Skip to content

deps(npm): bump the npm group across 1 directory with 9 updates#7690

Merged
ferrarimarco merged 1 commit intomainfrom
dependabot/npm_and_yarn/dependencies/npm-e8dedfa41f
Mar 31, 2026
Merged

deps(npm): bump the npm group across 1 directory with 9 updates#7690
ferrarimarco merged 1 commit intomainfrom
dependabot/npm_and_yarn/dependencies/npm-e8dedfa41f

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github Mar 30, 2026 •
edited
Loading

Bumps the npm group with 9 updates in the /dependencies directory:

Package From To
@biomejs/biome 2.4.8 2.4.9
@typescript-eslint/eslint-plugin 8.57.1 8.57.2
eslint-plugin-jest 29.15.0 29.15.1
npm-groovy-lint 17.0.0 17.0.2
react-intl 10.1.0 10.1.1
react-router-dom 7.13.1 7.13.2
renovate 43.86.1 43.100.1
stylelint 17.5.0 17.6.0
typescript 5.9.3 6.0.2

Updates @biomejs/biome from 2.4.8 to 2.4.9

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.4.9

2.4.9

Patch Changes

  • #9315 085d324 Thanks @​ematipico! - Added a new nursery CSS rule noDuplicateSelectors, that disallows duplicate selector lists within the same at-rule context.

    For example, the following snippet triggers the rule because the second selector and the first selector are the same:

    /* First selector */
.x .y .z {
}
/* Second selector */
.x {
.y {
.z {
}
}
}

  • #9567 b7ab931 Thanks @​ematipico! - Fixed #7211: useOptionalChain now detects negated logical OR chains. The following code is now considered invalid:

    !foo || !foo.bar;

  • #8670 607ebf9 Thanks @​tt-a1i! - Fixed #8345: useAdjacentOverloadSignatures no longer reports false positives for static and instance methods with the same name. Static methods and instance methods are now treated as separate overload groups.

    class Kek {
  static kek(): number {
    return 0;
  }
  another(): string {
    return "";
  }
  kek(): number {
    return 1;
  } // no longer reported as non-adjacent
}

  • #9476 97b80a8 Thanks @​masterkain! - Fixed [#9475](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome/issues/9475): Fixed a panic when Biome analyzed ambient TypeScript modules containing class constructor, getter, or setter signatures that reference local type aliases. Biome now handles these declarations without crashing during semantic analysis.

  • #9553 0cd5298 Thanks @​dyc3! - Fixed a bug where enabling the rules of a whole group, would enable rules that belonged to a domain under the same group.

... (truncated)

Changelog

Sourced from @​biomejs/biome's changelog.

2.4.9

Patch Changes

  • #9315 085d324 Thanks @​ematipico! - Added a new nursery CSS rule noDuplicateSelectors, that disallows duplicate selector lists within the same at-rule context.

    For example, the following snippet triggers the rule because the second selector and the first selector are the same:

    /* First selector */
.x .y .z {
}
/* Second selector */
.x {
.y {
.z {
}
}
}

  • #9567 b7ab931 Thanks @​ematipico! - Fixed #7211: useOptionalChain now detects negated logical OR chains. The following code is now considered invalid:

    !foo || !foo.bar;

  • #8670 607ebf9 Thanks @​tt-a1i! - Fixed #8345: useAdjacentOverloadSignatures no longer reports false positives for static and instance methods with the same name. Static methods and instance methods are now treated as separate overload groups.

    class Kek {
  static kek(): number {
    return 0;
  }
  another(): string {
    return "";
  }
  kek(): number {
    return 1;
  } // no longer reported as non-adjacent
}

  • #9476 97b80a8 Thanks @​masterkain! - Fixed [#9475](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome/issues/9475): Fixed a panic when Biome analyzed ambient TypeScript modules containing class constructor, getter, or setter signatures that reference local type aliases. Biome now handles these declarations without crashing during semantic analysis.

  • #9553 0cd5298 Thanks @​dyc3! - Fixed a bug where enabling the rules of a whole group, would enable rules that belonged to a domain under the same group.

    For example, linter.rules.correctness = "error" no longer enables React- or Qwik-specific correctness rules unless linter.domains.react, linter.domains.qwik, or an explicit rule config also enables them, or their relative dependencies are installed.

... (truncated)

Commits

Updates @typescript-eslint/eslint-plugin from 8.57.1 to 8.57.2

Release notes

Sourced from @​typescript-eslint/eslint-plugin's releases.

v8.57.2

8.57.2 (2026-03-23)

🩹 Fixes

  • eslint-plugin: [prefer-optional-chain] remove dangling closing parenthesis (#11865)
  • eslint-plugin: [array-type] ignore Array and ReadonlyArray without type arguments (#11971)
  • eslint-plugin: [no-restricted-types] flag banned generics in extends or implements (#12120)
  • eslint-plugin: [no-unsafe-return] false positive on unwrapping generic (#12125)
  • eslint-plugin: [no-unsafe-return] false positive on unwrapping generic (#12125)
  • eslint-plugin: [no-useless-default-assignment] skip reporting false positives for unresolved type parameters (#12127)
  • eslint-plugin: [prefer-readonly-parameter-types] preserve type alias infomation (#11954)
  • typescript-estree: skip createIsolatedProgram fallback for projectService (#12066, #12065)

❤️ Thank You

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Changelog

Sourced from @​typescript-eslint/eslint-plugin's changelog.

8.57.2 (2026-03-23)

🩹 Fixes

  • eslint-plugin: [prefer-readonly-parameter-types] preserve type alias infomation (#11954)
  • eslint-plugin: [no-useless-default-assignment] skip reporting false positives for unresolved type parameters (#12127)
  • eslint-plugin: [no-unsafe-return] false positive on unwrapping generic (#12125)
  • eslint-plugin: [no-restricted-types] flag banned generics in extends or implements (#12120)
  • eslint-plugin: [array-type] ignore Array and ReadonlyArray without type arguments (#11971)
  • eslint-plugin: [prefer-optional-chain] remove dangling closing parenthesis (#11865)

❤️ Thank You

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Commits
  • be4d54d chore(release): publish 8.57.2
  • f68c8e4 fix(eslint-plugin): [prefer-readonly-parameter-types] preserve type alias inf...
  • 73acd2e fix(eslint-plugin): [no-useless-default-assignment] skip reporting false posi...
  • 3d21482 fix(eslint-plugin): [no-unsafe-return] false positive on unwrapping generic (...
  • e128548 fix(eslint-plugin): [no-restricted-types] flag banned generics in extends or ...
  • 2b7f63f chore(eslint-plugin): correct tsutils.isTypeFlag usage post-merge
  • 65175cd fix(eslint-plugin): [array-type] ignore Array and ReadonlyArray without type ...
  • 9c9ab5e feat(eslint-plugin): [no-unnecessary-type-arguments] report inferred required...
  • 42a1c89 fix(eslint-plugin): [prefer-optional-chain] remove dangling closing parenthes...
  • 71855ff docs(eslint-plugin): [no-unnecessary-condition] add link to TS handbook (#12131)
  • See full diff in compare view

Updates eslint-plugin-jest from 29.15.0 to 29.15.1

Release notes

Sourced from eslint-plugin-jest's releases.

v29.15.1

29.15.1 (2026-03-24)

Bug Fixes

Changelog

Sourced from eslint-plugin-jest's changelog.

29.15.1 (2026-03-24)

Bug Fixes

Commits

Updates npm-groovy-lint from 17.0.0 to 17.0.2

Release notes

Sourced from npm-groovy-lint's releases.

v17.0.2

What's Changed

  • Upgrade dependencies

Pull Requests

Full Changelog: nvuillam/npm-groovy-lint@v17.0.0...v17.0.2

Changelog

Sourced from npm-groovy-lint's changelog.

[17.0.2] 2026-03-29

  • Upgrade dependencies
Commits

Updates react-intl from 10.1.0 to 10.1.1

Release notes

Sourced from react-intl's releases.

react-intl@10.1.1

10.1.1 (2026-03-27)

Bug Fixes

Commits
  • 68d4114 build: publish
  • 168ecf5 chore(deps): upgrade typescript to 6.0.2 (#6194)
  • 6fce93d fix(deps): regenerate pnpm-lock.yaml after dependency updates
  • b0d3488 chore(deps): update dependency @​typescript/native-preview to v7.0.0-dev.20260...
  • 5580661 chore(deps): update tailwindcss monorepo to v4.2.2 (#6163)
  • 988fc1c chore(deps): update dependency happy-dom to v20.8.8 [security] (#6190)
  • 7564fac build(deps): bump flatted from 3.4.1 to 3.4.2 in /packages/react-intl/example...
  • 4e6ed5c build(deps): bump picomatch from 2.3.1 to 2.3.2 in /packages/react-intl/examp...
  • aad8b45 build(deps): bump picomatch from 2.3.1 to 2.3.2 in /packages/react-intl/examp...
  • 5f77a64 build(deps): bump yaml from 1.10.2 to 1.10.3 (#6187)
  • Additional commits viewable in compare view

Updates react-router-dom from 7.13.1 to 7.13.2

Changelog

Sourced from react-router-dom's changelog.

7.13.2

Patch Changes

  • Updated dependencies:
    • react-router@7.13.2
Commits

Updates renovate from 43.86.1 to 43.100.1

Release notes

Sourced from renovate's releases.

43.100.1

43.100.1 (2026-03-30)

Documentation

  • config: clarify commitMessagePrefix affects Dependency Dashboard (#42236) (9a76a15)

Build System

  • deps: update dependency diff to v8.0.4 (main) (#42244) (4cc9819)

43.100.0

43.100.0 (2026-03-30)

Features

Bug Fixes

  • swift: Parse pins without version key in Package.resolved (#42220) (8ed5d0f)

Documentation

  • update references to renovate/renovate (main) (#42228) (30d346b)

Miscellaneous Chores

  • deps: lock file maintenance (main) (#42229) (f8a752e)
  • deps: update containerbase/internal-tools action to v4.5.8 (main) (#42230) (4d23825)
  • deps: update containerbase/internal-tools action to v4.5.9 (main) (#42232) (5e3680b)
  • deps: update dependency @​containerbase/istanbul-reports-html to v1.1.38 (main) (#42231) (7ae0c34)
  • deps: update dependency @​containerbase/semantic-release-pnpm to v1.3.28 (main) (#42233) (a569c4e)

43.99.1

43.99.1 (2026-03-29)

Bug Fixes

  • datasource/dart: Use npm versioning to make rangeStrategy=bump work again (#42115) (ef9662a)
  • deps: update ghcr.io/renovatebot/base-image docker tag to v13.31.1 (main) (#42226) (fa018c4)

Miscellaneous Chores

  • deps: update containerbase/internal-tools action to v4.5.6 (main) (#42219) (d850027)
  • deps: update dependency markdownlint-cli2 to v0.22.0 (main) (#42222) (8ae44af)

Code Refactoring

... (truncated)

Commits
  • 4cc9819 build(deps): update dependency diff to v8.0.4 (main) (#42244)
  • 9a76a15 docs(config): clarify commitMessagePrefix affects Dependency Dashboard (#42236)
  • 8ed5d0f fix(swift): Parse pins without version key in Package.resolved (#42220)
  • c5e1b14 feat(manager/mise): add npm upgrade tooling (#42235)
  • a569c4e chore(deps): update dependency @​containerbase/semantic-release-pnpm to v1.3.2...
  • 5e3680b chore(deps): update containerbase/internal-tools action to v4.5.9 (main) (#42...
  • 7ae0c34 chore(deps): update dependency @​containerbase/istanbul-reports-html to v1.1.3...
  • 4d23825 chore(deps): update containerbase/internal-tools action to v4.5.8 (main) (#42...
  • f8a752e chore(deps): lock file maintenance (main) (#42229)
  • 30d346b docs: update references to renovate/renovate (main) (#42228)
  • Additional commits viewable in compare view

Updates stylelint from 17.5.0 to 17.6.0

Release notes

Sourced from stylelint's releases.

17.6.0

It adds support for extending units in languageOptions, which then apply to rules like declaration-property-value-no-unknown, and fixes 2 bugs.

  • Added: support for extending units to languageOptions (#9166) (@​jeddy3).
  • Fixed: missing ruleMetadata when linting multiple files with overrides (#9154) (@​kovsu).
  • Fixed: custom-property-no-missing-var-function false positives for timeline-scope and animation-timeline (#9164) (@​splincode).
Changelog

Sourced from stylelint's changelog.

17.6.0 - 2026-03-26

It adds support for extending units in languageOptions, which then apply to rules like declaration-property-value-no-unknown, and fixes 2 bugs.

  • Added: support for extending units to languageOptions (#9166) (@​jeddy3).
  • Fixed: missing ruleMetadata when linting multiple files with overrides (#9154) (@​kovsu).
  • Fixed: custom-property-no-missing-var-function false positives for timeline-scope and animation-timeline (#9164) (@​splincode).
Commits
  • f74ceaf Release 17.6.0 (#9180)
  • 895f7f2 Add support for extending units to languageOptions (#9166)
  • dd7231b Refactor to replace imurmurhash with node:crypto (#9177)
  • 5b6b024 Bump picomatch (#9178)
  • 7e25378 Bump @​csstools/css-syntax-patches-for-csstree from 1.0.29 to 1.1.1 in the css...
  • 9edeff4 Group csstree and @csstools/css-syntax-patches-for-csstree in dependabot ...
  • 2f7c0ca Bump actions/download-artifact from 8.0.0 to 8.0.1 (#9167)
  • 59f310d Bump write-file-atomic from 7.0.0 to 7.0.1 (#9169)
  • ab2ffcb Bump @​vscode/windows-process-tree from 0.6.3 to 0.7.0 (#9170)
  • a9f3e5b Bump lint-staged from 16.3.3 to 16.4.0 (#9171)
  • Additional commits viewable in compare view

Updates typescript from 5.9.3 to 6.0.2

Release notes

Sourced from typescript's releases.

TypeScript 6.0

For release notes, check out the release announcement blog post.

Downloads are available on:

TypeScript 6.0 Beta

For release notes, check out the release announcement.

Downloads are available on:

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Mar 30, 2026
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Mar 30, 2026
@github-actions github-actions Bot enabled auto-merge March 30, 2026 14:51
@dependabot dependabot Bot force-pushed the dependabot/npm_and_yarn/dependencies/npm-e8dedfa41f branch from 5c9c1e6 to f6edacb Compare March 31, 2026 09:23
@dependabot
deps(npm): bump the npm group across 1 directory with 9 updates
657c35c 
Bumps the npm group with 9 updates in the /dependencies directory:

| Package | From | To |
| --- | --- | --- |
| [@biomejs/biome](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome) | `2.4.8` | `2.4.9` |
| [@typescript-eslint/eslint-plugin](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin) | `8.57.1` | `8.57.2` |
| [eslint-plugin-jest](https://github.com/jest-community/eslint-plugin-jest) | `29.15.0` | `29.15.1` |
| [npm-groovy-lint](https://github.com/nvuillam/npm-groovy-lint) | `17.0.0` | `17.0.2` |
| [react-intl](https://github.com/formatjs/formatjs) | `10.1.0` | `10.1.1` |
| [react-router-dom](https://github.com/remix-run/react-router/tree/HEAD/packages/react-router-dom) | `7.13.1` | `7.13.2` |
| [renovate](https://github.com/renovatebot/renovate) | `43.86.1` | `43.100.1` |
| [stylelint](https://github.com/stylelint/stylelint) | `17.5.0` | `17.6.0` |
| [typescript](https://github.com/microsoft/TypeScript) | `5.9.3` | `6.0.2` |



Updates `@biomejs/biome` from 2.4.8 to 2.4.9
- [Release notes](https://github.com/biomejs/biome/releases)
- [Changelog](https://github.com/biomejs/biome/blob/main/packages/@biomejs/biome/CHANGELOG.md)
- [Commits](https://github.com/biomejs/biome/commits/@biomejs/biome@2.4.9/packages/@biomejs/biome)

Updates `@typescript-eslint/eslint-plugin` from 8.57.1 to 8.57.2
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/eslint-plugin/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.57.2/packages/eslint-plugin)

Updates `eslint-plugin-jest` from 29.15.0 to 29.15.1
- [Release notes](https://github.com/jest-community/eslint-plugin-jest/releases)
- [Changelog](https://github.com/jest-community/eslint-plugin-jest/blob/main/CHANGELOG.md)
- [Commits](jest-community/eslint-plugin-jest@v29.15.0...v29.15.1)

Updates `npm-groovy-lint` from 17.0.0 to 17.0.2
- [Release notes](https://github.com/nvuillam/npm-groovy-lint/releases)
- [Changelog](https://github.com/nvuillam/npm-groovy-lint/blob/main/CHANGELOG.md)
- [Commits](nvuillam/npm-groovy-lint@v17.0.0...v17.0.2)

Updates `react-intl` from 10.1.0 to 10.1.1
- [Release notes](https://github.com/formatjs/formatjs/releases)
- [Commits](https://github.com/formatjs/formatjs/compare/react-intl@10.1.0...react-intl@10.1.1)

Updates `react-router-dom` from 7.13.1 to 7.13.2
- [Release notes](https://github.com/remix-run/react-router/releases)
- [Changelog](https://github.com/remix-run/react-router/blob/main/packages/react-router-dom/CHANGELOG.md)
- [Commits](https://github.com/remix-run/react-router/commits/react-router-dom@7.13.2/packages/react-router-dom)

Updates `renovate` from 43.86.1 to 43.100.1
- [Release notes](https://github.com/renovatebot/renovate/releases)
- [Commits](renovatebot/renovate@43.86.1...43.100.1)

Updates `stylelint` from 17.5.0 to 17.6.0
- [Release notes](https://github.com/stylelint/stylelint/releases)
- [Changelog](https://github.com/stylelint/stylelint/blob/main/CHANGELOG.md)
- [Commits](stylelint/stylelint@17.5.0...17.6.0)

Updates `typescript` from 5.9.3 to 6.0.2
- [Release notes](https://github.com/microsoft/TypeScript/releases)
- [Commits](microsoft/TypeScript@v5.9.3...v6.0.2)

---
updated-dependencies:
- dependency-name: "@biomejs/biome"
  dependency-version: 2.4.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: "@typescript-eslint/eslint-plugin"
  dependency-version: 8.57.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: eslint-plugin-jest
  dependency-version: 29.15.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: npm-groovy-lint
  dependency-version: 17.0.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: react-intl
  dependency-version: 10.1.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: react-router-dom
  dependency-version: 7.13.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: renovate
  dependency-version: 43.100.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm
- dependency-name: stylelint
  dependency-version: 17.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm
- dependency-name: typescript
  dependency-version: 6.0.2
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: npm
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot force-pushed the dependabot/npm_and_yarn/dependencies/npm-e8dedfa41f branch from f6edacb to 657c35c Compare March 31, 2026 09:27
@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented Mar 31, 2026

Super-linter summary

Language Validation result
BIOME_FORMAT Pass ✅
BIOME_LINT Pass ✅
CHECKOV Pass ✅
EDITORCONFIG Pass ✅
GITLEAKS Pass ✅
GIT_COMMITLINT Pass ✅
GIT_MERGE_CONFLICT_MARKERS Pass ✅
JSCPD Pass ✅
JSON Pass ✅
JSON_PRETTIER Pass ✅
PRE_COMMIT Pass ✅
SPELL_CODESPELL Pass ✅
TRIVY Fail ❌

Super-linter detected linting errors

For more information, see the
GitHub Actions workflow run

Powered by Super-linter

TRIVY 
trivy filesystem --config /github/workspace/.github/linters/trivy.yaml /github/workspace

Report Summary

┌─────────────────────────────────────┬────────────┬─────────────────┬───────────────────┬─────────┐
│               Target                │    Type    │ Vulnerabilities │ Misconfigurations │ Secrets │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ dependencies/Gemfile.lock           │  bundler   │        3        │         -         │    -    │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ dependencies/composer/composer.lock │  composer  │        0        │         -         │    -    │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ dependencies/package-lock.json      │    npm     │        0        │         -         │    -    │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ dev-dependencies/package-lock.json  │    npm     │        0        │         -         │    -    │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ Dockerfile                          │ dockerfile │        -        │         0         │    -    │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ dev-dependencies/Dockerfile         │ dockerfile │        -        │         0         │    -    │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ test/linters/trivy/good/Dockerfile  │ dockerfile │        -        │         0         │    -    │
└─────────────────────────────────────┴────────────┴─────────────────┴───────────────────┴─────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)


For OSS Maintainers: VEX Notice
--------------------------------
If you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement.
VEX allows you to communicate the actual status of vulnerabilities in your project, improving security transparency and reducing false positives for your users.
Learn more and start using VEX: https://trivy.dev/docs/v0.69/guide/supply-chain/vex/repo#publishing-vex-documents

To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable.


dependencies/Gemfile.lock (bundler)
===================================
Total: 3 (UNKNOWN: 0, LOW: 0, MEDIUM: 3, HIGH: 0, CRITICAL: 0)

┌───────────────┬────────────────┬──────────┬────────┬───────────────────┬───────────────────────────┬──────────────────────────────────────────────────────────────┐
│    Library    │ Vulnerability  │ Severity │ Status │ Installed Version │       Fixed Version       │                            Title                             │
├───────────────┼────────────────┼──────────┼────────┼───────────────────┼───────────────────────────┼──────────────────────────────────────────────────────────────┤
│ activesupport │ CVE-2026-33169 │ MEDIUM   │ fixed  │ 8.1.2             │ 8.1.2.1, 8.0.4.1, 7.2.3.1 │ rails: rails-activesupport: Active Support: Denial of        │
│               │                │          │        │                   │                           │ Service via crafted long digit strings...                    │
│               │                │          │        │                   │                           │ https://avd.aquasec.com/nvd/cve-2026-33169                   │
│               ├────────────────┤          │        │                   │                           ├──────────────────────────────────────────────────────────────┤
│               │ CVE-2026-33170 │          │        │                   │                           │ Rails: Active Support: Active Support: Cross-Site Scripting  │
│               │                │          │        │                   │                           │ (XSS) due to improper HTML...                                │
│               │                │          │        │                   │                           │ https://avd.aquasec.com/nvd/cve-2026-33170                   │
│               ├────────────────┤          │        │                   │                           ├──────────────────────────────────────────────────────────────┤
│               │ CVE-2026-33176 │          │        │                   │                           │ Rails: Active Support: Active Support: Denial of Service via │
│               │                │          │        │                   │                           │ large scientific notation...                                 │
│               │                │          │        │                   │                           │ https://avd.aquasec.com/nvd/cve-2026-33176                   │
└───────────────┴────────────────┴──────────┴────────┴───────────────────┴───────────────────────────┴──────────────────────────────────────────────────────────────┘

@ferrarimarco ferrarimarco disabled auto-merge March 31, 2026 10:39
@ferrarimarco ferrarimarco merged commit db85efc into main Mar 31, 2026
218 of 231 checks passed
@ferrarimarco ferrarimarco deleted the dependabot/npm_and_yarn/dependencies/npm-e8dedfa41f branch March 31, 2026 10:39
@ferrarimarco ferrarimarco added this to the v8.6.0 milestone Mar 31, 2026
@github-actions github-actions Bot mentioned this pull request Mar 31, 2026
Merged
@marcusmai-telia marcusmai-telia mentioned this pull request Apr 8, 2026
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@zkoppert zkoppert Awaiting requested review from zkoppert zkoppert is a code owner

@Hanse00 Hanse00 Awaiting requested review from Hanse00 Hanse00 is a code owner

@ferrarimarco ferrarimarco Awaiting requested review from ferrarimarco ferrarimarco is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code

Projects

None yet

Milestone

v8.6.0

Development

Successfully merging this pull request may close these issues.

1 participant

@ferrarimarco