Skip to content

fix(deps): update minor updates 📉#48

Open
iexec-renovate-app[bot] wants to merge 1 commit intodevelopfrom
renovate/minor-updates
Open

fix(deps): update minor updates 📉#48
iexec-renovate-app[bot] wants to merge 1 commit intodevelopfrom
renovate/minor-updates

Conversation

@iexec-renovate-app
Copy link
Copy Markdown
Contributor

@iexec-renovate-app iexec-renovate-app Bot commented Mar 27, 2025

This PR contains the following updates:

Package Type Update Change
@graphprotocol/graph-cli (source) dependencies minor ^0.96.0 -> ^0.97.0
ethers (source) dependencies minor 6.13.5 -> 6.14.4
ghcr.io/foundry-rs/foundry minor v1.0.0 -> v1.2.3
graphprotocol/graph-node minor v0.37.0 -> v0.39.1
iexec dependencies minor 8.12.0 -> 8.15.0
ipfs/go-ipfs minor v0.34.1 -> v0.35.0
lint-staged dependencies minor 15.2.11 -> 15.5.2
postgres minor 16.8 -> 16.9
prettier (source) dependencies minor 3.4.2 -> 3.5.3
tsx (source) dependencies minor 4.19.3 -> 4.20.3

Release Notes

graphprotocol/graph-tooling (@​graphprotocol/graph-cli)

v0.97.1

Compare Source

Patch Changes

v0.97.0

Compare Source

Minor Changes
Patch Changes
ethers-io/ethers.js (ethers)

v6.14.4

Compare Source

  • Fixed serialization of EIP-7702 transactions with leading 0-bytes (#​4916; 389dc03).

v6.14.3

Compare Source

  • Fixed non-normalized yParity on EIP-7702 JSON-RPC responses (#​4985; a8803ca).

v6.14.2

Compare Source

v6.14.1

Compare Source

  • Fix JSON-RPC authorizationList signature entries encoded as DATA instead of QUANTITY values (#​4916; 135db72).

v6.14.0

Compare Source

  • Remove BlockscoutProvider temporarily until custom error issues are fixed (805a8b3).

v6.13.7

Compare Source

  • Fix FallbackProvider coalescing call exceptions when backends return slightly different error message (268a0ac).

v6.13.6

Compare Source

  • Implicitly use EIP-7702 if authorizationList is given and non-empty (#​4961; e7c1bdf).
    • Initial EIP-7702 support (#​4916; db490e1).
    • Added support for to override fetch init options in the Browser (#​3895; 844ae68).
    • Added EIP-6963 discovery to BrowserProvider (f5469dd).
    • Merge: e5036e7 158f5d0 Merge branch 'main' into wip-v6.14 (e7165a6).
    • tests: squelch the noisy runtime console API event in browser tests (79428fd).
    • tests: added faucet key environment for browser CI tests (27d42af).
    • tests: better runtime exception output for browser tests (0beed25).
    • tests: added more debug endpoints to browser tests (33bbf66).
    • tests: added JSON-RPC tests to web browser CI (1c0c23c).
    • tests: added browser tests for sending (afd613a).
    • tests: debugging browser tests failing to launch (d1baa74).
    • tests: fix assert call for browser assert (1806bbd).
    • tests: inlcude more node tests in the browser tests (92fd5d1).
    • tests: move more tests to dev network (996f30c).
    • tests: debugging CI browser failure (ce7212d).
    • tests: debugging CI browser failure (f1821a6).
    • tests: debugging CI browser failure (cc9119c).
    • tests: debugging CI browser failure (3ac33f9).
    • tests: debugging CI browser failure (25b11ee).
    • tests: debug CI failing (3bcbcae).
    • tests: added circular support to browser-safe inspect (3854b39).
    • tests: added browser-safe inspect for tests (e299a31).
    • tests: fix for browser CI tests (74a68bc).
    • tests: adding debug info to local JsonPrcProvider (c508538).
    • tests: temporarily remove QuickNode (499ed8c).
    • Accept modern KZG library API while exposing legacy API (#​4841; e5036e7).
    • Added CommunityResourcable to exports (#​4776; bca8d1b).
foundry-rs/foundry (ghcr.io/foundry-rs/foundry)

v1.2.3

Compare Source

Foundry v1.2.3

Foundry v1.2.3 is a bugfix release for anvil and cast call command.

Anvil Fixes

  • fix(anvil): guard against the blockchain advancing while checking latest block (#​10709) by @​alexghr

Cast Fixes

Changelog:

foundry-rs/foundry@v1.2.2...v1.2.3

Foundry v1.2.2

Foundry v1.2.2 is a bugfix release for forge formatter and cast hash-message command.

Forge Fixes

Cast Fixes

Changelog:

foundry-rs/foundry@v1.2.1...v1.2.2

Foundry v1.2.1

Foundry v1.2.1 is a bugfix release for forge formatter, forked tests and vm.cool cheatcode.

Forge Fixes

Changelog:

foundry-rs/foundry@v1.2.0...v1.2.1

Foundry v1.2.0

This release comes with support for Etherscan's V2 API, forge script execution protection, performance improvement of Anvil block mining and several fixes for EIP-7702 cheatcodes.

Etherscan v2 API support

⚠️ At the end of May Etherscan will deprecate its V1 API. With the new V2 API Etherscan enables users to use a single API key for all chains to greatly simplify the management of API keys for multichain Foundry codebases. Any API key created on etherscan.io (mainnet) can be used for all chains. API keys created on deployments of Etherscan on other chains (e.g. BaseScan, Arbiscan, etc..) will likely stop working. Please see the Etherscan v2 documenation for additional details. Whilst Foundry still supports V1 API keys until deprecation it is highly recommended to migrate now as follows in your foundry.toml:

[etherscan]
sepolia = { key = "$YOUR_V2_COMPATIBLE_API_KEY" }

Etherscan v1 API and keys are still supported by specifying the global etherscan_api_version = "v1" config, or per chain api-version as follows in your foundry.toml:

[etherscan]
base-sepolia = { key = "$YOUR_V1_API_KEY", api-version = "v1" }

Performance

Consistent Anvil blocks mining

Mining a block in Anvil is a blocking operation because it can take a relatively long time (and can be significantly longer in forking mode due to rpc requests). Until this version, the mining block tasks were not spawned as blocking tasks, and that could cause state inconsistencies like seen in Cow protocol integration tests failures. Foundry v1.2.0 changes the way blocks are mined in Anvil and ensures consistency by spawning request handlers as blocking tasks.

Forge script execution protection

In order to protect against coding errors that could lead to undesired transactions and transfer of funds to script address itself, this version comes with execution protection feature which reverts execution if address(this) is used. The protection is enabled by default and can be turned off by setting as follows in foundry.toml:

script_execution_protection = false

Anvil Features

Anvil Fixes

Cast Features

Cast Fixes## Anvil Features

Anvil Fixes

Cast Features

Cast Fixes

Forge Features

Forge Fixes

Other

Full Changelog:

foundry-rs/foundry@v1.1.0...v1.2.3

Forge Features

Forge Fixes

Other

Full Changelog:

foundry-rs/foundry@v1.1.0...v1.2.0

v1.2.2

Compare Source

Foundry v1.2.2

Foundry v1.2.2 is a bugfix release for forge formatter and cast hash-message command.

Forge Fixes

Cast Fixes

Changelog:

foundry-rs/foundry@v1.2.1...v1.2.2

Foundry v1.2.1

Foundry v1.2.1 is a bugfix release for forge formatter, forked tests and vm.cool cheatcode.

Forge Fixes

Changelog:

foundry-rs/foundry@v1.2.0...v1.2.1

Foundry v1.2.0

This release comes with support for Etherscan's V2 API, forge script execution protection, performance improvement of Anvil block mining and several fixes for EIP-7702 cheatcodes.

Etherscan v2 API support

⚠️ At the end of May Etherscan will deprecate its V1 API. With the new V2 API Etherscan enables users to use a single API key for all chains to greatly simplify the management of API keys for multichain Foundry codebases. Any API key created on etherscan.io (mainnet) can be used for all chains. API keys created on deployments of Etherscan on other chains (e.g. BaseScan, Arbiscan, etc..) will likely stop working. Please see the Etherscan v2 documenation for additional details. Whilst Foundry still supports V1 API keys until deprecation it is highly recommended to migrate now as follows in your foundry.toml:

[etherscan]
sepolia = { key = "$YOUR_V2_COMPATIBLE_API_KEY" }

Etherscan v1 API and keys are still supported by specifying the global etherscan_api_version = "v1" config, or per chain api-version as follows in your foundry.toml:

[etherscan]
base-sepolia = { key = "$YOUR_V1_API_KEY", api-version = "v1" }

Performance

Consistent Anvil blocks mining

Mining a block in Anvil is a blocking operation because it can take a relatively long time (and can be significantly longer in forking mode due to rpc requests). Until this version, the mining block tasks were not spawned as blocking tasks, and that could cause state inconsistencies like seen in Cow protocol integration tests failures. Foundry v1.2.0 changes the way blocks are mined in Anvil and ensures consistency by spawning request handlers as blocking tasks.

Forge script execution protection

In order to protect against coding errors that could lead to undesired transactions and transfer of funds to script address itself, this version comes with execution protection feature which reverts execution if address(this) is used. The protection is enabled by default and can be turned off by setting as follows in foundry.toml:

script_execution_protection = false

Anvil Features

Anvil Fixes

Cast Features

Cast Fixes

Forge Features

Forge Fixes

Other


Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.


  • If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot.

@github-actions
Copy link
Copy Markdown

🔒 Trivy Security Scan Results

Click to expand detailed results

For OSS Maintainers: VEX Notice
--------------------------------
If you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement.
VEX allows you to communicate the actual status of vulnerabilities in your project, improving security transparency and reducing false positives for your users.
Learn more and start using VEX: https://aquasecurity.github.io/trivy/v0.57/docs/supply-chain/vex/repo#publishing-vex-documents

To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable.


vuln-image.tar (debian 12.10)
=============================
Total: 4 (HIGH: 4, CRITICAL: 0)

┌──────────────┬────────────────┬──────────┬────────┬───────────────────┬──────────────────┬─────────────────────────────────────────────────────────────┐
│   Library    │ Vulnerability  │ Severity │ Status │ Installed Version │  Fixed Version   │                            Title                            │
├──────────────┼────────────────┼──────────┼────────┼───────────────────┼──────────────────┼─────────────────────────────────────────────────────────────┤
│ libxslt1-dev │ CVE-2024-55549 │ HIGH     │ fixed  │ 1.1.35-1          │ 1.1.35-1+deb12u1 │ libxslt: Use-After-Free in libxslt (xsltGetInheritedNsList) │
│              │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2024-55549                  │
│              ├────────────────┤          │        │                   │                  ├─────────────────────────────────────────────────────────────┤
│              │ CVE-2025-24855 │          │        │                   │                  │ libxslt: Use-After-Free in libxslt numbers.c                │
│              │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2025-24855                  │
├──────────────┼────────────────┤          │        │                   │                  ├─────────────────────────────────────────────────────────────┤
│ libxslt1.1   │ CVE-2024-55549 │          │        │                   │                  │ libxslt: Use-After-Free in libxslt (xsltGetInheritedNsList) │
│              │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2024-55549                  │
│              ├────────────────┤          │        │                   │                  ├─────────────────────────────────────────────────────────────┤
│              │ CVE-2025-24855 │          │        │                   │                  │ libxslt: Use-After-Free in libxslt numbers.c                │
│              │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2025-24855                  │
└──────────────┴────────────────┴──────────┴────────┴───────────────────┴──────────────────┴─────────────────────────────────────────────────────────────┘

Node.js (node-pkg)
==================
Total: 7 (HIGH: 6, CRITICAL: 1)

┌────────────────────────────────────────┬────────────────┬──────────┬────────┬───────────────────┬─────────────────────┬──────────────────────────────────────────────────────────────┐
│                Library                 │ Vulnerability  │ Severity │ Status │ Installed Version │    Fixed Version    │                            Title                             │
├────────────────────────────────────────┼────────────────┼──────────┼────────┼───────────────────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│ @openzeppelin/contracts (package.json) │ CVE-2021-46320 │ HIGH     │ fixed  │ 3.2.0             │ 4.4.1               │ Improper Initialization in OpenZeppelin                      │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2021-46320                   │
│                                        ├────────────────┼──────────┤        ├───────────────────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│                                        │ CVE-2021-39167 │ CRITICAL │        │ 3.3.0             │ 4.3.1, 3.4.2        │ TimelockController vulnerability in OpenZeppelin Contracts   │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2021-39167                   │
│                                        ├────────────────┼──────────┤        │                   ├─────────────────────┼──────────────────────────────────────────────────────────────┤
│                                        │ CVE-2021-46320 │ HIGH     │        │                   │ 4.4.1               │ Improper Initialization in OpenZeppelin                      │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2021-46320                   │
├────────────────────────────────────────┼────────────────┤          │        ├───────────────────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│ axios (package.json)                   │ CVE-2025-27152 │          │        │ 0.21.4            │ 1.8.2               │ axios: Possible SSRF and Credential Leakage via Absolute URL │
│                                        │                │          │        │                   │                     │ in axios Requests...                                         │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2025-27152                   │
├────────────────────────────────────────┼────────────────┤          │        ├───────────────────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│ cross-spawn (package.json)             │ CVE-2024-21538 │          │        │ 7.0.3             │ 7.0.5, 6.0.6        │ cross-spawn: regular expression denial of service            │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2024-21538                   │
│                                        │                │          │        │                   │                     │                                                              │
│                                        │                │          │        │                   │                     │                                                              │
│                                        │                │          │        │                   │                     │                                                              │
├────────────────────────────────────────┼────────────────┤          │        ├───────────────────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│ semver (package.json)                  │ CVE-2022-25883 │          │        │ 7.3.5             │ 7.5.2, 6.3.1, 5.7.2 │ nodejs-semver: Regular expression denial of service          │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2022-25883                   │
└────────────────────────────────────────┴────────────────┴──────────┴────────┴───────────────────┴─────────────────────┴──────────────────────────────────────────────────────────────┘

@iexec-renovate-app iexec-renovate-app Bot force-pushed the renovate/minor-updates branch from d5c7184 to 61bfd5a Compare March 27, 2025 19:03
@github-actions
Copy link
Copy Markdown

🔒 Trivy Security Scan Results

Click to expand detailed results

For OSS Maintainers: VEX Notice
--------------------------------
If you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement.
VEX allows you to communicate the actual status of vulnerabilities in your project, improving security transparency and reducing false positives for your users.
Learn more and start using VEX: https://aquasecurity.github.io/trivy/v0.57/docs/supply-chain/vex/repo#publishing-vex-documents

To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable.


vuln-image.tar (debian 12.10)
=============================
Total: 4 (HIGH: 4, CRITICAL: 0)

┌──────────────┬────────────────┬──────────┬────────┬───────────────────┬──────────────────┬─────────────────────────────────────────────────────────────┐
│   Library    │ Vulnerability  │ Severity │ Status │ Installed Version │  Fixed Version   │                            Title                            │
├──────────────┼────────────────┼──────────┼────────┼───────────────────┼──────────────────┼─────────────────────────────────────────────────────────────┤
│ libxslt1-dev │ CVE-2024-55549 │ HIGH     │ fixed  │ 1.1.35-1          │ 1.1.35-1+deb12u1 │ libxslt: Use-After-Free in libxslt (xsltGetInheritedNsList) │
│              │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2024-55549                  │
│              ├────────────────┤          │        │                   │                  ├─────────────────────────────────────────────────────────────┤
│              │ CVE-2025-24855 │          │        │                   │                  │ libxslt: Use-After-Free in libxslt numbers.c                │
│              │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2025-24855                  │
├──────────────┼────────────────┤          │        │                   │                  ├─────────────────────────────────────────────────────────────┤
│ libxslt1.1   │ CVE-2024-55549 │          │        │                   │                  │ libxslt: Use-After-Free in libxslt (xsltGetInheritedNsList) │
│              │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2024-55549                  │
│              ├────────────────┤          │        │                   │                  ├─────────────────────────────────────────────────────────────┤
│              │ CVE-2025-24855 │          │        │                   │                  │ libxslt: Use-After-Free in libxslt numbers.c                │
│              │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2025-24855                  │
└──────────────┴────────────────┴──────────┴────────┴───────────────────┴──────────────────┴─────────────────────────────────────────────────────────────┘

Node.js (node-pkg)
==================
Total: 7 (HIGH: 6, CRITICAL: 1)

┌────────────────────────────────────────┬────────────────┬──────────┬────────┬───────────────────┬─────────────────────┬──────────────────────────────────────────────────────────────┐
│                Library                 │ Vulnerability  │ Severity │ Status │ Installed Version │    Fixed Version    │                            Title                             │
├────────────────────────────────────────┼────────────────┼──────────┼────────┼───────────────────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│ @openzeppelin/contracts (package.json) │ CVE-2021-46320 │ HIGH     │ fixed  │ 3.2.0             │ 4.4.1               │ Improper Initialization in OpenZeppelin                      │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2021-46320                   │
│                                        ├────────────────┼──────────┤        ├───────────────────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│                                        │ CVE-2021-39167 │ CRITICAL │        │ 3.3.0             │ 4.3.1, 3.4.2        │ TimelockController vulnerability in OpenZeppelin Contracts   │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2021-39167                   │
│                                        ├────────────────┼──────────┤        │                   ├─────────────────────┼──────────────────────────────────────────────────────────────┤
│                                        │ CVE-2021-46320 │ HIGH     │        │                   │ 4.4.1               │ Improper Initialization in OpenZeppelin                      │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2021-46320                   │
├────────────────────────────────────────┼────────────────┤          │        ├───────────────────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│ axios (package.json)                   │ CVE-2025-27152 │          │        │ 0.21.4            │ 1.8.2               │ axios: Possible SSRF and Credential Leakage via Absolute URL │
│                                        │                │          │        │                   │                     │ in axios Requests...                                         │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2025-27152                   │
├────────────────────────────────────────┼────────────────┤          │        ├───────────────────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│ cross-spawn (package.json)             │ CVE-2024-21538 │          │        │ 7.0.3             │ 7.0.5, 6.0.6        │ cross-spawn: regular expression denial of service            │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2024-21538                   │
│                                        │                │          │        │                   │                     │                                                              │
│                                        │                │          │        │                   │                     │                                                              │
│                                        │                │          │        │                   │                     │                                                              │
├────────────────────────────────────────┼────────────────┤          │        ├───────────────────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│ semver (package.json)                  │ CVE-2022-25883 │          │        │ 7.3.5             │ 7.5.2, 6.3.1, 5.7.2 │ nodejs-semver: Regular expression denial of service          │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2022-25883                   │
└────────────────────────────────────────┴────────────────┴──────────┴────────┴───────────────────┴─────────────────────┴──────────────────────────────────────────────────────────────┘

@iexec-renovate-app iexec-renovate-app Bot force-pushed the renovate/minor-updates branch from 61bfd5a to 360b3ea Compare March 31, 2025 15:53
@github-actions
Copy link
Copy Markdown

🔒 Trivy Security Scan Results

Click to expand detailed results

For OSS Maintainers: VEX Notice
--------------------------------
If you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement.
VEX allows you to communicate the actual status of vulnerabilities in your project, improving security transparency and reducing false positives for your users.
Learn more and start using VEX: https://aquasecurity.github.io/trivy/v0.57/docs/supply-chain/vex/repo#publishing-vex-documents

To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable.


vuln-image.tar (debian 12.10)
=============================
Total: 4 (HIGH: 4, CRITICAL: 0)

┌──────────────┬────────────────┬──────────┬────────┬───────────────────┬──────────────────┬─────────────────────────────────────────────────────────────┐
│   Library    │ Vulnerability  │ Severity │ Status │ Installed Version │  Fixed Version   │                            Title                            │
├──────────────┼────────────────┼──────────┼────────┼───────────────────┼──────────────────┼─────────────────────────────────────────────────────────────┤
│ libxslt1-dev │ CVE-2024-55549 │ HIGH     │ fixed  │ 1.1.35-1          │ 1.1.35-1+deb12u1 │ libxslt: Use-After-Free in libxslt (xsltGetInheritedNsList) │
│              │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2024-55549                  │
│              ├────────────────┤          │        │                   │                  ├─────────────────────────────────────────────────────────────┤
│              │ CVE-2025-24855 │          │        │                   │                  │ libxslt: Use-After-Free in libxslt numbers.c                │
│              │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2025-24855                  │
├──────────────┼────────────────┤          │        │                   │                  ├─────────────────────────────────────────────────────────────┤
│ libxslt1.1   │ CVE-2024-55549 │          │        │                   │                  │ libxslt: Use-After-Free in libxslt (xsltGetInheritedNsList) │
│              │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2024-55549                  │
│              ├────────────────┤          │        │                   │                  ├─────────────────────────────────────────────────────────────┤
│              │ CVE-2025-24855 │          │        │                   │                  │ libxslt: Use-After-Free in libxslt numbers.c                │
│              │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2025-24855                  │
└──────────────┴────────────────┴──────────┴────────┴───────────────────┴──────────────────┴─────────────────────────────────────────────────────────────┘

Node.js (node-pkg)
==================
Total: 7 (HIGH: 6, CRITICAL: 1)

┌────────────────────────────────────────┬────────────────┬──────────┬────────┬───────────────────┬─────────────────────┬──────────────────────────────────────────────────────────────┐
│                Library                 │ Vulnerability  │ Severity │ Status │ Installed Version │    Fixed Version    │                            Title                             │
├────────────────────────────────────────┼────────────────┼──────────┼────────┼───────────────────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│ @openzeppelin/contracts (package.json) │ CVE-2021-46320 │ HIGH     │ fixed  │ 3.2.0             │ 4.4.1               │ Improper Initialization in OpenZeppelin                      │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2021-46320                   │
│                                        ├────────────────┼──────────┤        ├───────────────────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│                                        │ CVE-2021-39167 │ CRITICAL │        │ 3.3.0             │ 4.3.1, 3.4.2        │ TimelockController vulnerability in OpenZeppelin Contracts   │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2021-39167                   │
│                                        ├────────────────┼──────────┤        │                   ├─────────────────────┼──────────────────────────────────────────────────────────────┤
│                                        │ CVE-2021-46320 │ HIGH     │        │                   │ 4.4.1               │ Improper Initialization in OpenZeppelin                      │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2021-46320                   │
├────────────────────────────────────────┼────────────────┤          │        ├───────────────────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│ axios (package.json)                   │ CVE-2025-27152 │          │        │ 0.21.4            │ 1.8.2, 0.30.0       │ axios: Possible SSRF and Credential Leakage via Absolute URL │
│                                        │                │          │        │                   │                     │ in axios Requests...                                         │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2025-27152                   │
├────────────────────────────────────────┼────────────────┤          │        ├───────────────────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│ cross-spawn (package.json)             │ CVE-2024-21538 │          │        │ 7.0.3             │ 7.0.5, 6.0.6        │ cross-spawn: regular expression denial of service            │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2024-21538                   │
│                                        │                │          │        │                   │                     │                                                              │
│                                        │                │          │        │                   │                     │                                                              │
│                                        │                │          │        │                   │                     │                                                              │
├────────────────────────────────────────┼────────────────┤          │        ├───────────────────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│ semver (package.json)                  │ CVE-2022-25883 │          │        │ 7.3.5             │ 7.5.2, 6.3.1, 5.7.2 │ nodejs-semver: Regular expression denial of service          │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2022-25883                   │
└────────────────────────────────────────┴────────────────┴──────────┴────────┴───────────────────┴─────────────────────┴──────────────────────────────────────────────────────────────┘

@iexec-renovate-app iexec-renovate-app Bot force-pushed the renovate/minor-updates branch from 360b3ea to e8144a3 Compare April 3, 2025 21:48
@github-actions
Copy link
Copy Markdown

github-actions Bot commented Apr 3, 2025

🔒 Trivy Security Scan Results

Click to expand detailed results

For OSS Maintainers: VEX Notice
--------------------------------
If you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement.
VEX allows you to communicate the actual status of vulnerabilities in your project, improving security transparency and reducing false positives for your users.
Learn more and start using VEX: https://aquasecurity.github.io/trivy/v0.57/docs/supply-chain/vex/repo#publishing-vex-documents

To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable.


vuln-image.tar (debian 12.10)
=============================
Total: 4 (HIGH: 4, CRITICAL: 0)

┌──────────────┬────────────────┬──────────┬────────┬───────────────────┬──────────────────┬─────────────────────────────────────────────────────────────┐
│   Library    │ Vulnerability  │ Severity │ Status │ Installed Version │  Fixed Version   │                            Title                            │
├──────────────┼────────────────┼──────────┼────────┼───────────────────┼──────────────────┼─────────────────────────────────────────────────────────────┤
│ libxslt1-dev │ CVE-2024-55549 │ HIGH     │ fixed  │ 1.1.35-1          │ 1.1.35-1+deb12u1 │ libxslt: Use-After-Free in libxslt (xsltGetInheritedNsList) │
│              │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2024-55549                  │
│              ├────────────────┤          │        │                   │                  ├─────────────────────────────────────────────────────────────┤
│              │ CVE-2025-24855 │          │        │                   │                  │ libxslt: Use-After-Free in libxslt numbers.c                │
│              │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2025-24855                  │
├──────────────┼────────────────┤          │        │                   │                  ├─────────────────────────────────────────────────────────────┤
│ libxslt1.1   │ CVE-2024-55549 │          │        │                   │                  │ libxslt: Use-After-Free in libxslt (xsltGetInheritedNsList) │
│              │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2024-55549                  │
│              ├────────────────┤          │        │                   │                  ├─────────────────────────────────────────────────────────────┤
│              │ CVE-2025-24855 │          │        │                   │                  │ libxslt: Use-After-Free in libxslt numbers.c                │
│              │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2025-24855                  │
└──────────────┴────────────────┴──────────┴────────┴───────────────────┴──────────────────┴─────────────────────────────────────────────────────────────┘

Node.js (node-pkg)
==================
Total: 7 (HIGH: 6, CRITICAL: 1)

┌────────────────────────────────────────┬────────────────┬──────────┬────────┬───────────────────┬─────────────────────┬──────────────────────────────────────────────────────────────┐
│                Library                 │ Vulnerability  │ Severity │ Status │ Installed Version │    Fixed Version    │                            Title                             │
├────────────────────────────────────────┼────────────────┼──────────┼────────┼───────────────────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│ @openzeppelin/contracts (package.json) │ CVE-2021-46320 │ HIGH     │ fixed  │ 3.2.0             │ 4.4.1               │ Improper Initialization in OpenZeppelin                      │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2021-46320                   │
│                                        ├────────────────┼──────────┤        ├───────────────────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│                                        │ CVE-2021-39167 │ CRITICAL │        │ 3.3.0             │ 4.3.1, 3.4.2        │ TimelockController vulnerability in OpenZeppelin Contracts   │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2021-39167                   │
│                                        ├────────────────┼──────────┤        │                   ├─────────────────────┼──────────────────────────────────────────────────────────────┤
│                                        │ CVE-2021-46320 │ HIGH     │        │                   │ 4.4.1               │ Improper Initialization in OpenZeppelin                      │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2021-46320                   │
├────────────────────────────────────────┼────────────────┤          │        ├───────────────────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│ axios (package.json)                   │ CVE-2025-27152 │          │        │ 0.21.4            │ 1.8.2, 0.30.0       │ axios: Possible SSRF and Credential Leakage via Absolute URL │
│                                        │                │          │        │                   │                     │ in axios Requests...                                         │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2025-27152                   │
├────────────────────────────────────────┼────────────────┤          │        ├───────────────────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│ cross-spawn (package.json)             │ CVE-2024-21538 │          │        │ 7.0.3             │ 7.0.5, 6.0.6        │ cross-spawn: regular expression denial of service            │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2024-21538                   │
│                                        │                │          │        │                   │                     │                                                              │
│                                        │                │          │        │                   │                     │                                                              │
│                                        │                │          │        │                   │                     │                                                              │
├────────────────────────────────────────┼────────────────┤          │        ├───────────────────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│ semver (package.json)                  │ CVE-2022-25883 │          │        │ 7.3.5             │ 7.5.2, 6.3.1, 5.7.2 │ nodejs-semver: Regular expression denial of service          │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2022-25883                   │
└────────────────────────────────────────┴────────────────┴──────────┴────────┴───────────────────┴─────────────────────┴──────────────────────────────────────────────────────────────┘

@iexec-renovate-app iexec-renovate-app Bot force-pushed the renovate/minor-updates branch from e8144a3 to 80aaa71 Compare April 4, 2025 01:13
@github-actions
Copy link
Copy Markdown

github-actions Bot commented Apr 4, 2025

🔒 Trivy Security Scan Results

Click to expand detailed results

For OSS Maintainers: VEX Notice
--------------------------------
If you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement.
VEX allows you to communicate the actual status of vulnerabilities in your project, improving security transparency and reducing false positives for your users.
Learn more and start using VEX: https://aquasecurity.github.io/trivy/v0.57/docs/supply-chain/vex/repo#publishing-vex-documents

To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable.


vuln-image.tar (debian 12.10)
=============================
Total: 4 (HIGH: 4, CRITICAL: 0)

┌──────────────┬────────────────┬──────────┬────────┬───────────────────┬──────────────────┬─────────────────────────────────────────────────────────────┐
│   Library    │ Vulnerability  │ Severity │ Status │ Installed Version │  Fixed Version   │                            Title                            │
├──────────────┼────────────────┼──────────┼────────┼───────────────────┼──────────────────┼─────────────────────────────────────────────────────────────┤
│ libxslt1-dev │ CVE-2024-55549 │ HIGH     │ fixed  │ 1.1.35-1          │ 1.1.35-1+deb12u1 │ libxslt: Use-After-Free in libxslt (xsltGetInheritedNsList) │
│              │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2024-55549                  │
│              ├────────────────┤          │        │                   │                  ├─────────────────────────────────────────────────────────────┤
│              │ CVE-2025-24855 │          │        │                   │                  │ libxslt: Use-After-Free in libxslt numbers.c                │
│              │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2025-24855                  │
├──────────────┼────────────────┤          │        │                   │                  ├─────────────────────────────────────────────────────────────┤
│ libxslt1.1   │ CVE-2024-55549 │          │        │                   │                  │ libxslt: Use-After-Free in libxslt (xsltGetInheritedNsList) │
│              │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2024-55549                  │
│              ├────────────────┤          │        │                   │                  ├─────────────────────────────────────────────────────────────┤
│              │ CVE-2025-24855 │          │        │                   │                  │ libxslt: Use-After-Free in libxslt numbers.c                │
│              │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2025-24855                  │
└──────────────┴────────────────┴──────────┴────────┴───────────────────┴──────────────────┴─────────────────────────────────────────────────────────────┘

Node.js (node-pkg)
==================
Total: 7 (HIGH: 6, CRITICAL: 1)

┌────────────────────────────────────────┬────────────────┬──────────┬────────┬───────────────────┬─────────────────────┬──────────────────────────────────────────────────────────────┐
│                Library                 │ Vulnerability  │ Severity │ Status │ Installed Version │    Fixed Version    │                            Title                             │
├────────────────────────────────────────┼────────────────┼──────────┼────────┼───────────────────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│ @openzeppelin/contracts (package.json) │ CVE-2021-46320 │ HIGH     │ fixed  │ 3.2.0             │ 4.4.1               │ Improper Initialization in OpenZeppelin                      │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2021-46320                   │
│                                        ├────────────────┼──────────┤        ├───────────────────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│                                        │ CVE-2021-39167 │ CRITICAL │        │ 3.3.0             │ 4.3.1, 3.4.2        │ TimelockController vulnerability in OpenZeppelin Contracts   │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2021-39167                   │
│                                        ├────────────────┼──────────┤        │                   ├─────────────────────┼──────────────────────────────────────────────────────────────┤
│                                        │ CVE-2021-46320 │ HIGH     │        │                   │ 4.4.1               │ Improper Initialization in OpenZeppelin                      │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2021-46320                   │
├────────────────────────────────────────┼────────────────┤          │        ├───────────────────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│ axios (package.json)                   │ CVE-2025-27152 │          │        │ 0.21.4            │ 1.8.2, 0.30.0       │ axios: Possible SSRF and Credential Leakage via Absolute URL │
│                                        │                │          │        │                   │                     │ in axios Requests...                                         │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2025-27152                   │
├────────────────────────────────────────┼────────────────┤          │        ├───────────────────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│ cross-spawn (package.json)             │ CVE-2024-21538 │          │        │ 7.0.3             │ 7.0.5, 6.0.6        │ cross-spawn: regular expression denial of service            │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2024-21538                   │
│                                        │                │          │        │                   │                     │                                                              │
│                                        │                │          │        │                   │                     │                                                              │
│                                        │                │          │        │                   │                     │                                                              │
├────────────────────────────────────────┼────────────────┤          │        ├───────────────────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│ semver (package.json)                  │ CVE-2022-25883 │          │        │ 7.3.5             │ 7.5.2, 6.3.1, 5.7.2 │ nodejs-semver: Regular expression denial of service          │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2022-25883                   │
└────────────────────────────────────────┴────────────────┴──────────┴────────┴───────────────────┴─────────────────────┴──────────────────────────────────────────────────────────────┘

@iexec-renovate-app iexec-renovate-app Bot force-pushed the renovate/minor-updates branch from 80aaa71 to 8ee366c Compare April 8, 2025 12:53
@github-actions
Copy link
Copy Markdown

github-actions Bot commented Apr 8, 2025

🔒 Trivy Security Scan Results

Click to expand detailed results

For OSS Maintainers: VEX Notice
--------------------------------
If you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement.
VEX allows you to communicate the actual status of vulnerabilities in your project, improving security transparency and reducing false positives for your users.
Learn more and start using VEX: https://aquasecurity.github.io/trivy/v0.57/docs/supply-chain/vex/repo#publishing-vex-documents

To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable.


vuln-image.tar (debian 12.10)
=============================
Total: 0 (HIGH: 0, CRITICAL: 0)


Node.js (node-pkg)
==================
Total: 7 (HIGH: 6, CRITICAL: 1)

┌────────────────────────────────────────┬────────────────┬──────────┬────────┬───────────────────┬─────────────────────┬──────────────────────────────────────────────────────────────┐
│                Library                 │ Vulnerability  │ Severity │ Status │ Installed Version │    Fixed Version    │                            Title                             │
├────────────────────────────────────────┼────────────────┼──────────┼────────┼───────────────────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│ @openzeppelin/contracts (package.json) │ CVE-2021-46320 │ HIGH     │ fixed  │ 3.2.0             │ 4.4.1               │ Improper Initialization in OpenZeppelin                      │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2021-46320                   │
│                                        ├────────────────┼──────────┤        ├───────────────────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│                                        │ CVE-2021-39167 │ CRITICAL │        │ 3.3.0             │ 4.3.1, 3.4.2        │ TimelockController vulnerability in OpenZeppelin Contracts   │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2021-39167                   │
│                                        ├────────────────┼──────────┤        │                   ├─────────────────────┼──────────────────────────────────────────────────────────────┤
│                                        │ CVE-2021-46320 │ HIGH     │        │                   │ 4.4.1               │ Improper Initialization in OpenZeppelin                      │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2021-46320                   │
├────────────────────────────────────────┼────────────────┤          │        ├───────────────────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│ axios (package.json)                   │ CVE-2025-27152 │          │        │ 0.21.4            │ 1.8.2, 0.30.0       │ axios: Possible SSRF and Credential Leakage via Absolute URL │
│                                        │                │          │        │                   │                     │ in axios Requests...                                         │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2025-27152                   │
├────────────────────────────────────────┼────────────────┤          │        ├───────────────────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│ cross-spawn (package.json)             │ CVE-2024-21538 │          │        │ 7.0.3             │ 7.0.5, 6.0.6        │ cross-spawn: regular expression denial of service            │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2024-21538                   │
│                                        │                │          │        │                   │                     │                                                              │
│                                        │                │          │        │                   │                     │                                                              │
│                                        │                │          │        │                   │                     │                                                              │
├────────────────────────────────────────┼────────────────┤          │        ├───────────────────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│ semver (package.json)                  │ CVE-2022-25883 │          │        │ 7.3.5             │ 7.5.2, 6.3.1, 5.7.2 │ nodejs-semver: Regular expression denial of service          │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2022-25883                   │
└────────────────────────────────────────┴────────────────┴──────────┴────────┴───────────────────┴─────────────────────┴──────────────────────────────────────────────────────────────┘

@iexec-renovate-app iexec-renovate-app Bot force-pushed the renovate/minor-updates branch from 8ee366c to de70eac Compare April 10, 2025 12:59
@github-actions
Copy link
Copy Markdown

🔒 Trivy Security Scan Results

Click to expand detailed results

For OSS Maintainers: VEX Notice
--------------------------------
If you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement.
VEX allows you to communicate the actual status of vulnerabilities in your project, improving security transparency and reducing false positives for your users.
Learn more and start using VEX: https://aquasecurity.github.io/trivy/v0.57/docs/supply-chain/vex/repo#publishing-vex-documents

To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable.


vuln-image.tar (debian 12.10)
=============================
Total: 0 (HIGH: 0, CRITICAL: 0)


Node.js (node-pkg)
==================
Total: 7 (HIGH: 6, CRITICAL: 1)

┌────────────────────────────────────────┬────────────────┬──────────┬────────┬───────────────────┬─────────────────────┬──────────────────────────────────────────────────────────────┐
│                Library                 │ Vulnerability  │ Severity │ Status │ Installed Version │    Fixed Version    │                            Title                             │
├────────────────────────────────────────┼────────────────┼──────────┼────────┼───────────────────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│ @openzeppelin/contracts (package.json) │ CVE-2021-46320 │ HIGH     │ fixed  │ 3.2.0             │ 4.4.1               │ Improper Initialization in OpenZeppelin                      │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2021-46320                   │
│                                        ├────────────────┼──────────┤        ├───────────────────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│                                        │ CVE-2021-39167 │ CRITICAL │        │ 3.3.0             │ 4.3.1, 3.4.2        │ TimelockController vulnerability in OpenZeppelin Contracts   │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2021-39167                   │
│                                        ├────────────────┼──────────┤        │                   ├─────────────────────┼──────────────────────────────────────────────────────────────┤
│                                        │ CVE-2021-46320 │ HIGH     │        │                   │ 4.4.1               │ Improper Initialization in OpenZeppelin                      │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2021-46320                   │
├────────────────────────────────────────┼────────────────┤          │        ├───────────────────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│ axios (package.json)                   │ CVE-2025-27152 │          │        │ 0.21.4            │ 1.8.2, 0.30.0       │ axios: Possible SSRF and Credential Leakage via Absolute URL │
│                                        │                │          │        │                   │                     │ in axios Requests...                                         │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2025-27152                   │
├────────────────────────────────────────┼────────────────┤          │        ├───────────────────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│ cross-spawn (package.json)             │ CVE-2024-21538 │          │        │ 7.0.3             │ 7.0.5, 6.0.6        │ cross-spawn: regular expression denial of service            │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2024-21538                   │
│                                        │                │          │        │                   │                     │                                                              │
│                                        │                │          │        │                   │                     │                                                              │
│                                        │                │          │        │                   │                     │                                                              │
├────────────────────────────────────────┼────────────────┤          │        ├───────────────────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│ semver (package.json)                  │ CVE-2022-25883 │          │        │ 7.3.5             │ 7.5.2, 6.3.1, 5.7.2 │ nodejs-semver: Regular expression denial of service          │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2022-25883                   │
└────────────────────────────────────────┴────────────────┴──────────┴────────┴───────────────────┴─────────────────────┴──────────────────────────────────────────────────────────────┘

@iexec-renovate-app iexec-renovate-app Bot force-pushed the renovate/minor-updates branch from de70eac to f8788b1 Compare April 12, 2025 01:13
@github-actions
Copy link
Copy Markdown

🔒 Trivy Security Scan Results

Click to expand detailed results

For OSS Maintainers: VEX Notice
--------------------------------
If you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement.
VEX allows you to communicate the actual status of vulnerabilities in your project, improving security transparency and reducing false positives for your users.
Learn more and start using VEX: https://aquasecurity.github.io/trivy/v0.57/docs/supply-chain/vex/repo#publishing-vex-documents

To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable.


vuln-image.tar (debian 12.10)
=============================
Total: 0 (HIGH: 0, CRITICAL: 0)


Node.js (node-pkg)
==================
Total: 7 (HIGH: 6, CRITICAL: 1)

┌────────────────────────────────────────┬────────────────┬──────────┬────────┬───────────────────┬─────────────────────┬──────────────────────────────────────────────────────────────┐
│                Library                 │ Vulnerability  │ Severity │ Status │ Installed Version │    Fixed Version    │                            Title                             │
├────────────────────────────────────────┼────────────────┼──────────┼────────┼───────────────────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│ @openzeppelin/contracts (package.json) │ CVE-2021-46320 │ HIGH     │ fixed  │ 3.2.0             │ 4.4.1               │ Improper Initialization in OpenZeppelin                      │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2021-46320                   │
│                                        ├────────────────┼──────────┤        ├───────────────────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│                                        │ CVE-2021-39167 │ CRITICAL │        │ 3.3.0             │ 4.3.1, 3.4.2        │ TimelockController vulnerability in OpenZeppelin Contracts   │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2021-39167                   │
│                                        ├────────────────┼──────────┤        │                   ├─────────────────────┼──────────────────────────────────────────────────────────────┤
│                                        │ CVE-2021-46320 │ HIGH     │        │                   │ 4.4.1               │ Improper Initialization in OpenZeppelin                      │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2021-46320                   │
├────────────────────────────────────────┼────────────────┤          │        ├───────────────────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│ axios (package.json)                   │ CVE-2025-27152 │          │        │ 0.21.4            │ 1.8.2, 0.30.0       │ axios: Possible SSRF and Credential Leakage via Absolute URL │
│                                        │                │          │        │                   │                     │ in axios Requests...                                         │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2025-27152                   │
├────────────────────────────────────────┼────────────────┤          │        ├───────────────────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│ cross-spawn (package.json)             │ CVE-2024-21538 │          │        │ 7.0.3             │ 7.0.5, 6.0.6        │ cross-spawn: regular expression denial of service            │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2024-21538                   │
│                                        │                │          │        │                   │                     │                                                              │
│                                        │                │          │        │                   │                     │                                                              │
│                                        │                │          │        │                   │                     │                                                              │
├────────────────────────────────────────┼────────────────┤          │        ├───────────────────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│ semver (package.json)                  │ CVE-2022-25883 │          │        │ 7.3.5             │ 7.5.2, 6.3.1, 5.7.2 │ nodejs-semver: Regular expression denial of service          │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2022-25883                   │
└────────────────────────────────────────┴────────────────┴──────────┴────────┴───────────────────┴─────────────────────┴──────────────────────────────────────────────────────────────┘

@github-actions
Copy link
Copy Markdown

🔒 Trivy Security Scan Results

Click to expand detailed results

For OSS Maintainers: VEX Notice
--------------------------------
If you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement.
VEX allows you to communicate the actual status of vulnerabilities in your project, improving security transparency and reducing false positives for your users.
Learn more and start using VEX: https://aquasecurity.github.io/trivy/v0.57/docs/supply-chain/vex/repo#publishing-vex-documents

To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable.


vuln-image.tar (debian 12.10)
=============================
Total: 23 (HIGH: 23, CRITICAL: 0)

┌───────────────────┬────────────────┬──────────┬────────┬───────────────────┬──────────────────┬──────────────────────────────────────────────────────────────┐
│      Library      │ Vulnerability  │ Severity │ Status │ Installed Version │  Fixed Version   │                            Title                             │
├───────────────────┼────────────────┼──────────┼────────┼───────────────────┼──────────────────┼──────────────────────────────────────────────────────────────┤
│ libperl5.36       │ CVE-2024-56406 │ HIGH     │ fixed  │ 5.36.0-7+deb12u1  │ 5.36.0-7+deb12u2 │ perl: Perl 5.34, 5.36, 5.38 and 5.40 are vulnerable to a     │
│                   │                │          │        │                   │                  │ heap...                                                      │
│                   │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2024-56406                   │
├───────────────────┼────────────────┤          │        ├───────────────────┼──────────────────┼──────────────────────────────────────────────────────────────┤
│ linux-libc-dev    │ CVE-2024-26982 │          │        │ 6.1.129-1         │ 6.1.133-1        │ kernel: Squashfs: check the inode number is not the invalid  │
│                   │                │          │        │                   │                  │ value of...                                                  │
│                   │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2024-26982                   │
│                   ├────────────────┤          │        │                   │                  ├──────────────────────────────────────────────────────────────┤
│                   │ CVE-2024-35866 │          │        │                   │                  │ kernel: smb: client: fix potential UAF in                    │
│                   │                │          │        │                   │                  │ cifs_dump_full_key()                                         │
│                   │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2024-35866                   │
│                   ├────────────────┤          │        │                   │                  ├──────────────────────────────────────────────────────────────┤
│                   │ CVE-2024-50246 │          │        │                   │                  │ kernel: fs/ntfs3: Add rough attr alloc_size check            │
│                   │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2024-50246                   │
│                   ├────────────────┤          │        │                   │                  ├──────────────────────────────────────────────────────────────┤
│                   │ CVE-2024-53166 │          │        │                   │                  │ kernel: block, bfq: fix bfqq uaf in bfq_limit_depth()        │
│                   │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2024-53166                   │
│                   ├────────────────┤          │        │                   │                  ├──────────────────────────────────────────────────────────────┤
│                   │ CVE-2024-58002 │          │        │                   │                  │ kernel: media: uvcvideo: Remove dangling pointers            │
│                   │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2024-58002                   │
│                   ├────────────────┤          │        │                   │                  ├──────────────────────────────────────────────────────────────┤
│                   │ CVE-2025-21702 │          │        │                   │                  │ kernel: pfifo_tail_enqueue: Drop new packet when sch->limit  │
│                   │                │          │        │                   │                  │ == 0                                                         │
│                   │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2025-21702                   │
│                   ├────────────────┤          │        │                   │                  ├──────────────────────────────────────────────────────────────┤
│                   │ CVE-2025-21855 │          │        │                   │                  │ kernel: ibmvnic: Don't reference skb after sending to VIOS   │
│                   │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2025-21855                   │
│                   ├────────────────┤          │        │                   │                  ├──────────────────────────────────────────────────────────────┤
│                   │ CVE-2025-21858 │          │        │                   │                  │ kernel: geneve: Fix use-after-free in geneve_find_dev().     │
│                   │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2025-21858                   │
│                   ├────────────────┤          │        │                   │                  ├──────────────────────────────────────────────────────────────┤
│                   │ CVE-2025-21905 │          │        │                   │                  │ kernel: wifi: iwlwifi: limit printed string from FW file     │
│                   │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2025-21905                   │
│                   ├────────────────┤          │        │                   │                  ├──────────────────────────────────────────────────────────────┤
│                   │ CVE-2025-21919 │          │        │                   │                  │ kernel: sched/fair: Fix potential memory corruption in       │
│                   │                │          │        │                   │                  │ child_cfs_rq_on_list                                         │
│                   │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2025-21919                   │
│                   ├────────────────┤          │        │                   │                  ├──────────────────────────────────────────────────────────────┤
│                   │ CVE-2025-21920 │          │        │                   │                  │ kernel: vlan: enforce underlying device type                 │
│                   │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2025-21920                   │
│                   ├────────────────┤          │        │                   │                  ├──────────────────────────────────────────────────────────────┤
│                   │ CVE-2025-21926 │          │        │                   │                  │ kernel: net: gso: fix ownership in __udp_gso_segment         │
│                   │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2025-21926                   │
│                   ├────────────────┤          │        │                   │                  ├──────────────────────────────────────────────────────────────┤
│                   │ CVE-2025-21928 │          │        │                   │                  │ kernel: HID: intel-ish-hid: Fix use-after-free issue in      │
│                   │                │          │        │                   │                  │ ishtp_hid_remove()                                           │
│                   │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2025-21928                   │
│                   ├────────────────┤          │        │                   │                  ├──────────────────────────────────────────────────────────────┤
│                   │ CVE-2025-21934 │          │        │                   │                  │ kernel: rapidio: fix an API misues when rio_add_net() fails  │
│                   │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2025-21934                   │
│                   ├────────────────┤          │        │                   │                  ├──────────────────────────────────────────────────────────────┤
│                   │ CVE-2025-21945 │          │        │                   │                  │ kernel: ksmbd: fix use-after-free in smb2_lock               │
│                   │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2025-21945                   │
│                   ├────────────────┤          │        │                   │                  ├──────────────────────────────────────────────────────────────┤
│                   │ CVE-2025-21968 │          │        │                   │                  │ kernel: drm/amd/display: Fix slab-use-after-free on          │
│                   │                │          │        │                   │                  │ hdcp_work                                                    │
│                   │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2025-21968                   │
│                   ├────────────────┤          │        │                   │                  ├──────────────────────────────────────────────────────────────┤
│                   │ CVE-2025-21979 │          │        │                   │                  │ kernel: wifi: cfg80211: cancel wiphy_work before freeing     │
│                   │                │          │        │                   │                  │ wiphy                                                        │
│                   │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2025-21979                   │
│                   ├────────────────┤          │        │                   │                  ├──────────────────────────────────────────────────────────────┤
│                   │ CVE-2025-21991 │          │        │                   │                  │ kernel: x86/microcode/AMD: Fix out-of-bounds on systems with │
│                   │                │          │        │                   │                  │ CPU-less NUMA nodes                                          │
│                   │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2025-21991                   │
│                   ├────────────────┤          │        │                   │                  ├──────────────────────────────────────────────────────────────┤
│                   │ CVE-2025-21993 │          │        │                   │                  │ kernel: iscsi_ibft: Fix UBSAN shift-out-of-bounds warning in │
│                   │                │          │        │                   │                  │ ibft_attr_show_nic()                                         │
│                   │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2025-21993                   │
├───────────────────┼────────────────┤          │        ├───────────────────┼──────────────────┼──────────────────────────────────────────────────────────────┤
│ perl              │ CVE-2024-56406 │          │        │ 5.36.0-7+deb12u1  │ 5.36.0-7+deb12u2 │ perl: Perl 5.34, 5.36, 5.38 and 5.40 are vulnerable to a     │
│                   │                │          │        │                   │                  │ heap...                                                      │
│                   │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2024-56406                   │
├───────────────────┤                │          │        │                   │                  │                                                              │
│ perl-base         │                │          │        │                   │                  │                                                              │
│                   │                │          │        │                   │                  │                                                              │
│                   │                │          │        │                   │                  │                                                              │
├───────────────────┤                │          │        │                   │                  │                                                              │
│ perl-modules-5.36 │                │          │        │                   │                  │                                                              │
│                   │                │          │        │                   │                  │                                                              │
│                   │                │          │        │                   │                  │                                                              │
└───────────────────┴────────────────┴──────────┴────────┴───────────────────┴──────────────────┴──────────────────────────────────────────────────────────────┘

Node.js (node-pkg)
==================
Total: 7 (HIGH: 6, CRITICAL: 1)

┌────────────────────────────────────────┬────────────────┬──────────┬────────┬───────────────────┬─────────────────────┬──────────────────────────────────────────────────────────────┐
│                Library                 │ Vulnerability  │ Severity │ Status │ Installed Version │    Fixed Version    │                            Title                             │
├────────────────────────────────────────┼────────────────┼──────────┼────────┼───────────────────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│ @openzeppelin/contracts (package.json) │ CVE-2021-46320 │ HIGH     │ fixed  │ 3.2.0             │ 4.4.1               │ Improper Initialization in OpenZeppelin                      │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2021-46320                   │
│                                        ├────────────────┼──────────┤        ├───────────────────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│                                        │ CVE-2021-39167 │ CRITICAL │        │ 3.3.0             │ 4.3.1, 3.4.2        │ TimelockController vulnerability in OpenZeppelin Contracts   │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2021-39167                   │
│                                        ├────────────────┼──────────┤        │                   ├─────────────────────┼──────────────────────────────────────────────────────────────┤
│                                        │ CVE-2021-46320 │ HIGH     │        │                   │ 4.4.1               │ Improper Initialization in OpenZeppelin                      │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2021-46320                   │
├────────────────────────────────────────┼────────────────┤          │        ├───────────────────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│ axios (package.json)                   │ CVE-2025-27152 │          │        │ 0.21.4            │ 1.8.2, 0.30.0       │ axios: Possible SSRF and Credential Leakage via Absolute URL │
│                                        │                │          │        │                   │                     │ in axios Requests...                                         │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2025-27152                   │
├────────────────────────────────────────┼────────────────┤          │        ├───────────────────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│ cross-spawn (package.json)             │ CVE-2024-21538 │          │        │ 7.0.3             │ 7.0.5, 6.0.6        │ cross-spawn: regular expression denial of service            │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2024-21538                   │
│                                        │                │          │        │                   │                     │                                                              │
│                                        │                │          │        │                   │                     │                                                              │
│                                        │                │          │        │                   │                     │                                                              │
├────────────────────────────────────────┼────────────────┤          │        ├───────────────────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│ semver (package.json)                  │ CVE-2022-25883 │          │        │ 7.3.5             │ 7.5.2, 6.3.1, 5.7.2 │ nodejs-semver: Regular expression denial of service          │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2022-25883                   │
└────────────────────────────────────────┴────────────────┴──────────┴────────┴───────────────────┴─────────────────────┴──────────────────────────────────────────────────────────────┘

@iexec-renovate-app iexec-renovate-app Bot force-pushed the renovate/minor-updates branch from 95bd457 to 2b7cb60 Compare May 10, 2025 01:03
@github-actions
Copy link
Copy Markdown

🔒 Trivy Security Scan Results

Click to expand detailed results

For OSS Maintainers: VEX Notice
--------------------------------
If you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement.
VEX allows you to communicate the actual status of vulnerabilities in your project, improving security transparency and reducing false positives for your users.
Learn more and start using VEX: https://aquasecurity.github.io/trivy/v0.57/docs/supply-chain/vex/repo#publishing-vex-documents

To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable.


vuln-image.tar (debian 12.10)
=============================
Total: 0 (HIGH: 0, CRITICAL: 0)


Node.js (node-pkg)
==================
Total: 7 (HIGH: 6, CRITICAL: 1)

┌────────────────────────────────────────┬────────────────┬──────────┬────────┬───────────────────┬─────────────────────┬──────────────────────────────────────────────────────────────┐
│                Library                 │ Vulnerability  │ Severity │ Status │ Installed Version │    Fixed Version    │                            Title                             │
├────────────────────────────────────────┼────────────────┼──────────┼────────┼───────────────────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│ @openzeppelin/contracts (package.json) │ CVE-2021-46320 │ HIGH     │ fixed  │ 3.2.0             │ 4.4.1               │ Improper Initialization in OpenZeppelin                      │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2021-46320                   │
│                                        ├────────────────┼──────────┤        ├───────────────────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│                                        │ CVE-2021-39167 │ CRITICAL │        │ 3.3.0             │ 4.3.1, 3.4.2        │ TimelockController vulnerability in OpenZeppelin Contracts   │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2021-39167                   │
│                                        ├────────────────┼──────────┤        │                   ├─────────────────────┼──────────────────────────────────────────────────────────────┤
│                                        │ CVE-2021-46320 │ HIGH     │        │                   │ 4.4.1               │ Improper Initialization in OpenZeppelin                      │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2021-46320                   │
├────────────────────────────────────────┼────────────────┤          │        ├───────────────────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│ axios (package.json)                   │ CVE-2025-27152 │          │        │ 0.21.4            │ 1.8.2, 0.30.0       │ axios: Possible SSRF and Credential Leakage via Absolute URL │
│                                        │                │          │        │                   │                     │ in axios Requests...                                         │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2025-27152                   │
├────────────────────────────────────────┼────────────────┤          │        ├───────────────────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│ cross-spawn (package.json)             │ CVE-2024-21538 │          │        │ 7.0.3             │ 7.0.5, 6.0.6        │ cross-spawn: regular expression denial of service            │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2024-21538                   │
│                                        │                │          │        │                   │                     │                                                              │
│                                        │                │          │        │                   │                     │                                                              │
│                                        │                │          │        │                   │                     │                                                              │
├────────────────────────────────────────┼────────────────┤          │        ├───────────────────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│ semver (package.json)                  │ CVE-2022-25883 │          │        │ 7.3.5             │ 7.5.2, 6.3.1, 5.7.2 │ nodejs-semver: Regular expression denial of service          │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2022-25883                   │
└────────────────────────────────────────┴────────────────┴──────────┴────────┴───────────────────┴─────────────────────┴──────────────────────────────────────────────────────────────┘

@iexec-renovate-app iexec-renovate-app Bot force-pushed the renovate/minor-updates branch from 2b7cb60 to 1cfb7f4 Compare May 17, 2025 01:08
@github-actions
Copy link
Copy Markdown

🔒 Trivy Security Scan Results

Click to expand detailed results

For OSS Maintainers: VEX Notice
--------------------------------
If you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement.
VEX allows you to communicate the actual status of vulnerabilities in your project, improving security transparency and reducing false positives for your users.
Learn more and start using VEX: https://aquasecurity.github.io/trivy/v0.57/docs/supply-chain/vex/repo#publishing-vex-documents

To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable.


vuln-image.tar (debian 12.10)
=============================
Total: 0 (HIGH: 0, CRITICAL: 0)


Node.js (node-pkg)
==================
Total: 7 (HIGH: 6, CRITICAL: 1)

┌────────────────────────────────────────┬────────────────┬──────────┬────────┬───────────────────┬─────────────────────┬──────────────────────────────────────────────────────────────┐
│                Library                 │ Vulnerability  │ Severity │ Status │ Installed Version │    Fixed Version    │                            Title                             │
├────────────────────────────────────────┼────────────────┼──────────┼────────┼───────────────────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│ @openzeppelin/contracts (package.json) │ CVE-2021-46320 │ HIGH     │ fixed  │ 3.2.0             │ 4.4.1               │ Improper Initialization in OpenZeppelin                      │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2021-46320                   │
│                                        ├────────────────┼──────────┤        ├───────────────────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│                                        │ CVE-2021-39167 │ CRITICAL │        │ 3.3.0             │ 4.3.1, 3.4.2        │ TimelockController vulnerability in OpenZeppelin Contracts   │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2021-39167                   │
│                                        ├────────────────┼──────────┤        │                   ├─────────────────────┼──────────────────────────────────────────────────────────────┤
│                                        │ CVE-2021-46320 │ HIGH     │        │                   │ 4.4.1               │ Improper Initialization in OpenZeppelin                      │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2021-46320                   │
├────────────────────────────────────────┼────────────────┤          │        ├───────────────────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│ axios (package.json)                   │ CVE-2025-27152 │          │        │ 0.21.4            │ 1.8.2, 0.30.0       │ axios: Possible SSRF and Credential Leakage via Absolute URL │
│                                        │                │          │        │                   │                     │ in axios Requests...                                         │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2025-27152                   │
├────────────────────────────────────────┼────────────────┤          │        ├───────────────────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│ cross-spawn (package.json)             │ CVE-2024-21538 │          │        │ 7.0.3             │ 7.0.5, 6.0.6        │ cross-spawn: regular expression denial of service            │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2024-21538                   │
│                                        │                │          │        │                   │                     │                                                              │
│                                        │                │          │        │                   │                     │                                                              │
│                                        │                │          │        │                   │                     │                                                              │
├────────────────────────────────────────┼────────────────┤          │        ├───────────────────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│ semver (package.json)                  │ CVE-2022-25883 │          │        │ 7.3.5             │ 7.5.2, 6.3.1, 5.7.2 │ nodejs-semver: Regular expression denial of service          │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2022-25883                   │
└────────────────────────────────────────┴────────────────┴──────────┴────────┴───────────────────┴─────────────────────┴──────────────────────────────────────────────────────────────┘

@iexec-renovate-app iexec-renovate-app Bot force-pushed the renovate/minor-updates branch from 1cfb7f4 to acf844f Compare May 24, 2025 01:04
@github-actions
Copy link
Copy Markdown

🔒 Trivy Security Scan Results

Click to expand detailed results

For OSS Maintainers: VEX Notice
--------------------------------
If you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement.
VEX allows you to communicate the actual status of vulnerabilities in your project, improving security transparency and reducing false positives for your users.
Learn more and start using VEX: https://aquasecurity.github.io/trivy/v0.57/docs/supply-chain/vex/repo#publishing-vex-documents

To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable.


vuln-image.tar (debian 12.11)
=============================
Total: 0 (HIGH: 0, CRITICAL: 0)


Node.js (node-pkg)
==================
Total: 7 (HIGH: 6, CRITICAL: 1)

┌────────────────────────────────────────┬────────────────┬──────────┬────────┬───────────────────┬─────────────────────┬──────────────────────────────────────────────────────────────┐
│                Library                 │ Vulnerability  │ Severity │ Status │ Installed Version │    Fixed Version    │                            Title                             │
├────────────────────────────────────────┼────────────────┼──────────┼────────┼───────────────────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│ @openzeppelin/contracts (package.json) │ CVE-2021-46320 │ HIGH     │ fixed  │ 3.2.0             │ 4.4.1               │ Improper Initialization in OpenZeppelin                      │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2021-46320                   │
│                                        ├────────────────┼──────────┤        ├───────────────────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│                                        │ CVE-2021-39167 │ CRITICAL │        │ 3.3.0             │ 4.3.1, 3.4.2        │ TimelockController vulnerability in OpenZeppelin Contracts   │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2021-39167                   │
│                                        ├────────────────┼──────────┤        │                   ├─────────────────────┼──────────────────────────────────────────────────────────────┤
│                                        │ CVE-2021-46320 │ HIGH     │        │                   │ 4.4.1               │ Improper Initialization in OpenZeppelin                      │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2021-46320                   │
├────────────────────────────────────────┼────────────────┤          │        ├───────────────────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│ axios (package.json)                   │ CVE-2025-27152 │          │        │ 0.21.4            │ 1.8.2, 0.30.0       │ axios: Possible SSRF and Credential Leakage via Absolute URL │
│                                        │                │          │        │                   │                     │ in axios Requests...                                         │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2025-27152                   │
├────────────────────────────────────────┼────────────────┤          │        ├───────────────────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│ cross-spawn (package.json)             │ CVE-2024-21538 │          │        │ 7.0.3             │ 7.0.5, 6.0.6        │ cross-spawn: regular expression denial of service            │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2024-21538                   │
│                                        │                │          │        │                   │                     │                                                              │
│                                        │                │          │        │                   │                     │                                                              │
│                                        │                │          │        │                   │                     │                                                              │
├────────────────────────────────────────┼────────────────┤          │        ├───────────────────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│ semver (package.json)                  │ CVE-2022-25883 │          │        │ 7.3.5             │ 7.5.2, 6.3.1, 5.7.2 │ nodejs-semver: Regular expression denial of service          │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2022-25883                   │
└────────────────────────────────────────┴────────────────┴──────────┴────────┴───────────────────┴─────────────────────┴──────────────────────────────────────────────────────────────┘

@iexec-renovate-app iexec-renovate-app Bot force-pushed the renovate/minor-updates branch from acf844f to 54d522f Compare May 31, 2025 01:00
@github-actions
Copy link
Copy Markdown

🔒 Trivy Security Scan Results

Click to expand detailed results

For OSS Maintainers: VEX Notice
--------------------------------
If you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement.
VEX allows you to communicate the actual status of vulnerabilities in your project, improving security transparency and reducing false positives for your users.
Learn more and start using VEX: https://aquasecurity.github.io/trivy/v0.57/docs/supply-chain/vex/repo#publishing-vex-documents

To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable.


vuln-image.tar (debian 12.11)
=============================
Total: 27 (HIGH: 27, CRITICAL: 0)

┌────────────────┬────────────────┬──────────┬────────┬───────────────────┬──────────────────┬──────────────────────────────────────────────────────────────┐
│    Library     │ Vulnerability  │ Severity │ Status │ Installed Version │  Fixed Version   │                            Title                             │
├────────────────┼────────────────┼──────────┼────────┼───────────────────┼──────────────────┼──────────────────────────────────────────────────────────────┤
│ libsystemd0    │ CVE-2025-4598  │ HIGH     │ fixed  │ 252.36-1~deb12u1  │ 252.38-1~deb12u1 │ ELSA-2025-20344: systemd security update (IMPORTANT)         │
│                │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2025-4598                    │
├────────────────┤                │          │        │                   │                  │                                                              │
│ libudev1       │                │          │        │                   │                  │                                                              │
│                │                │          │        │                   │                  │                                                              │
├────────────────┼────────────────┤          │        ├───────────────────┼──────────────────┼──────────────────────────────────────────────────────────────┤
│ linux-libc-dev │ CVE-2024-53203 │          │        │ 6.1.137-1         │ 6.1.140-1        │ kernel: usb: typec: fix potential array underflow in         │
│                │                │          │        │                   │                  │ ucsi_ccg_sync_control()                                      │
│                │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2024-53203                   │
│                ├────────────────┤          │        │                   │                  ├──────────────────────────────────────────────────────────────┤
│                │ CVE-2025-37897 │          │        │                   │                  │ kernel: wifi: plfxlc: Remove erroneous assert in             │
│                │                │          │        │                   │                  │ plfxlc_mac_release                                           │
│                │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2025-37897                   │
│                ├────────────────┤          │        │                   │                  ├──────────────────────────────────────────────────────────────┤
│                │ CVE-2025-37909 │          │        │                   │                  │ kernel: net: lan743x: Fix memleak issue when GSO enabled     │
│                │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2025-37909                   │
│                ├────────────────┤          │        │                   │                  ├──────────────────────────────────────────────────────────────┤
│                │ CVE-2025-37911 │          │        │                   │                  │ kernel: bnxt_en: Fix out-of-bound memcpy() during ethtool -w │
│                │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2025-37911                   │
│                ├────────────────┤          │        │                   │                  ├──────────────────────────────────────────────────────────────┤
│                │ CVE-2025-37912 │          │        │                   │                  │ kernel: ice: Check VF VSI Pointer Value in                   │
│                │                │          │        │                   │                  │ ice_vc_add_fdir_fltr()                                       │
│                │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2025-37912                   │
│                ├────────────────┤          │        │                   │                  ├──────────────────────────────────────────────────────────────┤
│                │ CVE-2025-37914 │          │        │                   │                  │ kernel: net_sched: ets: Fix double list add in class with    │
│                │                │          │        │                   │                  │ netem as...                                                  │
│                │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2025-37914                   │
│                ├────────────────┤          │        │                   │                  ├──────────────────────────────────────────────────────────────┤
│                │ CVE-2025-37917 │          │        │                   │                  │ kernel: net: ethernet: mtk-star-emac: fix spinlock recursion │
│                │                │          │        │                   │                  │ issues on rx/tx poll                                         │
│                │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2025-37917                   │
│                ├────────────────┤          │        │                   │                  ├──────────────────────────────────────────────────────────────┤
│                │ CVE-2025-37921 │          │        │                   │                  │ kernel: vxlan: vnifilter: Fix unlocked deletion of default   │
│                │                │          │        │                   │                  │ FDB entry                                                    │
│                │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2025-37921                   │
│                ├────────────────┤          │        │                   │                  ├──────────────────────────────────────────────────────────────┤
│                │ CVE-2025-37923 │          │        │                   │                  │ kernel: tracing: Fix oob write in trace_seq_to_buffer()      │
│                │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2025-37923                   │
│                ├────────────────┤          │        │                   │                  ├──────────────────────────────────────────────────────────────┤
│                │ CVE-2025-37928 │          │        │                   │                  │ kernel: dm-bufio: don't schedule in atomic context           │
│                │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2025-37928                   │
│                ├────────────────┤          │        │                   │                  ├──────────────────────────────────────────────────────────────┤
│                │ CVE-2025-37929 │          │        │                   │                  │ kernel: arm64: errata: Add missing sentinels to Spectre-BHB  │
│                │                │          │        │                   │                  │ MIDR arrays                                                  │
│                │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2025-37929                   │
│                ├────────────────┤          │        │                   │                  ├──────────────────────────────────────────────────────────────┤
│                │ CVE-2025-37932 │          │        │                   │                  │ kernel: sch_htb: make htb_qlen_notify() idempotent           │
│                │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2025-37932                   │
│                ├────────────────┤          │        │                   │                  ├──────────────────────────────────────────────────────────────┤
│                │ CVE-2025-37936 │          │        │                   │                  │ kernel: perf/x86/intel: KVM: Mask PEBS_ENABLE loaded for     │
│                │                │          │        │                   │                  │ guest with vCPU's value.                                     │
│                │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2025-37936                   │
│                ├────────────────┤          │        │                   │                  ├──────────────────────────────────────────────────────────────┤
│                │ CVE-2025-37948 │          │        │                   │                  │ kernel: arm64: bpf: Add BHB mitigation to the epilogue for   │
│                │                │          │        │                   │                  │ cBPF programs...                                             │
│                │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2025-37948                   │
│                ├────────────────┤          │        │                   │                  ├──────────────────────────────────────────────────────────────┤
│                │ CVE-2025-37949 │          │        │                   │                  │ kernel: xenbus: Use kref to track req lifetime               │
│                │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2025-37949                   │
│                ├────────────────┤          │        │                   │                  ├──────────────────────────────────────────────────────────────┤
│                │ CVE-2025-37951 │          │        │                   │                  │ kernel: drm/v3d: Add job to pending list if the reset was    │
│                │                │          │        │                   │                  │ skipped...                                                   │
│                │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2025-37951                   │
│                ├────────────────┤          │        │                   │                  ├──────────────────────────────────────────────────────────────┤
│                │ CVE-2025-37953 │          │        │                   │                  │ kernel: sch_htb: make htb_deactivate() idempotent            │
│                │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2025-37953                   │
│                ├────────────────┤          │        │                   │                  ├──────────────────────────────────────────────────────────────┤
│                │ CVE-2025-37959 │          │        │                   │                  │ kernel: bpf: Scrub packet on bpf_redirect_peer               │
│                │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2025-37959                   │
│                ├────────────────┤          │        │                   │                  ├──────────────────────────────────────────────────────────────┤
│                │ CVE-2025-37961 │          │        │                   │                  │ kernel: ipvs: fix uninit-value for saddr in do_output_route4 │
│                │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2025-37961                   │
│                ├────────────────┤          │        │                   │                  ├──────────────────────────────────────────────────────────────┤
│                │ CVE-2025-37963 │          │        │                   │                  │ kernel: arm64: bpf: Only mitigate cBPF programs loaded by    │
│                │                │          │        │                   │                  │ unprivileged users                                           │
│                │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2025-37963                   │
│                ├────────────────┤          │        │                   │                  ├──────────────────────────────────────────────────────────────┤
│                │ CVE-2025-37964 │          │        │                   │                  │ kernel: x86/mm: Eliminate window where TLB flushes may be    │
│                │                │          │        │                   │                  │ inadvertently skipped                                        │
│                │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2025-37964                   │
│                ├────────────────┤          │        │                   │                  ├──────────────────────────────────────────────────────────────┤
│                │ CVE-2025-37967 │          │        │                   │                  │ kernel: usb: typec: ucsi: displayport: Fix deadlock          │
│                │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2025-37967                   │
│                ├────────────────┤          │        │                   │                  ├──────────────────────────────────────────────────────────────┤
│                │ CVE-2025-37969 │          │        │                   │                  │ kernel: iio: imu: st_lsm6dsx: fix possible lockup in         │
│                │                │          │        │                   │                  │ st_lsm6dsx_read_tagged_fifo                                  │
│                │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2025-37969                   │
│                ├────────────────┤          │        │                   │                  ├──────────────────────────────────────────────────────────────┤
│                │ CVE-2025-37970 │          │        │                   │                  │ kernel: iio: imu: st_lsm6dsx: fix possible lockup in         │
│                │                │          │        │                   │                  │ st_lsm6dsx_read_fifo                                         │
│                │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2025-37970                   │
│                ├────────────────┤          │        │                   │                  ├──────────────────────────────────────────────────────────────┤
│                │ CVE-2025-37990 │          │        │                   │                  │ kernel: wifi: brcm80211: fmac: Add error handling for        │
│                │                │          │        │                   │                  │ brcmf_usb_dl_writeimage()                                    │
│                │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2025-37990                   │
└────────────────┴────────────────┴──────────┴────────┴───────────────────┴──────────────────┴──────────────────────────────────────────────────────────────┘

Node.js (node-pkg)
==================
Total: 7 (HIGH: 6, CRITICAL: 1)

┌────────────────────────────────────────┬────────────────┬──────────┬────────┬───────────────────┬─────────────────────┬──────────────────────────────────────────────────────────────┐
│                Library                 │ Vulnerability  │ Severity │ Status │ Installed Version │    Fixed Version    │                            Title                             │
├────────────────────────────────────────┼────────────────┼──────────┼────────┼───────────────────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│ @openzeppelin/contracts (package.json) │ CVE-2021-46320 │ HIGH     │ fixed  │ 3.2.0             │ 4.4.1               │ Improper Initialization in OpenZeppelin                      │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2021-46320                   │
│                                        ├────────────────┼──────────┤        ├───────────────────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│                                        │ CVE-2021-39167 │ CRITICAL │        │ 3.3.0             │ 4.3.1, 3.4.2        │ TimelockController vulnerability in OpenZeppelin Contracts   │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2021-39167                   │
│                                        ├────────────────┼──────────┤        │                   ├─────────────────────┼──────────────────────────────────────────────────────────────┤
│                                        │ CVE-2021-46320 │ HIGH     │        │                   │ 4.4.1               │ Improper Initialization in OpenZeppelin                      │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2021-46320                   │
├────────────────────────────────────────┼────────────────┤          │        ├───────────────────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│ axios (package.json)                   │ CVE-2025-27152 │          │        │ 0.21.4            │ 1.8.2, 0.30.0       │ axios: Possible SSRF and Credential Leakage via Absolute URL │
│                                        │                │          │        │                   │                     │ in axios Requests...                                         │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2025-27152                   │
├────────────────────────────────────────┼────────────────┤          │        ├───────────────────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│ cross-spawn (package.json)             │ CVE-2024-21538 │          │        │ 7.0.3             │ 7.0.5, 6.0.6        │ cross-spawn: regular expression denial of service            │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2024-21538                   │
│                                        │                │          │        │                   │                     │                                                              │
│                                        │                │          │        │                   │                     │                                                              │
│                                        │                │          │        │                   │                     │                                                              │
├────────────────────────────────────────┼────────────────┤          │        ├───────────────────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│ semver (package.json)                  │ CVE-2022-25883 │          │        │ 7.3.5             │ 7.5.2, 6.3.1, 5.7.2 │ nodejs-semver: Regular expression denial of service          │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2022-25883                   │
└────────────────────────────────────────┴────────────────┴──────────┴────────┴───────────────────┴─────────────────────┴──────────────────────────────────────────────────────────────┘

@iexec-renovate-app iexec-renovate-app Bot force-pushed the renovate/minor-updates branch from 54d522f to 61f4b02 Compare June 7, 2025 01:02
@github-actions
Copy link
Copy Markdown

github-actions Bot commented Jun 7, 2025

🔒 Trivy Security Scan Results

Click to expand detailed results

For OSS Maintainers: VEX Notice
--------------------------------
If you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement.
VEX allows you to communicate the actual status of vulnerabilities in your project, improving security transparency and reducing false positives for your users.
Learn more and start using VEX: https://aquasecurity.github.io/trivy/v0.57/docs/supply-chain/vex/repo#publishing-vex-documents

To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable.


vuln-image.tar (debian 12.11)
=============================
Total: 25 (HIGH: 25, CRITICAL: 0)

┌────────────────┬────────────────┬──────────┬────────┬───────────────────┬───────────────┬──────────────────────────────────────────────────────────────┐
│    Library     │ Vulnerability  │ Severity │ Status │ Installed Version │ Fixed Version │                            Title                             │
├────────────────┼────────────────┼──────────┼────────┼───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ linux-libc-dev │ CVE-2024-53203 │ HIGH     │ fixed  │ 6.1.137-1         │ 6.1.140-1     │ kernel: usb: typec: fix potential array underflow in         │
│                │                │          │        │                   │               │ ucsi_ccg_sync_control()                                      │
│                │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2024-53203                   │
│                ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│                │ CVE-2025-37897 │          │        │                   │               │ kernel: wifi: plfxlc: Remove erroneous assert in             │
│                │                │          │        │                   │               │ plfxlc_mac_release                                           │
│                │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2025-37897                   │
│                ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│                │ CVE-2025-37909 │          │        │                   │               │ kernel: net: lan743x: Fix memleak issue when GSO enabled     │
│                │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2025-37909                   │
│                ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│                │ CVE-2025-37911 │          │        │                   │               │ kernel: bnxt_en: Fix out-of-bound memcpy() during ethtool -w │
│                │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2025-37911                   │
│                ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│                │ CVE-2025-37912 │          │        │                   │               │ kernel: ice: Check VF VSI Pointer Value in                   │
│                │                │          │        │                   │               │ ice_vc_add_fdir_fltr()                                       │
│                │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2025-37912                   │
│                ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│                │ CVE-2025-37914 │          │        │                   │               │ kernel: net_sched: ets: Fix double list add in class with    │
│                │                │          │        │                   │               │ netem as...                                                  │
│                │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2025-37914                   │
│                ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│                │ CVE-2025-37917 │          │        │                   │               │ kernel: net: ethernet: mtk-star-emac: fix spinlock recursion │
│                │                │          │        │                   │               │ issues on rx/tx poll                                         │
│                │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2025-37917                   │
│                ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│                │ CVE-2025-37921 │          │        │                   │               │ kernel: vxlan: vnifilter: Fix unlocked deletion of default   │
│                │                │          │        │                   │               │ FDB entry                                                    │
│                │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2025-37921                   │
│                ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│                │ CVE-2025-37923 │          │        │                   │               │ kernel: tracing: Fix oob write in trace_seq_to_buffer()      │
│                │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2025-37923                   │
│                ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│                │ CVE-2025-37928 │          │        │                   │               │ kernel: dm-bufio: don't schedule in atomic context           │
│                │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2025-37928                   │
│                ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│                │ CVE-2025-37929 │          │        │                   │               │ kernel: arm64: errata: Add missing sentinels to Spectre-BHB  │
│                │                │          │        │                   │               │ MIDR arrays                                                  │
│                │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2025-37929                   │
│                ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│                │ CVE-2025-37932 │          │        │                   │               │ kernel: sch_htb: make htb_qlen_notify() idempotent           │
│                │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2025-37932                   │
│                ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│                │ CVE-2025-37936 │          │        │                   │               │ kernel: perf/x86/intel: KVM: Mask PEBS_ENABLE loaded for     │
│                │                │          │        │                   │               │ guest with vCPU's value.                                     │
│                │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2025-37936                   │
│                ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│                │ CVE-2025-37948 │          │        │                   │               │ kernel: arm64: bpf: Add BHB mitigation to the epilogue for   │
│                │                │          │        │                   │               │ cBPF programs...                                             │
│                │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2025-37948                   │
│                ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│                │ CVE-2025-37949 │          │        │                   │               │ kernel: xenbus: Use kref to track req lifetime               │
│                │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2025-37949                   │
│                ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│                │ CVE-2025-37951 │          │        │                   │               │ kernel: drm/v3d: Add job to pending list if the reset was    │
│                │                │          │        │                   │               │ skipped...                                                   │
│                │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2025-37951                   │
│                ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│                │ CVE-2025-37953 │          │        │                   │               │ kernel: sch_htb: make htb_deactivate() idempotent            │
│                │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2025-37953                   │
│                ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│                │ CVE-2025-37959 │          │        │                   │               │ kernel: bpf: Scrub packet on bpf_redirect_peer               │
│                │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2025-37959                   │
│                ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│                │ CVE-2025-37961 │          │        │                   │               │ kernel: ipvs: fix uninit-value for saddr in do_output_route4 │
│                │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2025-37961                   │
│                ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│                │ CVE-2025-37963 │          │        │                   │               │ kernel: arm64: bpf: Only mitigate cBPF programs loaded by    │
│                │                │          │        │                   │               │ unprivileged users                                           │
│                │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2025-37963                   │
│                ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│                │ CVE-2025-37964 │          │        │                   │               │ kernel: x86/mm: Eliminate window where TLB flushes may be    │
│                │                │          │        │                   │               │ inadvertently skipped                                        │
│                │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2025-37964                   │
│                ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│                │ CVE-2025-37967 │          │        │                   │               │ kernel: usb: typec: ucsi: displayport: Fix deadlock          │
│                │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2025-37967                   │
│                ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│                │ CVE-2025-37969 │          │        │                   │               │ kernel: iio: imu: st_lsm6dsx: fix possible lockup in         │
│                │                │          │        │                   │               │ st_lsm6dsx_read_tagged_fifo                                  │
│                │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2025-37969                   │
│                ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│                │ CVE-2025-37970 │          │        │                   │               │ kernel: iio: imu: st_lsm6dsx: fix possible lockup in         │
│                │                │          │        │                   │               │ st_lsm6dsx_read_fifo                                         │
│                │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2025-37970                   │
│                ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│                │ CVE-2025-37990 │          │        │                   │               │ kernel: wifi: brcm80211: fmac: Add error handling for        │
│                │                │          │        │                   │               │ brcmf_usb_dl_writeimage()                                    │
│                │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2025-37990                   │
└────────────────┴────────────────┴──────────┴────────┴───────────────────┴───────────────┴──────────────────────────────────────────────────────────────┘

Node.js (node-pkg)
==================
Total: 7 (HIGH: 6, CRITICAL: 1)

┌────────────────────────────────────────┬────────────────┬──────────┬────────┬───────────────────┬─────────────────────┬──────────────────────────────────────────────────────────────┐
│                Library                 │ Vulnerability  │ Severity │ Status │ Installed Version │    Fixed Version    │                            Title                             │
├────────────────────────────────────────┼────────────────┼──────────┼────────┼───────────────────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│ @openzeppelin/contracts (package.json) │ CVE-2021-46320 │ HIGH     │ fixed  │ 3.2.0             │ 4.4.1               │ Improper Initialization in OpenZeppelin                      │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2021-46320                   │
│                                        ├────────────────┼──────────┤        ├───────────────────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│                                        │ CVE-2021-39167 │ CRITICAL │        │ 3.3.0             │ 4.3.1, 3.4.2        │ TimelockController vulnerability in OpenZeppelin Contracts   │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2021-39167                   │
│                                        ├────────────────┼──────────┤        │                   ├─────────────────────┼──────────────────────────────────────────────────────────────┤
│                                        │ CVE-2021-46320 │ HIGH     │        │                   │ 4.4.1               │ Improper Initialization in OpenZeppelin                      │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2021-46320                   │
├────────────────────────────────────────┼────────────────┤          │        ├───────────────────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│ axios (package.json)                   │ CVE-2025-27152 │          │        │ 0.21.4            │ 1.8.2, 0.30.0       │ axios: Possible SSRF and Credential Leakage via Absolute URL │
│                                        │                │          │        │                   │                     │ in axios Requests...                                         │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2025-27152                   │
├────────────────────────────────────────┼────────────────┤          │        ├───────────────────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│ cross-spawn (package.json)             │ CVE-2024-21538 │          │        │ 7.0.3             │ 7.0.5, 6.0.6        │ cross-spawn: regular expression denial of service            │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2024-21538                   │
│                                        │                │          │        │                   │                     │                                                              │
│                                        │                │          │        │                   │                     │                                                              │
│                                        │                │          │        │                   │                     │                                                              │
├────────────────────────────────────────┼────────────────┤          │        ├───────────────────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│ semver (package.json)                  │ CVE-2022-25883 │          │        │ 7.3.5             │ 7.5.2, 6.3.1, 5.7.2 │ nodejs-semver: Regular expression denial of service          │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2022-25883                   │
└────────────────────────────────────────┴────────────────┴──────────┴────────┴───────────────────┴─────────────────────┴──────────────────────────────────────────────────────────────┘

@iexec-renovate-app iexec-renovate-app Bot force-pushed the renovate/minor-updates branch from 61f4b02 to 13c83a1 Compare June 14, 2025 01:05
@github-actions
Copy link
Copy Markdown

🔒 Trivy Security Scan Results

Click to expand detailed results

For OSS Maintainers: VEX Notice
--------------------------------
If you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement.
VEX allows you to communicate the actual status of vulnerabilities in your project, improving security transparency and reducing false positives for your users.
Learn more and start using VEX: https://aquasecurity.github.io/trivy/v0.57/docs/supply-chain/vex/repo#publishing-vex-documents

To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable.


vuln-image.tar (debian 12.11)
=============================
Total: 0 (HIGH: 0, CRITICAL: 0)


Node.js (node-pkg)
==================
Total: 7 (HIGH: 6, CRITICAL: 1)

┌────────────────────────────────────────┬────────────────┬──────────┬────────┬───────────────────┬─────────────────────┬──────────────────────────────────────────────────────────────┐
│                Library                 │ Vulnerability  │ Severity │ Status │ Installed Version │    Fixed Version    │                            Title                             │
├────────────────────────────────────────┼────────────────┼──────────┼────────┼───────────────────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│ @openzeppelin/contracts (package.json) │ CVE-2021-46320 │ HIGH     │ fixed  │ 3.2.0             │ 4.4.1               │ Improper Initialization in OpenZeppelin                      │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2021-46320                   │
│                                        ├────────────────┼──────────┤        ├───────────────────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│                                        │ CVE-2021-39167 │ CRITICAL │        │ 3.3.0             │ 4.3.1, 3.4.2        │ TimelockController vulnerability in OpenZeppelin Contracts   │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2021-39167                   │
│                                        ├────────────────┼──────────┤        │                   ├─────────────────────┼──────────────────────────────────────────────────────────────┤
│                                        │ CVE-2021-46320 │ HIGH     │        │                   │ 4.4.1               │ Improper Initialization in OpenZeppelin                      │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2021-46320                   │
├────────────────────────────────────────┼────────────────┤          │        ├───────────────────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│ axios (package.json)                   │ CVE-2025-27152 │          │        │ 0.21.4            │ 1.8.2, 0.30.0       │ axios: Possible SSRF and Credential Leakage via Absolute URL │
│                                        │                │          │        │                   │                     │ in axios Requests...                                         │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2025-27152                   │
├────────────────────────────────────────┼────────────────┤          │        ├───────────────────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│ cross-spawn (package.json)             │ CVE-2024-21538 │          │        │ 7.0.3             │ 7.0.5, 6.0.6        │ cross-spawn: regular expression denial of service            │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2024-21538                   │
│                                        │                │          │        │                   │                     │                                                              │
│                                        │                │          │        │                   │                     │                                                              │
│                                        │                │          │        │                   │                     │                                                              │
├────────────────────────────────────────┼────────────────┤          │        ├───────────────────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│ semver (package.json)                  │ CVE-2022-25883 │          │        │ 7.3.5             │ 7.5.2, 6.3.1, 5.7.2 │ nodejs-semver: Regular expression denial of service          │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2022-25883                   │
└────────────────────────────────────────┴────────────────┴──────────┴────────┴───────────────────┴─────────────────────┴──────────────────────────────────────────────────────────────┘

iexec-voucher-subgraph/node_modules/@esbuild/linux-x64/bin/esbuild (gobinary)
=============================================================================
Total: 1 (HIGH: 1, CRITICAL: 0)

┌─────────┬────────────────┬──────────┬────────┬───────────────────┬─────────────────┬──────────────────────────────────────────────────────┐
│ Library │ Vulnerability  │ Severity │ Status │ Installed Version │  Fixed Version  │                        Title                         │
├─────────┼────────────────┼──────────┼────────┼───────────────────┼─────────────────┼──────────────────────────────────────────────────────┤
│ stdlib  │ CVE-2025-22874 │ HIGH     │ fixed  │ v1.23.7           │ 1.23.10, 1.24.4 │ crypto/x509: Usage of ExtKeyUsageAny disables policy │
│         │                │          │        │                   │                 │ validation in crypto/x509                            │
│         │                │          │        │                   │                 │ https://avd.aquasec.com/nvd/cve-2025-22874           │
└─────────┴────────────────┴──────────┴────────┴───────────────────┴─────────────────┴──────────────────────────────────────────────────────┘

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants