Known vulnerabilities in dependencies

[axi92]

I know its a lot of work to keep everything up to date with the CVEs that daily emerge, but would it be possible to fix some of those?
I tried to make a PR but I was not able to fix all of them without breaking something.
If wanted I can open a PR that fixes some of them.

This scan is from trivy:

Report Summary

┌───────────┬──────┬─────────────────┬─────────┐
│  Target   │ Type │ Vulnerabilities │ Secrets │
├───────────┼──────┼─────────────────┼─────────┤
│ yarn.lock │ yarn │       13        │    -    │
└───────────┴──────┴─────────────────┴─────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)


yarn.lock (yarn)

Total: 13 (UNKNOWN: 0, LOW: 3, MEDIUM: 7, HIGH: 0, CRITICAL: 3)

┌───────────────────────────────┬────────────────┬──────────┬────────┬───────────────────┬─────────────────────────────┬──────────────────────────────────────────────────────────────┐
│            Library            │ Vulnerability  │ Severity │ Status │ Installed Version │        Fixed Version        │                            Title                             │
├───────────────────────────────┼────────────────┼──────────┼────────┼───────────────────┼─────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ @octokit/plugin-paginate-rest │ CVE-2025-25288 │ MEDIUM   │ fixed  │ 2.21.3            │ 11.4.1, 9.2.2               │ octokit/plugin-paginate-rest: @octokit/plugin-paginate-rest  │
│                               │                │          │        │                   │                             │ has a Regular Expression in iterator that Leads to ReDoS...  │
│                               │                │          │        │                   │                             │ https://avd.aquasec.com/nvd/cve-2025-25288                   │
├───────────────────────────────┼────────────────┤          │        ├───────────────────┼─────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ @octokit/request              │ CVE-2025-25290 │          │        │ 5.6.3             │ 9.2.1, 8.4.1                │ octokit/request: @octokit/request has a Regular Expression   │
│                               │                │          │        │                   │                             │ in fetchWrapper that Leads to ReDoS...                       │
│                               │                │          │        │                   │                             │ https://avd.aquasec.com/nvd/cve-2025-25290                   │
│                               │                │          │        ├───────────────────┤                             │                                                              │
│                               │                │          │        │ 8.1.4             │                             │                                                              │
│                               │                │          │        │                   │                             │                                                              │
│                               │                │          │        │                   │                             │                                                              │
├───────────────────────────────┼────────────────┤          │        ├───────────────────┼─────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ @octokit/request-error        │ CVE-2025-25289 │          │        │ 2.1.0             │ 5.1.1, 6.1.7                │ @octokit/request-error: @octokit/request-error has a Regular │
│                               │                │          │        │                   │                             │ Expression in index that Leads to ReDoS...                   │
│                               │                │          │        │                   │                             │ https://avd.aquasec.com/nvd/cve-2025-25289                   │
│                               │                │          │        ├───────────────────┤                             │                                                              │
│                               │                │          │        │ 5.0.1             │                             │                                                              │
│                               │                │          │        │                   │                             │                                                              │
│                               │                │          │        │                   │                             │                                                              │
├───────────────────────────────┼────────────────┼──────────┤        ├───────────────────┼─────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ brace-expansion               │ CVE-2025-5889  │ LOW      │        │ 1.1.11            │ 2.0.2, 1.1.12, 3.0.1, 4.0.1 │ brace-expansion: juliangruber brace-expansion index.js       │
│                               │                │          │        │                   │                             │ expand redos                                                 │
│                               │                │          │        │                   │                             │ https://avd.aquasec.com/nvd/cve-2025-5889                    │
│                               │                │          │        ├───────────────────┤                             │                                                              │
│                               │                │          │        │ 2.0.1             │                             │                                                              │
│                               │                │          │        │                   │                             │                                                              │
│                               │                │          │        │                   │                             │                                                              │
├───────────────────────────────┼────────────────┼──────────┤        ├───────────────────┼─────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ form-data                     │ CVE-2025-7783  │ CRITICAL │        │ 2.5.1             │ 2.5.4, 3.0.4, 4.0.4         │ form-data: Unsafe random function in form-data               │
│                               │                │          │        │                   │                             │ https://avd.aquasec.com/nvd/cve-2025-7783                    │
│                               │                │          │        ├───────────────────┤                             │                                                              │
│                               │                │          │        │ 3.0.1             │                             │                                                              │
│                               │                │          │        │                   │                             │                                                              │
│                               │                │          │        ├───────────────────┤                             │                                                              │
│                               │                │          │        │ 4.0.0             │                             │                                                              │
│                               │                │          │        │                   │                             │                                                              │
├───────────────────────────────┼────────────────┼──────────┤        ├───────────────────┼─────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ tough-cookie                  │ CVE-2023-26136 │ MEDIUM   │        │ 3.0.1             │ 4.1.3                       │ tough-cookie: prototype pollution in cookie memstore         │
│                               │                │          │        │                   │                             │ https://avd.aquasec.com/nvd/cve-2023-26136                   │
├───────────────────────────────┼────────────────┤          │        ├───────────────────┼─────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ undici                        │ CVE-2025-22150 │          │        │ 5.28.4            │ 5.28.5, 6.21.1, 7.2.3       │ undici: Undici Uses Insufficiently Random Values             │
│                               │                │          │        │                   │                             │ https://avd.aquasec.com/nvd/cve-2025-22150                   │
│                               ├────────────────┼──────────┤        │                   ├─────────────────────────────┼──────────────────────────────────────────────────────────────┤
│                               │ CVE-2025-47279 │ LOW      │        │                   │ 5.29.0, 6.21.2, 7.5.0       │ undici: Undici Memory Leak with Invalid Certificates         │
│                               │                │          │        │                   │                             │ https://avd.aquasec.com/nvd/cve-2025-47279                   │
└───────────────────────────────┴────────────────┴──────────┴────────┴───────────────────┴─────────────────────────────┴──────────────────────────────────────────────────────────────┘

[thompson-shaun]

Thanks for raising this up. Dependabot had an existing PR up for the CRITICAL error and that's been merged

#432

For the remainder I believe we are waiting on some upstream updates. @crazy-max would know precisely.

[crazy-max]

For the remainder I believe we are waiting on some upstream updates. @crazy-max would know precisely.

Yeah we are waiting for @actions/github to update to latest octokit. And we also need dep updates in our actions-toolkit. I'm taking a look.

[crazy-max]

Updated in

• update dependencies actions-toolkit#750
• build(deps): bump @docker/actions-toolkit from 0.62.1 to 0.63.0 #434
• build(deps): bump undici from 5.28.4 to 5.29.0 #435
• build(deps): bump brace-expansion from 1.1.11 to 1.1.12 #436

For remaining ones these are transitive deps that need to be updated on https://github.com/actions/toolkit first: