Skip to content

Conversation

@dependabot
Copy link

@dependabot dependabot bot commented on behalf of github Nov 17, 2025

Bumps brace-expansion from 1.1.11 to 1.1.12.

Release notes

Sourced from brace-expansion's releases.

v1.1.12

  • pkg: publish on tag 1.x c460dbd
  • fmt ccb8ac6
  • Fix potential ReDoS Vulnerability or Inefficient Regular Expression (#65) c3c73c8

juliangruber/brace-expansion@v1.1.11...v1.1.12

Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps [brace-expansion](https://github.com/juliangruber/brace-expansion) from 1.1.11 to 1.1.12.
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@1.1.11...v1.1.12)

---
updated-dependencies:
- dependency-name: brace-expansion
  dependency-version: 1.1.12
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Nov 17, 2025
@AC-KunalParmar
Copy link

AC-KunalParmar commented Nov 17, 2025

Snyk checks have passed. No issues have been found so far.

Status Scanner Critical High Medium Low Total (0)
Open Source Security 0 0 0 0 0 issues
Licenses 0 0 0 0 0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

@TheRedHatter
Copy link
Owner

Logo
Checkmarx One – Scan Summary & Details94747fc3-59c6-4db5-8914-21555110fa22

New Issues (23)

Checkmarx found the following issues in this Pull Request

Severity Issue Source File / Package Checkmarx Insight
CRITICAL CVE-2022-37616 Npm-xmldom-0.6.0
detailsDescription: A Prototype Pollution vulnerability exists in the function "copy" in "dom.js" in the @xmldom/xmldom for Node.js via the "p" variable. This issue af...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: zQqiKLfbPF4gilRtypcq%2FfZQh6B2lRegJJaoz9QCaE0%3D
Vulnerable Package
HIGH CVE-2025-58754 Npm-axios-0.21.4
detailsRecommended version: 0.30.2
Description: Axios is a promise based HTTP client for the browser and Node.js. When Axios prior to version 1.12.0 runs on Node.js and is given a URL with the "d...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: edEWvsfdNkCBePlh%2BSfSFwPICnal5x%2B6CHNm4Trgpsc%3D
Vulnerable Package
HIGH CVE-2025-58754 Npm-axios-0.26.1
detailsRecommended version: 0.30.2
Description: Axios is a promise based HTTP client for the browser and Node.js. When Axios prior to version 1.12.0 runs on Node.js and is given a URL with the "d...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: HnOVOTufW7dE7dmBbCu7BOZZ%2BgWbcu4JIRvu7Oegxf4%3D
Vulnerable Package
MEDIUM CVE-2025-9714 Npm-libxmljs-0.19.7
detailsDescription: Uncontrolled recursion in XPath evaluation in libxml2 versions through 2.9.14 allow a local attacker to cause a Stack Overflow via crafted expressi...
Attack Vector: LOCAL
Attack Complexity: LOW

ID: Q2m8oBN22b8Vacp4E8pHn7aXco0aSrrAb8oNykyoUbk%3D
Vulnerable Package
MEDIUM Client_HTML5_Insecure_Storage /client/src/pages/main/Contact.tsx: 18
detailsThe application stores data setItem on the client, in an insecure manner, at line 14 of /client/src/api/makeApiRequest.ts.
ID: uiK52hD26OkcWZgBOsJ25UlWgLY%3D
Attack Vector
MEDIUM Client_HTML5_Insecure_Storage /client/src/pages/main/Contact.tsx: 15
detailsThe application stores data setItem on the client, in an insecure manner, at line 14 of /client/src/api/makeApiRequest.ts.
ID: JZDg45NluuE%2FqR%2Bp%2BWCS0x1tZLA%3D
Attack Vector
MEDIUM Client_HTML5_Insecure_Storage /client/src/pages/main/Contact.tsx: 16
detailsThe application stores data setItem on the client, in an insecure manner, at line 14 of /client/src/api/makeApiRequest.ts.
ID: %2BtI6gXdp3CQHT6EvDNvc%2FI39dCw%3D
Attack Vector
MEDIUM Client_HTML5_Insecure_Storage /client/src/pages/main/Contact.tsx: 17
detailsThe application stores data setItem on the client, in an insecure manner, at line 14 of /client/src/api/makeApiRequest.ts.
ID: TRaxCrq1rJuovIK6EiRB0NFsaXc%3D
Attack Vector
MEDIUM Cx9b50aef6-319d Npm-nodemailer-6.9.12
detailsRecommended version: 7.0.7
Description: The email parsing library incorrectly handles quoted local-parts containing '@' in versions through 7.0.6. This leads to misrouting of email recipi...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: Yb%2FdjJVn74Sssgq2VAKsXhfcW%2FHPwGex1g0RNlL6pto%3D
Vulnerable Package
LOW CVE-2025-6170 Npm-libxmljs-0.19.7
detailsDescription: A flaw was found in the interactive shell of the xmllint tool in libxml2, used for parsing XML files. When a user inputs an overly long command, th...
Attack Vector: LOCAL
Attack Complexity: HIGH

ID: yzImVaIaZP%2F%2FBT8%2BwwZowopuKkF9LIJek6Oq94ubH2g%3D
Vulnerable Package
LOW Image Pull Policy Of The Container Is Not Set To Always /deployment.yaml: 30
detailsImage Pull Policy of the container must be defined and set to Always
ID: kAB29SiF81Xj2yvqEXcagrysLLk%3D
LOW Image Pull Policy Of The Container Is Not Set To Always /deployment.yaml: 30
detailsImage Pull Policy of the container must be defined and set to Always
ID: jbItttOvKogovAAd%2FH7ig4ypMIA%3D
LOW Image Pull Policy Of The Container Is Not Set To Always /deployment.yaml: 30
detailsImage Pull Policy of the container must be defined and set to Always
ID: wXXi0cahCHD4cGDLh4rsNi0F%2BxE%3D
LOW Missing AppArmor Profile /deployment.yaml: 15
detailsContainers should be configured with an AppArmor profile to enforce fine-grained access control over low-level system resources
ID: AtGpeSzGAaO6IqS8kfZ1%2BmJ2So8%3D
LOW Missing AppArmor Profile /deployment.yaml: 15
detailsContainers should be configured with an AppArmor profile to enforce fine-grained access control over low-level system resources
ID: rVWUGXaxxgPUFH6NVrYH%2BIxRDoI%3D
LOW Missing AppArmor Profile /deployment.yaml: 15
detailsContainers should be configured with an AppArmor profile to enforce fine-grained access control over low-level system resources
ID: irG%2BNIBc6DWhLX%2BN60f7sxAVZvs%3D
LOW Missing AppArmor Profile /deployment.yaml: 15
detailsContainers should be configured with an AppArmor profile to enforce fine-grained access control over low-level system resources
ID: mE5WzW1JsoXaX7Y%2FDD4RZL6%2BTFg%3D
LOW Missing AppArmor Profile /deployment.yaml: 15
detailsContainers should be configured with an AppArmor profile to enforce fine-grained access control over low-level system resources
ID: FtVqRT0IgpU5fG0V%2FoZRtkWXFjA%3D
LOW Pod or Container Without Security Context /deployment.yaml: 30
detailsA security context defines privilege and access control settings for a Pod or Container
ID: QO1LDg3imADaP%2F3rfRqZzDjA61U%3D
LOW Pod or Container Without Security Context /deployment.yaml: 30
detailsA security context defines privilege and access control settings for a Pod or Container
ID: b3jDxVGkL%2Btdfas40YiFuaUKdSo%3D
LOW Pod or Container Without Security Context /deployment.yaml: 30
detailsA security context defines privilege and access control settings for a Pod or Container
ID: WRTmMWRmGjWWGOH58Uek%2B3mC6AY%3D
LOW Pod or Container Without Security Context /deployment.yaml: 30
detailsA security context defines privilege and access control settings for a Pod or Container
ID: AESOX60Q5UC39RXXUYls3GmXdxg%3D
LOW Pod or Container Without Security Context /deployment.yaml: 30
detailsA security context defines privilege and access control settings for a Pod or Container
ID: fT1H%2BQm7xq21r2CSbuHh2HKfYqY%3D
Fixed Issues (17)

Great job! The following issues were fixed in this Pull Request

Severity Issue Source File / Package
HIGH CVE-2022-46175 Npm-json5-2.2.0
HIGH CVE-2023-45133 Npm-@babel/traverse-7.16.3
HIGH CVE-2025-45767 Npm-jose-4.13.1
HIGH Cxc7705965-e0f0 Npm-@babel/core-7.12.3
LOW Image Pull Policy Of The Container Is Not Set To Always /deployment.yaml: 30
LOW Image Pull Policy Of The Container Is Not Set To Always /deployment.yaml: 30
LOW Image Pull Policy Of The Container Is Not Set To Always /deployment.yaml: 30
LOW Missing AppArmor Profile /deployment.yaml: 15
LOW Missing AppArmor Profile /deployment.yaml: 15
LOW Missing AppArmor Profile /deployment.yaml: 15
LOW Missing AppArmor Profile /deployment.yaml: 15
LOW Missing AppArmor Profile /deployment.yaml: 15
LOW Pod or Container Without Security Context /deployment.yaml: 30
LOW Pod or Container Without Security Context /deployment.yaml: 30
LOW Pod or Container Without Security Context /deployment.yaml: 30
LOW Pod or Container Without Security Context /deployment.yaml: 30
LOW Pod or Container Without Security Context /deployment.yaml: 30

Use @Checkmarx to reach out to us for assistance.

Just send a PR comment with @Checkmarx followed by a natural language request.

Examples: @Checkmarx how are you able to help me? @Checkmarx rescan this PR

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants