build(deps): bump @commitlint/config-conventional from 21.0.1 to 21.0.2 in /dependencies by dependabot[bot] · Pull Request #36 · step-security/super-linter

dependabot · 2026-06-10T11:30:47Z

Bumps @commitlint/config-conventional from 21.0.1 to 21.0.2.

Release notes

Sourced from @commitlint/config-conventional's releases.

v21.0.2

21.0.2 (2026-05-29)

Bug Fixes

fix: emit actionable error when --edit cannot find COMMIT_EDITMSG (#589) by @escapedcat in conventional-changelog/commitlint#4755

fix: apply oxfmt formatting to get-edit-commit.ts by @escapedcat in conventional-changelog/commitlint#4768

fix(read): fail when --from and --to share no merge-base #4555 by @CervEdin in conventional-changelog/commitlint#4754

fix: disallow same commit hash for --from and --to by @knocte in conventional-changelog/commitlint#4773

Chore/CI

ci: have renovate rebase stale PRs before merging by @escapedcat in conventional-changelog/commitlint#4782

chore: have renovate hold PRs for 3 days after release by @escapedcat in conventional-changelog/commitlint#4788

chore: anchor vite 8 by @escapedcat in conventional-changelog/commitlint#4790

ci: run commitlint once per same-repo PR by @escapedcat in conventional-changelog/commitlint#4795

New Contributors

@CervEdin made their first contribution in conventional-changelog/commitlint#4754

Full Changelog: conventional-changelog/commitlint@v21.0.1...v21.0.2

Changelog

Sourced from @commitlint/config-conventional's changelog.

21.0.2 (2026-05-29)

Note: Version bump only for package @commitlint/config-conventional

Commits

8069048 v21.0.2
See full diff in compare view

github-actions · 2026-06-10T12:41:02Z

Super-linter summary

Language	Validation result
BIOME_FORMAT	Pass ✅
BIOME_LINT	Pass ✅
CHECKOV	Pass ✅
EDITORCONFIG	Pass ✅
GITLEAKS	Pass ✅
GIT_COMMITLINT	Pass ✅
GIT_MERGE_CONFLICT_MARKERS	Pass ✅
JSCPD	Pass ✅
JSON	Pass ✅
JSON_PRETTIER	Pass ✅
PRE_COMMIT	Pass ✅
SPELL_CODESPELL	Pass ✅
TRIVY	Fail ❌

Super-linter detected linting errors

For more information, see the
GitHub Actions workflow run

Powered by Super-linter

TRIVY

trivy filesystem --config /github/workspace/.github/linters/trivy.yaml /github/workspace

Report Summary

┌─────────────────────────────────────┬────────────┬─────────────────┬───────────────────┬─────────┐
│               Target                │    Type    │ Vulnerabilities │ Misconfigurations │ Secrets │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ dependencies/Gemfile.lock           │  bundler   │        0        │         -         │    -    │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ dependencies/composer/composer.lock │  composer  │        0        │         -         │    -    │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ dependencies/package-lock.json      │    npm     │       15        │         -         │    -    │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ Dockerfile                          │ dockerfile │        -        │         0         │    -    │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ test/linters/trivy/good/Dockerfile  │ dockerfile │        -        │         0         │    -    │
└─────────────────────────────────────┴────────────┴─────────────────┴───────────────────┴─────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)


For OSS Maintainers: VEX Notice
--------------------------------
If you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement.
VEX allows you to communicate the actual status of vulnerabilities in your project, improving security transparency and reducing false positives for your users.
Learn more and start using VEX: https://trivy.dev/docs/v0.70/guide/supply-chain/vex/repo#publishing-vex-documents

To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable.


dependencies/package-lock.json (npm)
====================================
Total: 15 (UNKNOWN: 0, LOW: 0, MEDIUM: 10, HIGH: 5, CRITICAL: 0)

┌────────────┬────────────────┬──────────┬────────┬───────────────────┬───────────────┬──────────────────────────────────────────────────────────────┐
│  Library   │ Vulnerability  │ Severity │ Status │ Installed Version │ Fixed Version │                            Title                             │
├────────────┼────────────────┼──────────┼────────┼───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ hono       │ CVE-2026-47673 │ MEDIUM   │ fixed  │ 4.12.18           │ 4.12.21       │ Hono: JWT middleware accepts any Authorization scheme, not   │
│            │                │          │        │                   │               │ only Bearer                                                  │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-47673                   │
│            ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│            │ CVE-2026-47674 │          │        │                   │               │ Hono: IP Restriction bypasses static deny rules for          │
│            │                │          │        │                   │               │ non-canonical IPv6                                           │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-47674                   │
│            ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│            │ CVE-2026-47675 │          │        │                   │               │ Hono: Cookie helper does not sanitize sameSite and priority, │
│            │                │          │        │                   │               │ allowing Set-Cookie injection...                             │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-47675                   │
│            ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│            │ CVE-2026-47676 │          │        │                   │               │ Hono: app.mount() strips mount prefix using undecoded path,  │
│            │                │          │        │                   │               │ causing incorrect routing for...                             │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-47676                   │
├────────────┼────────────────┤          │        ├───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ postcss    │ CVE-2026-41305 │          │        │ 8.4.31            │ 8.5.10        │ postcss: PostCSS: Cross-Site Scripting (XSS) via improper    │
│            │                │          │        │                   │               │ escaping of style closing tags...                            │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-41305                   │
├────────────┼────────────────┼──────────┤        ├───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ protobufjs │ CVE-2026-44289 │ HIGH     │        │ 8.0.1             │ 7.5.6, 8.0.2  │ protobuf.js: Denial of service through unbounded protobuf    │
│            │                │          │        │                   │               │ recursion                                                    │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-44289                   │
│            ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│            │ CVE-2026-44290 │          │        │                   │               │ protobuf.js: Process-wide denial of service through unsafe   │
│            │                │          │        │                   │               │ option paths                                                 │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-44290                   │
│            ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│            │ CVE-2026-44291 │          │        │                   │               │ protobuf.js: Code generation gadget after prototype          │
│            │                │          │        │                   │               │ pollution                                                    │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-44291                   │
│            ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│            │ CVE-2026-44293 │          │        │                   │               │ protobuf.js: Code injection through bytes field defaults in  │
│            │                │          │        │                   │               │ generated toObject code                                      │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-44293                   │
│            ├────────────────┼──────────┤        │                   │               ├──────────────────────────────────────────────────────────────┤
│            │ CVE-2026-44288 │ MEDIUM   │        │                   │               │ protobufjs has overlong UTF-8 decoding                       │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-44288                   │
│            ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│            │ CVE-2026-44292 │          │        │                   │               │ protobuf.js: Prototype injection in generated message        │
│            │                │          │        │                   │               │ constructors                                                 │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-44292                   │
│            ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│            │ CVE-2026-44294 │          │        │                   │               │ protobuf.js: Denial of service from crafted field names in   │
│            │                │          │        │                   │               │ generated code                                               │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-44294                   │
│            ├────────────────┤          │        │                   ├───────────────┼──────────────────────────────────────────────────────────────┤
│            │ CVE-2026-45740 │          │        │                   │ 7.5.8, 8.2.0  │ protobufjs: Denial of Service via unbounded recursive JSON   │
│            │                │          │        │                   │               │ descriptor expansion                                         │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-45740                   │
├────────────┼────────────────┤          │        ├───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ qs         │ CVE-2026-8723  │          │        │ 6.14.2            │ 6.15.2        │ ### Summary `qs.stringify` throws `TypeError` when called    │
│            │                │          │        │                   │               │ with `arr...                                                 │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-8723                    │
├────────────┼────────────────┼──────────┤        ├───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ simple-git │ CVE-2026-6951  │ HIGH     │        │ 3.35.2            │ 3.36.0        │ simple-git: simple-git: Remote Code Execution due to         │
│            │                │          │        │                   │               │ incomplete fix bypass                                        │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-6951                    │
└────────────┴────────────────┴──────────┴────────┴───────────────────┴───────────────┴──────────────────────────────────────────────────────────────┘

github-actions · 2026-06-10T12:41:21Z

Super-linter summary

Language	Validation result
BIOME_FORMAT	Pass ✅
BIOME_LINT	Pass ✅
CHECKOV	Pass ✅
EDITORCONFIG	Pass ✅
GITLEAKS	Pass ✅
GIT_COMMITLINT	Pass ✅
GIT_MERGE_CONFLICT_MARKERS	Pass ✅
JSCPD	Pass ✅
JSON	Pass ✅
JSON_PRETTIER	Pass ✅
PRE_COMMIT	Pass ✅
SPELL_CODESPELL	Pass ✅
TRIVY	Fail ❌

Super-linter detected linting errors

For more information, see the
GitHub Actions workflow run

Powered by Super-linter

TRIVY

trivy filesystem --config /github/workspace/.github/linters/trivy.yaml /github/workspace

Report Summary

┌─────────────────────────────────────┬────────────┬─────────────────┬───────────────────┬─────────┐
│               Target                │    Type    │ Vulnerabilities │ Misconfigurations │ Secrets │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ dependencies/Gemfile.lock           │  bundler   │        0        │         -         │    -    │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ dependencies/composer/composer.lock │  composer  │        0        │         -         │    -    │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ dependencies/package-lock.json      │    npm     │       15        │         -         │    -    │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ Dockerfile                          │ dockerfile │        -        │         0         │    -    │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ test/linters/trivy/good/Dockerfile  │ dockerfile │        -        │         0         │    -    │
└─────────────────────────────────────┴────────────┴─────────────────┴───────────────────┴─────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)


For OSS Maintainers: VEX Notice
--------------------------------
If you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement.
VEX allows you to communicate the actual status of vulnerabilities in your project, improving security transparency and reducing false positives for your users.
Learn more and start using VEX: https://trivy.dev/docs/v0.70/guide/supply-chain/vex/repo#publishing-vex-documents

To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable.


dependencies/package-lock.json (npm)
====================================
Total: 15 (UNKNOWN: 0, LOW: 0, MEDIUM: 10, HIGH: 5, CRITICAL: 0)

┌────────────┬────────────────┬──────────┬────────┬───────────────────┬───────────────┬──────────────────────────────────────────────────────────────┐
│  Library   │ Vulnerability  │ Severity │ Status │ Installed Version │ Fixed Version │                            Title                             │
├────────────┼────────────────┼──────────┼────────┼───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ hono       │ CVE-2026-47673 │ MEDIUM   │ fixed  │ 4.12.18           │ 4.12.21       │ Hono: JWT middleware accepts any Authorization scheme, not   │
│            │                │          │        │                   │               │ only Bearer                                                  │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-47673                   │
│            ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│            │ CVE-2026-47674 │          │        │                   │               │ Hono: IP Restriction bypasses static deny rules for          │
│            │                │          │        │                   │               │ non-canonical IPv6                                           │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-47674                   │
│            ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│            │ CVE-2026-47675 │          │        │                   │               │ Hono: Cookie helper does not sanitize sameSite and priority, │
│            │                │          │        │                   │               │ allowing Set-Cookie injection...                             │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-47675                   │
│            ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│            │ CVE-2026-47676 │          │        │                   │               │ Hono: app.mount() strips mount prefix using undecoded path,  │
│            │                │          │        │                   │               │ causing incorrect routing for...                             │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-47676                   │
├────────────┼────────────────┤          │        ├───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ postcss    │ CVE-2026-41305 │          │        │ 8.4.31            │ 8.5.10        │ postcss: PostCSS: Cross-Site Scripting (XSS) via improper    │
│            │                │          │        │                   │               │ escaping of style closing tags...                            │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-41305                   │
├────────────┼────────────────┼──────────┤        ├───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ protobufjs │ CVE-2026-44289 │ HIGH     │        │ 8.0.1             │ 7.5.6, 8.0.2  │ protobuf.js: Denial of service through unbounded protobuf    │
│            │                │          │        │                   │               │ recursion                                                    │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-44289                   │
│            ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│            │ CVE-2026-44290 │          │        │                   │               │ protobuf.js: Process-wide denial of service through unsafe   │
│            │                │          │        │                   │               │ option paths                                                 │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-44290                   │
│            ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│            │ CVE-2026-44291 │          │        │                   │               │ protobuf.js: Code generation gadget after prototype          │
│            │                │          │        │                   │               │ pollution                                                    │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-44291                   │
│            ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│            │ CVE-2026-44293 │          │        │                   │               │ protobuf.js: Code injection through bytes field defaults in  │
│            │                │          │        │                   │               │ generated toObject code                                      │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-44293                   │
│            ├────────────────┼──────────┤        │                   │               ├──────────────────────────────────────────────────────────────┤
│            │ CVE-2026-44288 │ MEDIUM   │        │                   │               │ protobufjs has overlong UTF-8 decoding                       │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-44288                   │
│            ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│            │ CVE-2026-44292 │          │        │                   │               │ protobuf.js: Prototype injection in generated message        │
│            │                │          │        │                   │               │ constructors                                                 │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-44292                   │
│            ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│            │ CVE-2026-44294 │          │        │                   │               │ protobuf.js: Denial of service from crafted field names in   │
│            │                │          │        │                   │               │ generated code                                               │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-44294                   │
│            ├────────────────┤          │        │                   ├───────────────┼──────────────────────────────────────────────────────────────┤
│            │ CVE-2026-45740 │          │        │                   │ 7.5.8, 8.2.0  │ protobufjs: Denial of Service via unbounded recursive JSON   │
│            │                │          │        │                   │               │ descriptor expansion                                         │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-45740                   │
├────────────┼────────────────┤          │        ├───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ qs         │ CVE-2026-8723  │          │        │ 6.14.2            │ 6.15.2        │ ### Summary `qs.stringify` throws `TypeError` when called    │
│            │                │          │        │                   │               │ with `arr...                                                 │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-8723                    │
├────────────┼────────────────┼──────────┤        ├───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ simple-git │ CVE-2026-6951  │ HIGH     │        │ 3.35.2            │ 3.36.0        │ simple-git: simple-git: Remote Code Execution due to         │
│            │                │          │        │                   │               │ incomplete fix bypass                                        │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-6951                    │
└────────────┴────────────────┴──────────┴────────┴───────────────────┴───────────────┴──────────────────────────────────────────────────────────────┘

github-actions · 2026-06-10T12:41:36Z

Super-linter summary

Language	Validation result
BIOME_FORMAT	Pass ✅
BIOME_LINT	Pass ✅
CHECKOV	Pass ✅
EDITORCONFIG	Pass ✅
GITLEAKS	Pass ✅
GIT_COMMITLINT	Pass ✅
GIT_MERGE_CONFLICT_MARKERS	Pass ✅
JSCPD	Pass ✅
JSON	Pass ✅
JSON_PRETTIER	Pass ✅
PRE_COMMIT	Pass ✅
SPELL_CODESPELL	Pass ✅
TRIVY	Fail ❌

Super-linter detected linting errors

For more information, see the
GitHub Actions workflow run

Powered by Super-linter

TRIVY


Report Summary

┌─────────────────────────────────────┬────────────┬─────────────────┬───────────────────┬─────────┐
│               Target                │    Type    │ Vulnerabilities │ Misconfigurations │ Secrets │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ dependencies/Gemfile.lock           │  bundler   │        0        │         -         │    -    │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ dependencies/composer/composer.lock │  composer  │        0        │         -         │    -    │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ dependencies/package-lock.json      │    npm     │       15        │         -         │    -    │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ Dockerfile                          │ dockerfile │        -        │         0         │    -    │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ test/linters/trivy/good/Dockerfile  │ dockerfile │        -        │         0         │    -    │
└─────────────────────────────────────┴────────────┴─────────────────┴───────────────────┴─────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)


For OSS Maintainers: VEX Notice
--------------------------------
If you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement.
VEX allows you to communicate the actual status of vulnerabilities in your project, improving security transparency and reducing false positives for your users.
Learn more and start using VEX: https://trivy.dev/docs/v0.70/guide/supply-chain/vex/repo#publishing-vex-documents

To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable.


dependencies/package-lock.json (npm)
====================================
Total: 15 (UNKNOWN: 0, LOW: 0, MEDIUM: 10, HIGH: 5, CRITICAL: 0)

┌────────────┬────────────────┬──────────┬────────┬───────────────────┬───────────────┬──────────────────────────────────────────────────────────────┐
│  Library   │ Vulnerability  │ Severity │ Status │ Installed Version │ Fixed Version │                            Title                             │
├────────────┼────────────────┼──────────┼────────┼───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ hono       │ CVE-2026-47673 │ MEDIUM   │ fixed  │ 4.12.18           │ 4.12.21       │ Hono: JWT middleware accepts any Authorization scheme, not   │
│            │                │          │        │                   │               │ only Bearer                                                  │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-47673                   │
│            ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│            │ CVE-2026-47674 │          │        │                   │               │ Hono: IP Restriction bypasses static deny rules for          │
│            │                │          │        │                   │               │ non-canonical IPv6                                           │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-47674                   │
│            ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│            │ CVE-2026-47675 │          │        │                   │               │ Hono: Cookie helper does not sanitize sameSite and priority, │
│            │                │          │        │                   │               │ allowing Set-Cookie injection...                             │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-47675                   │
│            ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│            │ CVE-2026-47676 │          │        │                   │               │ Hono: app.mount() strips mount prefix using undecoded path,  │
│            │                │          │        │                   │               │ causing incorrect routing for...                             │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-47676                   │
├────────────┼────────────────┤          │        ├───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ postcss    │ CVE-2026-41305 │          │        │ 8.4.31            │ 8.5.10        │ postcss: PostCSS: Cross-Site Scripting (XSS) via improper    │
│            │                │          │        │                   │               │ escaping of style closing tags...                            │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-41305                   │
├────────────┼────────────────┼──────────┤        ├───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ protobufjs │ CVE-2026-44289 │ HIGH     │        │ 8.0.1             │ 7.5.6, 8.0.2  │ protobuf.js: Denial of service through unbounded protobuf    │
│            │                │          │        │                   │               │ recursion                                                    │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-44289                   │
│            ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│            │ CVE-2026-44290 │          │        │                   │               │ protobuf.js: Process-wide denial of service through unsafe   │
│            │                │          │        │                   │               │ option paths                                                 │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-44290                   │
│            ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│            │ CVE-2026-44291 │          │        │                   │               │ protobuf.js: Code generation gadget after prototype          │
│            │                │          │        │                   │               │ pollution                                                    │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-44291                   │
│            ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│            │ CVE-2026-44293 │          │        │                   │               │ protobuf.js: Code injection through bytes field defaults in  │
│            │                │          │        │                   │               │ generated toObject code                                      │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-44293                   │
│            ├────────────────┼──────────┤        │                   │               ├──────────────────────────────────────────────────────────────┤
│            │ CVE-2026-44288 │ MEDIUM   │        │                   │               │ protobufjs has overlong UTF-8 decoding                       │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-44288                   │
│            ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│            │ CVE-2026-44292 │          │        │                   │               │ protobuf.js: Prototype injection in generated message        │
│            │                │          │        │                   │               │ constructors                                                 │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-44292                   │
│            ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│            │ CVE-2026-44294 │          │        │                   │               │ protobuf.js: Denial of service from crafted field names in   │
│            │                │          │        │                   │               │ generated code                                               │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-44294                   │
│            ├────────────────┤          │        │                   ├───────────────┼──────────────────────────────────────────────────────────────┤
│            │ CVE-2026-45740 │          │        │                   │ 7.5.8, 8.2.0  │ protobufjs: Denial of Service via unbounded recursive JSON   │
│            │                │          │        │                   │               │ descriptor expansion                                         │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-45740                   │
├────────────┼────────────────┤          │        ├───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ qs         │ CVE-2026-8723  │          │        │ 6.14.2            │ 6.15.2        │ ### Summary `qs.stringify` throws `TypeError` when called    │
│            │                │          │        │                   │               │ with `arr...                                                 │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-8723                    │
├────────────┼────────────────┼──────────┤        ├───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ simple-git │ CVE-2026-6951  │ HIGH     │        │ 3.35.2            │ 3.36.0        │ simple-git: simple-git: Remote Code Execution due to         │
│            │                │          │        │                   │               │ incomplete fix bypass                                        │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-6951                    │
└────────────┴────────────────┴──────────┴────────┴───────────────────┴───────────────┴──────────────────────────────────────────────────────────────┘

github-actions · 2026-06-10T12:41:54Z

Super-linter summary

Language	Validation result
BIOME_FORMAT	Pass ✅
BIOME_LINT	Pass ✅
CHECKOV	Pass ✅
EDITORCONFIG	Pass ✅
GITLEAKS	Pass ✅
GIT_COMMITLINT	Pass ✅
GIT_MERGE_CONFLICT_MARKERS	Pass ✅
JSCPD	Pass ✅
JSON	Pass ✅
JSON_PRETTIER	Pass ✅
PRE_COMMIT	Pass ✅
SPELL_CODESPELL	Pass ✅
TRIVY	Fail ❌

Super-linter detected linting errors

For more information, see the
GitHub Actions workflow run

Powered by Super-linter

TRIVY


Report Summary

┌─────────────────────────────────────┬────────────┬─────────────────┬───────────────────┬─────────┐
│               Target                │    Type    │ Vulnerabilities │ Misconfigurations │ Secrets │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ dependencies/Gemfile.lock           │  bundler   │        0        │         -         │    -    │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ dependencies/composer/composer.lock │  composer  │        0        │         -         │    -    │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ dependencies/package-lock.json      │    npm     │       15        │         -         │    -    │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ Dockerfile                          │ dockerfile │        -        │         0         │    -    │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ test/linters/trivy/good/Dockerfile  │ dockerfile │        -        │         0         │    -    │
└─────────────────────────────────────┴────────────┴─────────────────┴───────────────────┴─────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)


For OSS Maintainers: VEX Notice
--------------------------------
If you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement.
VEX allows you to communicate the actual status of vulnerabilities in your project, improving security transparency and reducing false positives for your users.
Learn more and start using VEX: https://trivy.dev/docs/v0.70/guide/supply-chain/vex/repo#publishing-vex-documents

To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable.


dependencies/package-lock.json (npm)
====================================
Total: 15 (UNKNOWN: 0, LOW: 0, MEDIUM: 10, HIGH: 5, CRITICAL: 0)

┌────────────┬────────────────┬──────────┬────────┬───────────────────┬───────────────┬──────────────────────────────────────────────────────────────┐
│  Library   │ Vulnerability  │ Severity │ Status │ Installed Version │ Fixed Version │                            Title                             │
├────────────┼────────────────┼──────────┼────────┼───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ hono       │ CVE-2026-47673 │ MEDIUM   │ fixed  │ 4.12.18           │ 4.12.21       │ Hono: JWT middleware accepts any Authorization scheme, not   │
│            │                │          │        │                   │               │ only Bearer                                                  │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-47673                   │
│            ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│            │ CVE-2026-47674 │          │        │                   │               │ Hono: IP Restriction bypasses static deny rules for          │
│            │                │          │        │                   │               │ non-canonical IPv6                                           │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-47674                   │
│            ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│            │ CVE-2026-47675 │          │        │                   │               │ Hono: Cookie helper does not sanitize sameSite and priority, │
│            │                │          │        │                   │               │ allowing Set-Cookie injection...                             │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-47675                   │
│            ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│            │ CVE-2026-47676 │          │        │                   │               │ Hono: app.mount() strips mount prefix using undecoded path,  │
│            │                │          │        │                   │               │ causing incorrect routing for...                             │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-47676                   │
├────────────┼────────────────┤          │        ├───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ postcss    │ CVE-2026-41305 │          │        │ 8.4.31            │ 8.5.10        │ postcss: PostCSS: Cross-Site Scripting (XSS) via improper    │
│            │                │          │        │                   │               │ escaping of style closing tags...                            │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-41305                   │
├────────────┼────────────────┼──────────┤        ├───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ protobufjs │ CVE-2026-44289 │ HIGH     │        │ 8.0.1             │ 7.5.6, 8.0.2  │ protobuf.js: Denial of service through unbounded protobuf    │
│            │                │          │        │                   │               │ recursion                                                    │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-44289                   │
│            ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│            │ CVE-2026-44290 │          │        │                   │               │ protobuf.js: Process-wide denial of service through unsafe   │
│            │                │          │        │                   │               │ option paths                                                 │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-44290                   │
│            ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│            │ CVE-2026-44291 │          │        │                   │               │ protobuf.js: Code generation gadget after prototype          │
│            │                │          │        │                   │               │ pollution                                                    │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-44291                   │
│            ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│            │ CVE-2026-44293 │          │        │                   │               │ protobuf.js: Code injection through bytes field defaults in  │
│            │                │          │        │                   │               │ generated toObject code                                      │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-44293                   │
│            ├────────────────┼──────────┤        │                   │               ├──────────────────────────────────────────────────────────────┤
│            │ CVE-2026-44288 │ MEDIUM   │        │                   │               │ protobufjs has overlong UTF-8 decoding                       │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-44288                   │
│            ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│            │ CVE-2026-44292 │          │        │                   │               │ protobuf.js: Prototype injection in generated message        │
│            │                │          │        │                   │               │ constructors                                                 │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-44292                   │
│            ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│            │ CVE-2026-44294 │          │        │                   │               │ protobuf.js: Denial of service from crafted field names in   │
│            │                │          │        │                   │               │ generated code                                               │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-44294                   │
│            ├────────────────┤          │        │                   ├───────────────┼──────────────────────────────────────────────────────────────┤
│            │ CVE-2026-45740 │          │        │                   │ 7.5.8, 8.2.0  │ protobufjs: Denial of Service via unbounded recursive JSON   │
│            │                │          │        │                   │               │ descriptor expansion                                         │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-45740                   │
├────────────┼────────────────┤          │        ├───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ qs         │ CVE-2026-8723  │          │        │ 6.14.2            │ 6.15.2        │ ### Summary `qs.stringify` throws `TypeError` when called    │
│            │                │          │        │                   │               │ with `arr...                                                 │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-8723                    │
├────────────┼────────────────┼──────────┤        ├───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ simple-git │ CVE-2026-6951  │ HIGH     │        │ 3.35.2            │ 3.36.0        │ simple-git: simple-git: Remote Code Execution due to         │
│            │                │          │        │                   │               │ incomplete fix bypass                                        │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-6951                    │
└────────────┴────────────────┴──────────┴────────┴───────────────────┴───────────────┴──────────────────────────────────────────────────────────────┘

Bumps [@commitlint/config-conventional](https://github.com/conventional-changelog/commitlint/tree/HEAD/@commitlint/config-conventional) from 21.0.1 to 21.0.2. - [Release notes](https://github.com/conventional-changelog/commitlint/releases) - [Changelog](https://github.com/conventional-changelog/commitlint/blob/master/@commitlint/config-conventional/CHANGELOG.md) - [Commits](https://github.com/conventional-changelog/commitlint/commits/v21.0.2/@commitlint/config-conventional) --- updated-dependencies: - dependency-name: "@commitlint/config-conventional" dependency-version: 21.0.2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>

github-actions · 2026-06-11T07:11:52Z

Super-linter summary

Language	Validation result
BIOME_FORMAT	Pass ✅
BIOME_LINT	Pass ✅
CHECKOV	Pass ✅
EDITORCONFIG	Pass ✅
GITLEAKS	Pass ✅
GIT_COMMITLINT	Pass ✅
GIT_MERGE_CONFLICT_MARKERS	Pass ✅
JSCPD	Pass ✅
JSON	Pass ✅
JSON_PRETTIER	Pass ✅
PRE_COMMIT	Pass ✅
SPELL_CODESPELL	Pass ✅
TRIVY	Fail ❌

Super-linter detected linting errors

For more information, see the
GitHub Actions workflow run

Powered by Super-linter

TRIVY

trivy filesystem --config /github/workspace/.github/linters/trivy.yaml /github/workspace

Report Summary

┌─────────────────────────────────────┬────────────┬─────────────────┬───────────────────┬─────────┐
│               Target                │    Type    │ Vulnerabilities │ Misconfigurations │ Secrets │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ dependencies/Gemfile.lock           │  bundler   │        0        │         -         │    -    │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ dependencies/composer/composer.lock │  composer  │        0        │         -         │    -    │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ dependencies/package-lock.json      │    npm     │        1        │         -         │    -    │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ Dockerfile                          │ dockerfile │        -        │         0         │    -    │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ test/linters/trivy/good/Dockerfile  │ dockerfile │        -        │         0         │    -    │
└─────────────────────────────────────┴────────────┴─────────────────┴───────────────────┴─────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)


For OSS Maintainers: VEX Notice
--------------------------------
If you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement.
VEX allows you to communicate the actual status of vulnerabilities in your project, improving security transparency and reducing false positives for your users.
Learn more and start using VEX: https://trivy.dev/docs/v0.71/guide/supply-chain/vex/repo#publishing-vex-documents

To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable.


dependencies/package-lock.json (npm)
====================================
Total: 1 (UNKNOWN: 0, LOW: 0, MEDIUM: 1, HIGH: 0, CRITICAL: 0)

┌─────────┬────────────────┬──────────┬────────┬───────────────────┬───────────────┬───────────────────────────────────────────────────────────┐
│ Library │ Vulnerability  │ Severity │ Status │ Installed Version │ Fixed Version │                           Title                           │
├─────────┼────────────────┼──────────┼────────┼───────────────────┼───────────────┼───────────────────────────────────────────────────────────┤
│ postcss │ CVE-2026-41305 │ MEDIUM   │ fixed  │ 8.4.31            │ 8.5.10        │ postcss: PostCSS: Cross-Site Scripting (XSS) via improper │
│         │                │          │        │                   │               │ escaping of style closing tags...                         │
│         │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-41305                │
└─────────┴────────────────┴──────────┴────────┴───────────────────┴───────────────┴───────────────────────────────────────────────────────────┘

github-actions · 2026-06-11T07:12:26Z

Super-linter summary

Language	Validation result
BIOME_FORMAT	Pass ✅
BIOME_LINT	Pass ✅
CHECKOV	Pass ✅
EDITORCONFIG	Pass ✅
GITLEAKS	Pass ✅
GIT_COMMITLINT	Pass ✅
GIT_MERGE_CONFLICT_MARKERS	Pass ✅
JSCPD	Pass ✅
JSON	Pass ✅
JSON_PRETTIER	Pass ✅
PRE_COMMIT	Pass ✅
SPELL_CODESPELL	Pass ✅
TRIVY	Fail ❌

Super-linter detected linting errors

For more information, see the
GitHub Actions workflow run

Powered by Super-linter

TRIVY


Report Summary

┌─────────────────────────────────────┬────────────┬─────────────────┬───────────────────┬─────────┐
│               Target                │    Type    │ Vulnerabilities │ Misconfigurations │ Secrets │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ dependencies/Gemfile.lock           │  bundler   │        0        │         -         │    -    │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ dependencies/composer/composer.lock │  composer  │        0        │         -         │    -    │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ dependencies/package-lock.json      │    npm     │        1        │         -         │    -    │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ Dockerfile                          │ dockerfile │        -        │         0         │    -    │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ test/linters/trivy/good/Dockerfile  │ dockerfile │        -        │         0         │    -    │
└─────────────────────────────────────┴────────────┴─────────────────┴───────────────────┴─────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)


For OSS Maintainers: VEX Notice
--------------------------------
If you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement.
VEX allows you to communicate the actual status of vulnerabilities in your project, improving security transparency and reducing false positives for your users.
Learn more and start using VEX: https://trivy.dev/docs/v0.71/guide/supply-chain/vex/repo#publishing-vex-documents

To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable.


dependencies/package-lock.json (npm)
====================================
Total: 1 (UNKNOWN: 0, LOW: 0, MEDIUM: 1, HIGH: 0, CRITICAL: 0)

┌─────────┬────────────────┬──────────┬────────┬───────────────────┬───────────────┬───────────────────────────────────────────────────────────┐
│ Library │ Vulnerability  │ Severity │ Status │ Installed Version │ Fixed Version │                           Title                           │
├─────────┼────────────────┼──────────┼────────┼───────────────────┼───────────────┼───────────────────────────────────────────────────────────┤
│ postcss │ CVE-2026-41305 │ MEDIUM   │ fixed  │ 8.4.31            │ 8.5.10        │ postcss: PostCSS: Cross-Site Scripting (XSS) via improper │
│         │                │          │        │                   │               │ escaping of style closing tags...                         │
│         │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-41305                │
└─────────┴────────────────┴──────────┴────────┴───────────────────┴───────────────┴───────────────────────────────────────────────────────────┘

github-actions · 2026-06-11T07:12:27Z

Super-linter summary

Language	Validation result
BIOME_FORMAT	Pass ✅
BIOME_LINT	Pass ✅
CHECKOV	Pass ✅
EDITORCONFIG	Pass ✅
GITLEAKS	Pass ✅
GIT_COMMITLINT	Pass ✅
GIT_MERGE_CONFLICT_MARKERS	Pass ✅
JSCPD	Pass ✅
JSON	Pass ✅
JSON_PRETTIER	Pass ✅
PRE_COMMIT	Pass ✅
SPELL_CODESPELL	Pass ✅
TRIVY	Fail ❌

Super-linter detected linting errors

For more information, see the
GitHub Actions workflow run

Powered by Super-linter

TRIVY

trivy filesystem --config /github/workspace/.github/linters/trivy.yaml /github/workspace

Report Summary

┌─────────────────────────────────────┬────────────┬─────────────────┬───────────────────┬─────────┐
│               Target                │    Type    │ Vulnerabilities │ Misconfigurations │ Secrets │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ dependencies/Gemfile.lock           │  bundler   │        0        │         -         │    -    │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ dependencies/composer/composer.lock │  composer  │        0        │         -         │    -    │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ dependencies/package-lock.json      │    npm     │        1        │         -         │    -    │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ Dockerfile                          │ dockerfile │        -        │         0         │    -    │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ test/linters/trivy/good/Dockerfile  │ dockerfile │        -        │         0         │    -    │
└─────────────────────────────────────┴────────────┴─────────────────┴───────────────────┴─────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)


For OSS Maintainers: VEX Notice
--------------------------------
If you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement.
VEX allows you to communicate the actual status of vulnerabilities in your project, improving security transparency and reducing false positives for your users.
Learn more and start using VEX: https://trivy.dev/docs/v0.71/guide/supply-chain/vex/repo#publishing-vex-documents

To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable.


dependencies/package-lock.json (npm)
====================================
Total: 1 (UNKNOWN: 0, LOW: 0, MEDIUM: 1, HIGH: 0, CRITICAL: 0)

┌─────────┬────────────────┬──────────┬────────┬───────────────────┬───────────────┬───────────────────────────────────────────────────────────┐
│ Library │ Vulnerability  │ Severity │ Status │ Installed Version │ Fixed Version │                           Title                           │
├─────────┼────────────────┼──────────┼────────┼───────────────────┼───────────────┼───────────────────────────────────────────────────────────┤
│ postcss │ CVE-2026-41305 │ MEDIUM   │ fixed  │ 8.4.31            │ 8.5.10        │ postcss: PostCSS: Cross-Site Scripting (XSS) via improper │
│         │                │          │        │                   │               │ escaping of style closing tags...                         │
│         │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-41305                │
└─────────┴────────────────┴──────────┴────────┴───────────────────┴───────────────┴───────────────────────────────────────────────────────────┘

github-actions · 2026-06-11T07:13:01Z

Super-linter summary

Language	Validation result
BIOME_FORMAT	Pass ✅
BIOME_LINT	Pass ✅
CHECKOV	Pass ✅
EDITORCONFIG	Pass ✅
GITLEAKS	Pass ✅
GIT_COMMITLINT	Pass ✅
GIT_MERGE_CONFLICT_MARKERS	Pass ✅
JSCPD	Pass ✅
JSON	Pass ✅
JSON_PRETTIER	Pass ✅
PRE_COMMIT	Pass ✅
SPELL_CODESPELL	Pass ✅
TRIVY	Fail ❌

Super-linter detected linting errors

For more information, see the
GitHub Actions workflow run

Powered by Super-linter

TRIVY


Report Summary

┌─────────────────────────────────────┬────────────┬─────────────────┬───────────────────┬─────────┐
│               Target                │    Type    │ Vulnerabilities │ Misconfigurations │ Secrets │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ dependencies/Gemfile.lock           │  bundler   │        0        │         -         │    -    │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ dependencies/composer/composer.lock │  composer  │        0        │         -         │    -    │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ dependencies/package-lock.json      │    npm     │        1        │         -         │    -    │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ Dockerfile                          │ dockerfile │        -        │         0         │    -    │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ test/linters/trivy/good/Dockerfile  │ dockerfile │        -        │         0         │    -    │
└─────────────────────────────────────┴────────────┴─────────────────┴───────────────────┴─────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)


For OSS Maintainers: VEX Notice
--------------------------------
If you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement.
VEX allows you to communicate the actual status of vulnerabilities in your project, improving security transparency and reducing false positives for your users.
Learn more and start using VEX: https://trivy.dev/docs/v0.71/guide/supply-chain/vex/repo#publishing-vex-documents

To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable.


dependencies/package-lock.json (npm)
====================================
Total: 1 (UNKNOWN: 0, LOW: 0, MEDIUM: 1, HIGH: 0, CRITICAL: 0)

┌─────────┬────────────────┬──────────┬────────┬───────────────────┬───────────────┬───────────────────────────────────────────────────────────┐
│ Library │ Vulnerability  │ Severity │ Status │ Installed Version │ Fixed Version │                           Title                           │
├─────────┼────────────────┼──────────┼────────┼───────────────────┼───────────────┼───────────────────────────────────────────────────────────┤
│ postcss │ CVE-2026-41305 │ MEDIUM   │ fixed  │ 8.4.31            │ 8.5.10        │ postcss: PostCSS: Cross-Site Scripting (XSS) via improper │
│         │                │          │        │                   │               │ escaping of style closing tags...                         │
│         │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-41305                │
└─────────┴────────────────┴──────────┴────────┴───────────────────┴───────────────┴───────────────────────────────────────────────────────────┘

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jun 10, 2026

dependabot Bot force-pushed the dependabot/npm_and_yarn/dependencies/commitlint/config-conventional-21.0.2 branch from 3dbb455 to 3a7b795 Compare June 11, 2026 06:16

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

build(deps): bump @commitlint/config-conventional from 21.0.1 to 21.0.2 in /dependencies#36

build(deps): bump @commitlint/config-conventional from 21.0.1 to 21.0.2 in /dependencies#36
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/dependencies/commitlint/config-conventional-21.0.2

dependabot Bot commented on behalf of github Jun 10, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Jun 10, 2026

Uh oh!

github-actions Bot commented Jun 10, 2026

Uh oh!

github-actions Bot commented Jun 10, 2026

Uh oh!

github-actions Bot commented Jun 10, 2026

Uh oh!

github-actions Bot commented Jun 11, 2026

Uh oh!

github-actions Bot commented Jun 11, 2026

Uh oh!

github-actions Bot commented Jun 11, 2026

Uh oh!

github-actions Bot commented Jun 11, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Jun 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v21.0.2

21.0.2 (2026-05-29)

Bug Fixes

Chore/CI

New Contributors

21.0.2 (2026-05-29)

Uh oh!

github-actions Bot commented Jun 10, 2026

Super-linter summary

Uh oh!

github-actions Bot commented Jun 10, 2026

Super-linter summary

Uh oh!

github-actions Bot commented Jun 10, 2026

Super-linter summary

Uh oh!

github-actions Bot commented Jun 10, 2026

Super-linter summary

Uh oh!

github-actions Bot commented Jun 11, 2026

Super-linter summary

Uh oh!

github-actions Bot commented Jun 11, 2026

Super-linter summary

Uh oh!

github-actions Bot commented Jun 11, 2026

Super-linter summary

Uh oh!

github-actions Bot commented Jun 11, 2026

Super-linter summary

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Jun 10, 2026 •

edited

Loading