[Aikido] Fix 9 security issues in lodash, uuid, @octokit/endpoint and 3 more

[aikido-autofix]

Upgrade dependencies to fix critical RCE vulnerability in lodash template injection via options.imports and high-severity buffer overflow in uuid.

✅ Code not affected by breaking changes.

✅ No breaking changes from the package upgrades affect this codebase.

lodash (4.17.21 => 4.18.1):

• The codebase only uses _.filter() and _.merge() methods (in src/gh.js)

• The breaking changes affect _.unset(), _.omit(), and _.template(), which are not used in this codebase

uuid (8.3.2 => 11.1.1):

• The uuid package is not imported or used anywhere in the source code

@octokit packages:

• These packages are indirect dependencies through @actions/github v6.0.1, which already uses the target versions or newer:

  • @octokit/endpoint: already at v9.0.6

  • @octokit/plugin-paginate-rest: already at v9.2.2

  • @octokit/request: already at v8.4.1

  • @octokit/request-error: already at v5.1.1

• The action runs on Node.js 24 (runs: using: node24 in action.yml), which satisfies all Node.js version requirements

• No custom HTTP agents or restricted request options are being passed to Octokit methods

All breaking changes by upgrading lodash from version 4.17.21 to 4.18.1 (CHANGELOG)

Version	Description
4.18.0	_.unset / _.omit now block constructor and prototype as non-terminal path keys unconditionally. Calls that previously returned true and deleted the property now return false and leave the target untouched.
4.18.0	_.template now throws "Invalid imports option passed into _.template" when imports keys contain forbidden identifier characters, which were previously allowed.

All breaking changes by upgrading uuid from version 8.3.2 to 11.1.1 (CHANGELOG)

Version	Description
9.0.0	Drop Node.js 10.x support
9.0.0	Remove the minified UMD build from the package
9.0.0	Drop IE 11 and Safari 10 support, remove msCrypto fallback, and no longer transpile browser build to ES2015
10.0.0	Drop Node.js 12 and 14 support, add Node.js 20 (update node support matrix to only support node 16-20)
11.0.0	Refactor v1 internal state and options logic
11.0.0	Refactor v7 internal state and options logic
11.0.0	Port to TypeScript
11.0.0	Update node support matrix (only support node 16-20)

All breaking changes by upgrading @octokit/endpoint from version 6.0.12 to 9.0.6 (CHANGELOG)

Version	Description
7.0.0	Drop support for NodeJS v10, v12
8.0.0	Drop support for NodeJS v14, v16
8.0.0	Remove previews logic for the REST API
9.0.0	Replace support for Node.js http(s) Agents with documentation on using fetch dispatchers instead

All breaking changes by upgrading @octokit/plugin-paginate-rest from version 2.21.3 to 9.2.2 (CHANGELOG)

Version	Description
3.0.0	Drop support for NodeJS v10, v12
4.0.0	Removed the now-defunct OAuth Authorizations APIs from the OpenAPI specifications (these were disabled and cut off on GitHub.com at the end of 2020)
5.0.0	Type support for GHEC routes has been removed
6.0.0	Remove defunct endpoints
7.0.0	Drop support for NodeJS v14, v16
8.0.0	Bump peerDependency of @octokit/core to v5
8.0.0	Bump @octokit/types to v11
9.0.0	Remove required workflow endpoints

All breaking changes by upgrading @octokit/request from version 5.6.3 to 8.4.1 (CHANGELOG)

Version	Description
6.0.0	Drop support for NodeJS v10, v12
7.0.0	Drop support for NodeJS v14, v16
7.0.0	Remove node-fetch in favor of global
8.0.0	Replace support for Node.js http(s) Agents with documentation on using fetch dispatchers instead
8.0.0	Remove ability to pass custom request options, except from method, headers, body, signal, data

All breaking changes by upgrading @octokit/request-error from version 2.1.0 to 5.1.1 (CHANGELOG)

Version	Description
3.0.0	Drop support for NodeJS v10, v12
4.0.0	Drop support for NodeJS v14, v16
5.0.0	Upgrade @octokit/types to v11

✅ 9 CVEs resolved by this upgrade, including 1 critical 🚨 CVE

This PR will resolve the following CVEs:

Issue	Severity	Description
CVE-2026-4800	🚨 CRITICAL	[lodash] A vulnerability in _.template allows arbitrary code execution through untrusted key names in options.imports or prototype pollution, as validation was incomplete after a prior CVE fix. An attacker can inject malicious code that executes during template compilation.
CVE-2025-13465	MEDIUM	[lodash] A prototype pollution vulnerability in _.unset and _.omit functions allows attackers to delete methods from global prototypes via crafted paths. While this prevents property overwriting, it can cause denial of service by removing critical functionality.
CVE-2026-2950	MEDIUM	[lodash] Prototype pollution vulnerability in _.unset and _.omit functions allows attackers to bypass previous fixes using array-wrapped path segments, enabling deletion of properties from built-in prototypes. While this doesn't allow overwriting prototype behavior, it can cause denial of service or unexpected application behavior.
CVE-2026-41907	HIGH	[uuid] A buffer overflow vulnerability allows v3, v5, and v6 UUID functions to write beyond caller-provided buffer boundaries when given small buffers or large offsets, causing silent data corruption. This can lead to memory corruption and potential code execution or information disclosure.
AIKIDO-2026-10892	MEDIUM	[uuid] UUID functions v3(), v5(), and v6() can write past the end of a caller-provided buffer due to missing offset validation, enabling buffer overflow attacks. The fix adds bounds checks to prevent out-of-range writes.
AIKIDO-2025-10094	LOW	[@octokit/endpoint] Improper header parsing for GraphQL endpoints allows attackers to craft malicious inputs triggering ReDoS through excessive regex backtracking, causing denial of service and performance degradation.
CVE-2025-25288	LOW	[@octokit/plugin-paginate-rest] A ReDoS (Regular Expression Denial of Service) vulnerability exists in the pagination iterator when processing malicious link headers, allowing attackers to cause denial of service through specially crafted requests.
CVE-2025-25290	LOW	[@octokit/request] A ReDoS vulnerability in the link header parsing regex allows attackers to cause excessive CPU usage and service unavailability through specially crafted HTTP responses. The unbounded regex pattern is susceptible to catastrophic backtracking when processing malicious input.
CVE-2025-25289	LOW	[@octokit/request-error] A Regular Expression Denial of Service (ReDoS) vulnerability in HTTP header processing allows attackers to cause excessive resource consumption and DoS by sending malformed authorization headers with long space sequences. This can significantly degrade performance or crash services.

🤖 Remediation details

Fix security vulnerabilities in lodash, uuid, undici, and @octokit/* packages

Short summary

This PR remediates security vulnerabilities in seven npm packages: lodash, uuid, undici, @octokit/endpoint, @octokit/plugin-paginate-rest, @octokit/request, and @octokit/request-error. Changes touch the root package.json (direct dependency version specs and a new overrides block) and the root package-lock.json (resolved versions for all affected transitive packages).

lodash

lodash is a direct dependency declared in the root package.json. Its version spec was raised from ^4.17.21 to ^4.18.1, which npm resolved to 4.18.1 in the lockfile. The bump was required to reach the patched release that addresses three separate vulnerabilities present in all 4.x versions below 4.18.1.

uuid

uuid appears as a transitive dependency pulled in by aws-sdk (itself a direct dependency). Because aws-sdk v2 is end-of-life and no published version of it upgrades its nested uuid to a safe release, no parent-bump path exists. A targeted overrides entry ("uuid@<11.1.1": "11.1.1") was added to the root package.json to force the lockfile to resolve uuid to 11.1.1 for all instances below the patched threshold. The uuid instance previously pulled in by @actions/core was eliminated entirely by bumping @actions/core to ^1.11.0 (see below), which drops the uuid dependency altogether.

undici

undici is a transitive dependency pulled in by @actions/http-client, which is itself a transitive dependency of @actions/github. The installed @actions/http-client@2.2.3 declares undici@^5.28.5, capping resolution to the vulnerable v5 branch. The first @actions/http-client release that depends on a safe undici (v6.x) is v3.0.2, which is a major bump outside the ^2.2.0 range that @actions/github@6.0.1 declares — meaning no parent version within the current @actions/github constraint can auto-resolve to a safe undici. A targeted overrides entry ("undici@<6.24.0": "6.24.0") was therefore added to the root package.json, forcing the lockfile to resolve undici to 6.24.0 for all instances below that threshold.

@octokit/endpoint

@octokit/endpoint is a transitive dependency pulled in by @octokit/request. The installed @octokit/request@5.6.3 only resolves @octokit/endpoint into the vulnerable 6.x range. Fixing this required bumping @actions/github from ^4.0.0 to ^6.0.0 in the root package.json; @actions/github@6.x depends on @octokit/core@^5, which in turn pulls @octokit/request@^8.4.1, and that version declares @octokit/endpoint@^9.0.0 — allowing npm to resolve @octokit/endpoint to the patched 9.0.6.

@octokit/plugin-paginate-rest

@octokit/plugin-paginate-rest is a transitive dependency pulled in by @actions/github. The previously installed @actions/github@4.0.0 resolved it to the vulnerable 2.21.3. Bumping @actions/github to ^6.0.0 in the root package.json was required because @actions/github@6.x is the first release that declares @octokit/plugin-paginate-rest@^9.0.0, allowing npm to resolve it to the patched 9.2.2.

@octokit/request

@octokit/request is a transitive dependency with two parent paths: via @octokit/core and via @octokit/graphql. Both parents were at versions that pinned @octokit/request into the vulnerable 5.x range. Bumping @actions/github to ^6.0.0 resolved this: @actions/github@6.x brings @octokit/core@^5 and @octokit/graphql@^7, both of which declare @octokit/request@^8.x, allowing npm to resolve it to the patched 8.4.1.

@octokit/request-error

@octokit/request-error is a transitive dependency pulled in by both @octokit/core and @octokit/request. The previously installed versions of those parents constrained @octokit/request-error to the vulnerable 2.x range. The same @actions/github bump to ^6.0.0 that fixed @octokit/request also resolved this: @octokit/core@5.x and @octokit/request@8.x both declare @octokit/request-error@^5.x, allowing npm to resolve it to the patched 5.1.1.

Version changes

Package	From	To	Why updated
lodash	^4.17.21 / 4.17.21	^4.18.1 / 4.18.1	Direct CVE fix
@actions/core	^1.10.0 / 1.10.0	^1.11.0 / 1.11.1	Parent bump to drop vulnerable uuid instance
@actions/github	^4.0.0 / 4.0.0	^6.0.0 / 6.0.1	Parent bump required to fix @octokit/plugin-paginate-rest, @octokit/request, @octokit/request-error, @octokit/endpoint
uuid	8.0.0 (nested under aws-sdk)	11.1.1	Override (no fixing parent version exists in EOL aws-sdk v2)
undici	5.29.0	6.24.0	Override (fixing @actions/http-client v3 is outside ^2.2.0 range declared by @actions/github)
@octokit/endpoint	6.0.12	9.0.6	Transitive after parent bump (@actions/github → @octokit/request@8.x)
@octokit/plugin-paginate-rest	2.21.3	9.2.2	Transitive after parent bump (@actions/github@6.x)
@octokit/request	5.6.3	8.4.1	Transitive after parent bump (@actions/github@6.x → @octokit/core@5.x)
@octokit/request-error	2.1.0	5.1.1	Transitive after parent bump (@octokit/core@5.x, @octokit/request@8.x)
@octokit/core	3.6.0	5.2.2	Transitive after parent bump (@actions/github@6.x)
@octokit/graphql	4.8.0	7.1.1	Transitive after parent bump (@actions/github@6.x → @octokit/core@5.x)
@actions/http-client	2.2.3	2.2.3 (spec unchanged; undici forced to 6.24.0 via override)	Lockfile unchanged; undici override applied above this package
@octokit/plugin-rest-endpoint-methods	(prior version)	10.4.1	Transitive after parent bump (@actions/github@6.x)
@octokit/auth-token	(prior version)	4.x	Transitive after parent bump (@octokit/core@5.x)
@octokit/types	(prior version)	13.x	Transitive after parent bump (@octokit/core@5.x, @octokit/request@8.x)

[aikido-autofix]

Closed by Aikido: a new AutoFix has been created → #19