go:236:20: tracing.Provider.Tracer calls trace.TracerProvider.Tracer, which calls global.Info
#8: internal/tracing/tracing.go:121:27: tracing.NewProvider calls otel.SetTextMapPropagator, which calls global.SetTextMapPropagator
#9: internal/tracing/tracing.go:118:24: tracing.NewProvider calls otel.SetTracerProvider, which calls global.SetTracerProvider
#10: internal/tracing/tracing.go:225:25: tracing.Provider.Shutdown calls trace.TracerProvider.Shutdown, which eventually calls global.Warn
#11: internal/tracing/tracing.go:225:25: tracing.Provider.Shutdown calls trace.TracerProvider.Shutdown, which eventually calls global.textMapPropagator.SetDelegate
#12: cmd/api/main.go:1310:34: api.main calls http.Server.ListenAndServe, which eventually calls propagation.Baggage.Extract

Vulnerability #11: GO-2026-5426
Opentelemetry-go: BSD kenv command not using absolute path enables PATH
hijacking in go.opentelemetry.io/otel/sdk
More info: https://pkg.go.dev/vuln/GO-2026-5426
Module: go.opentelemetry.io/otel/sdk
Found in: go.opentelemetry.io/otel/sdk@v1.38.0
Fixed in: go.opentelemetry.io/otel/sdk@v1.43.0
Example traces found:
#1: internal/tracing/tracing.go:71:26: tracing.NewProvider calls resource.New

Vulnerability #12: GO-2026-5039
Arbitrary inputs are included in errors without any escaping in
net/textproto
More info: https://pkg.go.dev/vuln/GO-2026-5039
Standard library
Found in: net/textproto@go1.24.12
Fixed in: net/textproto@go1.25.11
Example traces found:
#1: internal/indexer/client.go:208:36: indexer.Client.connect calls websocket.Dialer.DialContext, which eventually calls textproto.Reader.ReadMIMEHeader

Vulnerability #13: GO-2026-5037
Inefficient candidate hostname parsing in crypto/x509
More info: https://pkg.go.dev/vuln/GO-2026-5037
Standard library
Found in: crypto/x509@go1.24.12
Fixed in: crypto/x509@go1.25.11
Example traces found:
#1: internal/indexer/client.go:208:36: indexer.Client.connect calls websocket.Dialer.DialContext, which eventually calls x509.Certificate.Verify
#2: internal/indexer/client.go:208:36: indexer.Client.connect calls websocket.Dialer.DialContext, which eventually calls x509.Certificate.VerifyHostname
#3: internal/indexer/repository.go:235:34: indexer.PostgresRecordRepository.DeleteRecord calls x509.HostnameError.Error

Vulnerability #14: GO-2026-5026
Invoking failure to reject ASCII-only Punycode-encoded labels in
golang.org/x/net/idna
More info: https://pkg.go.dev/vuln/GO-2026-5026
Module: golang.org/x/net
Found in: golang.org/x/net@v0.47.0
Fixed in: golang.org/x/net@v0.55.0

Standard library
Found in: net/http@go1.24.12
Fixed in: net/http@go1.25.13
Example traces found:
#1: internal/health/livekit.go:44:25: health.LiveKitChecker.HealthCheck calls http.Client.Do
#2: internal/upload/service.go:204:55: upload.Service.GenerateSignedURL calls s3.PresignClient.PresignPutObject, which eventually calls http.Transport.CloseIdleConnections
#3: internal/upload/service.go:204:55: upload.Service.GenerateSignedURL calls s3.PresignClient.PresignPutObject, which eventually calls http.Transport.RoundTrip

Vulnerability #15: GO-2026-4985
Oversized OTLP HTTP response bodies can cause memory exhaustion in
go.opentelemetry.io/otel/exporters/otlp
More info: https://pkg.go.dev/vuln/GO-2026-4985
Module: go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp
Found in: go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.24.0
Fixed in: go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.43.0
Example traces found:
#1: internal/tracing/tracing.go:197:26: tracing.createOTLPHTTPExporter calls otlptracehttp.New
#2: internal/tracing/tracing.go:111:23: tracing.NewProvider calls trace.WithBatcher, which eventually calls otlptracehttp.client.UploadTraces

Vulnerability #16: GO-2026-4982
Bypass of meta content URL escaping causes XSS in html/template
More info: https://pkg.go.dev/vuln/GO-2026-4982
Standard library
Found in: html/template@go1.24.12
Fixed in: html/template@go1.25.10
Example traces found:
#1: cmd/api/main.go:1310:34: api.main calls http.Server.ListenAndServe, which eventually calls template.Template.Execute
#2: cmd/api/main.go:1310:34: api.main calls http.Server.ListenAndServe, which eventually calls template.Template.ExecuteTemplate

Vulnerability #17: GO-2026-4980
Escaper bypass leads to XSS in html/template
More info: https://pkg.go.dev/vuln/GO-2026-4980
Standard library
Found in: html/template@go1.24.12
Fixed in: html/template@go1.25.10
Example traces found:
#1: cmd/api/main.go:1310:34: api.main calls http.Server.ListenAndServe, which eventually calls template.Template.Execute
#2: cmd/api/main.go:1310:34: api.main calls http.Server.ListenAndServe, which eventually calls template.Template.ExecuteTemplate

Vulnerability #18: GO-2026-4971
Panic in Dial and LookupPort when handling NUL byte on Windows in net
More info: https://pkg.go.dev/vuln/GO-2026-4971
Standard library
Found in: net@go1.24.12
Fixed in: net@go1.25.10
Example traces found:
#1: internal/indexer/client.go:208:36: indexer.Client.connect calls websocket.Dialer.DialContext, which eventually calls net.Dial
#2: internal/stream/quality_metrics_repository.go:209:15: stream.PostgresQualityMetricsRepository.GetParticipantsWithHighPacketLoss calls sql.Rows.Next, which eventually calls net.Dialer.Dial
#3: internal/indexer/client.go:208:36: indexer.Client.connect calls websocket.Dialer.DialContext, which calls net.Dialer.DialContext
#4: cmd/api/main.go:1310:34: api.main calls http.Server.ListenAndServe, which calls net.Listen
#5: internal/validate/url.go:140:31: validate.checkSSRF calls net.Resolver.LookupIP

Vulnerability #19: GO-2026-4947
Unexpected work during chain building in crypto/x509
More info: https://pkg.go.dev/vuln/GO-2026-4947
Standard library
Found in: crypto/x509@go1.24.12
Fixed in: crypto/x509@go1.25.9
Example traces found:
#1: internal/indexer/client.go:208:36: indexer.Client.connect calls websocket.Dialer.DialContext, which eventually calls x509.Certificate.Verify

Vulnerability #20: GO-2026-4946
Inefficient policy validation in crypto/x509
More info: https://pkg.go.dev/vuln/GO-2026-4946
Standard library
Found in: crypto/x509@go1.24.12
Fixed in: crypto/x509@go1.25.9
Example traces found:
#1: internal/indexer/client.go:208:36: indexer.Client.connect calls websocket.Dialer.DialContext, which eventually calls x509.Certificate.Verify

Vulnerability #21: GO-2026-4945
Go JOSE Panics in JWE decryption in github.com/go-jose/go-jose
More info: https://pkg.go.dev/vuln/GO-2026-4945
Module: github.com/go-jose/go-jose/v3
Found in: github.com/go-jose/go-jose/v3@v3.0.4
Fixed in: github.com/go-jose/go-jose/v3@v3.0.5
Example traces found:
#1: internal/livekit/token.go:115:24: livekit.TokenService.GenerateToken calls auth.AccessToken.ToJWT, which eventually calls jose.JSONWebEncryption.CompactSerialize
#2: internal/livekit/token.go:115:24: livekit.TokenService.GenerateToken calls auth.AccessToken.ToJWT, which eventually calls jose.JSONWebSignature.CompactSerialize
#3: internal/livekit/token.go:115:24: livekit.TokenService.GenerateToken calls auth.AccessToken.ToJWT, which calls jose.NewSigner
#4: internal/livekit/token.go:115:24: livekit.TokenService.GenerateToken calls auth.AccessToken.ToJWT, which calls jose.SignerOptions.WithType
#5: internal/livekit/token.go:115:24: livekit.TokenService.GenerateToken calls auth.AccessToken.ToJWT, which eventually calls jose.genericSigner.Sign
#6: internal/livekit/token.go:10:2: livekit.init calls auth.init, which calls jose.init

Vulnerability #22: GO-2026-4918
Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in
net/http/internal/http2 in golang.org/x/net
More info: https://pkg.go.dev/vuln/GO-2026-4918
Module: golang.org/x/net
Found in: golang.org/x/net@v0.47.0
Fixed in: golang.org/x/net@v0.53.0

Standard library
Found in: net/http@go1.24.12
Fixed in: net/http@go1.25.10
Example traces found:
#1: internal/health/livekit.go:44:25: health.LiveKitChecker.HealthCheck calls http.Client.Do
#2: internal/upload/service.go:204:55: upload.Service.GenerateSignedURL calls s3.PresignClient.PresignPutObject, which eventually calls http.Transport.CloseIdleConnections
#3: internal/upload/service.go:204:55: upload.Service.GenerateSignedURL calls s3.PresignClient.PresignPutObject, which eventually calls http.Transport.RoundTrip

Vulnerability #23: GO-2026-4870
Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection
retention and DoS in crypto/tls
More info: https://pkg.go.dev/vuln/GO-2026-4870
Standard library
Found in: crypto/tls@go1.24.12
Fixed in: crypto/tls@go1.25.9
Example traces found:
#1: internal/stream/quality_metrics_repository.go:209:15: stream.PostgresQualityMetricsRepository.GetParticipantsWithHighPacketLoss calls sql.Rows.Next, which eventually calls tls.Conn.Handshake
#2: internal/indexer/client.go:208:36: indexer.Client.connect calls websocket.Dialer.DialContext, which eventually calls tls.Conn.HandshakeContext
#3: internal/indexer/car.go:102:23: indexer.CARReader.ReadByte calls io.ReadFull, which eventually calls tls.Conn.Read
#4: examples/jwt-rotation-integration.go:45:12: examples.main calls fmt.Printf, which eventually calls tls.Conn.Write
#5: cmd/api/main.go:345:32: api.main calls redis.NewClient, which eventually calls tls.DialWithDialer
#6: internal/health/livekit.go:44:25: health.LiveKitChecker.HealthCheck calls http.Client.Do, which eventually calls tls.Dialer.DialContext

Vulnerability #24: GO-2026-4865
JsBraceDepth Context Tracking Bugs (XSS) in html/template
More info: https://pkg.go.dev/vuln/GO-2026-4865
Standard library
Found in: html/template@go1.24.12
Fixed in: html/template@go1.25.9
Example traces found:
#1: internal/indexer/repository.go:235:34: indexer.PostgresRecordRepository.DeleteRecord calls template.Error.Error
#2: cmd/api/main.go:1310:34: api.main calls http.Server.ListenAndServe, which eventually calls template.Template.Execute
#3: cmd/api/main.go:1310:34: api.main calls http.Server.ListenAndServe, which eventually calls template.Template.ExecuteTemplate
#4: internal/tracing/tracing.go:225:25: tracing.Provider.Shutdown calls trace.TracerProvider.Shutdown, which eventually calls template.Template.Funcs
#5: internal/tracing/tracing.go:225:25: tracing.Provider.Shutdown calls trace.TracerProvider.Shutdown, which eventually calls template.Template.Parse
#6: internal/indexer/repository.go:911:20: indexer.InMemoryRecordRepository.DeleteRecord calls fmt.Sprintf, which eventually calls template.context.String

Vulnerability #25: GO-2026-4603
URLs in meta content attribute actions are not escaped in html/template
More info: https://pkg.go.dev/vuln/GO-2026-4603
Standard library
Found in: html/template@go1.24.12
Fixed in: html/template@go1.25.8
Example traces found:
#1: cmd/api/main.go:1310:34: api.main calls http.Server.ListenAndServe, which eventually calls template.Template.Execute
#2: cmd/api/main.go:1310:34: api.main calls http.Server.ListenAndServe, which eventually calls template.Template.ExecuteTemplate

Vulnerability #26: GO-2026-4602
FileInfo can escape from a Root in os
More info: https://pkg.go.dev/vuln/GO-2026-4602
Standard library
Found in: os@go1.24.12
Fixed in: os@go1.25.8
Example traces found:
#1: internal/tracing/tracing.go:225:25: tracing.Provider.Shutdown calls trace.TracerProvider.Shutdown, which eventually calls os.ReadDir

Vulnerability #27: GO-2026-4601
Incorrect parsing of IPv6 host literals in net/url
More info: https://pkg.go.dev/vuln/GO-2026-4601
Standard library
Found in: net/url@go1.24.12
Fixed in: net/url@go1.25.8
Example traces found:
#1: internal/api/payment_handlers.go:223:24: api.PaymentHandlers.CreateCheckoutSession calls url.Parse
#2: cmd/api/main.go:1310:34: api.main calls http.Server.ListenAndServe, which eventually calls url.ParseRequestURI
#3: internal/health/livekit.go:44:25: health.LiveKitChecker.HealthCheck calls http.Client.Do, which eventually calls url.URL.Parse

Vulnerability #28: GO-2026-4394
OpenTelemetry Go SDK Vulnerable to Arbitrary Code Execution via PATH
Hijacking in go.opentelemetry.io/otel/sdk
More info: https://pkg.go.dev/vuln/GO-2026-4394
Module: go.opentelemetry.io/otel/sdk
Found in: go.opentelemetry.io/otel/sdk@v1.38.0
Fixed in: go.opentelemetry.io/otel/sdk@v1.40.0
Example traces found:
#1: internal/tracing/tracing.go:111:23: tracing.NewProvider calls trace.WithBatcher, which eventually calls env.BatchSpanProcessorExportTimeout
#2: internal/tracing/tracing.go:111:23: tracing.NewProvider calls trace.WithBatcher, which eventually calls env.BatchSpanProcessorMaxExportBatchSize
#3: internal/tracing/tracing.go:111:23: tracing.NewProvider calls trace.WithBatcher, which eventually calls env.BatchSpanProcessorMaxQueueSize
#4: internal/tracing/tracing.go:111:23: tracing.NewProvider calls trace.WithBatcher, which eventually calls env.BatchSpanProcessorScheduleDelay
#5: internal/tracing/tracing.go:108:34: tracing.NewProvider calls trace.NewTracerProvider, which eventually calls env.SpanAttributeCount
#6: internal/tracing/tracing.go:108:34: tracing.NewProvider calls trace.NewTracerProvider, which eventually calls env.SpanAttributeValueLength
#7: internal/tracing/tracing.go:108:34: tracing.NewProvider calls trace.NewTracerProvider, which eventually calls env.SpanEventAttributeCount
#8: internal/tracing/tracing.go:108:34: tracing.NewProvider calls trace.NewTracerProvider, which eventually calls env.SpanEventCount
#9: internal/tracing/tracing.go:108:34: tracing.NewProvider calls trace.NewTracerProvider, which eventually calls env.SpanLinkAttributeCount
#10: internal/tracing/tracing.go:108:34: tracing.NewProvider calls trace.NewTracerProvider, which eventually calls env.SpanLinkCount
#11: internal/tracing/tracing.go:19:2: tracing.init calls trace.init, which calls env.init
#12: internal/tracing/tracing.go:19:2: tracing.init calls trace.init, which calls instrumentation.init
#13: internal/tracing/tracing.go:108:34: tracing.NewProvider calls trace.NewTracerProvider, which eventually calls resource.Default
#14: internal/tracing/tracing.go:225:25: tracing.Provider.Shutdown calls trace.TracerProvider.Shutdown, which eventually calls resource.Default
#15: internal/tracing/tracing.go:108:34: tracing.NewProvider calls trace.NewTracerProvider, which eventually calls resource.Environment
#16: internal/tracing/tracing.go:108:34: tracing.NewProvider calls trace.NewTracerProvider, which eventually calls resource.Merge
#17: internal/tracing/tracing.go:71:26: tracing.NewProvider calls resource.New
#18: internal/tracing/tracing.go:19:2: tracing.init calls trace.init, which eventually calls resource.NewSchemaless
#19: internal/tracing/tracing.go:111:23: tracing.NewProvider calls trace.WithBatcher, which eventually calls resource.Resource.Equivalent
#20: internal/tracing/tracing.go:111:23: tracing.NewProvider calls trace.WithBatcher, which eventually calls resource.Resource.Iter
#21: internal/tracing/tracing.go:111:23: tracing.NewProvider calls trace.WithBatcher, which eventually calls resource.Resource.SchemaURL
#22: internal/tracing/tracing.go:73:26: tracing.NewProvider calls resource.WithAttributes
#23: internal/tracing/tracing.go:18:2: tracing.init calls resource.init
#24: internal/tracing/tracing.go:236:20: tracing.Provider.Tracer calls trace.TracerProvider.Tracer, which eventually calls sdk.Version
#25: internal/tracing/tracing.go:19:2: tracing.init calls trace.init, which calls sdk.init
#26: internal/tracing/tracing.go:100:34: tracing.NewProvider calls trace.AlwaysSample
#27: internal/tracing/tracing.go:102:33: tracing.NewProvider calls trace.NeverSample
#28: internal/tracing/tracing.go:108:34: tracing.NewProvider calls trace.NewTracerProvider
#29: internal/health/livekit.go:48:1: health.LiveKitChecker.HealthCheck calls http.http2requestBody.Close, which eventually calls trace.Shutdown
#30: internal/health/livekit.go:48:1: health.LiveKitChecker.HealthCheck calls http.http2requestBody.Close, which eventually calls trace.Shutdown
#31: internal/tracing/tracing.go:104:39: tracing.NewProvider calls trace.TraceIDRatioBased
#32: internal/tracing/tracing.go:225:25: tracing.Provider.Shutdown calls trace.TracerProvider.Shutdown
#33: internal/tracing/tracing.go:236:20: tracing.Provider.Tracer calls trace.TracerProvider.Tracer
#34: internal/tracing/tracing.go:112:29: tracing.NewProvider calls trace.WithBatchTimeout
#35: internal/tracing/tracing.go:111:23: tracing.NewProvider calls trace.WithBatcher
#36: internal/tracing/tracing.go:113:35: tracing.NewProvider calls trace.WithMaxExportBatchSize
#37: internal/tracing/tracing.go:109:24: tracing.NewProvider calls trace.WithResource
#38: internal/tracing/tracing.go:110:23: tracing.NewProvider calls trace.WithSampler
#39: internal/indexer/repository.go:235:34: indexer.PostgresRecordRepository.DeleteRecord calls trace.errUnsupportedSampler.Error
#40: internal/tracing/tracing.go:19:2: tracing.init calls trace.init
#41: internal/health/livekit.go:48:1: health.LiveKitChecker.HealthCheck calls http.http2requestBody.Close, which eventually calls trace.init
#42: internal/health/livekit.go:48:1: health.LiveKitChecker.HealthCheck calls http.http2requestBody.Close, which eventually calls trace.logDropped
#43: internal/health/livekit.go:48:1: health.LiveKitChecker.HealthCheck calls http.http2requestBody.Close, which eventually calls trace.logDropped
#44: internal/tracing/helpers.go:91:15: tracing.AddEvent calls trace.nonRecordingSpan.AddEvent
#45: internal/health/livekit.go:48:1: health.LiveKitChecker.HealthCheck calls otelhttp.wrappedBody.Close, which calls trace.nonRecordingSpan.End
#46: internal/tracing/helpers.go:77:27: tracing.StartSpan calls noop.Tracer.Start, which calls trace.nonRecordingSpan.IsRecording
#47: internal/tracing/helpers.go:81:20: tracing.StartSpan calls trace.nonRecordingSpan.RecordError
#48: internal/tracing/helpers.go:97:20: tracing.SetAttributes calls trace.nonRecordingSpan.SetAttributes
#49: cmd/api/main.go:1310:34: api.main calls http.Server.ListenAndServe, which eventually calls trace.nonRecordingSpan.SetName
#50: internal/tracing/helpers.go:82:18: tracing.StartSpan calls trace.nonRecordingSpan.SetStatus
#51: internal/middleware/tracing.go:55:41: middleware.GetSpanID calls trace.SpanContextFromContext, which calls trace.nonRecordingSpan.SpanContext
#52: internal/health/livekit.go:44:25: health.LiveKitChecker.HealthCheck calls http.Client.Do, which eventually calls trace.nonRecordingSpan.TracerProvider
#53: internal/tracing/helpers.go:91:15: tracing.AddEvent calls trace.recordingSpan.AddEvent
#54: internal/health/livekit.go:48:1: health.LiveKitChecker.HealthCheck calls otelhttp.wrappedBody.Close, which calls trace.recordingSpan.End
#55: internal/tracing/helpers.go:77:27: tracing.StartSpan calls noop.Tracer.Start, which calls trace.recordingSpan.IsRecording
#56: internal/tracing/helpers.go:81:20: tracing.StartSpan calls trace.recordingSpan.RecordError
#57: internal/tracing/helpers.go:97:20: tracing.SetAttributes calls trace.recordingSpan.SetAttributes
#58: cmd/api/main.go:1310:34: api.main calls http.Server.ListenAndServe, which eventually calls trace.recordingSpan.SetName
#59: internal/tracing/helpers.go:82:18: tracing.StartSpan calls trace.recordingSpan.SetStatus
#60: internal/middleware/tracing.go:55:41: middleware.GetSpanID calls trace.SpanContextFromContext, which calls trace.recordingSpan.SpanContext
#61: internal/health/livekit.go:44:25: health.LiveKitChecker.HealthCheck calls http.Client.Do, which eventually calls trace.recordingSpan.TracerProvider
#62: internal/indexer/repository.go:235:34: indexer.PostgresRecordRepository.DeleteRecord calls trace.samplerArgParseError.Error
#63: internal/api/stream_handlers.go:1530:15: api.StreamHandlers.LockStream calls errors.Is, which eventually calls trace.samplerArgParseError.Unwrap
#64: internal/tracing/helpers.go:77:27: tracing.StartSpan calls trace.tracer.Start
#65: internal/tracing/tracing.go:121:27: tracing.NewProvider calls otel.SetTextMapPropagator, which eventually calls trace.tracerProviderConfig.MarshalLog
#66: internal/tracing/tracing.go:236:20: tracing.Provider.Tracer calls trace.TracerProvider.Tracer, which eventually calls x.Feature[string].Enabled
#67: internal/tracing/tracing.go:225:25: tracing.Provider.Shutdown calls trace.TracerProvider.Shutdown, which eventually calls x.Feature[string].Enabled
#68: internal/tracing/tracing.go:19:2: tracing.init calls trace.init, which calls x.init
#69: internal/tracing/tracing.go:18:2: tracing.init calls resource.init, which calls x.init

Vulnerability #29: GO-2026-4337
Unexpected session resumption in crypto/tls
More info: https://pkg.go.dev/vuln/GO-2026-4337
Standard library
Found in: crypto/tls@go1.24.12
Fixed in: crypto/tls@go1.24.13
Example traces found:
#1: internal/stream/quality_metrics_repository.go:209:15: stream.PostgresQualityMetricsRepository.GetParticipantsWithHighPacketLoss calls sql.Rows.Next, which eventually calls tls.Conn.Handshake
#2: internal/indexer/client.go:208:36: indexer.Client.connect calls websocket.Dialer.DialContext, which eventually calls tls.Conn.HandshakeContext
#3: internal/indexer/car.go:102:23: indexer.CARReader.ReadByte calls io.ReadFull, which eventually calls tls.Conn.Read
#4: examples/jwt-rotation-integration.go:45:12: examples.main calls fmt.Printf, which eventually calls tls.Conn.Write
#5: cmd/api/main.go:345:32: api.main calls redis.NewClient, which eventually calls tls.DialWithDialer
#6: internal/health/livekit.go:44:25: health.LiveKitChecker.HealthCheck calls http.Client.Do, which eventually calls tls.Dialer.DialContext

Your code is affected by 29 vulnerabilities from 6 modules and the Go standard library.
This scan also found 11 vulnerabilities in packages you import and 27
vulnerabilities in modules you require, but your code doesn't appear to call
these vulnerabilities.
Use '-show verbose' for more details.

github-actions · 2026-08-31T09:30:51Z

NPM Vulnerability Scan Results - e2e

Severity	Count
Critical	0
High	2
Moderate	3
Low	0
Total	5

Click to see details

# npm audit report

body-parser  <=1.20.5 || 2.0.0-beta.1 - 2.0.2
Severity: moderate
body-parser vulnerable to denial of service when invalid limit value silently disables size enforcement - https://github.com/advisories/GHSA-v422-hmwv-36x6
Depends on vulnerable versions of qs
fix available via `npm audit fix`
node_modules/body-parser

path-to-regexp  <0.1.13
Severity: high
path-to-regexp vulnerable to Regular Expression Denial of Service via multiple route parameters - https://github.com/advisories/GHSA-37ch-88jc-xwx2
fix available via `npm audit fix`
node_modules/path-to-regexp

qs  6.7.0 - 6.15.1
Severity: moderate
qs's arrayLimit bypass in comma parsing allows denial of service - https://github.com/advisories/GHSA-w7fw-mjwx-w883
qs has a remotely triggerable DoS: qs.stringify crashes with TypeError on null/undefined entries in comma-format arrays when encodeValuesOnly is set - https://github.com/advisories/GHSA-q8mj-m7cp-5q26
fix available via `npm audit fix`
node_modules/qs
  express  4.21.0 - 4.22.1 || 5.0.0-alpha.1 - 5.0.1
  Depends on vulnerable versions of qs
  node_modules/express

ws  8.0.0 - 8.20.1
Severity: high
ws: Uninitialized memory disclosure - https://github.com/advisories/GHSA-58qx-3vcg-4xpx
ws: Memory exhaustion DoS from tiny fragments and data chunks - https://github.com/advisories/GHSA-96hv-2xvq-fx4p
fix available via `npm audit fix`
node_modules/ws

5 vulnerabilities (3 moderate, 2 high)

To address all issues, run:
  npm audit fix

dependabot Bot added the dependencies Pull requests that update a dependency file label Aug 31, 2026

Navigation Menu

chore(deps)(deps): bump the web-dependencies group in /web with 18 updates - #79

chore(deps)(deps): bump the web-dependencies group in /web with 18 updates#79
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/web/web-dependencies-0e23f34030

dependabot Bot commented on behalf of github Aug 31, 2026

Uh oh!

dependabot Bot commented on behalf of github Aug 31, 2026

Uh oh!

github-actions Bot commented Aug 31, 2026

Uh oh!

github-actions Bot commented Aug 31, 2026

Uh oh!

github-actions Bot commented Aug 31, 2026

Uh oh!

github-actions Bot commented Aug 31, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Aug 31, 2026

8.2.1

v2.22.1

Patch Changes

v2.22.0

Minor Changes

Patch Changes

2.22.1

Patch Changes

2.22.0

Minor Changes

Patch Changes

v5.0.15

What's Changed

v5.0.14

What's Changed

New Contributors

v5.0.13

What's Changed

New Contributors

v5.0.12

What's Changed

New Contributors

v1.62.1

Bug Fixes

v1.62.0

🧱 New component testing model

🛑 Cancel operations with AbortSignal

🖼️ WebP screenshots

v16.3.3

16.3.3 (2026-08-27)

Bug Fixes

v16.3.2

16.3.2 (2026-01-19)

Bug Fixes

v16.3.1

16.3.1 (2025-12-15)

Bug Fixes

v14.6.6

14.6.6 (2026-08-22)

Bug Fixes

v14.6.5

14.6.5 (2026-08-18)

Bug Fixes

v14.6.4

14.6.4 (2026-08-11)

Bug Fixes

v14.6.3

14.6.3 (2026-08-03)

Bug Fixes

v14.6.2

14.6.2 (2026-08-03)

v4.1.11

🐞 Bug Fixes

v4.1.10

🐞 Bug Fixes

v4.1.9

🐞 Bug Fixes

v4.1.8

🐞 Bug Fixes

v4.1.7

🐞 Bug Fixes

v4.1.11

🐞 Bug Fixes

v4.1.10

🐞 Bug Fixes

v4.1.9

🐞 Bug Fixes

v4.1.8

🐞 Bug Fixes

v4.1.7

🐞 Bug Fixes

10.5.4

10.5.3

10.5.2

10.5.1

Uh oh!

dependabot Bot commented on behalf of github Aug 31, 2026

Labels