build(deps): bump composer/composer from 2.9.8 to 2.10.1 by dependabot[bot] · Pull Request #13 · step-security/super-linter

dependabot · 2026-06-10T11:29:45Z

Bumps composer/composer from 2.9.8 to 2.10.1.

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

github-actions · 2026-06-10T12:18:58Z

Super-linter summary

Language	Validation result
BIOME_FORMAT	Pass ✅
BIOME_LINT	Pass ✅
CHECKOV	Pass ✅
DOCKERFILE_HADOLINT	Pass ✅
EDITORCONFIG	Pass ✅
GITLEAKS	Pass ✅
GIT_COMMITLINT	Pass ✅
GIT_MERGE_CONFLICT_MARKERS	Pass ✅
JSCPD	Pass ✅
PRE_COMMIT	Pass ✅
SPELL_CODESPELL	Pass ✅
TRIVY	Fail ❌

Super-linter detected linting errors

For more information, see the
GitHub Actions workflow run

Powered by Super-linter

TRIVY

trivy filesystem --config /github/workspace/.github/linters/trivy.yaml /github/workspace

Report Summary

┌─────────────────────────────────────┬────────────┬─────────────────┬───────────────────┬─────────┐
│               Target                │    Type    │ Vulnerabilities │ Misconfigurations │ Secrets │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ dependencies/Gemfile.lock           │  bundler   │        0        │         -         │    -    │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ dependencies/composer/composer.lock │  composer  │        0        │         -         │    -    │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ dependencies/package-lock.json      │    npm     │       15        │         -         │    -    │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ Dockerfile                          │ dockerfile │        -        │         0         │    -    │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ test/linters/trivy/good/Dockerfile  │ dockerfile │        -        │         0         │    -    │
└─────────────────────────────────────┴────────────┴─────────────────┴───────────────────┴─────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)


For OSS Maintainers: VEX Notice
--------------------------------
If you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement.
VEX allows you to communicate the actual status of vulnerabilities in your project, improving security transparency and reducing false positives for your users.
Learn more and start using VEX: https://trivy.dev/docs/v0.70/guide/supply-chain/vex/repo#publishing-vex-documents

To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable.


dependencies/package-lock.json (npm)
====================================
Total: 15 (UNKNOWN: 0, LOW: 0, MEDIUM: 10, HIGH: 5, CRITICAL: 0)

┌────────────┬────────────────┬──────────┬────────┬───────────────────┬───────────────┬──────────────────────────────────────────────────────────────┐
│  Library   │ Vulnerability  │ Severity │ Status │ Installed Version │ Fixed Version │                            Title                             │
├────────────┼────────────────┼──────────┼────────┼───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ hono       │ CVE-2026-47673 │ MEDIUM   │ fixed  │ 4.12.18           │ 4.12.21       │ Hono: JWT middleware accepts any Authorization scheme, not   │
│            │                │          │        │                   │               │ only Bearer                                                  │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-47673                   │
│            ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│            │ CVE-2026-47674 │          │        │                   │               │ Hono: IP Restriction bypasses static deny rules for          │
│            │                │          │        │                   │               │ non-canonical IPv6                                           │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-47674                   │
│            ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│            │ CVE-2026-47675 │          │        │                   │               │ Hono: Cookie helper does not sanitize sameSite and priority, │
│            │                │          │        │                   │               │ allowing Set-Cookie injection...                             │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-47675                   │
│            ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│            │ CVE-2026-47676 │          │        │                   │               │ Hono: app.mount() strips mount prefix using undecoded path,  │
│            │                │          │        │                   │               │ causing incorrect routing for...                             │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-47676                   │
├────────────┼────────────────┤          │        ├───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ postcss    │ CVE-2026-41305 │          │        │ 8.4.31            │ 8.5.10        │ postcss: PostCSS: Cross-Site Scripting (XSS) via improper    │
│            │                │          │        │                   │               │ escaping of style closing tags...                            │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-41305                   │
├────────────┼────────────────┼──────────┤        ├───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ protobufjs │ CVE-2026-44289 │ HIGH     │        │ 8.0.1             │ 7.5.6, 8.0.2  │ protobuf.js: Denial of service through unbounded protobuf    │
│            │                │          │        │                   │               │ recursion                                                    │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-44289                   │
│            ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│            │ CVE-2026-44290 │          │        │                   │               │ protobuf.js: Process-wide denial of service through unsafe   │
│            │                │          │        │                   │               │ option paths                                                 │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-44290                   │
│            ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│            │ CVE-2026-44291 │          │        │                   │               │ protobuf.js: Code generation gadget after prototype          │
│            │                │          │        │                   │               │ pollution                                                    │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-44291                   │
│            ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│            │ CVE-2026-44293 │          │        │                   │               │ protobuf.js: Code injection through bytes field defaults in  │
│            │                │          │        │                   │               │ generated toObject code                                      │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-44293                   │
│            ├────────────────┼──────────┤        │                   │               ├──────────────────────────────────────────────────────────────┤
│            │ CVE-2026-44288 │ MEDIUM   │        │                   │               │ protobufjs has overlong UTF-8 decoding                       │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-44288                   │
│            ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│            │ CVE-2026-44292 │          │        │                   │               │ protobuf.js: Prototype injection in generated message        │
│            │                │          │        │                   │               │ constructors                                                 │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-44292                   │
│            ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│            │ CVE-2026-44294 │          │        │                   │               │ protobuf.js: Denial of service from crafted field names in   │
│            │                │          │        │                   │               │ generated code                                               │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-44294                   │
│            ├────────────────┤          │        │                   ├───────────────┼──────────────────────────────────────────────────────────────┤
│            │ CVE-2026-45740 │          │        │                   │ 7.5.8, 8.2.0  │ protobufjs: Denial of Service via unbounded recursive JSON   │
│            │                │          │        │                   │               │ descriptor expansion                                         │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-45740                   │
├────────────┼────────────────┤          │        ├───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ qs         │ CVE-2026-8723  │          │        │ 6.14.2            │ 6.15.2        │ ### Summary `qs.stringify` throws `TypeError` when called    │
│            │                │          │        │                   │               │ with `arr...                                                 │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-8723                    │
├────────────┼────────────────┼──────────┤        ├───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ simple-git │ CVE-2026-6951  │ HIGH     │        │ 3.35.2            │ 3.36.0        │ simple-git: simple-git: Remote Code Execution due to         │
│            │                │          │        │                   │               │ incomplete fix bypass                                        │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-6951                    │
└────────────┴────────────────┴──────────┴────────┴───────────────────┴───────────────┴──────────────────────────────────────────────────────────────┘

github-actions · 2026-06-10T12:19:27Z

Super-linter summary

Language	Validation result
BIOME_FORMAT	Pass ✅
BIOME_LINT	Pass ✅
CHECKOV	Pass ✅
DOCKERFILE_HADOLINT	Pass ✅
EDITORCONFIG	Pass ✅
GITLEAKS	Pass ✅
GIT_COMMITLINT	Pass ✅
GIT_MERGE_CONFLICT_MARKERS	Pass ✅
JSCPD	Pass ✅
PRE_COMMIT	Pass ✅
SPELL_CODESPELL	Pass ✅
TRIVY	Fail ❌

Super-linter detected linting errors

For more information, see the
GitHub Actions workflow run

Powered by Super-linter

TRIVY


Report Summary

┌─────────────────────────────────────┬────────────┬─────────────────┬───────────────────┬─────────┐
│               Target                │    Type    │ Vulnerabilities │ Misconfigurations │ Secrets │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ dependencies/Gemfile.lock           │  bundler   │        0        │         -         │    -    │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ dependencies/composer/composer.lock │  composer  │        0        │         -         │    -    │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ dependencies/package-lock.json      │    npm     │       15        │         -         │    -    │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ Dockerfile                          │ dockerfile │        -        │         0         │    -    │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ test/linters/trivy/good/Dockerfile  │ dockerfile │        -        │         0         │    -    │
└─────────────────────────────────────┴────────────┴─────────────────┴───────────────────┴─────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)


For OSS Maintainers: VEX Notice
--------------------------------
If you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement.
VEX allows you to communicate the actual status of vulnerabilities in your project, improving security transparency and reducing false positives for your users.
Learn more and start using VEX: https://trivy.dev/docs/v0.70/guide/supply-chain/vex/repo#publishing-vex-documents

To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable.


dependencies/package-lock.json (npm)
====================================
Total: 15 (UNKNOWN: 0, LOW: 0, MEDIUM: 10, HIGH: 5, CRITICAL: 0)

┌────────────┬────────────────┬──────────┬────────┬───────────────────┬───────────────┬──────────────────────────────────────────────────────────────┐
│  Library   │ Vulnerability  │ Severity │ Status │ Installed Version │ Fixed Version │                            Title                             │
├────────────┼────────────────┼──────────┼────────┼───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ hono       │ CVE-2026-47673 │ MEDIUM   │ fixed  │ 4.12.18           │ 4.12.21       │ Hono: JWT middleware accepts any Authorization scheme, not   │
│            │                │          │        │                   │               │ only Bearer                                                  │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-47673                   │
│            ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│            │ CVE-2026-47674 │          │        │                   │               │ Hono: IP Restriction bypasses static deny rules for          │
│            │                │          │        │                   │               │ non-canonical IPv6                                           │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-47674                   │
│            ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│            │ CVE-2026-47675 │          │        │                   │               │ Hono: Cookie helper does not sanitize sameSite and priority, │
│            │                │          │        │                   │               │ allowing Set-Cookie injection...                             │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-47675                   │
│            ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│            │ CVE-2026-47676 │          │        │                   │               │ Hono: app.mount() strips mount prefix using undecoded path,  │
│            │                │          │        │                   │               │ causing incorrect routing for...                             │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-47676                   │
├────────────┼────────────────┤          │        ├───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ postcss    │ CVE-2026-41305 │          │        │ 8.4.31            │ 8.5.10        │ postcss: PostCSS: Cross-Site Scripting (XSS) via improper    │
│            │                │          │        │                   │               │ escaping of style closing tags...                            │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-41305                   │
├────────────┼────────────────┼──────────┤        ├───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ protobufjs │ CVE-2026-44289 │ HIGH     │        │ 8.0.1             │ 7.5.6, 8.0.2  │ protobuf.js: Denial of service through unbounded protobuf    │
│            │                │          │        │                   │               │ recursion                                                    │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-44289                   │
│            ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│            │ CVE-2026-44290 │          │        │                   │               │ protobuf.js: Process-wide denial of service through unsafe   │
│            │                │          │        │                   │               │ option paths                                                 │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-44290                   │
│            ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│            │ CVE-2026-44291 │          │        │                   │               │ protobuf.js: Code generation gadget after prototype          │
│            │                │          │        │                   │               │ pollution                                                    │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-44291                   │
│            ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│            │ CVE-2026-44293 │          │        │                   │               │ protobuf.js: Code injection through bytes field defaults in  │
│            │                │          │        │                   │               │ generated toObject code                                      │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-44293                   │
│            ├────────────────┼──────────┤        │                   │               ├──────────────────────────────────────────────────────────────┤
│            │ CVE-2026-44288 │ MEDIUM   │        │                   │               │ protobufjs has overlong UTF-8 decoding                       │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-44288                   │
│            ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│            │ CVE-2026-44292 │          │        │                   │               │ protobuf.js: Prototype injection in generated message        │
│            │                │          │        │                   │               │ constructors                                                 │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-44292                   │
│            ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│            │ CVE-2026-44294 │          │        │                   │               │ protobuf.js: Denial of service from crafted field names in   │
│            │                │          │        │                   │               │ generated code                                               │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-44294                   │
│            ├────────────────┤          │        │                   ├───────────────┼──────────────────────────────────────────────────────────────┤
│            │ CVE-2026-45740 │          │        │                   │ 7.5.8, 8.2.0  │ protobufjs: Denial of Service via unbounded recursive JSON   │
│            │                │          │        │                   │               │ descriptor expansion                                         │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-45740                   │
├────────────┼────────────────┤          │        ├───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ qs         │ CVE-2026-8723  │          │        │ 6.14.2            │ 6.15.2        │ ### Summary `qs.stringify` throws `TypeError` when called    │
│            │                │          │        │                   │               │ with `arr...                                                 │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-8723                    │
├────────────┼────────────────┼──────────┤        ├───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ simple-git │ CVE-2026-6951  │ HIGH     │        │ 3.35.2            │ 3.36.0        │ simple-git: simple-git: Remote Code Execution due to         │
│            │                │          │        │                   │               │ incomplete fix bypass                                        │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-6951                    │
└────────────┴────────────────┴──────────┴────────┴───────────────────┴───────────────┴──────────────────────────────────────────────────────────────┘

github-actions · 2026-06-10T12:21:26Z

Super-linter summary

Language	Validation result
BIOME_FORMAT	Pass ✅
BIOME_LINT	Pass ✅
CHECKOV	Pass ✅
DOCKERFILE_HADOLINT	Pass ✅
EDITORCONFIG	Pass ✅
GITLEAKS	Pass ✅
GIT_COMMITLINT	Pass ✅
GIT_MERGE_CONFLICT_MARKERS	Pass ✅
JSCPD	Pass ✅
PRE_COMMIT	Pass ✅
SPELL_CODESPELL	Pass ✅
TRIVY	Fail ❌

Super-linter detected linting errors

For more information, see the
GitHub Actions workflow run

Powered by Super-linter

TRIVY

trivy filesystem --config /github/workspace/.github/linters/trivy.yaml /github/workspace

Report Summary

┌─────────────────────────────────────┬────────────┬─────────────────┬───────────────────┬─────────┐
│               Target                │    Type    │ Vulnerabilities │ Misconfigurations │ Secrets │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ dependencies/Gemfile.lock           │  bundler   │        0        │         -         │    -    │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ dependencies/composer/composer.lock │  composer  │        0        │         -         │    -    │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ dependencies/package-lock.json      │    npm     │       15        │         -         │    -    │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ Dockerfile                          │ dockerfile │        -        │         0         │    -    │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ test/linters/trivy/good/Dockerfile  │ dockerfile │        -        │         0         │    -    │
└─────────────────────────────────────┴────────────┴─────────────────┴───────────────────┴─────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)


For OSS Maintainers: VEX Notice
--------------------------------
If you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement.
VEX allows you to communicate the actual status of vulnerabilities in your project, improving security transparency and reducing false positives for your users.
Learn more and start using VEX: https://trivy.dev/docs/v0.70/guide/supply-chain/vex/repo#publishing-vex-documents

To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable.


dependencies/package-lock.json (npm)
====================================
Total: 15 (UNKNOWN: 0, LOW: 0, MEDIUM: 10, HIGH: 5, CRITICAL: 0)

┌────────────┬────────────────┬──────────┬────────┬───────────────────┬───────────────┬──────────────────────────────────────────────────────────────┐
│  Library   │ Vulnerability  │ Severity │ Status │ Installed Version │ Fixed Version │                            Title                             │
├────────────┼────────────────┼──────────┼────────┼───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ hono       │ CVE-2026-47673 │ MEDIUM   │ fixed  │ 4.12.18           │ 4.12.21       │ Hono: JWT middleware accepts any Authorization scheme, not   │
│            │                │          │        │                   │               │ only Bearer                                                  │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-47673                   │
│            ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│            │ CVE-2026-47674 │          │        │                   │               │ Hono: IP Restriction bypasses static deny rules for          │
│            │                │          │        │                   │               │ non-canonical IPv6                                           │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-47674                   │
│            ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│            │ CVE-2026-47675 │          │        │                   │               │ Hono: Cookie helper does not sanitize sameSite and priority, │
│            │                │          │        │                   │               │ allowing Set-Cookie injection...                             │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-47675                   │
│            ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│            │ CVE-2026-47676 │          │        │                   │               │ Hono: app.mount() strips mount prefix using undecoded path,  │
│            │                │          │        │                   │               │ causing incorrect routing for...                             │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-47676                   │
├────────────┼────────────────┤          │        ├───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ postcss    │ CVE-2026-41305 │          │        │ 8.4.31            │ 8.5.10        │ postcss: PostCSS: Cross-Site Scripting (XSS) via improper    │
│            │                │          │        │                   │               │ escaping of style closing tags...                            │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-41305                   │
├────────────┼────────────────┼──────────┤        ├───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ protobufjs │ CVE-2026-44289 │ HIGH     │        │ 8.0.1             │ 7.5.6, 8.0.2  │ protobuf.js: Denial of service through unbounded protobuf    │
│            │                │          │        │                   │               │ recursion                                                    │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-44289                   │
│            ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│            │ CVE-2026-44290 │          │        │                   │               │ protobuf.js: Process-wide denial of service through unsafe   │
│            │                │          │        │                   │               │ option paths                                                 │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-44290                   │
│            ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│            │ CVE-2026-44291 │          │        │                   │               │ protobuf.js: Code generation gadget after prototype          │
│            │                │          │        │                   │               │ pollution                                                    │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-44291                   │
│            ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│            │ CVE-2026-44293 │          │        │                   │               │ protobuf.js: Code injection through bytes field defaults in  │
│            │                │          │        │                   │               │ generated toObject code                                      │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-44293                   │
│            ├────────────────┼──────────┤        │                   │               ├──────────────────────────────────────────────────────────────┤
│            │ CVE-2026-44288 │ MEDIUM   │        │                   │               │ protobufjs has overlong UTF-8 decoding                       │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-44288                   │
│            ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│            │ CVE-2026-44292 │          │        │                   │               │ protobuf.js: Prototype injection in generated message        │
│            │                │          │        │                   │               │ constructors                                                 │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-44292                   │
│            ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│            │ CVE-2026-44294 │          │        │                   │               │ protobuf.js: Denial of service from crafted field names in   │
│            │                │          │        │                   │               │ generated code                                               │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-44294                   │
│            ├────────────────┤          │        │                   ├───────────────┼──────────────────────────────────────────────────────────────┤
│            │ CVE-2026-45740 │          │        │                   │ 7.5.8, 8.2.0  │ protobufjs: Denial of Service via unbounded recursive JSON   │
│            │                │          │        │                   │               │ descriptor expansion                                         │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-45740                   │
├────────────┼────────────────┤          │        ├───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ qs         │ CVE-2026-8723  │          │        │ 6.14.2            │ 6.15.2        │ ### Summary `qs.stringify` throws `TypeError` when called    │
│            │                │          │        │                   │               │ with `arr...                                                 │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-8723                    │
├────────────┼────────────────┼──────────┤        ├───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ simple-git │ CVE-2026-6951  │ HIGH     │        │ 3.35.2            │ 3.36.0        │ simple-git: simple-git: Remote Code Execution due to         │
│            │                │          │        │                   │               │ incomplete fix bypass                                        │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-6951                    │
└────────────┴────────────────┴──────────┴────────┴───────────────────┴───────────────┴──────────────────────────────────────────────────────────────┘

github-actions · 2026-06-10T12:21:59Z

Super-linter summary

Language	Validation result
BIOME_FORMAT	Pass ✅
BIOME_LINT	Pass ✅
CHECKOV	Pass ✅
DOCKERFILE_HADOLINT	Pass ✅
EDITORCONFIG	Pass ✅
GITLEAKS	Pass ✅
GIT_COMMITLINT	Pass ✅
GIT_MERGE_CONFLICT_MARKERS	Pass ✅
JSCPD	Pass ✅
PRE_COMMIT	Pass ✅
SPELL_CODESPELL	Pass ✅
TRIVY	Fail ❌

Super-linter detected linting errors

For more information, see the
GitHub Actions workflow run

Powered by Super-linter

TRIVY


Report Summary

┌─────────────────────────────────────┬────────────┬─────────────────┬───────────────────┬─────────┐
│               Target                │    Type    │ Vulnerabilities │ Misconfigurations │ Secrets │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ dependencies/Gemfile.lock           │  bundler   │        0        │         -         │    -    │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ dependencies/composer/composer.lock │  composer  │        0        │         -         │    -    │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ dependencies/package-lock.json      │    npm     │       15        │         -         │    -    │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ Dockerfile                          │ dockerfile │        -        │         0         │    -    │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ test/linters/trivy/good/Dockerfile  │ dockerfile │        -        │         0         │    -    │
└─────────────────────────────────────┴────────────┴─────────────────┴───────────────────┴─────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)


For OSS Maintainers: VEX Notice
--------------------------------
If you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement.
VEX allows you to communicate the actual status of vulnerabilities in your project, improving security transparency and reducing false positives for your users.
Learn more and start using VEX: https://trivy.dev/docs/v0.70/guide/supply-chain/vex/repo#publishing-vex-documents

To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable.


dependencies/package-lock.json (npm)
====================================
Total: 15 (UNKNOWN: 0, LOW: 0, MEDIUM: 10, HIGH: 5, CRITICAL: 0)

┌────────────┬────────────────┬──────────┬────────┬───────────────────┬───────────────┬──────────────────────────────────────────────────────────────┐
│  Library   │ Vulnerability  │ Severity │ Status │ Installed Version │ Fixed Version │                            Title                             │
├────────────┼────────────────┼──────────┼────────┼───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ hono       │ CVE-2026-47673 │ MEDIUM   │ fixed  │ 4.12.18           │ 4.12.21       │ Hono: JWT middleware accepts any Authorization scheme, not   │
│            │                │          │        │                   │               │ only Bearer                                                  │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-47673                   │
│            ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│            │ CVE-2026-47674 │          │        │                   │               │ Hono: IP Restriction bypasses static deny rules for          │
│            │                │          │        │                   │               │ non-canonical IPv6                                           │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-47674                   │
│            ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│            │ CVE-2026-47675 │          │        │                   │               │ Hono: Cookie helper does not sanitize sameSite and priority, │
│            │                │          │        │                   │               │ allowing Set-Cookie injection...                             │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-47675                   │
│            ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│            │ CVE-2026-47676 │          │        │                   │               │ Hono: app.mount() strips mount prefix using undecoded path,  │
│            │                │          │        │                   │               │ causing incorrect routing for...                             │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-47676                   │
├────────────┼────────────────┤          │        ├───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ postcss    │ CVE-2026-41305 │          │        │ 8.4.31            │ 8.5.10        │ postcss: PostCSS: Cross-Site Scripting (XSS) via improper    │
│            │                │          │        │                   │               │ escaping of style closing tags...                            │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-41305                   │
├────────────┼────────────────┼──────────┤        ├───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ protobufjs │ CVE-2026-44289 │ HIGH     │        │ 8.0.1             │ 7.5.6, 8.0.2  │ protobuf.js: Denial of service through unbounded protobuf    │
│            │                │          │        │                   │               │ recursion                                                    │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-44289                   │
│            ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│            │ CVE-2026-44290 │          │        │                   │               │ protobuf.js: Process-wide denial of service through unsafe   │
│            │                │          │        │                   │               │ option paths                                                 │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-44290                   │
│            ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│            │ CVE-2026-44291 │          │        │                   │               │ protobuf.js: Code generation gadget after prototype          │
│            │                │          │        │                   │               │ pollution                                                    │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-44291                   │
│            ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│            │ CVE-2026-44293 │          │        │                   │               │ protobuf.js: Code injection through bytes field defaults in  │
│            │                │          │        │                   │               │ generated toObject code                                      │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-44293                   │
│            ├────────────────┼──────────┤        │                   │               ├──────────────────────────────────────────────────────────────┤
│            │ CVE-2026-44288 │ MEDIUM   │        │                   │               │ protobufjs has overlong UTF-8 decoding                       │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-44288                   │
│            ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│            │ CVE-2026-44292 │          │        │                   │               │ protobuf.js: Prototype injection in generated message        │
│            │                │          │        │                   │               │ constructors                                                 │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-44292                   │
│            ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│            │ CVE-2026-44294 │          │        │                   │               │ protobuf.js: Denial of service from crafted field names in   │
│            │                │          │        │                   │               │ generated code                                               │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-44294                   │
│            ├────────────────┤          │        │                   ├───────────────┼──────────────────────────────────────────────────────────────┤
│            │ CVE-2026-45740 │          │        │                   │ 7.5.8, 8.2.0  │ protobufjs: Denial of Service via unbounded recursive JSON   │
│            │                │          │        │                   │               │ descriptor expansion                                         │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-45740                   │
├────────────┼────────────────┤          │        ├───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ qs         │ CVE-2026-8723  │          │        │ 6.14.2            │ 6.15.2        │ ### Summary `qs.stringify` throws `TypeError` when called    │
│            │                │          │        │                   │               │ with `arr...                                                 │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-8723                    │
├────────────┼────────────────┼──────────┤        ├───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ simple-git │ CVE-2026-6951  │ HIGH     │        │ 3.35.2            │ 3.36.0        │ simple-git: simple-git: Remote Code Execution due to         │
│            │                │          │        │                   │               │ incomplete fix bypass                                        │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-6951                    │
└────────────┴────────────────┴──────────┴────────┴───────────────────┴───────────────┴──────────────────────────────────────────────────────────────┘

Bumps composer/composer from 2.9.8 to 2.10.1. --- updated-dependencies: - dependency-name: composer/composer dependency-version: 2.10.1 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>

github-actions · 2026-06-11T07:10:39Z

Super-linter summary

Language	Validation result
BIOME_FORMAT	Pass ✅
BIOME_LINT	Pass ✅
CHECKOV	Pass ✅
DOCKERFILE_HADOLINT	Pass ✅
EDITORCONFIG	Pass ✅
GITLEAKS	Pass ✅
GIT_COMMITLINT	Pass ✅
GIT_MERGE_CONFLICT_MARKERS	Pass ✅
JSCPD	Pass ✅
PRE_COMMIT	Pass ✅
SPELL_CODESPELL	Pass ✅
TRIVY	Fail ❌

Super-linter detected linting errors

For more information, see the
GitHub Actions workflow run

Powered by Super-linter

TRIVY

trivy filesystem --config /github/workspace/.github/linters/trivy.yaml /github/workspace

Report Summary

┌─────────────────────────────────────┬────────────┬─────────────────┬───────────────────┬─────────┐
│               Target                │    Type    │ Vulnerabilities │ Misconfigurations │ Secrets │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ dependencies/Gemfile.lock           │  bundler   │        0        │         -         │    -    │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ dependencies/composer/composer.lock │  composer  │        0        │         -         │    -    │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ dependencies/package-lock.json      │    npm     │        1        │         -         │    -    │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ Dockerfile                          │ dockerfile │        -        │         0         │    -    │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ test/linters/trivy/good/Dockerfile  │ dockerfile │        -        │         0         │    -    │
└─────────────────────────────────────┴────────────┴─────────────────┴───────────────────┴─────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)


For OSS Maintainers: VEX Notice
--------------------------------
If you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement.
VEX allows you to communicate the actual status of vulnerabilities in your project, improving security transparency and reducing false positives for your users.
Learn more and start using VEX: https://trivy.dev/docs/v0.71/guide/supply-chain/vex/repo#publishing-vex-documents

To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable.


dependencies/package-lock.json (npm)
====================================
Total: 1 (UNKNOWN: 0, LOW: 0, MEDIUM: 1, HIGH: 0, CRITICAL: 0)

┌─────────┬────────────────┬──────────┬────────┬───────────────────┬───────────────┬───────────────────────────────────────────────────────────┐
│ Library │ Vulnerability  │ Severity │ Status │ Installed Version │ Fixed Version │                           Title                           │
├─────────┼────────────────┼──────────┼────────┼───────────────────┼───────────────┼───────────────────────────────────────────────────────────┤
│ postcss │ CVE-2026-41305 │ MEDIUM   │ fixed  │ 8.4.31            │ 8.5.10        │ postcss: PostCSS: Cross-Site Scripting (XSS) via improper │
│         │                │          │        │                   │               │ escaping of style closing tags...                         │
│         │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-41305                │
└─────────┴────────────────┴──────────┴────────┴───────────────────┴───────────────┴───────────────────────────────────────────────────────────┘

github-actions · 2026-06-11T07:11:10Z

Super-linter summary

Language	Validation result
BIOME_FORMAT	Pass ✅
BIOME_LINT	Pass ✅
CHECKOV	Pass ✅
DOCKERFILE_HADOLINT	Pass ✅
EDITORCONFIG	Pass ✅
GITLEAKS	Pass ✅
GIT_COMMITLINT	Pass ✅
GIT_MERGE_CONFLICT_MARKERS	Pass ✅
JSCPD	Pass ✅
PRE_COMMIT	Pass ✅
SPELL_CODESPELL	Pass ✅
TRIVY	Fail ❌

Super-linter detected linting errors

For more information, see the
GitHub Actions workflow run

Powered by Super-linter

TRIVY


Report Summary

┌─────────────────────────────────────┬────────────┬─────────────────┬───────────────────┬─────────┐
│               Target                │    Type    │ Vulnerabilities │ Misconfigurations │ Secrets │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ dependencies/Gemfile.lock           │  bundler   │        0        │         -         │    -    │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ dependencies/composer/composer.lock │  composer  │        0        │         -         │    -    │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ dependencies/package-lock.json      │    npm     │        1        │         -         │    -    │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ Dockerfile                          │ dockerfile │        -        │         0         │    -    │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ test/linters/trivy/good/Dockerfile  │ dockerfile │        -        │         0         │    -    │
└─────────────────────────────────────┴────────────┴─────────────────┴───────────────────┴─────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)


For OSS Maintainers: VEX Notice
--------------------------------
If you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement.
VEX allows you to communicate the actual status of vulnerabilities in your project, improving security transparency and reducing false positives for your users.
Learn more and start using VEX: https://trivy.dev/docs/v0.71/guide/supply-chain/vex/repo#publishing-vex-documents

To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable.


dependencies/package-lock.json (npm)
====================================
Total: 1 (UNKNOWN: 0, LOW: 0, MEDIUM: 1, HIGH: 0, CRITICAL: 0)

┌─────────┬────────────────┬──────────┬────────┬───────────────────┬───────────────┬───────────────────────────────────────────────────────────┐
│ Library │ Vulnerability  │ Severity │ Status │ Installed Version │ Fixed Version │                           Title                           │
├─────────┼────────────────┼──────────┼────────┼───────────────────┼───────────────┼───────────────────────────────────────────────────────────┤
│ postcss │ CVE-2026-41305 │ MEDIUM   │ fixed  │ 8.4.31            │ 8.5.10        │ postcss: PostCSS: Cross-Site Scripting (XSS) via improper │
│         │                │          │        │                   │               │ escaping of style closing tags...                         │
│         │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-41305                │
└─────────┴────────────────┴──────────┴────────┴───────────────────┴───────────────┴───────────────────────────────────────────────────────────┘

github-actions · 2026-06-11T07:11:17Z

Super-linter summary

Language	Validation result
BIOME_FORMAT	Pass ✅
BIOME_LINT	Pass ✅
CHECKOV	Pass ✅
DOCKERFILE_HADOLINT	Pass ✅
EDITORCONFIG	Pass ✅
GITLEAKS	Pass ✅
GIT_COMMITLINT	Pass ✅
GIT_MERGE_CONFLICT_MARKERS	Pass ✅
JSCPD	Pass ✅
PRE_COMMIT	Pass ✅
SPELL_CODESPELL	Pass ✅
TRIVY	Fail ❌

Super-linter detected linting errors

For more information, see the
GitHub Actions workflow run

Powered by Super-linter

TRIVY

trivy filesystem --config /github/workspace/.github/linters/trivy.yaml /github/workspace

Report Summary

┌─────────────────────────────────────┬────────────┬─────────────────┬───────────────────┬─────────┐
│               Target                │    Type    │ Vulnerabilities │ Misconfigurations │ Secrets │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ dependencies/Gemfile.lock           │  bundler   │        0        │         -         │    -    │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ dependencies/composer/composer.lock │  composer  │        0        │         -         │    -    │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ dependencies/package-lock.json      │    npm     │        1        │         -         │    -    │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ Dockerfile                          │ dockerfile │        -        │         0         │    -    │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ test/linters/trivy/good/Dockerfile  │ dockerfile │        -        │         0         │    -    │
└─────────────────────────────────────┴────────────┴─────────────────┴───────────────────┴─────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)


For OSS Maintainers: VEX Notice
--------------------------------
If you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement.
VEX allows you to communicate the actual status of vulnerabilities in your project, improving security transparency and reducing false positives for your users.
Learn more and start using VEX: https://trivy.dev/docs/v0.71/guide/supply-chain/vex/repo#publishing-vex-documents

To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable.


dependencies/package-lock.json (npm)
====================================
Total: 1 (UNKNOWN: 0, LOW: 0, MEDIUM: 1, HIGH: 0, CRITICAL: 0)

┌─────────┬────────────────┬──────────┬────────┬───────────────────┬───────────────┬───────────────────────────────────────────────────────────┐
│ Library │ Vulnerability  │ Severity │ Status │ Installed Version │ Fixed Version │                           Title                           │
├─────────┼────────────────┼──────────┼────────┼───────────────────┼───────────────┼───────────────────────────────────────────────────────────┤
│ postcss │ CVE-2026-41305 │ MEDIUM   │ fixed  │ 8.4.31            │ 8.5.10        │ postcss: PostCSS: Cross-Site Scripting (XSS) via improper │
│         │                │          │        │                   │               │ escaping of style closing tags...                         │
│         │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-41305                │
└─────────┴────────────────┴──────────┴────────┴───────────────────┴───────────────┴───────────────────────────────────────────────────────────┘

github-actions · 2026-06-11T07:11:49Z

Super-linter summary

Language	Validation result
BIOME_FORMAT	Pass ✅
BIOME_LINT	Pass ✅
CHECKOV	Pass ✅
DOCKERFILE_HADOLINT	Pass ✅
EDITORCONFIG	Pass ✅
GITLEAKS	Pass ✅
GIT_COMMITLINT	Pass ✅
GIT_MERGE_CONFLICT_MARKERS	Pass ✅
JSCPD	Pass ✅
PRE_COMMIT	Pass ✅
SPELL_CODESPELL	Pass ✅
TRIVY	Fail ❌

Super-linter detected linting errors

For more information, see the
GitHub Actions workflow run

Powered by Super-linter

TRIVY


Report Summary

┌─────────────────────────────────────┬────────────┬─────────────────┬───────────────────┬─────────┐
│               Target                │    Type    │ Vulnerabilities │ Misconfigurations │ Secrets │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ dependencies/Gemfile.lock           │  bundler   │        0        │         -         │    -    │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ dependencies/composer/composer.lock │  composer  │        0        │         -         │    -    │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ dependencies/package-lock.json      │    npm     │        1        │         -         │    -    │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ Dockerfile                          │ dockerfile │        -        │         0         │    -    │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ test/linters/trivy/good/Dockerfile  │ dockerfile │        -        │         0         │    -    │
└─────────────────────────────────────┴────────────┴─────────────────┴───────────────────┴─────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)


For OSS Maintainers: VEX Notice
--------------------------------
If you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement.
VEX allows you to communicate the actual status of vulnerabilities in your project, improving security transparency and reducing false positives for your users.
Learn more and start using VEX: https://trivy.dev/docs/v0.71/guide/supply-chain/vex/repo#publishing-vex-documents

To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable.


dependencies/package-lock.json (npm)
====================================
Total: 1 (UNKNOWN: 0, LOW: 0, MEDIUM: 1, HIGH: 0, CRITICAL: 0)

┌─────────┬────────────────┬──────────┬────────┬───────────────────┬───────────────┬───────────────────────────────────────────────────────────┐
│ Library │ Vulnerability  │ Severity │ Status │ Installed Version │ Fixed Version │                           Title                           │
├─────────┼────────────────┼──────────┼────────┼───────────────────┼───────────────┼───────────────────────────────────────────────────────────┤
│ postcss │ CVE-2026-41305 │ MEDIUM   │ fixed  │ 8.4.31            │ 8.5.10        │ postcss: PostCSS: Cross-Site Scripting (XSS) via improper │
│         │                │          │        │                   │               │ escaping of style closing tags...                         │
│         │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-41305                │
└─────────┴────────────────┴──────────┴────────┴───────────────────┴───────────────┴───────────────────────────────────────────────────────────┘

dependabot Bot added dependencies Pull requests that update a dependency file docker Pull requests that update docker code labels Jun 10, 2026

dependabot Bot force-pushed the dependabot/docker/composer/composer-2.10.1 branch from 53f83d3 to 972368e Compare June 11, 2026 06:15

Navigation Menu

Repository navigation

build(deps): bump composer/composer from 2.9.8 to 2.10.1 - #13

build(deps): bump composer/composer from 2.9.8 to 2.10.1#13
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/docker/composer/composer-2.10.1

dependabot Bot commented on behalf of github Jun 10, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Jun 10, 2026

Uh oh!

github-actions Bot commented Jun 10, 2026

Uh oh!

github-actions Bot commented Jun 10, 2026

Uh oh!

github-actions Bot commented Jun 10, 2026

Uh oh!

github-actions Bot commented Jun 11, 2026

Uh oh!

github-actions Bot commented Jun 11, 2026

Uh oh!

github-actions Bot commented Jun 11, 2026

Uh oh!

github-actions Bot commented Jun 11, 2026

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Jun 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jun 10, 2026

Super-linter summary

Uh oh!

github-actions Bot commented Jun 10, 2026

Super-linter summary

Uh oh!

github-actions Bot commented Jun 10, 2026

Super-linter summary

Uh oh!

github-actions Bot commented Jun 10, 2026

Super-linter summary

Uh oh!

github-actions Bot commented Jun 11, 2026

Super-linter summary

Uh oh!

github-actions Bot commented Jun 11, 2026

Super-linter summary

Uh oh!

github-actions Bot commented Jun 11, 2026

Super-linter summary

Uh oh!

github-actions Bot commented Jun 11, 2026

Super-linter summary

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Jun 10, 2026 •

edited

Loading