chore(deps): bump vm2 from 3.11.5 to 3.11.6 in /packages/plugin-loader in the security-updates group across 1 directory

[dependabot]

Bumps the security-updates group with 1 update in the /packages/plugin-loader directory: vm2.

Updates vm2 from 3.11.5 to 3.11.6

Release notes

Sourced from vm2's releases.

v3.11.6

Five advisories closed. Patch release — no API changes for valid configurations.

What's Changed

Security fixes

• GHSA-cfcw-xp6x-25gj — Stacked-indirection bypass of the GHSA-v6mx-mf47-r5wg apply-trap peel. Two layers of Function.prototype.{call,apply,bind} pushed the host prototype mutator out of the inspected position; a later variant ran the __proto__ setter entirely host-side, defeating both identity checks (RCE).
• GHSA-gmc2-2x9w-cgh9 — bufferAllocLimit bypass via Buffer.concat(list, totalLength) and Buffer.from(arrayLike), which reach the host allocator without traversing the sandbox-side wrapper — one call allocates past a configured cap (host memory-exhaustion DoS).
• GHSA-m283-3h24-438v — Host errors leaked live host references into sandbox catch blocks via Error.cause, the SuppressedError / AggregateError slots, arbitrary own properties (err.detail = process), and the carrier's prototype chain. Any embedder function throwing an error that carried a host reference was an escape (RCE).
• GHSA-m5w8-4gq2-6f8x — NodeVM builtin: ['*'] exposed os and dns, the last two process-wide builtins. Both leak host identity and network topology, and both write host state: dns.setServers() hijacks the host's DNS resolver, os.setPriority() renices the host process.
• GHSA-v836-6xw4-9cx3 — bufferAllocLimit bypass via ArrayBuffer, SharedArrayBuffer, every TypedArray constructor, and WebAssembly.Memory, which hit the same timeout-immune V8 allocator uncapped — a ~200-byte payload becomes gigabytes of host RSS (host memory-exhaustion DoS).

Upgrade Notes

• builtin: ['*'] users depending on os or dns — both are now denied, along with node:os, node:dns and dns/promises. Re-introduce a safe subset via require.mock / require.override.
• Finite bufferAllocLimit users — the cap now also covers Buffer.concat / from / copyBytesFrom and the ArrayBuffer / SharedArrayBuffer / TypedArray / WebAssembly.Memory constructors. The default Infinity is unaffected.
• Host errors now reach sandbox catch blocks as sandbox-realm errors. Primitive diagnostics are preserved and instanceof now works for subclasses; non-primitive properties and the host prototype chain are gone by design.

Full Changelog: patriksimek/vm2@v3.11.5...3.11.6

Changelog

Sourced from vm2's changelog.

[3.11.6]

Five advisories closed. Patch release — no API changes for valid configurations.

Security fixes

• GHSA-cfcw-xp6x-25gj — stacked-indirection bypass of the GHSA-v6mx-mf47-r5wg apply-trap peel: the peel inspected one layer of Function.prototype.{call,apply,bind} indirection, so two layers slipped the host prototype mutator past it, and a follow-up variant laundered the severance entirely host-side. Closed at two independent chokepoints — lib/bridge.js refuses to deliver host prototype mutators, and both it and handleException reject any host object whose prototype chain reaches null without passing through the sandbox Object.prototype. See ATTACKS.md Category 37 and test/ghsa/GHSA-cfcw-xp6x-25gj/.
• GHSA-gmc2-2x9w-cgh9 — bufferAllocLimit (GHSA-6785-pvv7-mvg7) bypass via Buffer.concat(list, totalLength) and Buffer.from(arrayLike), whose host implementations reach the C++ allocator without traversing the sandbox-side allocUnsafe wrapper. lib/setup-sandbox.js now caps concat, from, and copyBytesFrom, and a fail-closed enumeration of host.Buffer's own keys turns any future uncapped allocator into an explicit error rather than a silent bypass. See ATTACKS.md Category 23 (extended) and test/ghsa/GHSA-gmc2-2x9w-cgh9/.
• GHSA-m283-3h24-438v — host errors leaked live host references into sandbox catch blocks through four channels: Error.cause, the SuppressedError / AggregateError sub-error slots, arbitrary own properties (err.detail = process), and — beyond the reach of own-key enumeration — the carrier's own prototype chain. handleException now seals the spec-defined slots and rebuilds every host-wrapped carrier as a fresh sandbox-realm error carrying only its primitive properties, discarding the host prototype chain entirely. See ATTACKS.md Category 38 and test/ghsa/GHSA-m283-3h24-438v/.
• GHSA-m5w8-4gq2-6f8x — sibling of GHSA-9g8x: NodeVM builtin: ['*'] still surfaced os and dns, the last two process-wide builtins. Beyond host-identity and network-topology reads, both carry writes reachable in one line of sandbox code — dns.setServers() hijacks the host's DNS resolver, os.setPriority() renices the host process. lib/builtin.js adds both to DANGEROUS_BUILTINS, covering node: spellings and dns/promises automatically. See ATTACKS.md Category 35 (extended) and test/ghsa/GHSA-m5w8-4gq2-6f8x/.
• GHSA-v836-6xw4-9cx3 — bufferAllocLimit bypass via ArrayBuffer / SharedArrayBuffer / TypedArray / WebAssembly.Memory, which reach the same synchronous, timeout-immune V8 backing-store allocator uncapped. When a finite limit is set, lib/setup-sandbox.js wraps each constructor with a construct trap capping the ToIndex-coerced byte count, and pins prototype.constructor so the uncapped intrinsic cannot be recovered by a constructor walk. The default Infinity leaves them untouched. See ATTACKS.md Category 36 and test/ghsa/GHSA-v836-6xw4-9cx3/.

Upgrade notes

• If you use NodeVM({ require: { builtin: ['*'] } }) and depend on os or dns, those two builtins are now denied (GHSA-m5w8-4gq2-6f8x), together with node:os, node:dns, and dns/promises. They join the process-wide class closed in 3.11.4: they expose host-process identity and network topology, and dns.setServers() / dns.setDefaultResultOrder() / os.setPriority() are outright writes to host-process state. Embedders needing a sandbox-local subset (typically os.platform(), os.EOL, os.constants) should register a controlled wrapper via require.mock or require.override.
• If you set a finite bufferAllocLimit, the cap now also covers Buffer.concat, Buffer.from, Buffer.copyBytesFrom, and the ArrayBuffer / SharedArrayBuffer / TypedArray / WebAssembly.Memory constructors (GHSA-gmc2-2x9w-cgh9, GHSA-v836-6xw4-9cx3). Sandbox code that previously allocated past the cap through those paths now gets the same RangeError. The default bufferAllocLimit: Infinity leaves every one of them untouched, so this is a no-op unless you opted into the cap.
• Errors thrown by embedder-exposed host functions now reach sandbox catch blocks as sandbox-realm errors rather than proxies of the host error (GHSA-m283-3h24-438v). Primitive diagnostics (message, name, stack, code, errno, syscall, path, …) are preserved and error subclasses (TypeError, RangeError, …) now satisfy instanceof correctly inside the sandbox; non-primitive properties, and anything reachable through the error's prototype chain, are gone by design.

Commits

• a5b31cd ci: pin the compilers job to TypeScript 6
• 3dffc8f test(GHSA-v836-6xw4-9cx3): raise the timeout on the documented-residual case
• a1cf31d chore(deps-dev): refresh lockfile, clearing all dev-dependency advisories
• b76dd7d chore: bump to 3.11.6 and cut the release section
• 7e3faaf fix(GHSA-m283-3h24-438v): sanitize host error carriers reaching the sandbox
• a85acb6 fix(GHSA-cfcw-xp6x-25gj): refuse host prototype mutators and severed host val...
• c950166 fix(GHSA-v836-6xw4-9cx3): cap ArrayBuffer/TypedArray/WebAssembly.Memory under...
• 3ffb315 fix(GHSA-gmc2-2x9w-cgh9): close bufferAllocLimit bypass via concat / from / c...
• 768bcfc fix(GHSA-m5w8-4gq2-6f8x): deny os and dns NodeVM builtins
• 5e0f255 feat: add maintainer skill governing the security advisory queue
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[cursor]

Bugbot is paused — on-demand spend limit reached

Bugbot uses usage-based billing for this team and has hit its on-demand spend limit.

A team admin can raise the spend limit in the Cursor dashboard, or wait for the next billing cycle to continue.

[changeset-bot]

⚠️ No Changeset found

Latest commit: b101b84

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[nx-cloud]

🤖 Nx Cloud AI Fix Eligible

An automatically generated fix could have helped fix failing tasks for this run, but Self-healing CI is disabled for this workspace. Visit workspace settings to enable it and get automatic fixes in future runs.

_{To disable these notifications, a workspace admin can disable them in workspace settings.}

---

View your CI Pipeline Execution ↗ for commit b101b84

Command	Status	Duration	Result
nx test @e2e/angular-19-ssr	❌ Failed	5m 51s	View ↗
nx test @e2e/angular-17-ssr	❌ Failed	4m 46s	View ↗
nx test @snippet/react	❌ Failed	4m 25s	View ↗
nx test @e2e/sveltekit	✅ Succeeded	11m 49s	View ↗
nx test @e2e/angular-17	✅ Succeeded	6m 44s	View ↗
nx test @snippet/svelte	✅ Succeeded	4m 28s	View ↗
nx test @e2e/solid	✅ Succeeded	4m 37s	View ↗
nx test @e2e/nextjs-sdk-next-app	✅ Succeeded	7m 10s	View ↗
Additional runs (38)	✅ Succeeded	...	View ↗

💡 Dealing with memory or CPU issues? See memory and CPU details with the resource usage add-on ↗.

---

☁️ Nx Cloud last updated this comment at 2026-08-18 21:32:18 UTC