[Aikido] Fix 9 security issues in lodash, uuid, @octokit/endpoint and 3 more

[aikido-autofix]

Upgrade dependencies to fix critical RCE vulnerability in lodash template injection via options.imports and high-severity buffer overflow in uuid.

⚠️ Incomplete breaking changes analysis (2/6 analyzed)

⚠️ Breaking changes analysis not available for: @octokit/endpoint, @octokit/plugin-paginate-rest, @octokit/request, @octokit/request-error

✅ No breaking changes affect this codebase.

The codebase runs on Node.js 24 (as specified in action.yml), which satisfies all Node.js version requirements from the upgraded packages. The lodash upgrade's breaking changes only affect _.unset, _.omit, and _.template, but this codebase only uses _.filter and _.merge in src/gh.js. The uuid package is not used at all. The @octokit packages are used indirectly through @actions/github, but the code doesn't use any deprecated features like custom HTTP agents, preview APIs, OAuth Authorizations APIs, or required workflow endpoints.

All breaking changes by upgrading lodash from version 4.17.21 to 4.18.1 (CHANGELOG)

Version	Description
4.18.0	_.unset / _.omit now block constructor and prototype as non-terminal path keys unconditionally. Calls that previously returned true and deleted the property now return false and leave the target untouched.
4.18.0	_.template now throws "Invalid imports option passed into _.template" when imports keys contain forbidden identifier characters, which were previously allowed.

All breaking changes by upgrading uuid from version 8.3.2 to 11.1.1 (CHANGELOG)

Version	Description
9.0.0	Drop Node.js 10.x support
9.0.0	Remove the minified UMD build from the package
9.0.0	Drop IE 11 and Safari 10 support, remove msCrypto fallback, and no longer transpile browser build to ES2015
10.0.0	Drop Node.js 12 and 14 support, add Node.js 20 (update node support matrix to only support node 16-20)
11.0.0	Refactor v1 internal state and options logic
11.0.0	Refactor v7 internal state and options logic
11.0.0	Port to TypeScript
11.0.0	Update node support matrix (only support node 16-20)

✅ 9 CVEs resolved by this upgrade, including 1 critical 🚨 CVE

This PR will resolve the following CVEs:

Issue	Severity	Description
CVE-2026-4800	🚨 CRITICAL	[lodash] A vulnerability in _.template allows arbitrary code execution through untrusted key names in options.imports or prototype pollution, as validation was incomplete after a prior CVE fix. An attacker can inject malicious code that executes during template compilation.
CVE-2025-13465	MEDIUM	[lodash] A prototype pollution vulnerability in _.unset and _.omit functions allows attackers to delete methods from global prototypes via crafted paths. While this prevents property overwriting, it can cause denial of service by removing critical functionality.
CVE-2026-2950	MEDIUM	[lodash] Prototype pollution vulnerability in _.unset and _.omit functions allows attackers to bypass previous fixes using array-wrapped path segments, enabling deletion of properties from built-in prototypes. While this doesn't allow overwriting prototype behavior, it can cause denial of service or unexpected application behavior.
CVE-2026-41907	HIGH	[uuid] A buffer overflow vulnerability allows v3, v5, and v6 UUID functions to write beyond caller-provided buffer boundaries when given small buffers or large offsets, causing silent data corruption. This can lead to memory corruption and potential code execution or information disclosure.
AIKIDO-2026-10892	MEDIUM	[uuid] UUID functions v3(), v5(), and v6() can write past the end of a caller-provided buffer due to missing offset validation, enabling buffer overflow attacks. The fix adds bounds checks to prevent out-of-range writes.
AIKIDO-2025-10094	LOW	[@octokit/endpoint] Improper header parsing for GraphQL endpoints allows attackers to craft malicious inputs triggering ReDoS through excessive regex backtracking, causing denial of service and performance degradation.
CVE-2025-25288	LOW	[@octokit/plugin-paginate-rest] A ReDoS (Regular Expression Denial of Service) vulnerability exists in the pagination iterator when processing malicious link headers, allowing attackers to cause denial of service through specially crafted requests.
CVE-2025-25290	LOW	[@octokit/request] A ReDoS vulnerability in the link header parsing regex allows attackers to cause excessive CPU usage and service unavailability through specially crafted HTTP responses. The unbounded regex pattern is susceptible to catastrophic backtracking when processing malicious input.
CVE-2025-25289	LOW	[@octokit/request-error] A Regular Expression Denial of Service (ReDoS) vulnerability in HTTP header processing allows attackers to cause excessive resource consumption and DoS by sending malformed authorization headers with long space sequences. This can significantly degrade performance or crash services.

🤖 Remediation details

Fix security vulnerabilities in lodash, uuid, @octokit/endpoint, @octokit/plugin-paginate-rest, @octokit/request, and @octokit/request-error

Short summary

This PR remediates security vulnerabilities in six npm packages: lodash, uuid, @octokit/endpoint, @octokit/plugin-paginate-rest, @octokit/request, and @octokit/request-error. All six were either direct dependencies or transitives pulled in through @actions/core, @actions/github, and aws-sdk. Changes touch the root package.json (four declared-version bumps and one new overrides entry) and are realized in package-lock.json. A regression introduced during the fix — five new undici CVEs pulled in at a vulnerable version by the initial @actions/github bump — was also resolved in the same pass.

lodash

lodash is a direct dependency declared in the root package.json. The declared spec was widened from ^4.17.21 to ^4.18.1, which causes npm install to resolve the lockfile to 4.18.1 — the minimum version that carries all three patches. No parent chain was involved.

uuid

uuid appears as a transitive dependency in two places. The copy under @actions/core was eliminated entirely by bumping @actions/core to ^2.0.0 (that major no longer depends on uuid). The copy nested inside aws-sdk is exact-pinned at 8.0.0 by aws-sdk's own manifest, and no published version of aws-sdk resolves uuid to a patched release, so a targeted overrides entry ("uuid@<11.1.1": "11.1.1") was added to the root package.json as the only remaining option — overrides were used only after confirming no parent bump could fix this instance.

@octokit/endpoint

@octokit/endpoint is a transitive dependency pulled in by @octokit/request. Fixing it required bumping @actions/github to ^8.0.1, which transitively resolves @octokit/request to 10.x — a version whose declared range for @octokit/endpoint is ^11.0.3, satisfying the patched floor. No direct declaration of @octokit/endpoint exists in the project manifests.

@octokit/plugin-paginate-rest

@octokit/plugin-paginate-rest is a transitive dependency of @actions/github. Bumping @actions/github to ^8.0.1 resolves this package to 14.0.0, well above the patched minimum of 9.2.2. The parent bump was necessary because the previously installed @actions/github@4.x pinned a 2.x release of this package.

@octokit/request

@octokit/request is a transitive dependency shared by @actions/github, @octokit/core, and @octokit/graphql. Bumping @actions/github to ^8.0.1 pulls in a new @octokit/core major (7.x) whose declared range for @octokit/request resolves to 10.0.10, satisfying the patched floor of 8.4.1. The old @actions/github@4.x → @octokit/core@3.x chain was the root cause of the stale version.

@octokit/request-error

@octokit/request-error is a transitive dependency of @octokit/request, @octokit/core, and @actions/github. The same @actions/github bump to ^8.0.1 that fixed @octokit/request also resolves @octokit/request-error to 7.1.0, above the patched minimum of 5.1.1, because the new @octokit/request@10.x declares @octokit/request-error@^7.x.

Version changes

Package	From	To	Why updated
lodash	^4.17.21 → 4.17.21	^4.18.1 → 4.18.1	Direct CVE fix
@actions/core	^1.10.0 → 1.10.0	^2.0.0 → 2.0.3	Parent bump to drop uuid transitive and pull in @actions/http-client@3.x (fixes uuid and undici)
@actions/github	^4.0.0 → 4.0.0	^8.0.1 → 8.0.1	Parent bump required to fix @octokit/plugin-paginate-rest, @octokit/request, @octokit/request-error, @octokit/endpoint, and undici transitives
uuid	8.3.2 (root), 8.0.0 (under aws-sdk)	11.1.1 (under aws-sdk via override; root copy removed)	Transitive CVE fix — override for aws-sdk-nested copy; root copy eliminated by @actions/core bump
@octokit/endpoint	6.0.12	11.0.3	Transitive CVE fix after parent bump (@actions/github → 8.0.1)
@octokit/plugin-paginate-rest	2.21.3	14.0.0	Transitive CVE fix after parent bump (@actions/github → 8.0.1)
@octokit/request	5.6.3	10.0.10	Transitive CVE fix after parent bump (@actions/github → 8.0.1)
@octokit/request-error	2.1.0	7.1.0	Transitive CVE fix after parent bump (@actions/github → 8.0.1)
undici	5.29.0	6.26.0	Transitive CVE fix (CVE-2026-1525/1526/1527/22036/2229) after parent bumps (@actions/github → 8.0.1, @actions/core → 2.0.0)
@actions/http-client	2.2.3	3.0.2	Transitive after parent bump (@actions/core → 2.0.0); required to resolve undici to a patched version
@octokit/core	3.6.0	7.0.6	Transitive after parent bump (@actions/github → 8.0.1)
@octokit/graphql	4.8.0	9.0.3	Transitive after parent bump (@actions/github → 8.0.1)

[aikido-autofix]

Closed by Aikido: a new AutoFix has been created → #17