[Aikido] Fix 9 security issues in lodash, uuid, @octokit/endpoint and 3 more

[aikido-autofix]

Upgrade dependencies to fix critical RCE vulnerability in lodash template injection via options.imports and high-severity buffer overflow in uuid.

⚠️ Incomplete breaking changes analysis (1/6 analyzed)

⚠️ Breaking changes analysis not available for: uuid, @octokit/endpoint, @octokit/plugin-paginate-rest, @octokit/request, @octokit/request-error

✅ No breaking changes from the package upgrades affect this codebase.

lodash: The codebase only uses _.filter() and _.merge() methods (in src/gh.js). The breaking changes in lodash 4.18.x only affect _.unset(), _.omit(), and _.template(), which are not used in this project.

uuid: This package is not imported or used anywhere in the source code.

@octokit packages: These are transitive dependencies through @actions/github. The code uses the high-level github.getOctokit() API without passing custom request options, HTTP agents, or using any deprecated features. The Node.js version requirement changes don't affect this project since it runs on Node.js 24.

All breaking changes by upgrading lodash from version 4.17.21 to 4.18.1 (CHANGELOG)

Version	Description
4.18.0	_.unset / _.omit now block constructor and prototype as non-terminal path keys unconditionally. Calls that previously returned true and deleted the property now return false and leave the target untouched.
4.18.0	_.template now throws "Invalid imports option passed into _.template" when imports keys contain forbidden identifier characters, which were previously allowed.

✅ 9 CVEs resolved by this upgrade, including 1 critical 🚨 CVE

This PR will resolve the following CVEs:

Issue	Severity	Description
CVE-2026-4800	🚨 CRITICAL	[lodash] A vulnerability in _.template allows arbitrary code execution through untrusted key names in options.imports or prototype pollution, as validation was incomplete after a prior CVE fix. An attacker can inject malicious code that executes during template compilation.
CVE-2025-13465	MEDIUM	[lodash] A prototype pollution vulnerability in _.unset and _.omit functions allows attackers to delete methods from global prototypes via crafted paths. While this prevents property overwriting, it can cause denial of service by removing critical functionality.
CVE-2026-2950	MEDIUM	[lodash] Prototype pollution vulnerability in _.unset and _.omit functions allows attackers to bypass previous fixes using array-wrapped path segments, enabling deletion of properties from built-in prototypes. While this doesn't allow overwriting prototype behavior, it can cause denial of service or unexpected application behavior.
CVE-2026-41907	HIGH	[uuid] A buffer overflow vulnerability allows v3, v5, and v6 UUID functions to write beyond caller-provided buffer boundaries when given small buffers or large offsets, causing silent data corruption. This can lead to memory corruption and potential code execution or information disclosure.
AIKIDO-2026-10892	MEDIUM	[uuid] UUID functions v3(), v5(), and v6() can write past the end of a caller-provided buffer due to missing offset validation, enabling buffer overflow attacks. The fix adds bounds checks to prevent out-of-range writes.
AIKIDO-2025-10094	LOW	[@octokit/endpoint] Improper header parsing for GraphQL endpoints allows attackers to craft malicious inputs triggering ReDoS through excessive regex backtracking, causing denial of service and performance degradation.
CVE-2025-25288	LOW	[@octokit/plugin-paginate-rest] A ReDoS (Regular Expression Denial of Service) vulnerability exists in the pagination iterator when processing malicious link headers, allowing attackers to cause denial of service through specially crafted requests.
CVE-2025-25290	LOW	[@octokit/request] A ReDoS vulnerability in the link header parsing regex allows attackers to cause excessive CPU usage and service unavailability through specially crafted HTTP responses. The unbounded regex pattern is susceptible to catastrophic backtracking when processing malicious input.
CVE-2025-25289	LOW	[@octokit/request-error] A Regular Expression Denial of Service (ReDoS) vulnerability in HTTP header processing allows attackers to cause excessive resource consumption and DoS by sending malformed authorization headers with long space sequences. This can significantly degrade performance or crash services.

🤖 Remediation details

Fix security vulnerabilities in lodash, uuid, @octokit/endpoint, @octokit/plugin-paginate-rest, @octokit/request, and @octokit/request-error

Short summary

This PR remediates security vulnerabilities in six npm packages: lodash, uuid, @octokit/endpoint, @octokit/plugin-paginate-rest, @octokit/request, and @octokit/request-error. All fixes are applied via direct dependency version spec changes in the root package.json, with package-lock.json updated accordingly. Because all six vulnerable packages are transitive dependencies (except lodash, which is a direct dependency), the fixes required bumping the direct dependencies that own each vulnerable package's resolution chain — specifically @actions/core, @actions/github, and lodash itself. Bumping @actions/github to ^8.0.1 also introduced and then resolved a secondary regression in the transitive undici package, which required a further bump of @actions/core to ^2.0.0.

lodash

lodash is a direct dependency declared in the root package.json. Its spec was widened from ^4.17.21 to ^4.18.1, resolving the lockfile to 4.18.1, which is the minimum patched version covering all three lodash advisories. No parent chain traversal was needed.

uuid

uuid appears as a transitive dependency in two places. The instance under node_modules/uuid was pulled in by @actions/core@1.10.0 (spec ^8.3.2); bumping @actions/core to ^1.11.0 (later further to ^2.0.0) caused that version to drop its uuid dependency entirely, removing the vulnerable instance from the lockfile. A second instance at node_modules/aws-sdk/node_modules/uuid remains at 8.0.0 because aws-sdk@2.x exact-pins uuid at that version and no published release of aws-sdk@2.x ever resolves uuid to a patched major (11.x / 12.x / 13.x); this instance cannot be fixed without replacing the aws-sdk package itself.

@octokit/endpoint

@octokit/endpoint is a transitive dependency pulled in by @octokit/request, which is itself pulled in through the @actions/github → @octokit/core / @octokit/graphql chain. Bumping @actions/github from ^4.0.0 to ^8.0.1 caused the entire @octokit stack to resolve to a generation that declares @octokit/endpoint@^9.0.0 (and later ^11.0.0), satisfying the ≥9.0.6 patched floor. The lockfile resolved to 11.0.3.

@octokit/plugin-paginate-rest

@octokit/plugin-paginate-rest is a transitive dependency of @actions/github. At @actions/github@4.0.0 it resolved to 2.21.3; bumping @actions/github to ^8.0.1 pulled in a version that declares @octokit/plugin-paginate-rest@^14.0.0, well above the ≥9.2.2 patched floor. The lockfile resolved to 14.0.0.

@octokit/request

@octokit/request is a transitive dependency shared by @octokit/core and @octokit/graphql, both of which are pulled in by @actions/github. At @actions/github@4.0.0 it resolved to 5.6.3; bumping @actions/github to ^8.0.1 caused resolution to @octokit/request@10.0.9, which satisfies the ≥8.4.1 patched floor.

@octokit/request-error

@octokit/request-error is a transitive dependency of @octokit/core and @octokit/request. At @actions/github@4.0.0 it resolved to 2.1.0; bumping @actions/github to ^8.0.1 caused the entire @octokit stack to resolve to a generation that declares @octokit/request-error@^7.0.0, satisfying the ≥5.1.1 patched floor. The lockfile resolved to 7.1.0.

Version changes

Package	From	To	Why updated
lodash	^4.17.21 → 4.17.21	^4.18.1 → 4.18.1	Direct CVE fix
@actions/core	^1.10.0 → 1.10.0	^2.0.0 → 2.0.3	Parent bump required to drop vulnerable uuid instance and to resolve undici regression via @actions/http-client@^3.0.2
@actions/github	^4.0.0 → 4.0.0	^8.0.1 → 8.0.1	Parent bump required to fix @octokit/endpoint, @octokit/plugin-paginate-rest, @octokit/request, @octokit/request-error; also resolves undici CVEs
uuid	8.3.2 (root instance)	removed	Transitive after parent bump (@actions/core@2.x dropped uuid dependency)
@octokit/endpoint	6.0.12	11.0.3	Transitive after parent bump (@actions/github)
@octokit/plugin-paginate-rest	2.21.3	14.0.0	Transitive after parent bump (@actions/github)
@octokit/request	5.6.3	10.0.9	Transitive after parent bump (@actions/github)
@octokit/request-error	2.1.0	7.1.0	Transitive after parent bump (@actions/github)
@octokit/core	3.6.0	7.0.6	Transitive after parent bump (@actions/github)
@octokit/graphql	4.8.0	9.0.3	Transitive after parent bump (@actions/github)
@actions/http-client	2.2.3	3.0.2	Transitive after parent bump (@actions/core@2.x); required to resolve undici to patched 6.x
undici	5.29.0	6.25.0	Transitive after parent bumps (@actions/github@8.x, @actions/http-client@3.x); fixes undici CVEs introduced by the @actions/github major bump
@octokit/plugin-rest-endpoint-methods	5.16.2	13.3.0	Transitive after parent bump (@actions/github)
@octokit/types	6.41.0	13.10.0	Transitive after parent bump (@actions/github)
@octokit/auth-token	2.5.0	5.1.2	Transitive after parent bump (@actions/github → @octokit/core@7.x)

[aikido-autofix]

Closed by Aikido: a new AutoFix has been created → #15