Bump the dependencies group with 5 updates by dependabot[bot] · Pull Request #401 · zaproxy/browser-extension

dependabot · 2026-10-26T13:28:49Z

Bumps the dependencies group with 5 updates:

Package	From	To
i18next	`26.4.7`	`26.5.6`
@types/lodash	`4.17.26`	`4.17.27`
postcss	`8.5.30`	`8.5.31`
sass	`1.105.2`	`1.106.1`
webpack	`5.112.0`	`5.112.2`

Updates i18next from 26.4.7 to 26.5.6

Release notes

Sourced from i18next's releases.

v26.5.6

fix: cloneInstance({ forkResourceStore: true }) now copies the resources at every level. It copied them only down to the namespace objects, so nested keys and arrays stayed shared with the original instance: addResource() with a nested key (fork.addResource('en', 'translation', 'greeting.hello', 'Hi')) or a deep addResourceBundle() on the fork also changed the original instance and every other fork. Flat keys were already isolated. Forking a large store takes a bit longer: with 300k keys in nested groups, about 11 ms instead of 3 ms per fork. Clones without forkResourceStore still share the store as before. Thanks @nk-batman21 (#2456, follow-up to #2270).

v26.5.5

fix: with the default skipOnVariables: true, a {{placeholder}} inside a value inserted with an unescaped {{- var}} now stays literal, as it already did for {{var}}. The escape pass ran after the unescaped values were written and scanned them again, so t('{{- a}}', { a: '{{b}}', b: 'c' }) returned 'c' instead of '{{b}}'. With pre-built HTML that carries user text, like t('You may contact {{name}} at {{- emailHTML}}.', { name, emailHTML }), that text could pull another variable of the same t() call into the output. Results with skipOnVariables: false, and values without placeholders, are unchanged. Compatibility note: a {{- var}} value whose placeholders were meant to be filled from the same t() call now keeps them literally; skipOnVariables: false restores the old behavior. Thanks @nk-batman21 (#2455, reported in #1595).

v26.5.4

fix: with the default skipOnVariables: true, a {{placeholder}} inside an interpolated value now stays literal also when the same placeholder appears later in the translation. Each value was written with String.replace, which replaces the first copy of the placeholder text, and that could be the copy inside an earlier value: t('{{name}} has {{count}} items', { name: '{{count}}', count: 5 }) returned '5 has {{count}} items' instead of '{{count}} has 5 items'. The value is now written at the position of the matched placeholder. Results with skipOnVariables: false are unchanged. Thanks @nk-batman21 (#2454, reported in #1595).

fix: with useRawValueToEscape: true, a non-string value in an unescaped {{- var}} placeholder or with escapeValue: false no longer throws val.replace is not a function; it is converted to a string like any other value.

v26.5.3

fix(types): with the selector API, a plural key now requires count also when the call passes an explicit ns. t(($) => $.item) already failed without count, but t(($) => $.item, { ns: 'items' }) compiled, although at runtime it looks up item instead of item_one / item_other and returns the key. It now fails the same way, also with ordinal: true, defaultValue, an ns array, a key prefix and i18n.t. Calls with count, context, returnObjects: true and arrays of selectors, as well as return types, are unchanged. Thanks @nyarthan (#2452).

v26.5.2

fix(types): on TypeScript 7, a t() call with a missing, misspelled or wrongly typed option now reports that option again (Property 'album' is missing, Type 'string' is not assignable to type 'number'), as TypeScript 5 and 6 do. TypeScript 7 elaborated the error against the default-value signature instead and ended in '{ count: 3; albm: "Summer"; }' is not assignable to type 'string': on a failed call TypeScript explains the last of the equally matching signatures, and TypeScript 7 sorts the 3-element [key, defaultValue, options?] last. It is now written as two signatures, [key, defaultValue] and [key, defaultValue, options]. This affects the default key checks with i18next {{name}} messages as well as parseInterpolation: 'icu' and 'mf2'. Which calls compile, their return types and the error positions are unchanged on TypeScript 5.9, 6 and 7.

v26.5.1

perf(types): type-checking t() calls against a large namespace is no longer quadratic in the number of keys. TypeScript does not cache keyof of an object type, and the types rebuilt the union of all keys of a namespace once per key while building the key union, and again in every t() call to look up the return type. Both now use a cached key union, and a literal key is looked up directly instead of being intersected with every key. With 5,000 keys in one namespace and one call per key, the check time went from 14.8s to 1.1s (TypeScript 6); with 1,000 keys from 0.75s to 0.27s. Keys, return types and errors are unchanged.

perf(types): the selector API (enableSelector: true / 'strict') with context is no longer quadratic in the size of an object. To decide which keys a context keeps, the types scanned all keys of the object once for every key, also when TypeScript checks the selector with context widened to string. With 1,000 keys plus one context variant each, a namespace took 18.7s and failed with "Type instantiation is excessively deep and possibly infinite" (TS2589); 2,500 and more ran out of memory. The context variants of an object are now collected once, in one pass over its keys: 1,000 keys check in 0.69s, 5,000 in 3.1s. Long keys (whole sentences with keySeparator: false) work as before. Selected values and errors are unchanged.

v26.5.0

feat(types): parseInterpolation: 'icu' and parseInterpolation: 'mf2' type t() options from the message's ICU MessageFormat arguments (i18next-icu) or MessageFormat 2 variables (i18next-mf2), so ICU and MF2 users no longer need parseInterpolation: false and lose argument checking. Missing, misspelled and wrongly typed arguments fail, and so does leaving out the options for a message with arguments (t('greeting')); that error names the missing arguments. Opt-in, default true is unchanged.

ICU: {name} takes string | number, {n, number}, plural and selectordinal take number, {d, date} and {t, time} take Date, select takes its case keys or any string (for other), and arguments nested in cases are required too. # and tags are not arguments, apostrophe quoting is read like intl-messageformat does.

MF2: {$name} takes string | number, a variable annotated with :number, :integer, :currency, :percent or :unit (inline or through .input / .local) takes number, :datetime, :date and :time take Date, :string takes string, option and markup variables (minimumFractionDigits=$digits, {#link href=$url}) are required too, .local variables are not arguments, and |quoted literals| and \{ escapes are skipped.

interpolationFormatTypeMap overrides a type by ICU format or MF2 function name, e.g. date: Date | number or a custom uppercase: string.

Applies to t(), getFixedT(), i18n.t, key prefixes, namespaces, the selector API and react-i18next's Trans values. Messages need literal types, as the resources file from i18next-cli's types command has them.

Type-check cost with 1,000 messages and one call each: 1.35s instead of 0.86s with false (TypeScript 6), 0.5s instead of 0.26s with TypeScript 7. Messages that no call uses cost nothing.

fix(types): with the default (non-strict) key checks, an options object with a missing or misspelled interpolation variable now reports the missing variable (Property 'name' is missing) instead of '{ nmae: string }' is not assignable to type 'string' from the default-value overload.

Changelog

Sourced from i18next's changelog.

26.5.6

fix: cloneInstance({ forkResourceStore: true }) now copies the resources at every level. It copied them only down to the namespace objects, so nested keys and arrays stayed shared with the original instance: addResource() with a nested key (fork.addResource('en', 'translation', 'greeting.hello', 'Hi')) or a deep addResourceBundle() on the fork also changed the original instance and every other fork. Flat keys were already isolated. Forking a large store takes a bit longer: with 300k keys in nested groups, about 11 ms instead of 3 ms per fork. Clones without forkResourceStore still share the store as before. Thanks @nk-batman21 (#2456, follow-up to #2270).

26.5.5

fix: with the default skipOnVariables: true, a {{placeholder}} inside a value inserted with an unescaped {{- var}} now stays literal, as it already did for {{var}}. The escape pass ran after the unescaped values were written and scanned them again, so t('{{- a}}', { a: '{{b}}', b: 'c' }) returned 'c' instead of '{{b}}'. With pre-built HTML that carries user text, like t('You may contact {{name}} at {{- emailHTML}}.', { name, emailHTML }), that text could pull another variable of the same t() call into the output. Results with skipOnVariables: false, and values without placeholders, are unchanged. Compatibility note: a {{- var}} value whose placeholders were meant to be filled from the same t() call now keeps them literally; skipOnVariables: false restores the old behavior. Thanks @nk-batman21 (#2455, reported in #1595).

26.5.4

fix: with the default skipOnVariables: true, a {{placeholder}} inside an interpolated value now stays literal also when the same placeholder appears later in the translation. Each value was written with String.replace, which replaces the first copy of the placeholder text, and that could be the copy inside an earlier value: t('{{name}} has {{count}} items', { name: '{{count}}', count: 5 }) returned '5 has {{count}} items' instead of '{{count}} has 5 items'. The value is now written at the position of the matched placeholder. Results with skipOnVariables: false are unchanged. Thanks @nk-batman21 (#2454, reported in #1595).

fix: with useRawValueToEscape: true, a non-string value in an unescaped {{- var}} placeholder or with escapeValue: false no longer throws val.replace is not a function; it is converted to a string like any other value.

26.5.3

fix(types): with the selector API, a plural key now requires count also when the call passes an explicit ns. t(($) => $.item) already failed without count, but t(($) => $.item, { ns: 'items' }) compiled, although at runtime it looks up item instead of item_one / item_other and returns the key. It now fails the same way, also with ordinal: true, defaultValue, an ns array, a key prefix and i18n.t. Calls with count, context, returnObjects: true and arrays of selectors, as well as return types, are unchanged. Thanks @nyarthan (#2452).

26.5.2

fix(types): on TypeScript 7, a t() call with a missing, misspelled or wrongly typed option now reports that option again (Property 'album' is missing, Type 'string' is not assignable to type 'number'), as TypeScript 5 and 6 do. TypeScript 7 elaborated the error against the default-value signature instead and ended in '{ count: 3; albm: "Summer"; }' is not assignable to type 'string': on a failed call TypeScript explains the last of the equally matching signatures, and TypeScript 7 sorts the 3-element [key, defaultValue, options?] last. It is now written as two signatures, [key, defaultValue] and [key, defaultValue, options]. This affects the default key checks with i18next {{name}} messages as well as parseInterpolation: 'icu' and 'mf2'. Which calls compile, their return types and the error positions are unchanged on TypeScript 5.9, 6 and 7.

26.5.1

perf(types): type-checking t() calls against a large namespace is no longer quadratic in the number of keys. TypeScript does not cache keyof of an object type, and the types rebuilt the union of all keys of a namespace once per key while building the key union, and again in every t() call to look up the return type. Both now use a cached key union, and a literal key is looked up directly instead of being intersected with every key. With 5,000 keys in one namespace and one call per key, the check time went from 14.8s to 1.1s (TypeScript 6); with 1,000 keys from 0.75s to 0.27s. Keys, return types and errors are unchanged.

perf(types): the selector API (enableSelector: true / 'strict') with context is no longer quadratic in the size of an object. To decide which keys a context keeps, the types scanned all keys of the object once for every key, also when TypeScript checks the selector with context widened to string. With 1,000 keys plus one context variant each, a namespace took 18.7s and failed with "Type instantiation is excessively deep and possibly infinite" (TS2589); 2,500 and more ran out of memory. The context variants of an object are now collected once, in one pass over its keys: 1,000 keys check in 0.69s, 5,000 in 3.1s. Long keys (whole sentences with keySeparator: false) work as before. Selected values and errors are unchanged.

26.5.0

feat(types): parseInterpolation: 'icu' and parseInterpolation: 'mf2' type t() options from the message's ICU MessageFormat arguments (i18next-icu) or MessageFormat 2 variables (i18next-mf2), so ICU and MF2 users no longer need parseInterpolation: false and lose argument checking. Missing, misspelled and wrongly typed arguments fail, and so does leaving out the options for a message with arguments (t('greeting')); that error names the missing arguments. Opt-in, default true is unchanged.

ICU: {name} takes string | number, {n, number}, plural and selectordinal take number, {d, date} and {t, time} take Date, select takes its case keys or any string (for other), and arguments nested in cases are required too. # and tags are not arguments, apostrophe quoting is read like intl-messageformat does.

MF2: {$name} takes string | number, a variable annotated with :number, :integer, :currency, :percent or :unit (inline or through .input / .local) takes number, :datetime, :date and :time take Date, :string takes string, option and markup variables (minimumFractionDigits=$digits, {#link href=$url}) are required too, .local variables are not arguments, and |quoted literals| and \{ escapes are skipped.

interpolationFormatTypeMap overrides a type by ICU format or MF2 function name, e.g. date: Date | number or a custom uppercase: string.

Applies to t(), getFixedT(), i18n.t, key prefixes, namespaces, the selector API and react-i18next's Trans values. Messages need literal types, as the resources file from i18next-cli's types command has them.

Type-check cost with 1,000 messages and one call each: 1.35s instead of 0.86s with false (TypeScript 6), 0.5s instead of 0.26s with TypeScript 7. Messages that no call uses cost nothing.

fix(types): with the default (non-strict) key checks, an options object with a missing or misspelled interpolation variable now reports the missing variable (Property 'name' is missing) instead of '{ nmae: string }' is not assignable to type 'string' from the default-value overload.

Commits

82894c1 26.5.6
343080d build
8e2eebb changelog for 26.5.6
822a37b fix: copy nested resources when cloning with forkResourceStore (#2456)
744c5cb 26.5.5
de5960e build
fbe16f3 changelog for 26.5.5
67b4ae1 fix: keep placeholders inside unescaped values literal (#2455)
aadd75b 26.5.4
a43c432 build
Additional commits viewable in compare view

Updates @types/lodash from 4.17.26 to 4.17.27

Commits

See full diff in compare view

Updates postcss from 8.5.30 to 8.5.31

Release notes

Sourced from postcss's releases.

8.5.31

Fix better source map on </style> escaping (by @firefoxic).

Changelog

Sourced from postcss's changelog.

8.5.31

Fix better source map on </style> escaping (by @firefoxic).

Commits

d190857 Release 8.5.31 version
4ef6d8c Update dependencies
6abd674 Call the builder with every node when the output is escaped (#2175)
See full diff in compare view

Updates sass from 1.105.2 to 1.106.1

Release notes

Sourced from sass's releases.

Dart Sass 1.106.1

To install Sass 1.106.1, download one of the packages below and add it to your PATH, or see the Sass website for full installation instructions.

Changes

Fix a bug where an attribute selector with an empty value (such as [class=""]) would crash when serializing.

Don't crash when serializing a number with an empty unit. This is only possible through the JavaScript and Dart APIs or the embedded protocol.

Embedded Dart Sass

More robustly convert invalid value errors into PARAMS errors.

See the full changelog for changes in earlier releases.

Dart Sass 1.106.0

To install Sass 1.106.0, download one of the packages below and add it to your PATH, or see the Sass website for full installation instructions.

Changes

Don't normalize CSS escapes in statement contexts that can contain interpolation. For example, @f\6Fo is now emitted as written rather than normalized to @foo.

Fix a bug where quotes would be removed from attribute selector values that contained backslashes.

Fix invalid source spans that could cause crashes when encountering a syntax error in selectors or media queries that also contain escape sequences.

Fix a bug where the indented syntax parser would crash when parsing a file where the first statement was indented and appeared after the first line.

Fix a bug that could cause crashes when encountering errors or warnings in interpolations that contain patterns like // */.

Potentially breaking compatibility fix: CSS escape codes whose values are 0, for Unicode surrogates, or greater than the maximum allowed code point are now consistently normalized to U+FFFD REPLACEMENT CHARACTER in expression contexts. Previously, in some cases these were instead normalized to the normalized form of the original escape sequence, which violates the principle that all escape sequences for identical values should be normalized the same way. In other cases, these would simply throw errors.

As a special case, \0 on its own will continue to be normalized to \0 to support historical CSS hacks.

Potentially breaking bug fix: Throw an error for mixins and functions that have rest parameters which are the same as normal parameters. Previously, the positional parameters wouldn't be accessible and calling such a mixin or function with a named argument would crash the compiler.

Potentially breaking bug fix: Fix various cases where using a CSS escape code at the beginning of an identifier would change parsing behavior versus using the character directly.

Potentially breaking bug fix: When a number's unit is ambiguous with a numeric exponent, the unit is now serialized as an escape code rather than a literal e to avoid being interpreted as an exponent by CSS.

Potentially breaking bug fix: Don't parse a CSS escape code for U+45 LATIN CAPITAL LETTER E or U+65 LATIN LOWERCASE LETTER E as an exponent in @keyframes percentage selectors.

Potentially breaking bug fix: Properly normalize underscores written as CSS escape codes in variable, mixin, and function names.

... (truncated)

Changelog

Sourced from sass's changelog.

1.106.1

Fix a bug where an attribute selector with an empty value (such as [class=""]) would crash when serializing.

Don't crash when serializing a number with an empty unit. This is only possible through the JavaScript and Dart APIs or the embedded protocol.

Embedded Dart Sass

More robustly convert invalid value errors into PARAMS errors.

1.106.0

Don't normalize CSS escapes in statement contexts that can contain interpolation. For example, @f\6Fo is now emitted as written rather than normalized to @foo.

Fix a bug where quotes would be removed from attribute selector values that contained backslashes.

Fix invalid source spans that could cause crashes when encountering a syntax error in selectors or media queries that also contain escape sequences.

Fix a bug where the indented syntax parser would crash when parsing a file where the first statement was indented and appeared after the first line.

Fix a bug that could cause crashes when encountering errors or warnings in interpolations that contain patterns like // */.

Potentially breaking compatibility fix: CSS escape codes whose values are 0, for Unicode surrogates, or greater than the maximum allowed code point are now consistently normalized to U+FFFD REPLACEMENT CHARACTER in expression contexts. Previously, in some cases these were instead normalized to the normalized form of the original escape sequence, which violates the principle that all escape sequences for identical values should be normalized the same way. In other cases, these would simply throw errors.

As a special case, \0 on its own will continue to be normalized to \0 to support historical CSS hacks.

Potentially breaking bug fix: Throw an error for mixins and functions that have rest parameters which are the same as normal parameters. Previously, the positional parameters wouldn't be accessible and calling such a mixin or function with a named argument would crash the compiler.

Potentially breaking bug fix: Fix various cases where using a CSS escape code at the beginning of an identifier would change parsing behavior versus using the character directly.

... (truncated)

Commits

811ecc6 Pull the version back to 1.106.1 (#2893)
b10205e Fix serializing a number with an empty-string unit (#2892)
e79f8a7 Fix serializing an attribute selector with an empty value (#2891)
2ea4fc0 Merge pull request #2883 from sass/fuzz
a113995 Bump postcss from 8.5.28 to 8.5.30 in /pkg/sass-parser (#2886)
2d2e76c Try using the SassBot GitHub token when auto-merging dependabot PRs (#2885)
5660824 Improve the accuracy of FileSpan.trimLeft() and .trimRight()
09e4024 Throw an error for duplicate rest and non-rest parameter names
34c8e6b Fix check for an indented first statement
a05866c Make _expandInterpolationLeft resilient to commented-out comments
Additional commits viewable in compare view

Updates webpack from 5.112.0 to 5.112.2

Release notes

Sourced from webpack's releases.

v5.112.2

Patch Changes

Reduce repeated scans when concatenating imported modules. (by @xiaoxiaojx in #22865)

Avoid allocating CSS module sets for single-group chunks. (by @xiaoxiaojx in #22866)

Return the value of every module type loaded with importModule(). (by @alexander-akait in #22869)

v5.112.1

Patch Changes

Rebuild a lazy barrel in watch when what it defers changes, and keep the imports and re-exports it still runs. (by @aryanraj45 in #22699)

Rebuild under cacheUnaffected a module whose re-export target goes or returns. (by @aryanraj45 in #22749)

Fix "Self-reference dependency has unused export name" for CommonJS namespace re-exports. (by @alexander-akait in #22791)

Fix exportType: "style" CSS modules throwing outside the runtime chunk. (by @lazerg in #22833)

Fix crash when a CSS module with exportType: "style" imports an ignored stylesheet. (by @codeXsidd in #22846)

Keep empty process environment variables that .env files don't define in DotenvPlugin. (by @alexander-akait in #22794)

Rehash an ESM entry chunk when a chunk it imports by file name changes. (by @alexander-akait in #22804)

Handle a NUL inside an HTML CDATA section the way the parsing spec does. (by @dependabot in #22811)

Keep module exports live across chunks, runtimes, HMR and eval, sparing globals. (by @alexander-akait in #22733)

Await asynchronous modules that ProvidePlugin injects into ES modules. (by @alexander-akait in #22728)

Keep a resolve that ends after the compiler closed from throwing. (by @alexander-akait in #22795)

Preserve string names passed to SharedWorker constructors. (by @bjohansebas in #22770)

Preserve string contents when extracting source map comments. (by @bjohansebas in #22768)

Scope strict-mode, async and generator block function declarations to their block. (by @alexander-akait in #22800)

Preserve raw dotenv values when reusing cached environment files. (by @Eshiv-Pandey in #22787)

Preserve assigned or patched built-ins, conversions and pattern targets. (by @aryanraj45 in #22761)

Keep globals a globalThis write replaces, and slice on a patched array. (by @alexander-akait in #22862)

Skip HTML script tags for shared chunks that emit no JavaScript. (by @bjohansebas in #22779)

Keep the digits Firefox lays out a minified CSS percentage with. (by @alexander-akait in #22718)

... (truncated)

Changelog

Sourced from webpack's changelog.

5.112.2

Patch Changes

Reduce repeated scans when concatenating imported modules. (by @xiaoxiaojx in #22865)

Avoid allocating CSS module sets for single-group chunks. (by @xiaoxiaojx in #22866)

Return the value of every module type loaded with importModule(). (by @alexander-akait in #22869)

5.112.1

Patch Changes

Rebuild a lazy barrel in watch when what it defers changes, and keep the imports and re-exports it still runs. (by @aryanraj45 in #22699)

Rebuild under cacheUnaffected a module whose re-export target goes or returns. (by @aryanraj45 in #22749)

Fix "Self-reference dependency has unused export name" for CommonJS namespace re-exports. (by @alexander-akait in #22791)

Fix exportType: "style" CSS modules throwing outside the runtime chunk. (by @lazerg in #22833)

Fix crash when a CSS module with exportType: "style" imports an ignored stylesheet. (by @codeXsidd in #22846)

Keep empty process environment variables that .env files don't define in DotenvPlugin. (by @alexander-akait in #22794)

Rehash an ESM entry chunk when a chunk it imports by file name changes. (by @alexander-akait in #22804)

Handle a NUL inside an HTML CDATA section the way the parsing spec does. (by @dependabot in #22811)

Keep module exports live across chunks, runtimes, HMR and eval, sparing globals. (by @alexander-akait in #22733)

Await asynchronous modules that ProvidePlugin injects into ES modules. (by @alexander-akait in #22728)

Keep a resolve that ends after the compiler closed from throwing. (by @alexander-akait in #22795)

Preserve string names passed to SharedWorker constructors. (by @bjohansebas in #22770)

Preserve string contents when extracting source map comments. (by @bjohansebas in #22768)

Scope strict-mode, async and generator block function declarations to their block. (by @alexander-akait in #22800)

Preserve raw dotenv values when reusing cached environment files. (by @Eshiv-Pandey in #22787)

Preserve assigned or patched built-ins, conversions and pattern targets. (by @aryanraj45 in #22761)

Keep globals a globalThis write replaces, and slice on a patched array. (by @alexander-akait in #22862)

Skip HTML script tags for shared chunks that emit no JavaScript. (by @bjohansebas in #22779)

... (truncated)

Commits

e95a7f2 chore(release): new release (#22867)
6e43fc2 fix: return the value of every module type from importModule() (#22869)
4ffac8d ci: rename the parser job to spec and run CSS, HTML and XML in one leg (#22870)
0c02242 test: split the syntax unit tests into tokenizer, parser and printer (#22825)
660608c perf(css): cut CPU and allocation in the CSS minifier (#22868)
8c3cbd3 perf: avoid allocating unused CSS module sets (#22866)
a1e5f6a perf: avoid duplicate scans in module concatenation (#22865)
759b539 chore(release): new release (#22720)
539f8de fix(minify): keep globals a globalThis write replaces, and slice on a pat...
9668155 ci: run the deep-imports check in the lint job (#22859)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the dependencies group with 5 updates: | Package | From | To | | --- | --- | --- | | [i18next](https://github.com/i18next/i18next) | `26.4.7` | `26.5.6` | | [@types/lodash](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/lodash) | `4.17.26` | `4.17.27` | | [postcss](https://github.com/postcss/postcss) | `8.5.30` | `8.5.31` | | [sass](https://github.com/sass/dart-sass) | `1.105.2` | `1.106.1` | | [webpack](https://github.com/webpack/webpack) | `5.112.0` | `5.112.2` | Updates `i18next` from 26.4.7 to 26.5.6 - [Release notes](https://github.com/i18next/i18next/releases) - [Changelog](https://github.com/i18next/i18next/blob/master/CHANGELOG.md) - [Commits](i18next/i18next@v26.4.7...v26.5.6) Updates `@types/lodash` from 4.17.26 to 4.17.27 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/lodash) Updates `postcss` from 8.5.30 to 8.5.31 - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](postcss/postcss@8.5.30...8.5.31) Updates `sass` from 1.105.2 to 1.106.1 - [Release notes](https://github.com/sass/dart-sass/releases) - [Changelog](https://github.com/sass/dart-sass/blob/main/CHANGELOG.md) - [Commits](sass/dart-sass@1.105.2...1.106.1) Updates `webpack` from 5.112.0 to 5.112.2 - [Release notes](https://github.com/webpack/webpack/releases) - [Changelog](https://github.com/webpack/webpack/blob/main/CHANGELOG.md) - [Commits](webpack/webpack@v5.112.0...v5.112.2) --- updated-dependencies: - dependency-name: i18next dependency-version: 26.5.6 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: "@types/lodash" dependency-version: 4.17.27 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: postcss dependency-version: 8.5.31 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: sass dependency-version: 1.106.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: webpack dependency-version: 5.112.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

psiinon · 2026-10-26T13:32:13Z

Checkmarx One – Scan Summary & Details – 03e627f9-0e83-434a-80f7-43c977f6b605

New Issues (65 out of 65)

Checkmarx found the following issues in this Pull Request

Severity: 36 High · 22 Medium · 7 Low

#	Issue	Source File / Package	Checkmarx Insight
1	CVE-2025-64756	Npm-glob-10.4.5	details Recommended version: 10.5.0 Description: Glob matches files using patterns the shell uses. In versions 10.2.0 prior to 10.5.0 and 11.0.0 prior to 11.1.0, the glob CLI contains a command in... Attack Vector: NETWORK Attack Complexity: HIGH Vulnerable Package
2	CVE-2026-102276	Npm-brace-expansion-2.0.2	details Recommended version: 2.1.5 Description: The brace-expansion library generates arbitrary strings containing a common prefix and suffix. In versions prior to 1.1.19, 2.0.0 prior to 2.1.5, 3... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
3	CVE-2026-102276	Npm-brace-expansion-5.0.9	details Recommended version: 5.0.10 Description: The brace-expansion library generates arbitrary strings containing a common prefix and suffix. In versions prior to 1.1.19, 2.0.0 prior to 2.1.5, 3... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
4	CVE-2026-102276	Npm-brace-expansion-1.1.12	details Recommended version: 1.1.19 Description: The brace-expansion library generates arbitrary strings containing a common prefix and suffix. In versions prior to 1.1.19, 2.0.0 prior to 2.1.5, 3... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
5	CVE-2026-102278	Npm-brace-expansion-2.0.2	details Recommended version: 2.1.6 Description: The brace-expansion library generates arbitrary strings containing a common prefix and suffix. In versions prior to 1.1.20, 2.0.0 prior to 2.1.6, 3... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
6	CVE-2026-102278	Npm-brace-expansion-5.0.9	details Recommended version: 5.0.11 Description: The brace-expansion library generates arbitrary strings containing a common prefix and suffix. In versions prior to 1.1.20, 2.0.0 prior to 2.1.6, 3... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
7	CVE-2026-102278	Npm-brace-expansion-1.1.12	details Recommended version: 1.1.20 Description: The brace-expansion library generates arbitrary strings containing a common prefix and suffix. In versions prior to 1.1.20, 2.0.0 prior to 2.1.6, 3... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
8	CVE-2026-111181	Npm-body-parser-1.20.4	details Recommended version: 1.20.9 Description: body-parser is body parsing middleware for Node.js and Express. In versions before 1.20.9 and in versions from 2.0.0 before 2.4.0, a single request... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
9	CVE-2026-111181	Npm-body-parser-2.3.0	details Recommended version: 2.4.0 Description: body-parser is body parsing middleware for Node.js and Express. In versions before 1.20.9 and in versions from 2.0.0 before 2.4.0, a single request... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
10	CVE-2026-13149	Npm-brace-expansion-2.0.2	details Recommended version: 2.1.2 Description: brace-expansion through 5.0.6 is vulnerable to denial of service. The expand() function exhibits exponential-time complexity in the number of conse... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
11	CVE-2026-13149	Npm-brace-expansion-1.1.12	details Recommended version: 1.1.16 Description: brace-expansion through 5.0.6 is vulnerable to denial of service. The expand() function exhibits exponential-time complexity in the number of conse... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
12	CVE-2026-14257	Npm-brace-expansion-2.0.2	details Recommended version: 2.1.3 Description: brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand() function limits the number of results with a m... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
13	CVE-2026-14257	Npm-brace-expansion-1.1.12	details Recommended version: 1.1.17 Description: brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand() function limits the number of results with a m... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
14	CVE-2026-26996	Npm-minimatch-3.1.2	details Recommended version: 3.1.3 Description: minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions prior to 3.1.3, 4.0.0 prior to 4.2... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
15	CVE-2026-26996	Npm-minimatch-5.1.6	details Recommended version: 5.1.7 Description: minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions prior to 3.1.3, 4.0.0 prior to 4.2... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
16	CVE-2026-26996	Npm-minimatch-9.0.5	details Recommended version: 9.0.6 Description: minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions prior to 3.1.3, 4.0.0 prior to 4.2... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
17	CVE-2026-27903	Npm-minimatch-3.1.2	details Recommended version: 3.1.3 Description: minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. All versions starting from 3.0.0 and prior ... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
18	CVE-2026-27903	Npm-minimatch-5.1.6	details Recommended version: 5.1.8 Description: minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. All versions starting from 3.0.0 and prior ... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
19	CVE-2026-27903	Npm-minimatch-9.0.5	details Recommended version: 9.0.7 Description: minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. All versions starting from 3.0.0 and prior ... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
20	CVE-2026-27904	Npm-minimatch-3.1.2	details Recommended version: 3.1.4 Description: minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. All versions starting from 3.0.0 and prior ... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
21	CVE-2026-27904	Npm-minimatch-5.1.6	details Recommended version: 5.1.8 Description: minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. All versions starting from 3.0.0 and prior ... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
22	CVE-2026-27904	Npm-minimatch-9.0.5	details Recommended version: 9.0.7 Description: minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. All versions starting from 3.0.0 and prior ... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
23	CVE-2026-33671	Npm-picomatch-2.3.1	details Recommended version: 2.3.2 Description: `picomatch` is vulnerable prior to 2.3.2, 3.x prior to 3.0.2 and 4.x prior to 4.0.4, to Regular Expression Denial of Service (ReDoS) when processi... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
24	CVE-2026-33671	Npm-picomatch-4.0.3	details Recommended version: 4.0.4 Description: `picomatch` is vulnerable prior to 2.3.2, 3.x prior to 3.0.2 and 4.x prior to 4.0.4, to Regular Expression Denial of Service (ReDoS) when processi... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
25	CVE-2026-33750	Npm-brace-expansion-1.1.12	details Recommended version: 1.1.13 Description: The brace-expansion library generates arbitrary strings containing a common prefix and suffix. In versions prior to 1.1.13, 2.0.0 prior to 2.0.3, 3... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
26	CVE-2026-33750	Npm-brace-expansion-2.0.2	details Recommended version: 2.0.3 Description: The brace-expansion library generates arbitrary strings containing a common prefix and suffix. In versions prior to 1.1.13, 2.0.0 prior to 2.0.3, 3... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
27	CVE-2026-4867	Npm-path-to-regexp-0.1.12	details Recommended version: 0.1.13 Description: A bad regular expression is generated any time you have three or more parameters within a single segment, separated by something that is not a peri... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
28	CVE-2026-4926	Npm-path-to-regexp-8.2.0	details Recommended version: 8.4.0 Description: A bad regular expression is generated any time you have multiple sequential optional groups (curly brace syntax), such as "{a}{b}{c}:z". The genera... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
29	CVE-2026-59869	Npm-js-yaml-3.14.1	details Recommended version: 3.15.0 Description: js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 prior to 3.15.0 and from 4.0.0 prior to 4.3.0, from 5.0.0 prior to 5.1.0, js-yaml can sp... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
30	CVE-2026-59869	Npm-js-yaml-4.1.0	details Recommended version: 4.3.0 Description: js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 prior to 3.15.0 and from 4.0.0 prior to 4.3.0, from 5.0.0 prior to 5.1.0, js-yaml can sp... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
31	CVE-2026-69152	Npm-brace-expansion-1.1.12	details Recommended version: 1.1.18 Description: The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.18, 2.x prior to 2.1.4, 3.x prior to 3.... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
32	CVE-2026-69152	Npm-brace-expansion-2.0.2	details Recommended version: 2.1.4 Description: The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.18, 2.x prior to 2.1.4, 3.x prior to 3.... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
33	CVE-2026-84375	Npm-js-yaml-3.14.1	details Recommended version: 3.15.2 Description: js-yaml is a JavaScript YAML parser and dumper. In versions 3.0.0 prior to 3.15.2 and 4.x prior to 4.3.2, `maxTotalMergeKeys` in `lib/js-yaml/loade... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
34	CVE-2026-84375	Npm-js-yaml-4.1.0	details Recommended version: 4.3.2 Description: js-yaml is a JavaScript YAML parser and dumper. In versions 3.0.0 prior to 3.15.2 and 4.x prior to 4.3.2, `maxTotalMergeKeys` in `lib/js-yaml/loade... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
35	Cx0e1b35ca-f68b	Npm-js-yaml-3.14.1	details Recommended version: 3.15.1 Description: "resolveYamlOmap()" enforces key uniqueness for !!omap sequences with a linear scan (objectKeys.indexOf(...)) inside the per-element loop, making r... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
36	Cx0e1b35ca-f68b	Npm-js-yaml-4.1.0	details Recommended version: 4.3.1 Description: "resolveYamlOmap()" enforces key uniqueness for !!omap sequences with a linear scan (objectKeys.indexOf(...)) inside the per-element loop, making r... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
37	CVE-2025-15284	Npm-qs-6.14.0	details Recommended version: 6.14.1 Description: Improper Input Validation vulnerability in qs (parse modules) versions prior to 6.14.1 allows HTTP Denial-of-Service (DoS). The "arrayLimit" option... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
38	CVE-2025-64718	Npm-js-yaml-3.14.1	details Recommended version: 3.14.2 Description: js-yaml is a JavaScript YAML parser and dumper. In js-yaml versions through 3.14.1 and 4.x through 4.1.0, it's possible for an attacker to modify t... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
39	CVE-2025-64718	Npm-js-yaml-4.1.0	details Recommended version: 4.1.1 Description: js-yaml is a JavaScript YAML parser and dumper. In js-yaml versions through 3.14.1 and 4.x through 4.1.0, it's possible for an attacker to modify t... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
40	CVE-2026-102277	Npm-brace-expansion-1.1.12	details Recommended version: 1.1.21 Description: The brace-expansion library generates arbitrary strings containing a common prefix and suffix. In versions prior to 1.1.21, 2.x prior to 2.1.7, 3.x... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
41	CVE-2026-102277	Npm-brace-expansion-5.0.9	details Recommended version: 5.0.12 Description: The brace-expansion library generates arbitrary strings containing a common prefix and suffix. In versions prior to 1.1.21, 2.x prior to 2.1.7, 3.x... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
42	CVE-2026-102277	Npm-brace-expansion-2.0.2	details Recommended version: 2.1.7 Description: The brace-expansion library generates arbitrary strings containing a common prefix and suffix. In versions prior to 1.1.21, 2.x prior to 2.1.7, 3.x... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
43	CVE-2026-110180	Npm-fast-uri-3.1.7	details Recommended version: 3.1.9 Description: fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions from 2.4.2 through 2.4.7, 3.1.3 through 3.1.8, and 4.0.1 ... Attack Vector: NETWORK Attack Complexity: HIGH Vulnerable Package
44	CVE-2026-110306	Npm-fast-uri-3.1.7	details Recommended version: 3.1.9 Description: fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions prior to 2.4.8, 3.0.0 through 3.1.8, and 4.0.0 through 4.... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
45	CVE-2026-110816	Npm-qs-6.16.0	details Recommended version: 6.16.1 Description: ### Summary `qs.stringify` with `arrayFormat: 'comma'` throws `TypeError: Cannot convert object to primitive value` when an array element cannot... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
46	CVE-2026-110816	Npm-qs-6.14.0	details Recommended version: 6.16.1 Description: ### Summary `qs.stringify` with `arrayFormat: 'comma'` throws `TypeError: Cannot convert object to primitive value` when an array element cannot... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
47	CVE-2026-12590	Npm-body-parser-1.20.4	details Recommended version: 1.20.6 Description: Impact: In body-parser versions prior to 1.20.6 (1.x line) and 2.0.0-beta.1 prior to 2.3.0 , when the parser is configured with an invalid limit op... Attack Vector: NETWORK Attack Complexity: HIGH Vulnerable Package
48	CVE-2026-2391	Npm-qs-6.14.0	details Recommended version: 6.14.2 Description: The "arrayLimit" option in qs versions from 6.7.0 through 6.14.1 does not enforce limits for comma-separated values when "comma: true" is enabled, ... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
49	CVE-2026-33532	Npm-yaml-1.10.2	details Recommended version: 1.10.3 Description: yaml is a YAML parser and serialiser for JavaScript. Parsing a YAML document with a version of yaml on the 1.x branch prior to 1.10.3 or on the 2.x... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
50	CVE-2026-33672	Npm-picomatch-2.3.1	details Recommended version: 2.3.2 Description: Picomatch is a glob matcher written JavaScript. Versions prior to 2.3.2, 3.0.0 prior to 3.0.2 and 4.0.0 prior to 4.0.4, are vulnerable to a method ... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
51	CVE-2026-33672	Npm-picomatch-4.0.3	details Recommended version: 4.0.4 Description: Picomatch is a glob matcher written JavaScript. Versions prior to 2.3.2, 3.0.0 prior to 3.0.2 and 4.0.0 prior to 4.0.4, are vulnerable to a method ... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
52	CVE-2026-4923	Npm-path-to-regexp-8.2.0	details Recommended version: 8.4.0 Description: Impact: When using multiple wildcards, combined with at least one parameter, a regular expression can be generated that is vulnerable to ReDoS. Th... Attack Vector: NETWORK Attack Complexity: HIGH Vulnerable Package
53	CVE-2026-53550	Npm-js-yaml-3.14.1	details Recommended version: 3.15.0 Description: js-yaml is a JavaScript YAML parser and dumper. Prior to 4.2.0, a crafted YAML document can trigger algorithmic CPU exhaustion in js-yaml merge-key... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
54	CVE-2026-53550	Npm-js-yaml-4.1.0	details Recommended version: 4.2.0 Description: js-yaml is a JavaScript YAML parser and dumper. Prior to 4.2.0, a crafted YAML document can trigger algorithmic CPU exhaustion in js-yaml merge-key... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
55	CVE-2026-82417	Npm-qs-6.14.0	details Recommended version: 6.16.0 Description: ### Summary `qs.stringify` throws a `TypeError` when it serializes an object whose own `constructor` property has a truthy, non-callable `isBuff... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
56	CVE-2026-85062	Npm-colord-2.9.3	details Recommended version: 2.9.4 Description: Colord is a tiny yet powerful tool for high-performance color manipulations and conversions. Prior to 2.9.4, synchronous CSS color string matchers ... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
57	CVE-2026-86472	Npm-fast-uri-3.1.7	details Recommended version: 3.1.8 Description: fast-uri is a dependency-free RFC 3986 URI parser for Node.js, used by Fastify and ajv. In versions prior to 2.4.7, 3.0.0 prior to 3.1.8, and 4.0.0... Attack Vector: NETWORK Attack Complexity: HIGH Vulnerable Package
58	CVE-2026-8723	Npm-qs-6.14.0	details Recommended version: 6.15.2 Description: ### Summary `qs.stringify` throws `TypeError` when called with `arrayFormat: 'comma'` and `encodeValuesOnly: true` on an array containing `null`... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
59	CVE-2025-69873	Npm-ajv-6.12.6	details Recommended version: 6.14.0 Description: ajv (Another JSON Schema Validator) through version 8.17.1 is vulnerable to Regular Expression Denial of Service (ReDoS) when the "$data" option is... Attack Vector: LOCAL Attack Complexity: HIGH Vulnerable Package
60	CVE-2025-69873	Npm-ajv-8.17.1	details Recommended version: 8.18.0 Description: ajv (Another JSON Schema Validator) through version 8.17.1 is vulnerable to Regular Expression Denial of Service (ReDoS) when the "$data" option is... Attack Vector: LOCAL Attack Complexity: HIGH Vulnerable Package
61	CVE-2026-110095	Npm-fast-uri-3.1.7	details Recommended version: 3.1.9 Description: fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions prior to 2.4.8, 3.0.0 prior to 3.1.9, and 4.0.0 prior to ... Attack Vector: NETWORK Attack Complexity: HIGH Vulnerable Package
62	CVE-2026-110725	Npm-fast-uri-3.1.7	details Recommended version: 3.1.9 Description: fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions prior to 2.4.8, 3.0.0 prior to 3.1.9, and 4.0.0 prior to ... Attack Vector: NETWORK Attack Complexity: HIGH Vulnerable Package
63	CVE-2026-115897	Npm-serialize-javascript-7.0.5	details Recommended version: 7.1.3 Description: Serialize JavaScript serializes JavaScript values to a superset of JSON that includes regular expressions and functions. Prior to 7.1.3, the functi... Attack Vector: NETWORK Attack Complexity: HIGH Vulnerable Package
64	CVE-2026-9358	Npm-postcss-selector-parser-7.1.0	details Recommended version: 7.1.2 Description: A vulnerability was determined in postcss-selector-parser through 6.1.2, through 7.1.1. Affected is the function toString of the file src/selectors... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
65	CVE-2026-9358	Npm-postcss-selector-parser-6.1.2	details Recommended version: 6.1.3 Description: A vulnerability was determined in postcss-selector-parser through 6.1.2, through 7.1.1. Affected is the function toString of the file src/selectors... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package

Use @Checkmarx to take action directly from this PR:

Rescan the PR

Try it: @Checkmarx how can you help? · @Checkmarx rescan this PR

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Oct 26, 2026

thc202 approved these changes Oct 26, 2026

View reviewed changes

psiinon approved these changes Oct 26, 2026

View reviewed changes

psiinon merged commit dc1e59d into main Oct 26, 2026
5 of 6 checks passed

thc202 deleted the dependabot/npm_and_yarn/dependencies-bbaa8af56f branch October 26, 2026 13:52

Navigation Menu

Repository navigation

Bump the dependencies group with 5 updates - #401

Bump the dependencies group with 5 updates#401
psiinon merged 1 commit into
mainfrom
dependabot/npm_and_yarn/dependencies-bbaa8af56f

dependabot Bot commented on behalf of github Oct 26, 2026

Uh oh!

psiinon commented Oct 26, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

dependabot Bot commented on behalf of github Oct 26, 2026

v26.5.6

v26.5.5

v26.5.4

v26.5.3

v26.5.2

v26.5.1

v26.5.0

26.5.6

26.5.5

26.5.4

26.5.3

26.5.2

26.5.1

26.5.0

8.5.31

8.5.31

Dart Sass 1.106.1

Changes

Embedded Dart Sass

Dart Sass 1.106.0

Changes

1.106.1

Embedded Dart Sass

1.106.0

v5.112.2

Patch Changes

v5.112.1

Patch Changes

5.112.2

Patch Changes

5.112.1

Patch Changes

Uh oh!

psiinon commented Oct 26, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants