chore(deps)(deps): bump i18next from 25.7.2 to 26.4.0 in /web by dependabot[bot] · Pull Request #84 · PatrickFanella/subcults

dependabot · 2026-08-31T09:19:34Z

Bumps i18next from 25.7.2 to 26.4.0.

Release notes

v26.4.0

perf: cache toResolveHierarchy results per (code, fallbackCode) pair. The hierarchy resolver runs on every t() call and calls Intl.getCanonicalLocales multiple times, which showed up prominently when profiling render-heavy UIs (e.g. virtualized data grids); with the cache the per-call cost drops from ~886 ns to ~41 ns. The cache is invalidated automatically when options.fallbackLng changes (reassignment or in-place array mutation); if you mutate other resolution-relevant options at runtime (load, lowerCaseLng, cleanCode, nonExplicitSupportedLngs), call i18next.services.languageUtils.clearCache() afterwards. Function-valued fallbackLng and per-call array/object fallbackLng options are never cached, so dynamic fallbacks keep working as before. Thanks @equaterina (#2444).

chore: update all devDependencies (Babel stays on 7.x until @rollup/plugin-babel supports 8, eslint on 9.x for neostandard). Removed the unused coveralls package (CI uses the Coveralls GitHub Action) and replaced sinon with nise + vitest.spyOn in the v1 compatibility tests, which resolves all open npm audit findings (0 vulnerabilities) and should close the dependabot alerts on the lockfile.

v26.3.6

fix: allow TypeScript 7 in the optional typescript peer dependency range (^5 || ^6 || ^7). With typescript@7.0.2 in a project, npm install failed with an ERESOLVE peer conflict. The published types are TS7-compatible as-is: every test/typescript suite produces identical results under 6.0 and 7.0.2. Reported in react-i18next#1927, thanks @andikapradanaarif.

v26.3.5

fix: $t() nesting options blocks that span multiple lines are now parsed. nest() decided where the nested key ends by testing match[1] with /{.*}/, whose dot does not cross line breaks — so a $t(key, { ... }) options object containing a newline was treated as having no options, mis-split as formatters, and the nested lookup ran without its options (placeholders stayed unresolved). The nesting regexp itself already matches newlines inside $t(...); adding the s (dotAll) flag makes multiline options behave like the single-line form. Thanks @spokodev (#2440).

fix: getUsedParamsDetails (the returnDetails: true path) no longer mutates the passed replace object. It wrote count straight onto options.replace so the returned usedParams would include it — a caller reusing one replace object across t() calls then carried a stale count into later interpolations (e.g. a previous call's count: 5 rendered instead of the current call's value). The details are now built from a copy; usedParams still includes count. Thanks @spokodev (#2441).

fix: with the default skipOnVariables: true + escapeValue: true, a {{placeholder}} carried inside an interpolated value now stays literal even when the value contains escapable characters. The skip logic advanced the regex lastIndex by the raw value length, but the escaped text written into the string is longer, so lastIndex landed inside the inserted value and a trailing {{placeholder}} in it got interpolated — leaking another in-scope variable that should have stayed literal (values without escapable characters were already skipped correctly). The advance now uses the escaped length that is actually written, and the regex-safe $-doubling is applied only at the String.replace call so it can't distort the length arithmetic. Thanks @spokodev (#2442).

v26.3.4

fix(security): deepExtend (used by addResourceBundle(..., deep, overwrite)) no longer recurses into inherited properties. It checked key existence with the in operator, which walks the prototype chain, so a source key matching an inherited built-in (e.g. hasOwnProperty, toString) caused recursion into the shared Object.prototype function and, with overwrite: true, could overwrite e.g. Object.prototype.hasOwnProperty.call with a non-callable value — corrupting a shared built-in process-wide (DoS). Existence is now checked with Object.prototype.hasOwnProperty.call, so such keys are copied as plain own data instead. This complements the existing __proto__/constructor guard and is also strictly more correct for an own-property merge. Only affects applications that pass attacker-controlled data with deep: true and overwrite: true; no standard backend/integration does this. Distinct from CVE-2026-48713 / CVE-2026-48714 (different packages, setPath mechanism). Thanks to zx (Jace) for the responsible disclosure.

v26.3.3

fix(types): selector t($ => $.arr, { returnObjects: true, context }) on a JSON array of heterogeneous objects now preserves each element's full shape (e.g. { transKey1: string; transKey2: string }[]) instead of collapsing to a union of partial element types. Two type-level causes: (1) FilterKeys evaluated the whole array element type at once, so keyof (A | B) only saw the keys common to every element — it now distributes over the object union and filters each element independently; (2) when TypeScript merges mismatched array element types it injects phantom optional undefined keys (e.g. transKey1_withContext?: undefined on elements that don't define it), which the context-detection helpers mistook for real context variants — they now skip keys typed as undefined. Also adds a dedicated context + returnObjects: true selector overload using const Fn + ReturnType<Fn>, so Target is no longer collapsed to unknown via ApplyTarget. Resolves Problem 1 of #2398 (Problem 2 was already fixed on master). Thanks @sauravgupta-dotcom (#2438). Fixes #2398.

v26.3.2

fix: chained formatters with a parenthesised option that contains the format separator (e.g. join(separator: ', ')) now work at any position in the chain, not just first. Previously the comma-in-parens reassembly only repaired formats[0], so {{v, uppercase, join(separator: ', ')}} split the join(...) option on the inner comma and never rejoined it, producing corrupt output. Replaced the first-position-only repair with a position-independent pass that re-joins fragments until each open paren closes. Thanks @spokodev (#2437).

v26.3.1

fix(types): t() with a keyPrefix no longer pollutes its return type with sibling keys' values. A regression in 26.3.0 — the [Res] extends [never] guards added to KeysBuilderWithReturnObjects / KeysBuilderWithoutReturnObjects turned the builders into deferred conditional types, so KeyPrefix<Ns> stopped resolving to a literal union and keyPrefix inference widened to the whole namespace. Symptom: useTranslation(ns, { keyPrefix: 'a.b' }) then t('title') would resolve to '<a.b>.title' | '<other.path>.title' | ... instead of just the scoped value. Affected every react-i18next user using keyPrefix. Restored to the eager 26.2.0 form. The same-namespace conflict handling from #2434 still works via _DropConflictKeys at the merge layer (in options.d.ts). Thanks @aaronrosenthal (#2436).

v26.3.0

feat(types): introduce ResourceNamespaceMap — a separate mergeable augmentation surface for namespace resource types, designed for monorepos where multiple packages each want to contribute their own namespaces. Previously, every package had to coordinate on a single CustomTypeOptions.resources declaration (or fall back to typing dependency namespaces as any) because resources is a single property of an interface and TypeScript reports TS2717 when two declarations of the same property disagree. The new interface merges naturally across declare module 'i18next' blocks, so each package can ship its own i18next.d.ts independently. Per-property merge handles same-namespace contributions from multiple packages, and same-key/different-literal conflicts are silently dropped to avoid poisoning t() overload resolution. Fully backwards-compatible — existing CustomTypeOptions.resources augmentations continue to work, and both surfaces can coexist. Scalar options (defaultNS, returnNull, enableSelector, etc.) still belong on CustomTypeOptions. Thanks @sh3xu (#2434). Fixes #2409.

v26.2.0

feat(types): new parseInterpolation TypeOption (default true). When set to false in CustomTypeOptions, the type-level extractor stops parsing translation strings for {{variable}} patterns. Required by i18next-icu users — the default extractor mistakes ICU MessageFormat nested-brace plurals like {count, plural, one {{count} row} other {{count} rows}} for an interpolation block and demands a phantom variable name. The flag is type-only; runtime interpolation is governed by InterpolationOptions and is unaffected. Fixes i18next-icu#85.

fix(types): expose enableSelector on InitOptions so i18next.init({ enableSelector: 'strict' }) typechecks without a module augmentation. The runtime already reads opts?.enableSelector from init options; this lands the matching type declaration next to the other selector-resolution knobs. Accepts false | true | 'optimize' | 'strict'. Thanks @Faithfinder (#2431)

v26.1.0

feat: enableSelector: 'strict' (TypeOptions + runtime option). Opt-in mode that drops the flattened-primary form from NsResource at the type level — every namespace (primary included) is exposed only under its own key on $, uniformly across single- and multi-ns hooks. At runtime, a leading selector path segment matching the scope's namespace list is always rewritten as a namespace prefix, including the primary. Eliminates the silent-miss surface area where t($ => $.primary.foo) typechecks but doesn't resolve under the default mode (see #2429). Backward-compatible: default enableSelector: false | true | 'optimize' behavior is unchanged. Note: strict mode is incompatible with the #2405 pattern (keys whose names match sibling namespaces) — those users should stay on default mode.

v26.0.10

feat: getFixedT accepts a fourth optional fixedOpts argument carrying scopeNs — the full namespace list the bound t was created for. The selector API uses scopeNs to detect when a path's first segment is a namespace prefix, without changing resolution scope. Resolution still uses the bound ns (a single primary string in the typical react-i18next setup), so plain t('key') lookups stay isolated to the primary namespace exactly as before — only t($ => $.secondaryNs.foo) selectors now route correctly under useTranslation([nsA, nsB]). Fixes the runtime side of #2429 for the react-i18next default-nsMode case. The 4th argument is opt-in: existing 3-arg getFixedT(lng, ns, keyPrefix) callers see no behavior change.

v26.0.9

fix(types): unformatted interpolation values are now typed as string | number (was string). i18next stringifies values at runtime, so requiring callers to wrap numbers in String(...) for plain {{var}} placeholders was unnecessary friction — and could mask the real problem when a non-string value was passed alongside multiple interpolation slots (the t() overload resolution would fall through to the 3-arg form and report a confusing "not assignable to string" error against the options object). Typed format specifiers like {{x, number}}, {{x, currency}}, {{x, datetime}}, etc. keep their precise types; this only relaxes the no-format default. The count variable remains number-only

v26.0.8

fix(types): restore the pre-v25.10.4 ExistsFunction shape so plain arrow functions can again be assigned to ExistsFunction-typed variables (TypeScript cannot infer type predicates through multi-overload assignment). Direct i18next.exists(key) calls still narrow key to SelectorKey — the predicate is now declared inline on i18n.exists. Custom wrappers that want the narrowing can type themselves as typeof i18next.exists 2425

v26.0.7

fix: when a plural lookup misses, the missingKey debug log now shows the actual plural-resolved key (e.g. foo.bar_many for Polish count: 14) instead of the base key — making it obvious which plural category was expected and missing 2423

chore: drop @babel/runtime runtime dependency. The build no longer generates any @babel/runtime imports, so the package is unused by consumers. Rollup now uses babelHelpers: 'bundled' so any helpers that are ever needed in the future will be inlined rather than imported externally 2424

chore: stop emitting dist/esm/i18next.bundled.js. It was byte-identical to dist/esm/i18next.js because no helpers were being imported 2424

v26.0.6

Security release — all issues found via an internal audit. GHSA advisory filed after release.

... (truncated)

Changelog

Sourced from i18next's changelog.

26.4.0

perf: cache toResolveHierarchy results per (code, fallbackCode) pair. The hierarchy resolver runs on every t() call and calls Intl.getCanonicalLocales multiple times, which showed up prominently when profiling render-heavy UIs (e.g. virtualized data grids); with the cache the per-call cost drops from ~886 ns to ~41 ns. The cache is invalidated automatically when options.fallbackLng changes (reassignment or in-place array mutation); if you mutate other resolution-relevant options at runtime (load, lowerCaseLng, cleanCode, nonExplicitSupportedLngs), call i18next.services.languageUtils.clearCache() afterwards. Function-valued fallbackLng and per-call array/object fallbackLng options are never cached, so dynamic fallbacks keep working as before. Thanks @equaterina (#2444).

chore: update all devDependencies (Babel stays on 7.x until @rollup/plugin-babel supports 8, eslint on 9.x for neostandard). Removed the unused coveralls package (CI uses the Coveralls GitHub Action) and replaced sinon with nise + vitest.spyOn in the v1 compatibility tests, which resolves all open npm audit findings (0 vulnerabilities) and should close the dependabot alerts on the lockfile.

26.3.6

fix: allow TypeScript 7 in the optional typescript peer dependency range (^5 || ^6 || ^7). With typescript@7.0.2 in a project, npm install failed with an ERESOLVE peer conflict. The published types are TS7-compatible as-is: every test/typescript suite produces identical results under 6.0 and 7.0.2. Reported in react-i18next#1927, thanks @andikapradanaarif.

26.3.5

fix: $t() nesting options blocks that span multiple lines are now parsed. nest() decided where the nested key ends by testing match[1] with /{.*}/, whose dot does not cross line breaks — so a $t(key, { ... }) options object containing a newline was treated as having no options, mis-split as formatters, and the nested lookup ran without its options (placeholders stayed unresolved). The nesting regexp itself already matches newlines inside $t(...); adding the s (dotAll) flag makes multiline options behave like the single-line form. Thanks @spokodev (#2440).

fix: getUsedParamsDetails (the returnDetails: true path) no longer mutates the passed replace object. It wrote count straight onto options.replace so the returned usedParams would include it — a caller reusing one replace object across t() calls then carried a stale count into later interpolations (e.g. a previous call's count: 5 rendered instead of the current call's value). The details are now built from a copy; usedParams still includes count. Thanks @spokodev (#2441).

fix: with the default skipOnVariables: true + escapeValue: true, a {{placeholder}} carried inside an interpolated value now stays literal even when the value contains escapable characters. The skip logic advanced the regex lastIndex by the raw value length, but the escaped text written into the string is longer, so lastIndex landed inside the inserted value and a trailing {{placeholder}} in it got interpolated — leaking another in-scope variable that should have stayed literal (values without escapable characters were already skipped correctly). The advance now uses the escaped length that is actually written, and the regex-safe $-doubling is applied only at the String.replace call so it can't distort the length arithmetic. Thanks @spokodev (#2442).

26.3.4

fix(security): deepExtend (used by addResourceBundle(..., deep, overwrite)) no longer recurses into inherited properties. It checked key existence with the in operator, which walks the prototype chain, so a source key matching an inherited built-in (e.g. hasOwnProperty, toString) caused recursion into the shared Object.prototype function and, with overwrite: true, could overwrite e.g. Object.prototype.hasOwnProperty.call with a non-callable value — corrupting a shared built-in process-wide (DoS). Existence is now checked with Object.prototype.hasOwnProperty.call, so such keys are copied as plain own data instead. This complements the existing __proto__/constructor guard and is also strictly more correct for an own-property merge. Only affects applications that pass attacker-controlled data with deep: true and overwrite: true; no standard backend/integration does this. Distinct from CVE-2026-48713 / CVE-2026-48714 (different packages, setPath mechanism). See advisory GHSA-6jcc-5g8w-32mx, CVSS 5.9 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H). Thanks to zx (Jace) @manus-use for the responsible disclosure.

26.3.3

fix(types): selector t($ => $.arr, { returnObjects: true, context }) on a JSON array of heterogeneous objects now preserves each element's full shape (e.g. { transKey1: string; transKey2: string }[]) instead of collapsing to a union of partial element types. Two type-level causes: (1) FilterKeys evaluated the whole array element type at once, so keyof (A | B) only saw the keys common to every element — it now distributes over the object union and filters each element independently; (2) when TypeScript merges mismatched array element types it injects phantom optional undefined keys (e.g. transKey1_withContext?: undefined on elements that don't define it), which the context-detection helpers mistook for real context variants — they now skip keys typed as undefined. Also adds a dedicated context + returnObjects: true selector overload using const Fn + ReturnType<Fn>, so Target is no longer collapsed to unknown via ApplyTarget. Resolves Problem 1 of #2398 (Problem 2 was already fixed on master). Thanks @sauravgupta-dotcom (#2438). Fixes #2398.

26.3.2

fix: chained formatters with a parenthesised option that contains the format separator (e.g. join(separator: ', ')) now work at any position in the chain, not just first. Previously the comma-in-parens reassembly only repaired formats[0], so {{v, uppercase, join(separator: ', ')}} split the join(...) option on the inner comma and never rejoined it, producing corrupt output. Replaced the first-position-only repair with a position-independent pass that re-joins fragments until each open paren closes. Thanks @spokodev (#2437).

26.3.1

fix(types): t() with a keyPrefix no longer pollutes its return type with sibling keys' values. A regression in 26.3.0 — the [Res] extends [never] guards added to KeysBuilderWithReturnObjects / KeysBuilderWithoutReturnObjects turned the builders into deferred conditional types, so KeyPrefix<Ns> stopped resolving to a literal union and keyPrefix inference widened to the whole namespace. Symptom: useTranslation(ns, { keyPrefix: 'a.b' }) then t('title') would resolve to '<a.b>.title' | '<other.path>.title' | ... instead of just the scoped value. Affected every react-i18next user using keyPrefix. Restored to the eager 26.2.0 form. The same-namespace conflict handling from #2434 still works via _DropConflictKeys at the merge layer (in options.d.ts). Thanks @aaronrosenthal (#2436).

26.3.0

feat(types): introduce ResourceNamespaceMap — a separate mergeable augmentation surface for namespace resource types, designed for monorepos where multiple packages each want to contribute their own namespaces. Previously, every package had to coordinate on a single CustomTypeOptions.resources declaration (or fall back to typing dependency namespaces as any) because resources is a single property of an interface and TypeScript reports TS2717 when two declarations of the same property disagree. The new interface merges naturally across declare module 'i18next' blocks, so each package can ship its own i18next.d.ts independently. Per-property merge handles same-namespace contributions from multiple packages, and same-key/different-literal conflicts are silently dropped to avoid poisoning t() overload resolution. Fully backwards-compatible — existing CustomTypeOptions.resources augmentations continue to work, and both surfaces can coexist. Scalar options (defaultNS, returnNull, enableSelector, etc.) still belong on CustomTypeOptions. Thanks @sh3xu (#2434). Fixes #2409.

26.2.0

feat(types): new parseInterpolation TypeOption (default true). When set to false in CustomTypeOptions, the type-level extractor stops parsing translation strings for {{variable}} patterns. Required by i18next-icu users — the default extractor mistakes ICU MessageFormat nested-brace plurals like {count, plural, one {{count} row} other {{count} rows}} for an interpolation block and demands a phantom variable name. The flag is type-only; runtime interpolation is governed by InterpolationOptions and is unaffected. Fixes i18next-icu#85.

fix(types): expose enableSelector on InitOptions so i18next.init({ enableSelector: 'strict' }) typechecks without a module augmentation. The runtime already reads opts?.enableSelector from init options; this lands the matching type declaration next to the other selector-resolution knobs. Accepts false | true | 'optimize' | 'strict'. Thanks @Faithfinder (#2431)

26.1.0

feat: enableSelector: 'strict' (TypeOptions + runtime option). Opt-in mode that drops the flattened-primary form from NsResource at the type level — every namespace (primary included) is exposed only under its own key on $, uniformly across single- and multi-ns hooks. At runtime, a leading selector path segment matching the scope's namespace list is always rewritten as a namespace prefix, including the primary. Eliminates the silent-miss surface area where t($ => $.primary.foo) typechecks but doesn't resolve under the default mode (see #2429). Backward-compatible: default enableSelector: false | true | 'optimize' behavior is unchanged. Note: strict mode is incompatible with the #2405 pattern (keys whose names match sibling namespaces) — those users should stay on default mode.

26.0.10

feat: getFixedT accepts a fourth optional fixedOpts argument carrying scopeNs — the full namespace list the bound t was created for. The selector API uses scopeNs to detect when a path's first segment is a namespace prefix, without changing resolution scope. Resolution still uses the bound ns (a single primary string in the typical react-i18next setup), so plain t('key') lookups stay isolated to the primary namespace exactly as before — only t($ => $.secondaryNs.foo) selectors now route correctly under useTranslation([nsA, nsB]). Fixes the runtime side of #2429 for the react-i18next default-nsMode case. The 4th argument is opt-in: existing 3-arg getFixedT(lng, ns, keyPrefix) callers see no behavior change.

26.0.9

... (truncated)

Commits

652847e 26.4.0
6c6025f prettier fix
742b9a9 chore: update dependencies and clean up dev tooling
06924d9 fix: invalidate toResolveHierarchy cache on in-place fallbackLng mutation
bb80369 perf: cache toResolveHierarchy (#2444)
e1c60d4 26.3.6
04da43e fix: allow typescript 7 in optional peerDependencies range (react-i18next#1927)
8eed4ac build
573ae73 26.3.5
cc54b05 docs(changelog): 26.3.5 — multiline $t() options, replace mutation, escaped-l...
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [i18next](https://github.com/i18next/i18next) from 25.7.2 to 26.4.0. - [Release notes](https://github.com/i18next/i18next/releases) - [Changelog](https://github.com/i18next/i18next/blob/master/CHANGELOG.md) - [Commits](i18next/i18next@v25.7.2...v26.4.0) --- updated-dependencies: - dependency-name: i18next dependency-version: 26.4.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-08-31T09:19:35Z

Labels

The following labels could not be found: frontend, npm, security. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

github-actions · 2026-08-31T09:30:32Z

Docker Image Scan Results - Dockerfile.api

Image: subcults-api:scan

Severity	Count
Critical	1
High	41
Medium	23
Low	1
Total	66

Click to see details


Report Summary

┌───────────────────────────────────┬──────────┬─────────────────┬─────────┐
│              Target               │   Type   │ Vulnerabilities │ Secrets │
├───────────────────────────────────┼──────────┼─────────────────┼─────────┤
│ subcults-api:scan (alpine 3.21.7) │  alpine  │        0        │    -    │
├───────────────────────────────────┼──────────┼─────────────────┼─────────┤
│ app/api                           │ gobinary │       66        │    -    │
└───────────────────────────────────┴──────────┴─────────────────┴─────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)


For OSS Maintainers: VEX Notice
--------------------------------
If you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement.
VEX allows you to communicate the actual status of vulnerabilities in your project, improving security transparency and reducing false positives for your users.
Learn more and start using VEX: https://trivy.dev/docs/v0.74/guide/supply-chain/vex/repo#publishing-vex-documents

To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable.


app/api (gobinary)
==================
Total: 66 (LOW: 1, MEDIUM: 23, HIGH: 41, CRITICAL: 1)

┌──────────────────────────────────────────────────────────────┬─────────────────────┬──────────┬────────┬───────────────────┬──────────────────────────────┬──────────────────────────────────────────────────────────────┐
│                           Library                            │    Vulnerability    │ Severity │ Status │ Installed Version │        Fixed Version         │                            Title                             │
├──────────────────────────────────────────────────────────────┼─────────────────────┼──────────┼────────┼───────────────────┼──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream        │ GHSA-xmrv-pmrh-hhx2 │ MEDIUM   │ fixed  │ v1.7.4            │ 1.7.8                        │ Denial of Service due to Panic in AWS SDK for Go v2...       │
│                                                              │                     │          │        │                   │                              │ https://github.com/advisories/GHSA-xmrv-pmrh-hhx2            │
├──────────────────────────────────────────────────────────────┤                     │          │        ├───────────────────┼──────────────────────────────┤                                                              │
│ github.com/aws/aws-sdk-go-v2/service/s3                      │                     │          │        │ v1.95.1           │ 1.97.3                       │                                                              │
│                                                              │                     │          │        │                   │                              │                                                              │
├──────────────────────────────────────────────────────────────┼─────────────────────┼──────────┤        ├───────────────────┼──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ github.com/go-jose/go-jose/v3                                │ CVE-2026-34986      │ HIGH     │        │ v3.0.4            │ 3.0.5                        │ github.com/go-jose/go-jose/v3:                               │
│                                                              │                     │          │        │                   │                              │ github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service    │
│                                                              │                     │          │        │                   │                              │ via crafted JSON Web Encryption...                           │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-34986                   │
├──────────────────────────────────────────────────────────────┼─────────────────────┼──────────┤        ├───────────────────┼──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ github.com/google/cel-go                                     │ GHSA-gcjh-h69q-9w9g │ MEDIUM   │        │ v0.26.1           │ 0.29.0                       │ cel-go: JSON Private Fields Exposed via NativeTypes and      │
│                                                              │                     │          │        │                   │                              │ ParseStructTag                                               │
│                                                              │                     │          │        │                   │                              │ https://github.com/advisories/GHSA-gcjh-h69q-9w9g            │
├──────────────────────────────────────────────────────────────┼─────────────────────┤          │        ├───────────────────┼──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ github.com/pion/dtls/v3                                      │ CVE-2026-26014      │          │        │ v3.0.7            │ 3.1.1, 3.0.11                │ github.com/pion/dtls: Pion DTLS uses random nonce generation │
│                                                              │                     │          │        │                   │                              │ with AES GCM ciphers risks...                                │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-26014                   │
│                                                              ├─────────────────────┤          │        │                   ├──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-54908      │          │        │                   │ 3.1.4                        │ Pion DTLS is a Go implementation of Datagram Transport Layer │
│                                                              │                     │          │        │                   │                              │ Security. ......                                             │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-54908                   │
├──────────────────────────────────────────────────────────────┼─────────────────────┤          │        ├───────────────────┼──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ github.com/pion/stun/v3                                      │ CVE-2026-54909      │          │        │ v3.0.1            │ 3.1.5                        │ pion/stun is a Go implementation of STUN. Prior to 3.1.3,    │
│                                                              │                     │          │        │                   │                              │ XORMappedAdd ......                                          │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-54909                   │
├──────────────────────────────────────────────────────────────┼─────────────────────┼──────────┤        ├───────────────────┼──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ go.opentelemetry.io/otel                                     │ CVE-2026-29181      │ HIGH     │        │ v1.38.0           │ 1.41.0                       │ github.com/open-telemetry/opentelemetry-go:                  │
│                                                              │                     │          │        │                   │                              │ OpenTelemetry-Go: Denial of Service via crafted multi-value  │
│                                                              │                     │          │        │                   │                              │ baggage headers                                              │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-29181                   │
├──────────────────────────────────────────────────────────────┼─────────────────────┼──────────┤        ├───────────────────┼──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptrace- │ CVE-2026-39882      │ MEDIUM   │        │ v1.24.0           │ 1.43.0                       │ github.com/open-telemetry/opentelemetry-go: golang:          │
│ http                                                         │                     │          │        │                   │                              │ OpenTelemetry-Go: Memory exhaustion via uncapped HTTP        │
│                                                              │                     │          │        │                   │                              │ response body reading                                        │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-39882                   │
├──────────────────────────────────────────────────────────────┼─────────────────────┼──────────┤        ├───────────────────┼──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ go.opentelemetry.io/otel/sdk                                 │ CVE-2026-24051      │ HIGH     │        │ v1.38.0           │ 1.40.0                       │ opentelemetry-go: OpenTelemetry-Go Affected by Arbitrary     │
│                                                              │                     │          │        │                   │                              │ Code Execution via PATH Hijacking                            │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-24051                   │
│                                                              ├─────────────────────┤          │        │                   ├──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-39883      │          │        │                   │ 1.43.0                       │ github.com/open-telemetry/opentelemetry-go:                  │
│                                                              │                     │          │        │                   │                              │ OpenTelemetry-Go: Arbitrary code execution via PATH          │
│                                                              │                     │          │        │                   │                              │ hijacking on BSD/Solaris                                     │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-39883                   │
├──────────────────────────────────────────────────────────────┼─────────────────────┤          │        ├───────────────────┼──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ golang.org/x/crypto                                          │ CVE-2026-39828      │          │        │ v0.45.0           │ 0.52.0                       │ golang.org/x/crypto/ssh: golang.org/x/crypto/ssh:            │
│                                                              │                     │          │        │                   │                              │ Unauthorized command execution via discarded SSH permissions │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-39828                   │
│                                                              ├─────────────────────┤          │        │                   │                              ├──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-39829      │          │        │                   │                              │ golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of  │
│                                                              │                     │          │        │                   │                              │ Service via crafted public key with excessive parameters...  │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-39829                   │
│                                                              ├─────────────────────┤          │        │                   │                              ├──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-39830      │          │        │                   │                              │ golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of  │
│                                                              │                     │          │        │                   │                              │ Service via resource leak from unsolicited SSH responses...  │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-39830                   │
│                                                              ├─────────────────────┤          │        │                   │                              ├──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-39831      │          │        │                   │                              │ golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Security   │
│                                                              │                     │          │        │                   │                              │ key bypass due to missing user presence check                │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-39831                   │
│                                                              ├─────────────────────┤          │        │                   │                              ├──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-39832      │          │        │                   │                              │ golang.org/x/crypto/ssh/agent:                               │
│                                                              │                     │          │        │                   │                              │ golang.org/x/crypto/ssh/agent: Security bypass due to        │
│                                                              │                     │          │        │                   │                              │ improper handling of key restrictions                        │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-39832                   │
│                                                              ├─────────────────────┤          │        │                   │                              ├──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-39835      │          │        │                   │                              │ golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh:    │
│                                                              │                     │          │        │                   │                              │ Denial of Service via crafted SSH certificate                │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-39835                   │
│                                                              ├─────────────────────┤          │        │                   │                              ├──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-42508      │          │        │                   │                              │ golang.org/x/crypto/ssh/knownhosts: golang:                  │
│                                                              │                     │          │        │                   │                              │ golang.org/x/crypto/ssh/knownhosts: Revocation bypass via    │
│                                                              │                     │          │        │                   │                              │ unchecked SignatureKey                                       │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-42508                   │
│                                                              ├─────────────────────┤          │        │                   │                              ├──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-46595      │          │        │                   │                              │ golang.org/x/crypto/ssh: golang.org/x/crypto/ssh:            │
│                                                              │                     │          │        │                   │                              │ Authorization bypass due to skipped source-address           │
│                                                              │                     │          │        │                   │                              │ validation                                                   │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-46595                   │
│                                                              ├─────────────────────┤          │        │                   │                              ├──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-46597      │          │        │                   │                              │ golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of  │
│                                                              │                     │          │        │                   │                              │ Service via crafted AES-GCM packet decoder inputs            │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-46597                   │
│                                                              ├─────────────────────┼──────────┤        │                   │                              ├──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-39827      │ MEDIUM   │        │                   │                              │ golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh:    │
│                                                              │                     │          │        │                   │                              │ Denial of Service via repeated rejected channel openings     │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-39827                   │
│                                                              ├─────────────────────┤          │        │                   │                              ├──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-39833      │          │        │                   │                              │ golang.org/x/crypto/ssh/agent:                               │
│                                                              │                     │          │        │                   │                              │ golang.org/x/crypto/ssh/agent: Security bypass due to        │
│                                                              │                     │          │        │                   │                              │ unenforced key confirmation                                  │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-39833                   │
│                                                              ├─────────────────────┤          │        │                   │                              ├──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-39834      │          │        │                   │                              │ golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh:    │
│                                                              │                     │          │        │                   │                              │ Denial of Service due to integer overflow in SSH...          │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-39834                   │
│                                                              ├─────────────────────┤          │        │                   │                              ├──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-46598      │          │        │                   │                              │ golang.org/x/crypto/ssh/agent: golang:                       │
│                                                              │                     │          │        │                   │                              │ golang.org/x/crypto/ssh/agent: Denial of Service via         │
│                                                              │                     │          │        │                   │                              │ malformed input                                              │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-46598                   │
├──────────────────────────────────────────────────────────────┼─────────────────────┼──────────┤        ├───────────────────┼──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ golang.org/x/mod                                             │ CVE-2026-56864      │ HIGH     │        │ v0.30.0           │ 0.40.0                       │ A malicious GOSUMDB was capable of serving arbitrary module  │
│                                                              │                     │          │        │                   │                              │ content no ......                                            │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-56864                   │
│                                                              ├─────────────────────┤          │        │                   │                              ├──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-56865      │          │        │                   │                              │ golang.org/x/mod/sumdb/tlog: golang.org/x/mod/sumdb/tlog:    │
│                                                              │                     │          │        │                   │                              │ Supply chain compromise via transparency log tile            │
│                                                              │                     │          │        │                   │                              │ verification bypass                                          │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-56865                   │
├──────────────────────────────────────────────────────────────┼─────────────────────┤          │        ├───────────────────┼──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ golang.org/x/net                                             │ CVE-2026-25681      │          │        │ v0.47.0           │ 0.55.0                       │ golang.org/x/net/html: golang.org/x/net/html: Arbitrary code │
│                                                              │                     │          │        │                   │                              │ execution via Cross-Site Scripting                           │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-25681                   │
│                                                              ├─────────────────────┤          │        │                   │                              ├──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-27136      │          │        │                   │                              │ golang.org/x/net/html: golang: golang.org/x/net/html:        │
│                                                              │                     │          │        │                   │                              │ Cross-Site Scripting via HTML parsing bypass                 │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-27136                   │
│                                                              ├─────────────────────┤          │        │                   ├──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-33814      │          │        │                   │ 0.53.0                       │ net/http/internal/http2: golang: golang.org/x/net: Go        │
│                                                              │                     │          │        │                   │                              │ HTTP/2: Denial of Service via malformed                      │
│                                                              │                     │          │        │                   │                              │ SETTINGS_MAX_FRAME_SIZE frame...                             │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-33814                   │
│                                                              ├─────────────────────┤          │        │                   ├──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-39821      │          │        │                   │ 0.55.0                       │ golang.org/x/net/idna: golang: net/http:                     │
│                                                              │                     │          │        │                   │                              │ golang.org/x/net/idna: Privilege escalation via incorrect    │
│                                                              │                     │          │        │                   │                              │ Punycode label processing                                    │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-39821                   │
│                                                              ├─────────────────────┤          │        │                   ├──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-46600      │          │        │                   │ 0.56.0                       │ golang.org/x/net/dns/dnsmessage:                             │
│                                                              │                     │          │        │                   │                              │ golang.org/x/net/dns/dnsmessage: Denial of Service via       │
│                                                              │                     │          │        │                   │                              │ invalid DNS record parsing                                   │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-46600                   │
│                                                              ├─────────────────────┼──────────┤        │                   ├──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-25680      │ MEDIUM   │        │                   │ 0.55.0                       │ golang.org/x/net/html: golang.org/x/net/html: Denial of      │
│                                                              │                     │          │        │                   │                              │ Service due to excessive HTML parsing                        │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-25680                   │
│                                                              ├─────────────────────┤          │        │                   │                              ├──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-42502      │          │        │                   │                              │ golang.org/x/net/html: golang: golang.org/x/net/html:        │
│                                                              │                     │          │        │                   │                              │ Cross-Site Scripting via unexpected HTML tree rendering      │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-42502                   │
│                                                              ├─────────────────────┤          │        │                   │                              ├──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-42506      │          │        │                   │                              │ golang.org/x/net/html: golang.org/x/net/html: Cross-Site     │
│                                                              │                     │          │        │                   │                              │ Scripting (XSS) via arbitrary HTML parsing                   │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-42506                   │
├──────────────────────────────────────────────────────────────┼─────────────────────┼──────────┤        ├───────────────────┼──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ golang.org/x/text                                            │ CVE-2026-56852      │ HIGH     │        │ v0.31.0           │ 0.39.0                       │ golang.org/x/text: golang.org/x/text: Denial of Service via  │
│                                                              │                     │          │        │                   │                              │ invalid UTF-8 input                                          │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-56852                   │
├──────────────────────────────────────────────────────────────┼─────────────────────┼──────────┤        ├───────────────────┼──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ google.golang.org/grpc                                       │ CVE-2026-33186      │ CRITICAL │        │ v1.77.0           │ 1.79.3                       │ google.golang.org/grpc/grpc-go:                              │
│                                                              │                     │          │        │                   │                              │ google.golang.org/grpc/authz: gRPC-Go: Authorization bypass  │
│                                                              │                     │          │        │                   │                              │ due to improper HTTP/2 path validation                       │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-33186                   │
│                                                              ├─────────────────────┼──────────┤        │                   ├──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│                                                              │ GHSA-hrxh-6v49-42gf │ HIGH     │        │                   │ 1.82.1                       │ gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities                 │
│                                                              │                     │          │        │                   │                              │ https://github.com/advisories/GHSA-hrxh-6v49-42gf            │
├──────────────────────────────────────────────────────────────┼─────────────────────┤          │        ├───────────────────┼──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ stdlib                                                       │ CVE-2026-25679      │          │        │ v1.24.13          │ 1.25.8, 1.26.1               │ net/url: Incorrect parsing of IPv6 host literals in net/url  │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-25679                   │
│                                                              ├─────────────────────┤          │        │                   ├──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-27145      │          │        │                   │ 1.25.11, 1.26.4              │ crypto/x509: golang: golang crypto/x509: Denial of Service   │
│                                                              │                     │          │        │                   │                              │ via excessive processing of DNS...                           │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-27145                   │
│                                                              ├─────────────────────┤          │        │                   ├──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-32280      │          │        │                   │ 1.25.9, 1.26.2               │ crypto/x509: crypto/tls: golang: Go: Denial of Service       │
│                                                              │                     │          │        │                   │                              │ vulnerability in certificate chain building...               │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-32280                   │
│                                                              ├─────────────────────┤          │        │                   │                              ├──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-32281      │          │        │                   │                              │ crypto/x509: golang: Go crypto/x509: Denial of Service via   │
│                                                              │                     │          │        │                   │                              │ inefficient certificate chain validation...                  │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-32281                   │
│                                                              ├─────────────────────┤          │        │                   │                              ├──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-32283      │          │        │                   │                              │ crypto/tls: golang: Go crypto/tls: Denial of Service via     │
│                                                              │                     │          │        │                   │                              │ multiple TLS 1.3 key...                                      │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-32283                   │
│                                                              ├─────────────────────┤          │        │                   ├──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-33811      │          │        │                   │ 1.25.10, 1.26.3              │ net: golang: Go net package: Denial of Service via long      │
│                                                              │                     │          │        │                   │                              │ CNAME response...                                            │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-33811                   │
│                                                              ├─────────────────────┤          │        │                   │                              ├──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-33814      │          │        │                   │                              │ net/http/internal/http2: golang: golang.org/x/net: Go        │
│                                                              │                     │          │        │                   │                              │ HTTP/2: Denial of Service via malformed                      │
│                                                              │                     │          │        │                   │                              │ SETTINGS_MAX_FRAME_SIZE frame...                             │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-33814                   │
│                                                              ├─────────────────────┤          │        │                   ├──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-33818      │          │        │                   │ 1.25.13, 1.26.6, 1.27.0-rc.3 │ encoding/asn1: golang: Go encoding/asn1: Denial of Service   │
│                                                              │                     │          │        │                   │                              │ via excessive recursion in Unmarshal...                      │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-33818                   │
│                                                              ├─────────────────────┤          │        │                   ├──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-39820      │          │        │                   │ 1.25.10, 1.26.3              │ net/mail: golang: Go net/mail: Denial of Service via crafted │
│                                                              │                     │          │        │                   │                              │ email inputs                                                 │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-39820                   │
│                                                              ├─────────────────────┤          │        │                   ├──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-39821      │          │        │                   │ 1.25.13, 1.26.6, 1.27.0-rc.3 │ golang.org/x/net/idna: golang: net/http:                     │
│                                                              │                     │          │        │                   │                              │ golang.org/x/net/idna: Privilege escalation via incorrect    │
│                                                              │                     │          │        │                   │                              │ Punycode label processing                                    │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-39821                   │
│                                                              ├─────────────────────┤          │        │                   ├──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-39822      │          │        │                   │ 1.25.12, 1.26.5, 1.27.0-rc.2 │ golang: Go os.Root: Symlink following vulnerability allows   │
│                                                              │                     │          │        │                   │                              │ directory traversal                                          │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-39822                   │
│                                                              ├─────────────────────┤          │        │                   ├──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-39836      │          │        │                   │ 1.25.10, 1.26.3              │ net: golang: Go net package: Denial of Service via NUL byte  │
│                                                              │                     │          │        │                   │                              │ in...                                                        │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-39836                   │
│                                                              ├─────────────────────┤          │        │                   │                              ├──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-42499      │          │        │                   │                              │ net/mail: golang: net/mail: Denial of Service via            │
│                                                              │                     │          │        │                   │                              │ pathological email address parsing                           │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-42499                   │
│                                                              ├─────────────────────┤          │        │                   ├──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-42504      │          │        │                   │ 1.25.11, 1.26.4              │ mime: golang: Golang MIME: Denial of Service via             │
│                                                              │                     │          │        │                   │                              │ maliciously-crafted MIME header                              │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-42504                   │
│                                                              ├─────────────────────┤          │        │                   ├──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-56853      │          │        │                   │ 1.25.13, 1.26.6, 1.27.0-rc.3 │ net/http: golang: Go net/http: Unencrypted HTTP/2            │
│                                                              │                     │          │        │                   │                              │ connections vulnerable to Denial of Service...               │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-56853                   │
│                                                              ├─────────────────────┤          │        │                   │                              ├──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-56858      │          │        │                   │                              │ html/template: golang: Go html/template: Cross-Site          │
│                                                              │                     │          │        │                   │                              │ Scripting via pathological input                             │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-56858                   │
│                                                              ├─────────────────────┤          │        │                   │                              ├──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-56859      │          │        │                   │                              │ encoding/xml: golang: Go: Denial of Service via XML decoding │
│                                                              │                     │          │        │                   │                              │ recursion depth issue...                                     │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-56859                   │
│                                                              ├─────────────────────┤          │        │                   │                              ├──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-56860      │          │        │                   │                              │ net/url: golang: golang net/url: Denial of Service from      │
│                                                              │                     │          │        │                   │                              │ quadratic complexity in path...                              │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-56860                   │
│                                                              ├─────────────────────┤          │        │                   │                              ├──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-56862      │          │        │                   │                              │ crypto/tls: golang: Golang crypto/tls: Denial of Service via │
│                                                              │                     │          │        │                   │                              │ indefinite KeyUpdate messages                                │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-56862                   │
│                                                              ├─────────────────────┼──────────┤        │                   ├──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-27142      │ MEDIUM   │        │                   │ 1.25.8, 1.26.1               │ html/template: URLs in meta content attribute actions are    │
│                                                              │                     │          │        │                   │                              │ not escaped in html/template...                              │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-27142                   │
│                                                              ├─────────────────────┤          │        │                   ├──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-32282      │          │        │                   │ 1.25.9, 1.26.2               │ golang: internal/syscall/unix: Root.Chmod can follow         │
│                                                              │                     │          │        │                   │                              │ symlinks out of the root                                     │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-32282                   │
│                                                              ├─────────────────────┤          │        │                   │                              ├──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-32288      │          │        │                   │                              │ archive/tar: golang: Go's archive/tar package: Denial of     │
│                                                              │                     │          │        │                   │                              │ Service via maliciously-crafted archive                      │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-32288                   │
│                                                              ├─────────────────────┤          │        │                   │                              ├──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-32289      │          │        │                   │                              │ html/template: golang: html/template: Cross-Site Scripting   │
│                                                              │                     │          │        │                   │                              │ (XSS) via improper context and brace depth...                │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-32289                   │
│                                                              ├─────────────────────┤          │        │                   ├──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-39823      │          │        │                   │ 1.25.10, 1.26.3              │ html/template: golang: Go html/template: Cross-Site          │
│                                                              │                     │          │        │                   │                              │ Scripting via improper URL escaping in meta...               │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-39823                   │
│                                                              ├─────────────────────┤          │        │                   │                              ├──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-39825      │          │        │                   │                              │ net/http/httputil: golang: net/http/httputil: ReverseProxy   │
│                                                              │                     │          │        │                   │                              │ forwards hidden query parameters, potentially bypassing      │
│                                                              │                     │          │        │                   │                              │ security controls...                                         │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-39825                   │
│                                                              ├─────────────────────┤          │        │                   │                              ├──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-39826      │          │        │                   │                              │ html/template: golang: html/template: Cross-site scripting   │
│                                                              │                     │          │        │                   │                              │ due to incorrect script tag escaping                         │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-39826                   │
│                                                              ├─────────────────────┤          │        │                   ├──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-42505      │          │        │                   │ 1.25.12, 1.26.5, 1.27.0-rc.2 │ crypto/tls: golang: Go crypto/tls: Information disclosure in │
│                                                              │                     │          │        │                   │                              │ Encrypted Client Hello                                       │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-42505                   │
│                                                              ├─────────────────────┤          │        │                   ├──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-42507      │          │        │                   │ 1.25.11, 1.26.4              │ net/textproto: golang: Golang net/textproto: Misleading      │
│                                                              │                     │          │        │                   │                              │ error messages via input injection                           │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-42507                   │
│                                                              ├─────────────────────┼──────────┤        │                   ├──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-27139      │ LOW      │        │                   │ 1.25.8, 1.26.1               │ os: FileInfo can escape from a Root in golang os module      │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-27139                   │
└──────────────────────────────────────────────────────────────┴─────────────────────┴──────────┴────────┴───────────────────┴──────────────────────────────┴──────────────────────────────────────────────────────────────┘

github-actions · 2026-08-31T09:32:00Z

NPM Vulnerability Scan Results - e2e

Severity	Count
Critical	0
High	2
Moderate	3
Low	0
Total	5

Click to see details

# npm audit report

body-parser  <=1.20.5 || 2.0.0-beta.1 - 2.0.2
Severity: moderate
body-parser vulnerable to denial of service when invalid limit value silently disables size enforcement - https://github.com/advisories/GHSA-v422-hmwv-36x6
Depends on vulnerable versions of qs
fix available via `npm audit fix`
node_modules/body-parser

path-to-regexp  <0.1.13
Severity: high
path-to-regexp vulnerable to Regular Expression Denial of Service via multiple route parameters - https://github.com/advisories/GHSA-37ch-88jc-xwx2
fix available via `npm audit fix`
node_modules/path-to-regexp

qs  6.7.0 - 6.15.1
Severity: moderate
qs's arrayLimit bypass in comma parsing allows denial of service - https://github.com/advisories/GHSA-w7fw-mjwx-w883
qs has a remotely triggerable DoS: qs.stringify crashes with TypeError on null/undefined entries in comma-format arrays when encodeValuesOnly is set - https://github.com/advisories/GHSA-q8mj-m7cp-5q26
fix available via `npm audit fix`
node_modules/qs
  express  4.21.0 - 4.22.1 || 5.0.0-alpha.1 - 5.0.1
  Depends on vulnerable versions of qs
  node_modules/express

ws  8.0.0 - 8.20.1
Severity: high
ws: Uninitialized memory disclosure - https://github.com/advisories/GHSA-58qx-3vcg-4xpx
ws: Memory exhaustion DoS from tiny fragments and data chunks - https://github.com/advisories/GHSA-96hv-2xvq-fx4p
fix available via `npm audit fix`
node_modules/ws

5 vulnerabilities (3 moderate, 2 high)

To address all issues, run:
  npm audit fix

github-actions · 2026-08-31T09:32:34Z

NPM Vulnerability Scan Results - web

Severity	Count
Critical	3
High	11
Moderate	6
Low	1
Total	21

Click to see details

# npm audit report

@babel/core  <=7.29.0
@babel/core: Arbitrary File Read via sourceMappingURL Comment - https://github.com/advisories/GHSA-4x5r-pxfx-6jf8
fix available via `npm audit fix`
node_modules/@babel/core

@remix-run/router  1.3.0 - 1.23.2
Severity: moderate
React Router's same-origin redirect with path starting // causes open redirect via protocol-relative URL reinterpretation - https://github.com/advisories/GHSA-2j2x-hqr9-3h42
fix available via `npm audit fix`
node_modules/@remix-run/router
  react-router  6.0.0 - 7.17.0
  Depends on vulnerable versions of @remix-run/router
  node_modules/react-router
    react-router-dom  6.0.0-alpha.0 - 7.17.0
    Depends on vulnerable versions of @remix-run/router
    Depends on vulnerable versions of react-router
    node_modules/react-router-dom

ajv  <6.14.0
Severity: moderate
ajv has ReDoS when using `$data` option - https://github.com/advisories/GHSA-2g4f-4pwh-qvx6
fix available via `npm audit fix`
node_modules/ajv

brace-expansion  <=1.1.17 || 2.0.0 - 2.1.3
Severity: high
brace-expansion: Zero-step sequence causes process hang and memory exhaustion - https://github.com/advisories/GHSA-f886-m6hf-6m8v
brace-expansion: Zero-step sequence causes process hang and memory exhaustion - https://github.com/advisories/GHSA-f886-m6hf-6m8v
brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups - https://github.com/advisories/GHSA-3jxr-9vmj-r5cp
brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups - https://github.com/advisories/GHSA-3jxr-9vmj-r5cp
brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash - https://github.com/advisories/GHSA-mh99-v99m-4gvg
brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash - https://github.com/advisories/GHSA-mh99-v99m-4gvg
brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation - https://github.com/advisories/GHSA-rgw5-rvv9-x895
brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation - https://github.com/advisories/GHSA-rgw5-rvv9-x895
fix available via `npm audit fix`
node_modules/@typescript-eslint/typescript-estree/node_modules/brace-expansion
node_modules/brace-expansion

flatted  <=3.4.1
Severity: high
flatted vulnerable to unbounded recursion DoS in parse() revive phase - https://github.com/advisories/GHSA-25h7-pfq9-p65f
Prototype Pollution via parse() in NodeJS flatted - https://github.com/advisories/GHSA-rf6f-7fwh-wjgh
fix available via `npm audit fix`
node_modules/flatted

i18next-http-backend  <3.0.5
Severity: moderate
 i18next-http-backend has Path Traversal & URL Injection via Unsanitised lng/ns - https://github.com/advisories/GHSA-q89c-q3h5-w34g
fix available via `npm audit fix`
node_modules/i18next-http-backend

js-yaml  4.0.0 - 4.3.0
Severity: high
JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases - https://github.com/advisories/GHSA-h67p-54hq-rp68
js-yaml: YAML merge-key chains can force quadratic CPU consumption - https://github.com/advisories/GHSA-52cp-r559-cp3m
JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported - https://github.com/advisories/GHSA-5p4m-2wfm-xmqj
fix available via `npm audit fix`
node_modules/js-yaml

lodash-es  <=4.17.23
Severity: high
lodash vulnerable to Code Injection via `_.template` imports key names - https://github.com/advisories/GHSA-r5fr-rjxr-66jc
lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit` - https://github.com/advisories/GHSA-f23m-r3pf-42rh
fix available via `npm audit fix`
node_modules/lodash-es

minimatch  <=3.1.3 || 9.0.0 - 9.0.6
Severity: high
minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern - https://github.com/advisories/GHSA-3ppc-4f35-3m26
minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern - https://github.com/advisories/GHSA-3ppc-4f35-3m26
minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments - https://github.com/advisories/GHSA-7r86-cg39-jmmj
minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments - https://github.com/advisories/GHSA-7r86-cg39-jmmj
minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions - https://github.com/advisories/GHSA-23c5-xmqv-rm74
minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions - https://github.com/advisories/GHSA-23c5-xmqv-rm74
fix available via `npm audit fix`
node_modules/@typescript-eslint/typescript-estree/node_modules/minimatch
node_modules/minimatch

nanoid  <=3.3.17
Severity: high
nanoid: non-secure generators can loop indefinitely with negative size - https://github.com/advisories/GHSA-28wg-ghj8-5hjv
nanoid: custom generators can loop indefinitely when size is zero - https://github.com/advisories/GHSA-2v37-7h3g-55p8
fix available via `npm audit fix`
node_modules/nanoid

picomatch  <=2.3.1 || 4.0.0 - 4.0.3
Severity: high
Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching - https://github.com/advisories/GHSA-3v7f-55p6-f55p
Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching - https://github.com/advisories/GHSA-3v7f-55p6-f55p
Picomatch has a ReDoS vulnerability via extglob quantifiers - https://github.com/advisories/GHSA-c2c7-rcm5-vvqj
Picomatch has a ReDoS vulnerability via extglob quantifiers - https://github.com/advisories/GHSA-c2c7-rcm5-vvqj
fix available via `npm audit fix`
node_modules/picomatch
node_modules/rollup-plugin-visualizer/node_modules/picomatch
node_modules/tinyglobby/node_modules/picomatch
node_modules/vite/node_modules/picomatch
node_modules/vitest/node_modules/picomatch

postcss  <=8.5.22
Severity: high
PostCSS has XSS via Unescaped </style> in its CSS Stringify Output - https://github.com/advisories/GHSA-qx2v-qp2m-jg93
PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments - https://github.com/advisories/GHSA-6g55-p6wh-862q
PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset - https://github.com/advisories/GHSA-fxqj-rqcc-2cmp
PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure - https://github.com/advisories/GHSA-r28c-9q8g-f849
fix available via `npm audit fix`
node_modules/postcss

protocol-buffers-schema  <3.6.1
Severity: moderate
Mafintosh's protocol-buffers-schema is vulnerable to prototype pollution - https://github.com/advisories/GHSA-j452-xhg8-qg39
fix available via `npm audit fix`
node_modules/protocol-buffers-schema



rollup  4.0.0 - 4.58.0
Severity: high
Rollup 4 has Arbitrary File Write via Path Traversal - https://github.com/advisories/GHSA-mw96-cpmx-2vgc
fix available via `npm audit fix`
node_modules/rollup

vite  7.0.0 - 7.3.3
Severity: high
Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling - https://github.com/advisories/GHSA-4w7w-66w2-5vf9
Vite: `server.fs.deny` bypassed with queries - https://github.com/advisories/GHSA-v2wj-q39q-566r
Vite Vulnerable to Arbitrary File Read via Vite Dev Server WebSocket - https://github.com/advisories/GHSA-p9ff-h696-f583
launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows - https://github.com/advisories/GHSA-v6wh-96g9-6wx3
vite: `server.fs.deny` bypass on Windows alternate paths - https://github.com/advisories/GHSA-fx2h-pf6j-xcff
fix available via `npm audit fix`
node_modules/vite

vitest  4.0.0-beta.1 - 4.1.0-beta.6
Severity: critical
Depends on vulnerable versions of @vitest/ui
When Vitest UI server is listening, arbitrary file can be read and executed - https://github.com/advisories/GHSA-5xrq-8626-4rwp
fix available via `npm audit fix`
node_modules/vitest
  @vitest/coverage-v8  4.0.0-beta.1 - 4.1.0-beta.6
  Depends on vulnerable versions of vitest
  node_modules/@vitest/coverage-v8
  @vitest/ui  4.0.0-beta.1 - 4.1.0-beta.6
  Depends on vulnerable versions of vitest
  node_modules/@vitest/ui

ws  8.0.0 - 8.20.1
Severity: high
ws: Uninitialized memory disclosure - https://github.com/advisories/GHSA-58qx-3vcg-4xpx
ws: Memory exhaustion DoS from tiny fragments and data chunks - https://github.com/advisories/GHSA-96hv-2xvq-fx4p
fix available via `npm audit fix`
node_modules/ws

21 vulnerabilities (1 low, 6 moderate, 11 high, 3 critical)

To address all issues, run:
  npm audit fix

dependabot Bot added the dependencies Pull requests that update a dependency file label Aug 31, 2026

Navigation Menu

chore(deps)(deps): bump i18next from 25.7.2 to 26.4.0 in /web - #84

chore(deps)(deps): bump i18next from 25.7.2 to 26.4.0 in /web#84
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/web/i18next-26.4.0

dependabot Bot commented on behalf of github Aug 31, 2026

Uh oh!

dependabot Bot commented on behalf of github Aug 31, 2026

Uh oh!

github-actions Bot commented Aug 31, 2026

Uh oh!

github-actions Bot commented Aug 31, 2026

Uh oh!

github-actions Bot commented Aug 31, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Aug 31, 2026

v26.4.0

v26.3.6

v26.3.5

v26.3.4

v26.3.3

v26.3.2

v26.3.1

v26.3.0

v26.2.0

v26.1.0

v26.0.10

v26.0.9

v26.0.8

v26.0.7

v26.0.6

26.4.0

26.3.6

26.3.5

26.3.4

26.3.3

26.3.2

26.3.1

26.3.0

26.2.0

26.1.0

26.0.10

26.0.9

Uh oh!

dependabot Bot commented on behalf of github Aug 31, 2026

Labels

Uh oh!

github-actions Bot commented Aug 31, 2026

Docker Image Scan Results - Dockerfile.api

Uh oh!

github-actions Bot commented Aug 31, 2026

NPM Vulnerability Scan Results - e2e

Uh oh!

github-actions Bot commented Aug 31, 2026

NPM Vulnerability Scan Results - web

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants