[Aikido] Fix 7 security issues in lodash, @octokit/endpoint, @octokit/plugin-paginate-rest and 2 more

[aikido-autofix]

Upgrade dependencies to fix critical RCE vulnerability in lodash template injection and prototype pollution attacks via untrusted imports.

⚠️ Incomplete breaking changes analysis (1/5 analyzed)

⚠️ Breaking changes analysis not available for: @octokit/endpoint, @octokit/plugin-paginate-rest, @octokit/request, @octokit/request-error

✅ No breaking changes from the package upgrades affect this codebase:

lodash (4.17.21 => 4.18.1):

• The codebase uses lodash (_.filter and _.merge in src/gh.js), but does not use _.unset, _.omit, or _.template methods that have breaking changes.

@octokit packages:

• The action runs on node24 (as specified in action.yml), which satisfies all Node.js version requirements (v10, v12, v14, v16 are all older than Node 24).

• The codebase does not use OAuth Authorizations APIs or workflow endpoints that were removed.

• The codebase does not pass custom HTTP agents or custom request options to @octokit/request - it only uses standard octokit.request() and octokit.paginate() calls with basic parameters (method, headers, body which remain supported).

• The codebase relies on @actions/github package which handles the octokit initialization and will manage the transition from node-fetch to global fetch internally.

• No GHEC-specific routes or preview APIs are used.

All breaking changes are either for features not used by this codebase or are internal implementation changes that don't affect the API surface being used.

All breaking changes by upgrading lodash from version 4.17.21 to 4.18.1 (CHANGELOG)

Version	Description
4.18.0	_.unset / _.omit now block constructor and prototype as non-terminal path keys unconditionally. Calls that previously returned true and deleted the property now return false and leave the target untouched.
4.18.0	_.template now throws "Invalid imports option passed into _.template" when imports keys contain forbidden identifier characters, which were previously allowed.

✅ 7 CVEs resolved by this upgrade, including 1 critical 🚨 CVE

This PR will resolve the following CVEs:

Issue	Severity	Description
CVE-2026-4800	🚨 CRITICAL	[lodash] A vulnerability in _.template allows arbitrary code execution through untrusted key names in options.imports or prototype pollution, as validation was incomplete after a prior CVE fix. An attacker can inject malicious code that executes during template compilation.
CVE-2025-13465	MEDIUM	[lodash] A prototype pollution vulnerability in _.unset and _.omit functions allows attackers to delete methods from global prototypes via crafted paths. While this prevents property overwriting, it can cause denial of service by removing critical functionality.
CVE-2026-2950	MEDIUM	[lodash] Prototype pollution vulnerability in _.unset and _.omit functions allows attackers to bypass previous fixes using array-wrapped path segments, enabling deletion of properties from built-in prototypes. While this doesn't allow overwriting prototype behavior, it can cause denial of service or unexpected application behavior.
AIKIDO-2025-10094	LOW	[@octokit/endpoint] Improper header parsing for GraphQL endpoints allows attackers to craft malicious inputs triggering ReDoS through excessive regex backtracking, causing denial of service and performance degradation.
CVE-2025-25288	LOW	[@octokit/plugin-paginate-rest] A ReDoS (Regular Expression Denial of Service) vulnerability exists in the pagination iterator when processing malicious link headers, allowing attackers to cause denial of service through specially crafted requests.
CVE-2025-25290	LOW	[@octokit/request] A ReDoS vulnerability in the link header parsing regex allows attackers to cause excessive CPU usage and service unavailability through specially crafted HTTP responses. The unbounded regex pattern is susceptible to catastrophic backtracking when processing malicious input.
CVE-2025-25289	LOW	[@octokit/request-error] A Regular Expression Denial of Service (ReDoS) vulnerability in HTTP header processing allows attackers to cause excessive resource consumption and DoS by sending malformed authorization headers with long space sequences. This can significantly degrade performance or crash services.

🤖 Remediation details

Fix transitive security vulnerabilities in lodash and @octokit/* packages

This PR remediates security vulnerabilities in five packages named in the audit: lodash, @octokit/endpoint, @octokit/plugin-paginate-rest, @octokit/request, and @octokit/request-error. All fixes are applied via direct dependency version spec changes in the root package.json, with package-lock.json updated accordingly. In the course of fixing the @octokit/* chain, a new transitive vulnerability in undici was introduced and subsequently resolved by further parent bumps to @actions/github and @actions/core.

lodash

lodash is a direct dependency declared in the root package.json. Its version spec was raised from ^4.17.21 to ^4.18.1, resolving to 4.18.1 in the lockfile. This was necessary to satisfy the patched version floor required by three separate CVEs affecting the 4.17.x release line.

@octokit/endpoint

@octokit/endpoint is a transitive dependency pulled in by @octokit/request. Fixing it required bumping @actions/github (a direct dependency) from ^4.0.0 ultimately to ^8.0.1, which transitively resolves @octokit/request to 10.x — a version whose declared range for @octokit/endpoint is ^11.0.x, well above the patched floor of 9.0.6. The previously installed 6.0.12 had no fix available within its major line.

@octokit/plugin-paginate-rest

@octokit/plugin-paginate-rest is a transitive dependency pulled in by @actions/github. The installed version 2.21.3 is in an unfixed major line; the patched floor requires 9.2.2 or later. Bumping @actions/github to ^8.0.1 resolves this package to 14.0.0, which is well above the required floor.

@octokit/request

@octokit/request is a transitive dependency pulled in through @octokit/core and @octokit/graphql, both of which are themselves transitive under @actions/github. The installed version 5.6.3 is in an unfixed major line; the patched floor is 8.4.1. Bumping @actions/github to ^8.0.1 causes @octokit/core to resolve to 7.x, whose declared range for @octokit/request is ^10.x, resolving to 10.0.8 in the lockfile.

@octokit/request-error

@octokit/request-error is a transitive dependency pulled in by both @octokit/core and @octokit/request. The installed version 2.1.0 is in an unfixed major line; the patched floor is 5.1.1. The same @actions/github bump to ^8.0.1 that fixes the other @octokit/* packages causes @octokit/request to resolve to 10.x, whose declared range for @octokit/request-error is ^7.x, resolving to 7.1.0 in the lockfile.

Version changes

Package	From	To	Why updated
lodash	^4.17.21 → 4.17.21	^4.18.1 → 4.18.1	Direct CVE fix
@actions/github	^4.0.0 → 4.0.0	^8.0.1 → 8.0.1	Parent bump required to fix @octokit/endpoint, @octokit/plugin-paginate-rest, @octokit/request, @octokit/request-error, and undici
@actions/core	^1.10.0 → 1.10.0	^2.0.0 → 2.0.3	Parent bump required to fix undici (via @actions/http-client upgrade from 2.x to 3.x)
@octokit/endpoint	6.0.12	11.0.3	Transitive CVE fix after @actions/github parent bump
@octokit/plugin-paginate-rest	2.21.3	14.0.0	Transitive CVE fix after @actions/github parent bump
@octokit/request	5.6.3	10.0.8	Transitive CVE fix after @actions/github parent bump
@octokit/request-error	2.1.0	7.1.0	Transitive CVE fix after @actions/github parent bump
undici	5.29.0	6.25.0	Transitive CVE fix after @actions/github (^8.0.1) and @actions/core (^2.0.0) parent bumps
@actions/http-client	2.2.3	3.0.2	Transitive after @actions/core parent bump; carries undici@^6.23.0
@octokit/core	3.6.0	7.0.6	Transitive after @actions/github parent bump
@octokit/graphql	4.8.0	9.0.3	Transitive after @actions/github parent bump
@octokit/plugin-rest-endpoint-methods	5.x	17.x	Transitive after @actions/github parent bump
@octokit/auth-token	2.x	5.x	Transitive after @actions/github parent bump
@octokit/types	6.x	13.x	Transitive after @actions/github parent bump

[aikido-autofix]

Closed by Aikido: a new AutoFix has been created → #12