Repository navigation
Bump morgan from 1.10.0 to 1.12.1 in /server - #110
dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [morgan](https://github.com/expressjs/morgan) from 1.10.0 to 1.12.1. - [Release notes](https://github.com/expressjs/morgan/releases) - [Changelog](https://github.com/expressjs/morgan/blob/master/HISTORY.md) - [Commits](expressjs/morgan@1.10.0...1.12.1) --- updated-dependencies: - dependency-name: morgan dependency-version: 1.12.1 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
![xhawk-ai[bot]](https://avatars.githubusercontent.com/in/2457056?s=60&v=4){kind=small}
There was a problem hiding this comment.
📋 Review Summary — Ready to merge
Summary
The change bumps the server's morgan dependency and refreshes its lockfile entries for morgan, on-finished, and on-headers. The application only uses Morgan's built-in dev and common formats with a normal file stream, and no compatibility or lockfile correctness issues were found.
Findings
- js-yaml 4.1.0 has 5 known advisories ↗
- minimatch 3.1.2 has 3 known advisories ↗
- @faker-js/faker 7.6.0 has 1 known advisory ↗
- @tootallnate/once 1.1.2 has 1 known advisory ↗
- serve-static 1.15.0 has 1 known advisory ↗
- ajv 6.12.6 has 1 known advisory ↗
- axios 0.25.0 has 23 known advisories ↗
- axios 1.2.3 has 7 known advisories ↗
- form-data 4.0.0 has 2 known advisories ↗
- body-parser 1.20.1 has 2 known advisories ↗
- qs 6.11.0 has 3 known advisories ↗
- brace-expansion 1.1.11 has 5 known advisories ↗
- braces 3.0.2 has 1 known advisory ↗
- cloudinary 1.33.0 has 1 known advisory ↗
- lodash 4.17.21 has 2 known advisories ↗
- cookie 0.5.0 has 1 known advisory ↗
- diff 4.0.2 has 1 known advisory ↗
- express 4.18.2 has 2 known advisories ↗
- path-to-regexp 0.1.7 has 2 known advisories ↗
- send 0.18.0 has 1 known advisory ↗
- flatted 3.2.7 has 2 known advisories ↗
- follow-redirects 1.15.2 has 3 known advisories ↗
- ip 1.1.8 has 2 known advisories ↗
- jws 3.2.2 has 1 known advisory ↗
- micromatch 4.0.5 has 1 known advisory ↗
- picomatch 2.3.1 has 2 known advisories ↗
- multer 1.4.5-lts.1 has 11 known advisories ↗
- semver 5.7.1 has 1 known advisory ↗
- word-wrap 1.2.3 has 1 known advisory ↗
- sha.js 2.4.11 has 1 known advisory ↗
- shell-quote 1.7.4 has 2 known advisories ↗
- toml 2.3.6 has 2 known advisories ↗
- typeorm 0.3.11 has 3 known advisories ↗
- uuid 8.3.2 has 1 known advisory ↗
- xml2js 0.4.23 has 1 known advisory ↗
- vm2 3.9.13 has 41 known advisories ↗
Commands
Re-review the latest changes:
@xhawk-ai review again
Resolve all review threads and post a summary:
@xhawk-ai resolve all
Fix with agent prompt
These are the findings from a code review of this pull request.
## 1. @faker-js/faker 7.6.0 has 1 known advisory
Path: server/yarn.lock
Line: 27
This file is not part of the pull request's diff.
Bug: [CVE-2026-73231](https://osv.dev/vulnerability/CVE-2026-73231). Faker: helpers.fake exploitable into arbritary code execution
Cause: `server/yarn.lock` resolves `@faker-js/faker` to 7.6.0, which OSV lists as affected by 1 advisory. Highest CVSS 7.8. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `@faker-js/faker` to 10.5.0 or later in `server/yarn.lock`.
## 2. @tootallnate/once 1.1.2 has 1 known advisory
Path: server/yarn.lock
Line: 97
This file is not part of the pull request's diff.
Bug: [CVE-2026-3449](https://osv.dev/vulnerability/CVE-2026-3449). @tootallnate/once vulnerable to Incorrect Control Flow Scoping
Cause: `server/yarn.lock` resolves `@tootallnate/once` to 1.1.2, which OSV lists as affected by 1 advisory. Highest CVSS 3.3. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `@tootallnate/once` to 3.0.1 or later in `server/yarn.lock`.
## 3. ajv 6.12.6 has 1 known advisory
Path: server/yarn.lock
Line: 357
This file is not part of the pull request's diff.
Bug: [CVE-2025-69873](https://osv.dev/vulnerability/CVE-2025-69873). ajv has ReDoS when using `$data` option
Cause: `server/yarn.lock` resolves `ajv` to 6.12.6, which OSV lists as affected by 1 advisory. Highest CVSS 5.5. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `ajv` to 8.18.0 or later in `server/yarn.lock`.
## 4. axios 0.25.0 has 23 known advisories
Path: server/yarn.lock
Line: 432
This file is not part of the pull request's diff.
Bug: [CVE-2023-45857](https://osv.dev/vulnerability/CVE-2023-45857), [CVE-2025-27152](https://osv.dev/vulnerability/CVE-2025-27152), [CVE-2025-62718](https://osv.dev/vulnerability/CVE-2025-62718), [CVE-2026-25639](https://osv.dev/vulnerability/CVE-2026-25639), and 19 more. axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge
Cause: `server/yarn.lock` resolves `axios` to 0.25.0, which OSV lists as affected by 23 advisories. Highest CVSS 8.6. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `axios` to 1.18.0 or later in `server/yarn.lock`.
## 5. axios 1.2.3 has 7 known advisories
Path: server/yarn.lock
Line: 439
This file is not part of the pull request's diff.
Bug: [CVE-2025-58754](https://osv.dev/vulnerability/CVE-2025-58754), [CVE-2026-42037](https://osv.dev/vulnerability/CVE-2026-42037), [CVE-2026-42044](https://osv.dev/vulnerability/CVE-2026-42044), [CVE-2026-42264](https://osv.dev/vulnerability/CVE-2026-42264), and 3 more. axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`
Cause: `server/yarn.lock` resolves `axios` to 1.2.3, which OSV lists as affected by 7 advisories. Highest CVSS 8.7. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `axios` to 1.16.0 or later in `server/yarn.lock`.
## 6. body-parser 1.20.1 has 2 known advisories
Path: server/yarn.lock
Line: 480
This file is not part of the pull request's diff.
Bug: [CVE-2024-45590](https://osv.dev/vulnerability/CVE-2024-45590), [CVE-2026-12590](https://osv.dev/vulnerability/CVE-2026-12590). body-parser vulnerable to denial of service when url encoding is enabled
Cause: `server/yarn.lock` resolves `body-parser` to 1.20.1, which OSV lists as affected by 2 advisories. Highest CVSS 8.7. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `body-parser` to 1.20.6 or later in `server/yarn.lock`.
## 7. brace-expansion 1.1.11 has 5 known advisories
Path: server/yarn.lock
Line: 500
This file is not part of the pull request's diff.
Bug: [CVE-2025-5889](https://osv.dev/vulnerability/CVE-2025-5889), [CVE-2026-13149](https://osv.dev/vulnerability/CVE-2026-13149), [CVE-2026-14257](https://osv.dev/vulnerability/CVE-2026-14257), [CVE-2026-33750](https://osv.dev/vulnerability/CVE-2026-33750), and 1 more. brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups
Cause: `server/yarn.lock` resolves `brace-expansion` to 1.1.11, which OSV lists as affected by 5 advisories. Highest CVSS 7.7. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `brace-expansion` to 5.0.8 or later in `server/yarn.lock`.
## 8. braces 3.0.2 has 1 known advisory
Path: server/yarn.lock
Line: 513
This file is not part of the pull request's diff.
Bug: [CVE-2024-4068](https://osv.dev/vulnerability/CVE-2024-4068). Uncontrolled resource consumption in braces
Cause: `server/yarn.lock` resolves `braces` to 3.0.2, which OSV lists as affected by 1 advisory. Highest CVSS 7.5. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `braces` to 3.0.3 or later in `server/yarn.lock`.
## 9. cloudinary 1.33.0 has 1 known advisory
Path: server/yarn.lock
Line: 634
This file is not part of the pull request's diff.
Bug: [CVE-2025-12613](https://osv.dev/vulnerability/CVE-2025-12613). Cloudinary Node SDK is vulnerable to Arbitrary Argument Injection through parameters that include an ampersand
Cause: `server/yarn.lock` resolves `cloudinary` to 1.33.0, which OSV lists as affected by 1 advisory. Highest CVSS 8.8. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `cloudinary` to 2.7.0 or later in `server/yarn.lock`.
## 10. cookie 0.5.0 has 1 known advisory
Path: server/yarn.lock
Line: 712
This file is not part of the pull request's diff.
Bug: [CVE-2024-47764](https://osv.dev/vulnerability/CVE-2024-47764). cookie accepts cookie name, path, and domain with out of bounds characters
Cause: `server/yarn.lock` resolves `cookie` to 0.5.0, which OSV lists as affected by 1 advisory. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `cookie` to 0.7.0 or later in `server/yarn.lock`.
## 11. diff 4.0.2 has 1 known advisory
Path: server/yarn.lock
Line: 831
This file is not part of the pull request's diff.
Bug: [CVE-2026-24001](https://osv.dev/vulnerability/CVE-2026-24001). jsdiff has a Denial of Service vulnerability in parsePatch and applyPatch
Cause: `server/yarn.lock` resolves `diff` to 4.0.2, which OSV lists as affected by 1 advisory. Highest CVSS 2.7. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `diff` to 8.0.3 or later in `server/yarn.lock`.
## 12. express 4.18.2 has 2 known advisories
Path: server/yarn.lock
Line: 1057
This file is not part of the pull request's diff.
Bug: [CVE-2024-29041](https://osv.dev/vulnerability/CVE-2024-29041), [CVE-2024-43796](https://osv.dev/vulnerability/CVE-2024-43796). express vulnerable to XSS via response.redirect()
Cause: `server/yarn.lock` resolves `express` to 4.18.2, which OSV lists as affected by 2 advisories. Highest CVSS 6.1. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `express` to 4.20.0 or later in `server/yarn.lock`.
## 13. flatted 3.2.7 has 2 known advisories
Path: server/yarn.lock
Line: 1182
This file is not part of the pull request's diff.
Bug: [CVE-2026-32141](https://osv.dev/vulnerability/CVE-2026-32141), [CVE-2026-33228](https://osv.dev/vulnerability/CVE-2026-33228). flatted vulnerable to unbounded recursion DoS in parse() revive phase
Cause: `server/yarn.lock` resolves `flatted` to 3.2.7, which OSV lists as affected by 2 advisories. Highest CVSS 8.9. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `flatted` to 3.4.2 or later in `server/yarn.lock`.
## 14. follow-redirects 1.15.2 has 3 known advisories
Path: server/yarn.lock
Line: 1187
This file is not part of the pull request's diff.
Bug: [CVE-2023-26159](https://osv.dev/vulnerability/CVE-2023-26159), [CVE-2024-28849](https://osv.dev/vulnerability/CVE-2024-28849), [CVE-2026-40895](https://osv.dev/vulnerability/CVE-2026-40895). follow-redirects' Proxy-Authorization header kept across hosts
Cause: `server/yarn.lock` resolves `follow-redirects` to 1.15.2, which OSV lists as affected by 3 advisories. Highest CVSS 6.9. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `follow-redirects` to 1.16.0 or later in `server/yarn.lock`.
## 15. form-data 4.0.0 has 2 known advisories
Path: server/yarn.lock
Line: 445
This file is not part of the pull request's diff.
Bug: [CVE-2025-7783](https://osv.dev/vulnerability/CVE-2025-7783), [CVE-2026-12143](https://osv.dev/vulnerability/CVE-2026-12143). form-data uses unsafe random function in form-data for choosing boundary
Cause: `server/yarn.lock` resolves `form-data` to 4.0.0, which OSV lists as affected by 2 advisories. Highest CVSS 9.4. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `form-data` to 2.5.6 or later in `server/yarn.lock`.
## 16. ip 1.1.8 has 2 known advisories
Path: server/yarn.lock
Line: 1438
This file is not part of the pull request's diff.
Bug: [CVE-2023-42282](https://osv.dev/vulnerability/CVE-2023-42282), [CVE-2024-29415](https://osv.dev/vulnerability/CVE-2024-29415). ip SSRF improper categorization in isPublic
Cause: `server/yarn.lock` resolves `ip` to 1.1.8, which OSV lists as affected by 2 advisories. Highest CVSS 8.1. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `ip` to 2.0.1 or later in `server/yarn.lock`.
## 17. js-yaml 4.1.0 has 5 known advisories
Path: server/yarn.lock
Line: 23
This file is not part of the pull request's diff.
Bug: [CVE-2025-64718](https://osv.dev/vulnerability/CVE-2025-64718), [CVE-2026-53550](https://osv.dev/vulnerability/CVE-2026-53550), [CVE-2026-59869](https://osv.dev/vulnerability/CVE-2026-59869), [CVE-2026-84375](https://osv.dev/vulnerability/CVE-2026-84375), and 1 more. js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources
Cause: `server/yarn.lock` resolves `js-yaml` to 4.1.0, which OSV lists as affected by 5 advisories. Highest CVSS 7.5. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `js-yaml` to 4.3.2 or later in `server/yarn.lock`.
## 18. jws 3.2.2 has 1 known advisory
Path: server/yarn.lock
Line: 1542
This file is not part of the pull request's diff.
Bug: [CVE-2025-65945](https://osv.dev/vulnerability/CVE-2025-65945). auth0/node-jws Improperly Verifies HMAC Signature
Cause: `server/yarn.lock` resolves `jws` to 3.2.2, which OSV lists as affected by 1 advisory. Highest CVSS 7.5. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `jws` to 3.2.3 or later in `server/yarn.lock`.
## 19. lodash 4.17.21 has 2 known advisories
Path: server/yarn.lock
Line: 641
This file is not part of the pull request's diff.
Bug: [CVE-2021-23337](https://osv.dev/vulnerability/CVE-2021-23337), [CVE-2025-13465](https://osv.dev/vulnerability/CVE-2025-13465). lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`
Cause: `server/yarn.lock` resolves `lodash` to 4.17.21, which OSV lists as affected by 2 advisories. Highest CVSS 8.1. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `lodash` to 4.18.0 or later in `server/yarn.lock`.
## 20. micromatch 4.0.5 has 1 known advisory
Path: server/yarn.lock
Line: 1651
This file is not part of the pull request's diff.
Bug: [CVE-2024-4067](https://osv.dev/vulnerability/CVE-2024-4067). Regular Expression Denial of Service (ReDoS) in micromatch
Cause: `server/yarn.lock` resolves `micromatch` to 4.0.5, which OSV lists as affected by 1 advisory. Highest CVSS 5.3. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `micromatch` to 4.0.8 or later in `server/yarn.lock`.
## 21. minimatch 3.1.2 has 3 known advisories
Path: server/yarn.lock
Line: 24
This file is not part of the pull request's diff.
Bug: [CVE-2026-26996](https://osv.dev/vulnerability/CVE-2026-26996), [CVE-2026-27903](https://osv.dev/vulnerability/CVE-2026-27903), [CVE-2026-27904](https://osv.dev/vulnerability/CVE-2026-27904). minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions
Cause: `server/yarn.lock` resolves `minimatch` to 3.1.2, which OSV lists as affected by 3 advisories. Highest CVSS 8.7. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `minimatch` to 10.2.3 or later in `server/yarn.lock`.
## 22. multer 1.4.5-lts.1 has 11 known advisories
Path: server/yarn.lock
Line: 1731
This file is not part of the pull request's diff.
Bug: [CVE-2025-47935](https://osv.dev/vulnerability/CVE-2025-47935), [CVE-2025-47944](https://osv.dev/vulnerability/CVE-2025-47944), [CVE-2025-48997](https://osv.dev/vulnerability/CVE-2025-48997), [CVE-2025-7338](https://osv.dev/vulnerability/CVE-2025-7338), and 7 more. Multer vulnerable to Denial of Service via memory leaks from unclosed streams
Cause: `server/yarn.lock` resolves `multer` to 1.4.5-lts.1, which OSV lists as affected by 11 advisories. Highest CVSS 8.7. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `multer` to 2.3.0 or later in `server/yarn.lock`.
## 23. path-to-regexp 0.1.7 has 2 known advisories
Path: server/yarn.lock
Line: 1081
This file is not part of the pull request's diff.
Bug: [CVE-2024-45296](https://osv.dev/vulnerability/CVE-2024-45296), [CVE-2024-52798](https://osv.dev/vulnerability/CVE-2024-52798). path-to-regexp vulnerable to Regular Expression Denial of Service via multiple route parameters
Cause: `server/yarn.lock` resolves `path-to-regexp` to 0.1.7, which OSV lists as affected by 2 advisories. Highest CVSS 7.7. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `path-to-regexp` to 0.1.13 or later in `server/yarn.lock`.
## 24. picomatch 2.3.1 has 2 known advisories
Path: server/yarn.lock
Line: 1655
This file is not part of the pull request's diff.
Bug: [CVE-2026-33671](https://osv.dev/vulnerability/CVE-2026-33671), [CVE-2026-33672](https://osv.dev/vulnerability/CVE-2026-33672). Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching
Cause: `server/yarn.lock` resolves `picomatch` to 2.3.1, which OSV lists as affected by 2 advisories. Highest CVSS 7.5. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `picomatch` to 4.0.4 or later in `server/yarn.lock`.
## 25. qs 6.11.0 has 3 known advisories
Path: server/yarn.lock
Line: 493
This file is not part of the pull request's diff.
Bug: [CVE-2025-15284](https://osv.dev/vulnerability/CVE-2025-15284), [CVE-2026-2391](https://osv.dev/vulnerability/CVE-2026-2391), [CVE-2026-82417](https://osv.dev/vulnerability/CVE-2026-82417). qs: Denial of Service via Attacker Controlled isBuffer
Cause: `server/yarn.lock` resolves `qs` to 6.11.0, which OSV lists as affected by 3 advisories. Highest CVSS 6.3. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `qs` to 6.16.0 or later in `server/yarn.lock`.
## 26. semver 5.7.1 has 1 known advisory
Path: server/yarn.lock
Line: 1788
This file is not part of the pull request's diff.
Bug: [CVE-2022-25883](https://osv.dev/vulnerability/CVE-2022-25883). semver vulnerable to Regular Expression Denial of Service
Cause: `server/yarn.lock` resolves `semver` to 5.7.1, which OSV lists as affected by 1 advisory. Highest CVSS 7.5. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `semver` to 7.5.2 or later in `server/yarn.lock`.
## 27. send 0.18.0 has 1 known advisory
Path: server/yarn.lock
Line: 1086
This file is not part of the pull request's diff.
Bug: [CVE-2024-43799](https://osv.dev/vulnerability/CVE-2024-43799). send vulnerable to template injection that can lead to XSS
Cause: `server/yarn.lock` resolves `send` to 0.18.0, which OSV lists as affected by 1 advisory. Highest CVSS 5.0. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `send` to 0.19.0 or later in `server/yarn.lock`.
## 28. serve-static 1.15.0 has 1 known advisory
Path: server/yarn.lock
Line: 226
This file is not part of the pull request's diff.
Bug: [CVE-2024-43800](https://osv.dev/vulnerability/CVE-2024-43800). serve-static vulnerable to template injection that can lead to XSS
Cause: `server/yarn.lock` resolves `serve-static` to 1.15.0, which OSV lists as affected by 1 advisory. Highest CVSS 5.0. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `serve-static` to 1.16.0 or later in `server/yarn.lock`.
## 29. sha.js 2.4.11 has 1 known advisory
Path: server/yarn.lock
Line: 2304
This file is not part of the pull request's diff.
Bug: [CVE-2025-9288](https://osv.dev/vulnerability/CVE-2025-9288). sha.js is missing type checks leading to hash rewind and passing on crafted data
Cause: `server/yarn.lock` resolves `sha.js` to 2.4.11, which OSV lists as affected by 1 advisory. Highest CVSS 9.1. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `sha.js` to 2.4.12 or later in `server/yarn.lock`.
## 30. shell-quote 1.7.4 has 2 known advisories
Path: server/yarn.lock
Line: 2326
This file is not part of the pull request's diff.
Bug: [CVE-2026-13311](https://osv.dev/vulnerability/CVE-2026-13311), [CVE-2026-9277](https://osv.dev/vulnerability/CVE-2026-9277). shell-quote: Quadratic-complexity Denial of Service in `parse()` (CWE-407)
Cause: `server/yarn.lock` resolves `shell-quote` to 1.7.4, which OSV lists as affected by 2 advisories. Highest CVSS 9.2. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `shell-quote` to 1.9.0 or later in `server/yarn.lock`.
## 31. toml 2.3.6 has 2 known advisories
Path: server/yarn.lock
Line: 2538
This file is not part of the pull request's diff.
Bug: [CVE-2026-63376](https://osv.dev/vulnerability/CVE-2026-63376), [CVE-2026-77465](https://osv.dev/vulnerability/CVE-2026-77465). toml-node: Uncontrolled Recursion
Cause: `server/yarn.lock` resolves `toml` to 2.3.6, which OSV lists as affected by 2 advisories. Highest CVSS 8.2. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `toml` to 4.2.0 or later in `server/yarn.lock`.
## 32. typeorm 0.3.11 has 3 known advisories
Path: server/yarn.lock
Line: 2642
This file is not part of the pull request's diff.
Bug: [CVE-2025-60542](https://osv.dev/vulnerability/CVE-2025-60542), [CVE-2026-73651](https://osv.dev/vulnerability/CVE-2026-73651), [GHSA-9ggv-8w38-r7pm](https://osv.dev/vulnerability/GHSA-9ggv-8w38-r7pm). TypeORM: migration:generate template-literal code injection
Cause: `server/yarn.lock` resolves `typeorm` to 0.3.11, which OSV lists as affected by 3 advisories. Highest CVSS 8.9. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `typeorm` to 0.3.31 or later in `server/yarn.lock`.
## 33. uuid 8.3.2 has 1 known advisory
Path: server/yarn.lock
Line: 2661
This file is not part of the pull request's diff.
Bug: [CVE-2026-41907](https://osv.dev/vulnerability/CVE-2026-41907). uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided
Cause: `server/yarn.lock` resolves `uuid` to 8.3.2, which OSV lists as affected by 1 advisory. Highest CVSS 7.5. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `uuid` to 11.1.1 or later in `server/yarn.lock`.
## 34. vm2 3.9.13 has 41 known advisories
Path: server/yarn.lock
Line: 2729
This file is not part of the pull request's diff.
Bug: [CVE-2023-29017](https://osv.dev/vulnerability/CVE-2023-29017), [CVE-2023-29199](https://osv.dev/vulnerability/CVE-2023-29199), [CVE-2023-30547](https://osv.dev/vulnerability/CVE-2023-30547), [CVE-2023-32313](https://osv.dev/vulnerability/CVE-2023-32313), and 37 more. vm2 Has a Sandbox Breakout Using Async Generator
Cause: `server/yarn.lock` resolves `vm2` to 3.9.13, which OSV lists as affected by 41 advisories. Highest CVSS 10.0. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `vm2` to 3.11.6 or later in `server/yarn.lock`.
## 35. word-wrap 1.2.3 has 1 known advisory
Path: server/yarn.lock
Line: 1845
This file is not part of the pull request's diff.
Bug: [CVE-2023-26115](https://osv.dev/vulnerability/CVE-2023-26115). word-wrap vulnerable to Regular Expression Denial of Service
Cause: `server/yarn.lock` resolves `word-wrap` to 1.2.3, which OSV lists as affected by 1 advisory. Highest CVSS 5.3. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `word-wrap` to 1.2.4 or later in `server/yarn.lock`.
## 36. xml2js 0.4.23 has 1 known advisory
Path: server/yarn.lock
Line: 2662
This file is not part of the pull request's diff.
Bug: [CVE-2023-0842](https://osv.dev/vulnerability/CVE-2023-0842). xml2js is vulnerable to prototype pollution
Cause: `server/yarn.lock` resolves `xml2js` to 0.4.23, which OSV lists as affected by 1 advisory. Highest CVSS 5.3. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `xml2js` to 0.5.0 or later in `server/yarn.lock`.
---
For each finding above, determine whether it is valid and should be fixed. If so, fix it directly. Where a finding offers several remedies, pick one and say why. Leave the pull request's own changed files alone unless a fix requires touching them.
Findings Outside the DiffNote The change causes these, but the lines that exhibit them are not in the diff, so GitHub cannot host them inline. A finding drops off this list as soon as the file it names is part of the diff. @faker-js/faker 7.6.0 has 1 known advisory —
|
Bumps morgan from 1.10.0 to 1.12.1.
Release notes
Sourced from morgan's releases.
... (truncated)
Changelog
Sourced from morgan's changelog.
Commits
b1272e71.12.1 (#386)4b695edfix: escape double quotes in log fields0f74ecabuild(deps): bump github/codeql-action/analyze from 4.37.4 to 4.37.9 (#384)e399e3cbuild(deps): bump github/codeql-action/init from 4.37.4 to 4.37.9 (#383)1e86b34build(deps): bump github/codeql-action/autobuild from 4.37.4 to 4.37.9 (#382)87c0afdbuild(deps): bump github/codeql-action/upload-sarif to 4.37.9 (#381)286b000test: run CI on Windows and macOS (#379)5a5902adocs: fix typos across documentation (#378)063f0841.12.0 (#376)fbf9383fix: escape all token values in log outputMaintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for morgan since your current version.
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.