Skip to content

Conversation

iexec-renovate-app[bot]
Copy link
Contributor

@iexec-renovate-app iexec-renovate-app bot commented Apr 9, 2025

This PR contains the following updates:

Package Type Update Change
@graphprotocol/graph-cli (source) devDependencies minor ^0.96.0 -> ^0.97.0
@graphprotocol/graph-ts (source) devDependencies minor 0.35.1 -> 0.38.1
ethers (source) devDependencies minor 6.13.5 -> 6.14.4
ghcr.io/foundry-rs/foundry minor v1.0.0 -> v1.2.3
graphprotocol/graph-node minor v0.37.0 -> v0.39.1
ipfs/kubo minor v0.34.1 -> v0.35.0
node (source) minor 20.18 -> 20.19
postgres minor 16.8 -> 16.9
testcontainers devDependencies minor 10.24.2 -> 10.28.0
tsx (source) devDependencies minor 4.19.3 -> 4.20.3
zod (source) devDependencies minor 3.24.3 -> 3.25.64

Release Notes

graphprotocol/graph-tooling (@​graphprotocol/graph-cli)

v0.97.1

Compare Source

Patch Changes

v0.97.0

Compare Source

Minor Changes
Patch Changes
graphprotocol/graph-tooling (@​graphprotocol/graph-ts)

v0.38.1

Compare Source

Patch Changes

v0.38.0

Compare Source

Minor Changes

v0.37.0

Compare Source

Minor Changes

v0.36.0

Compare Source

Minor Changes
ethers-io/ethers.js (ethers)

v6.14.4

Compare Source

  • Fixed serialization of EIP-7702 transactions with leading 0-bytes (#​4916; 389dc03).

v6.14.3

Compare Source

  • Fixed non-normalized yParity on EIP-7702 JSON-RPC responses (#​4985; a8803ca).

v6.14.2

Compare Source

v6.14.1

Compare Source

  • Fix JSON-RPC authorizationList signature entries encoded as DATA instead of QUANTITY values (#​4916; 135db72).

v6.14.0

Compare Source

  • Remove BlockscoutProvider temporarily until custom error issues are fixed (805a8b3).

v6.13.7

Compare Source

  • Fix FallbackProvider coalescing call exceptions when backends return slightly different error message (268a0ac).

v6.13.6

Compare Source

  • Implicitly use EIP-7702 if authorizationList is given and non-empty (#​4961; e7c1bdf).
    • Initial EIP-7702 support (#​4916; db490e1).
    • Added support for to override fetch init options in the Browser (#​3895; 844ae68).
    • Added EIP-6963 discovery to BrowserProvider (f5469dd).
    • Merge: e5036e7 158f5d0 Merge branch 'main' into wip-v6.14 (e7165a6).
    • tests: squelch the noisy runtime console API event in browser tests (79428fd).
    • tests: added faucet key environment for browser CI tests (27d42af).
    • tests: better runtime exception output for browser tests (0beed25).
    • tests: added more debug endpoints to browser tests (33bbf66).
    • tests: added JSON-RPC tests to web browser CI (1c0c23c).
    • tests: added browser tests for sending (afd613a).
    • tests: debugging browser tests failing to launch (d1baa74).
    • tests: fix assert call for browser assert (1806bbd).
    • tests: inlcude more node tests in the browser tests (92fd5d1).
    • tests: move more tests to dev network (996f30c).
    • tests: debugging CI browser failure (ce7212d).
    • tests: debugging CI browser failure (f1821a6).
    • tests: debugging CI browser failure (cc9119c).
    • tests: debugging CI browser failure (3ac33f9).
    • tests: debugging CI browser failure (25b11ee).
    • tests: debug CI failing (3bcbcae).
    • tests: added circular support to browser-safe inspect (3854b39).
    • tests: added browser-safe inspect for tests (e299a31).
    • tests: fix for browser CI tests (74a68bc).
    • tests: adding debug info to local JsonPrcProvider (c508538).
    • tests: temporarily remove QuickNode (499ed8c).
    • Accept modern KZG library API while exposing legacy API (#​4841; e5036e7).
    • Added CommunityResourcable to exports (#​4776; bca8d1b).
foundry-rs/foundry (ghcr.io/foundry-rs/foundry)

v1.2.3

Compare Source

Foundry v1.2.3

Foundry v1.2.3 is a bugfix release for anvil and cast call command.

Anvil Fixes

  • fix(anvil): guard against the blockchain advancing while checking latest block (#​10709) by @​alexghr

Cast Fixes

Changelog:

foundry-rs/foundry@v1.2.2...v1.2.3

Foundry v1.2.2

Foundry v1.2.2 is a bugfix release for forge formatter and cast hash-message command.

Forge Fixes

Cast Fixes

Changelog:

foundry-rs/foundry@v1.2.1...v1.2.2

Foundry v1.2.1

Foundry v1.2.1 is a bugfix release for forge formatter, forked tests and vm.cool cheatcode.

Forge Fixes

Changelog:

foundry-rs/foundry@v1.2.0...v1.2.1

Foundry v1.2.0

This release comes with support for Etherscan's V2 API, forge script execution protection, performance improvement of Anvil block mining and several fixes for EIP-7702 cheatcodes.

Etherscan v2 API support

⚠️ At the end of May Etherscan will deprecate its V1 API. With the new V2 API Etherscan enables users to use a single API key for all chains to greatly simplify the management of API keys for multichain Foundry codebases. Any API key created on etherscan.io (mainnet) can be used for all chains. API keys created on deployments of Etherscan on other chains (e.g. BaseScan, Arbiscan, etc..) will likely stop working. Please see the Etherscan v2 documenation for additional details. Whilst Foundry still supports V1 API keys until deprecation it is highly recommended to migrate now as follows in your foundry.toml:

[etherscan]
sepolia = { key = "$YOUR_V2_COMPATIBLE_API_KEY" }

Etherscan v1 API and keys are still supported by specifying the global etherscan_api_version = "v1" config, or per chain api-version as follows in your foundry.toml:

[etherscan]
base-sepolia = { key = "$YOUR_V1_API_KEY", api-version = "v1" }

Performance

Consistent Anvil blocks mining

Mining a block in Anvil is a blocking operation because it can take a relatively long time (and can be significantly longer in forking mode due to rpc requests). Until this version, the mining block tasks were not spawned as blocking tasks, and that could cause state inconsistencies like seen in Cow protocol integration tests failures. Foundry v1.2.0 changes the way blocks are mined in Anvil and ensures consistency by spawning request handlers as blocking tasks.

Forge script execution protection

In order to protect against coding errors that could lead to undesired transactions and transfer of funds to script address itself, this version comes with execution protection feature which reverts execution if address(this) is used. The protection is enabled by default and can be turned off by setting as follows in foundry.toml:

script_execution_protection = false

Anvil Features

Anvil Fixes

Cast Features

Cast Fixes## Anvil Features

Anvil Fixes

Cast Features

Cast Fixes

Forge Features

Forge Fixes

Other

Full Changelog:

foundry-rs/foundry@v1.1.0...v1.2.3

Forge Features

Forge Fixes

Other

Full Changelog:

foundry-rs/foundry@v1.1.0...v1.2.0

v1.2.2

Compare Source

Foundry v1.2.2

Foundry v1.2.2 is a bugfix release for forge formatter and cast hash-message command.

Forge Fixes

Cast Fixes

Changelog:

foundry-rs/foundry@v1.2.1...v1.2.2

Foundry v1.2.1

Foundry v1.2.1 is a bugfix release for forge formatter, forked tests and vm.cool cheatcode.

Forge Fixes

Changelog:

foundry-rs/foundry@v1.2.0...v1.2.1

Foundry v1.2.0

This release comes with support for Etherscan's V2 API, forge script execution protection, performance improvement of Anvil block mining and several fixes for EIP-7702 cheatcodes.

Etherscan v2 API support

⚠️ At the end of May Etherscan will deprecate its V1 API. With the new V2 API Etherscan enables users to use a single API key for all chains to greatly simplify the management of API keys for multichain Foundry codebases. Any API key created on etherscan.io (mainnet) can be used for all chains. API keys created on deployments of Etherscan on other chains (e.g. BaseScan, Arbiscan, etc..) will likely stop working. Please see the Etherscan v2 documenation for additional details. Whilst Foundry still supports V1 API keys until deprecation it is highly recommended to migrate now as follows in your foundry.toml:

[etherscan]
sepolia = { key = "$YOUR_V2_COMPATIBLE_API_KEY" }

Etherscan v1 API and keys are still supported by specifying the global etherscan_api_version = "v1" config, or per chain api-version as follows in your foundry.toml:

[etherscan]
base-sepolia = { key = "$YOUR_V1_API_KEY", api-version = "v1" }

Performance

Consistent Anvil blocks mining

Mining a block in Anvil is a blocking operation because it can take a relatively long time (and can be significantly longer in forking mode due to rpc requests). Until this version, the mining block tasks were not spawned as blocking tasks, and that could cause state inconsistencies like seen in Cow protocol integration tests failures. Foundry v1.2.0 changes the way blocks are mined in Anvil and ensures consistency by spawning request handlers as blocking tasks.

Forge script execution protection

In order to protect against coding errors that could lead to undesired transactions and transfer of funds to script address itself, this version comes with execution protection feature which reverts execution if address(this) is used. The protection is enabled by default and can be turned off by setting as follows in foundry.toml:

script_execution_protection = false

Anvil Features

Anvil Fixes

Cast Features

Cast Fixes

Forge Features

Forge Fixes


Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.


  • If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot.

@iexec-renovate-app iexec-renovate-app bot force-pushed the renovate/minor-updates branch 3 times, most recently from 445e358 to 5ad5ccd Compare April 10, 2025 15:23
@iexec-renovate-app iexec-renovate-app bot force-pushed the renovate/minor-updates branch 2 times, most recently from 6a9463f to e3a22dc Compare April 19, 2025 00:37
@iexec-renovate-app iexec-renovate-app bot force-pushed the renovate/minor-updates branch from e3a22dc to 276d7cb Compare April 26, 2025 00:38
* Add Docker support and environment setup for poco-subgraph

- Introduced .dockerignore and Dockerfile for containerization.
- Updated networks.json with new addresses and start blocks.
- Enhanced package.json with new scripts for cleaning and managing the build process.
- Created .gitignore for test-stack to exclude .env files.
- Added docker-compose.yml to define services for the test environment.
- Implemented prepare-test-env.js for dynamic environment variable generation.
- Removed tsconfig.json as it is no longer needed.

* Update CHANGELOG and README with Docker subgraph deployer details

* Fix Docker run command to use correct image name for poco-subgraph-deployer

* Add PR number in changelog

* Remove unused 'fork-test' network configuration and update Docker Compose to use dynamic NETWORK_NAME for Ethereum service

* feat: add typechain generation script and update dependencies

- Added a new script to generate TypeChain types for ethers-v6 in package.json.
- Updated the start-test-stack script to ensure proper environment setup.
- Modified the itest script to include NETWORK_NAME in the environment.
- Removed unused callHandlers from subgraph.yaml.
- Enhanced docker-compose.yml to include a stack-ready service for better orchestration.
- Updated prepare-test-env.js to conditionally update networks.json based on NETWORK_NAME.
- Introduced tsconfig.json for TypeScript configuration with strict settings.

* docs: update CHANGELOG to include README section for Docker-based subgraph deployer

* chore: update .gitignore to include test-stack/.env and remove redundant .gitignore file

* test: update integration test description to reflect app indexing functionality

* refactor: restructure prepare-test-env.js to improve block number fetching and environment file creation

* fix: simplify itest script by removing DEBUG flag

* fix: update start-test-stack script to use export for NETWORK_NAME

* Update test-stack/prepare-test-env.js

Co-authored-by: gfournieriExec <[email protected]>

* refactor: streamline package.json scripts by removing redundant clean and codegen commands

* refactor: update build and test scripts for consistency and clarity

* fix: simplify remove drone logic

* fix: ensure typechain generation runs before starting test stack

* refactor: simplify README instructions for local development and testing

* fix: reorder unit test execution in CI workflow and update README for build instructions

* Remove unused files (#42)

* Remove obsolete Docker configurations, environment files, and subgraph definitions for bellecour, test, and viviani. Refactor unit tests for IexecCategoryManager and IexecPoco, consolidating mock utilities and event parameter builders into a unified structure.

* refactor:github-action-ci (#43)

* chore: update GitHub workflows for coverage, deployment, and testing

* refactor: add formatting scripts and .prettierignore for code consistency

* chore: update dependencies in package.json

* fix: correct paths in .gitignore for test artifacts

* feature/migrate-integration-tests (#44)

* Feature/remove dead handler (#45)

* fix: Fix Subgraph deployment (#47)

* refactor: update CI workflow to include health checks and integration tests, remove obsolete Jenkinsfile

* fix: update fork URL and block number retrieval in CI workflow

* fix: update command options and environment variable retrieval in CI workflow

* fix: correct health check options and update fork URL retrieval in CI workflow

* fix: update IPFS image and health check commands in CI workflow

* fix: update CI workflow to include genesis block retrieval and health checks for Graph Node

* fix: update IPFS image to use kubo version in docker-compose

* fix: retrieve fork URL and block number

* fix: remove blockchain-fork service configuration from CI workflow

* fix: update fetch block number to use static values and add IPFS readiness check

* fix: remove code generation step from README

* fix: remove unused services and streamline CI workflow

* fix: update FORK_URL to use the correct endpoint for integration tests

* fix: uncomment steps for installing dependencies, checking format, building, and running unit tests in CI workflow

* fix: uncomment steps for preparing local stack environment and update FORK_BLOCK in test environment setup

* fix: update fetch block step to source environment variables and use dynamic values for FORK_URL and FORK_BLOCK

* fix: add NETWORK_NAME environment variable to prepare local stack environment step

* fix: update fetch block step to source the correct environment file

* fix: remove .idea directory from .gitignore

* fix: reorder build step to occur before running unit tests

* fix: reorder steps to run unit tests after build in CI workflow

* fix: move NETWORK_NAME environment variable to the job level in CI workflow

* Update test-stack/prepare-test-env.ts

Co-authored-by: Zied Guesmi <[email protected]>

* fix: update changelog for integration tests migration to GitHub Actions

* fix: streamline test stack preparation in CI workflow (#46)

* fix: remove NETWORK_NAME environment variable from job level in CI workflow

* fix: update .env generation message in prepare-test-env script

* fix: update integration test structure and add .env.template file

* fix: add missing network configurations for avalancheFuji and arbitrumSepolia

* fix: add Arbitrum & Avalanche network to changelog

* fix: add dotenv and zod to package.json and package-lock.json; create env.ts for environment variable validation

* fix: update test:unit script to include 'unit' argument for clarity

* fix: update startBlock values and rename avalancheFuji to fuji in networks.json

* feat: add Protocol entity to Core data source in subgraph.yaml

* fix: update test:e2e script to specify test file pattern

* fix: downgrade @graphprotocol/graph-ts to version 0.35.1 in package.json and package-lock.json

* feat: add dotenv-cli dependency and update build scripts to use dotenv

---------

Co-authored-by: Ugo Mignon <[email protected]>
Co-authored-by: Zied Guesmi <[email protected]>

---------

Co-authored-by: gfournieriExec <[email protected]>
Co-authored-by: Ugo Mignon <[email protected]>
Co-authored-by: Zied Guesmi <[email protected]>
@iexec-renovate-app iexec-renovate-app bot force-pushed the renovate/minor-updates branch from 276d7cb to f613c11 Compare May 3, 2025 00:39
@iexec-renovate-app iexec-renovate-app bot changed the title Update minor updates 📉 chore(deps): update minor updates 📉 May 3, 2025
Copy link

github-actions bot commented May 3, 2025

🔒 Trivy Security Scan Results

Click to expand detailed results

For OSS Maintainers: VEX Notice
--------------------------------
If you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement.
VEX allows you to communicate the actual status of vulnerabilities in your project, improving security transparency and reducing false positives for your users.
Learn more and start using VEX: https://aquasecurity.github.io/trivy/v0.57/docs/supply-chain/vex/repo#publishing-vex-documents

To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable.


vuln-image.tar (debian 12.10)
=============================
Total: 0 (HIGH: 0, CRITICAL: 0)


Node.js (node-pkg)
==================
Total: 7 (HIGH: 6, CRITICAL: 1)

┌────────────────────────────────────────┬────────────────┬──────────┬────────┬───────────────────┬─────────────────────┬──────────────────────────────────────────────────────────────┐
│                Library                 │ Vulnerability  │ Severity │ Status │ Installed Version │    Fixed Version    │                            Title                             │
├────────────────────────────────────────┼────────────────┼──────────┼────────┼───────────────────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│ @openzeppelin/contracts (package.json) │ CVE-2021-46320 │ HIGH     │ fixed  │ 3.2.0             │ 4.4.1               │ Improper Initialization in OpenZeppelin                      │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2021-46320                   │
│                                        ├────────────────┼──────────┤        ├───────────────────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│                                        │ CVE-2021-39167 │ CRITICAL │        │ 3.3.0             │ 4.3.1, 3.4.2        │ TimelockController vulnerability in OpenZeppelin Contracts   │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2021-39167                   │
│                                        ├────────────────┼──────────┤        │                   ├─────────────────────┼──────────────────────────────────────────────────────────────┤
│                                        │ CVE-2021-46320 │ HIGH     │        │                   │ 4.4.1               │ Improper Initialization in OpenZeppelin                      │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2021-46320                   │
├────────────────────────────────────────┼────────────────┤          │        ├───────────────────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│ axios (package.json)                   │ CVE-2025-27152 │          │        │ 0.21.4            │ 1.8.2, 0.30.0       │ axios: Possible SSRF and Credential Leakage via Absolute URL │
│                                        │                │          │        │                   │                     │ in axios Requests...                                         │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2025-27152                   │
├────────────────────────────────────────┼────────────────┤          │        ├───────────────────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│ cross-spawn (package.json)             │ CVE-2024-21538 │          │        │ 7.0.3             │ 7.0.5, 6.0.6        │ cross-spawn: regular expression denial of service            │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2024-21538                   │
│                                        │                │          │        │                   │                     │                                                              │
│                                        │                │          │        │                   │                     │                                                              │
│                                        │                │          │        │                   │                     │                                                              │
├────────────────────────────────────────┼────────────────┤          │        ├───────────────────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│ semver (package.json)                  │ CVE-2022-25883 │          │        │ 7.3.5             │ 7.5.2, 6.3.1, 5.7.2 │ nodejs-semver: Regular expression denial of service          │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2022-25883                   │
└────────────────────────────────────────┴────────────────┴──────────┴────────┴───────────────────┴─────────────────────┴──────────────────────────────────────────────────────────────┘

@iexec-renovate-app iexec-renovate-app bot force-pushed the renovate/minor-updates branch from f613c11 to b7e5cf9 Compare May 10, 2025 00:33
Copy link

🔒 Trivy Security Scan Results

Click to expand detailed results

For OSS Maintainers: VEX Notice
--------------------------------
If you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement.
VEX allows you to communicate the actual status of vulnerabilities in your project, improving security transparency and reducing false positives for your users.
Learn more and start using VEX: https://aquasecurity.github.io/trivy/v0.57/docs/supply-chain/vex/repo#publishing-vex-documents

To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable.


vuln-image.tar (debian 12.10)
=============================
Total: 0 (HIGH: 0, CRITICAL: 0)


Node.js (node-pkg)
==================
Total: 7 (HIGH: 6, CRITICAL: 1)

┌────────────────────────────────────────┬────────────────┬──────────┬────────┬───────────────────┬─────────────────────┬──────────────────────────────────────────────────────────────┐
│                Library                 │ Vulnerability  │ Severity │ Status │ Installed Version │    Fixed Version    │                            Title                             │
├────────────────────────────────────────┼────────────────┼──────────┼────────┼───────────────────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│ @openzeppelin/contracts (package.json) │ CVE-2021-46320 │ HIGH     │ fixed  │ 3.2.0             │ 4.4.1               │ Improper Initialization in OpenZeppelin                      │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2021-46320                   │
│                                        ├────────────────┼──────────┤        ├───────────────────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│                                        │ CVE-2021-39167 │ CRITICAL │        │ 3.3.0             │ 4.3.1, 3.4.2        │ TimelockController vulnerability in OpenZeppelin Contracts   │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2021-39167                   │
│                                        ├────────────────┼──────────┤        │                   ├─────────────────────┼──────────────────────────────────────────────────────────────┤
│                                        │ CVE-2021-46320 │ HIGH     │        │                   │ 4.4.1               │ Improper Initialization in OpenZeppelin                      │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2021-46320                   │
├────────────────────────────────────────┼────────────────┤          │        ├───────────────────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│ axios (package.json)                   │ CVE-2025-27152 │          │        │ 0.21.4            │ 1.8.2, 0.30.0       │ axios: Possible SSRF and Credential Leakage via Absolute URL │
│                                        │                │          │        │                   │                     │ in axios Requests...                                         │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2025-27152                   │
├────────────────────────────────────────┼────────────────┤          │        ├───────────────────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│ cross-spawn (package.json)             │ CVE-2024-21538 │          │        │ 7.0.3             │ 7.0.5, 6.0.6        │ cross-spawn: regular expression denial of service            │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2024-21538                   │
│                                        │                │          │        │                   │                     │                                                              │
│                                        │                │          │        │                   │                     │                                                              │
│                                        │                │          │        │                   │                     │                                                              │
├────────────────────────────────────────┼────────────────┤          │        ├───────────────────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│ semver (package.json)                  │ CVE-2022-25883 │          │        │ 7.3.5             │ 7.5.2, 6.3.1, 5.7.2 │ nodejs-semver: Regular expression denial of service          │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2022-25883                   │
└────────────────────────────────────────┴────────────────┴──────────┴────────┴───────────────────┴─────────────────────┴──────────────────────────────────────────────────────────────┘

@iexec-renovate-app iexec-renovate-app bot force-pushed the renovate/minor-updates branch from b7e5cf9 to bf2b2b0 Compare May 17, 2025 00:35
Copy link

🔒 Trivy Security Scan Results

Click to expand detailed results

For OSS Maintainers: VEX Notice
--------------------------------
If you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement.
VEX allows you to communicate the actual status of vulnerabilities in your project, improving security transparency and reducing false positives for your users.
Learn more and start using VEX: https://aquasecurity.github.io/trivy/v0.57/docs/supply-chain/vex/repo#publishing-vex-documents

To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable.


vuln-image.tar (debian 12.10)
=============================
Total: 0 (HIGH: 0, CRITICAL: 0)


Node.js (node-pkg)
==================
Total: 7 (HIGH: 6, CRITICAL: 1)

┌────────────────────────────────────────┬────────────────┬──────────┬────────┬───────────────────┬─────────────────────┬──────────────────────────────────────────────────────────────┐
│                Library                 │ Vulnerability  │ Severity │ Status │ Installed Version │    Fixed Version    │                            Title                             │
├────────────────────────────────────────┼────────────────┼──────────┼────────┼───────────────────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│ @openzeppelin/contracts (package.json) │ CVE-2021-46320 │ HIGH     │ fixed  │ 3.2.0             │ 4.4.1               │ Improper Initialization in OpenZeppelin                      │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2021-46320                   │
│                                        ├────────────────┼──────────┤        ├───────────────────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│                                        │ CVE-2021-39167 │ CRITICAL │        │ 3.3.0             │ 4.3.1, 3.4.2        │ TimelockController vulnerability in OpenZeppelin Contracts   │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2021-39167                   │
│                                        ├────────────────┼──────────┤        │                   ├─────────────────────┼──────────────────────────────────────────────────────────────┤
│                                        │ CVE-2021-46320 │ HIGH     │        │                   │ 4.4.1               │ Improper Initialization in OpenZeppelin                      │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2021-46320                   │
├────────────────────────────────────────┼────────────────┤          │        ├───────────────────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│ axios (package.json)                   │ CVE-2025-27152 │          │        │ 0.21.4            │ 1.8.2, 0.30.0       │ axios: Possible SSRF and Credential Leakage via Absolute URL │
│                                        │                │          │        │                   │                     │ in axios Requests...                                         │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2025-27152                   │
├────────────────────────────────────────┼────────────────┤          │        ├───────────────────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│ cross-spawn (package.json)             │ CVE-2024-21538 │          │        │ 7.0.3             │ 7.0.5, 6.0.6        │ cross-spawn: regular expression denial of service            │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2024-21538                   │
│                                        │                │          │        │                   │                     │                                                              │
│                                        │                │          │        │                   │                     │                                                              │
│                                        │                │          │        │                   │                     │                                                              │
├────────────────────────────────────────┼────────────────┤          │        ├───────────────────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│ semver (package.json)                  │ CVE-2022-25883 │          │        │ 7.3.5             │ 7.5.2, 6.3.1, 5.7.2 │ nodejs-semver: Regular expression denial of service          │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2022-25883                   │
└────────────────────────────────────────┴────────────────┴──────────┴────────┴───────────────────┴─────────────────────┴──────────────────────────────────────────────────────────────┘

@iexec-renovate-app iexec-renovate-app bot force-pushed the renovate/minor-updates branch from bf2b2b0 to 2007732 Compare May 24, 2025 00:34
Copy link

🔒 Trivy Security Scan Results

Click to expand detailed results

For OSS Maintainers: VEX Notice
--------------------------------
If you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement.
VEX allows you to communicate the actual status of vulnerabilities in your project, improving security transparency and reducing false positives for your users.
Learn more and start using VEX: https://aquasecurity.github.io/trivy/v0.57/docs/supply-chain/vex/repo#publishing-vex-documents

To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable.


vuln-image.tar (debian 12.11)
=============================
Total: 0 (HIGH: 0, CRITICAL: 0)


Node.js (node-pkg)
==================
Total: 7 (HIGH: 6, CRITICAL: 1)

┌────────────────────────────────────────┬────────────────┬──────────┬────────┬───────────────────┬─────────────────────┬──────────────────────────────────────────────────────────────┐
│                Library                 │ Vulnerability  │ Severity │ Status │ Installed Version │    Fixed Version    │                            Title                             │
├────────────────────────────────────────┼────────────────┼──────────┼────────┼───────────────────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│ @openzeppelin/contracts (package.json) │ CVE-2021-46320 │ HIGH     │ fixed  │ 3.2.0             │ 4.4.1               │ Improper Initialization in OpenZeppelin                      │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2021-46320                   │
│                                        ├────────────────┼──────────┤        ├───────────────────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│                                        │ CVE-2021-39167 │ CRITICAL │        │ 3.3.0             │ 4.3.1, 3.4.2        │ TimelockController vulnerability in OpenZeppelin Contracts   │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2021-39167                   │
│                                        ├────────────────┼──────────┤        │                   ├─────────────────────┼──────────────────────────────────────────────────────────────┤
│                                        │ CVE-2021-46320 │ HIGH     │        │                   │ 4.4.1               │ Improper Initialization in OpenZeppelin                      │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2021-46320                   │
├────────────────────────────────────────┼────────────────┤          │        ├───────────────────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│ axios (package.json)                   │ CVE-2025-27152 │          │        │ 0.21.4            │ 1.8.2, 0.30.0       │ axios: Possible SSRF and Credential Leakage via Absolute URL │
│                                        │                │          │        │                   │                     │ in axios Requests...                                         │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2025-27152                   │
├────────────────────────────────────────┼────────────────┤          │        ├───────────────────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│ cross-spawn (package.json)             │ CVE-2024-21538 │          │        │ 7.0.3             │ 7.0.5, 6.0.6        │ cross-spawn: regular expression denial of service            │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2024-21538                   │
│                                        │                │          │        │                   │                     │                                                              │
│                                        │                │          │        │                   │                     │                                                              │
│                                        │                │          │        │                   │                     │                                                              │
├────────────────────────────────────────┼────────────────┤          │        ├───────────────────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│ semver (package.json)                  │ CVE-2022-25883 │          │        │ 7.3.5             │ 7.5.2, 6.3.1, 5.7.2 │ nodejs-semver: Regular expression denial of service          │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2022-25883                   │
└────────────────────────────────────────┴────────────────┴──────────┴────────┴───────────────────┴─────────────────────┴──────────────────────────────────────────────────────────────┘

@iexec-renovate-app iexec-renovate-app bot force-pushed the renovate/minor-updates branch from 2007732 to 9a0761d Compare May 31, 2025 00:33
Copy link

🔒 Trivy Security Scan Results

Click to expand detailed results

For OSS Maintainers: VEX Notice
--------------------------------
If you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement.
VEX allows you to communicate the actual status of vulnerabilities in your project, improving security transparency and reducing false positives for your users.
Learn more and start using VEX: https://aquasecurity.github.io/trivy/v0.57/docs/supply-chain/vex/repo#publishing-vex-documents

To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable.


vuln-image.tar (debian 12.11)
=============================
Total: 27 (HIGH: 27, CRITICAL: 0)

┌────────────────┬────────────────┬──────────┬────────┬───────────────────┬──────────────────┬──────────────────────────────────────────────────────────────┐
│    Library     │ Vulnerability  │ Severity │ Status │ Installed Version │  Fixed Version   │                            Title                             │
├────────────────┼────────────────┼──────────┼────────┼───────────────────┼──────────────────┼──────────────────────────────────────────────────────────────┤
│ libsystemd0    │ CVE-2025-4598  │ HIGH     │ fixed  │ 252.36-1~deb12u1  │ 252.38-1~deb12u1 │ ELSA-2025-20344: systemd security update (IMPORTANT)         │
│                │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2025-4598                    │
├────────────────┤                │          │        │                   │                  │                                                              │
│ libudev1       │                │          │        │                   │                  │                                                              │
│                │                │          │        │                   │                  │                                                              │
├────────────────┼────────────────┤          │        ├───────────────────┼──────────────────┼──────────────────────────────────────────────────────────────┤
│ linux-libc-dev │ CVE-2024-53203 │          │        │ 6.1.137-1         │ 6.1.140-1        │ kernel: usb: typec: fix potential array underflow in         │
│                │                │          │        │                   │                  │ ucsi_ccg_sync_control()                                      │
│                │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2024-53203                   │
│                ├────────────────┤          │        │                   │                  ├──────────────────────────────────────────────────────────────┤
│                │ CVE-2025-37897 │          │        │                   │                  │ kernel: wifi: plfxlc: Remove erroneous assert in             │
│                │                │          │        │                   │                  │ plfxlc_mac_release                                           │
│                │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2025-37897                   │
│                ├────────────────┤          │        │                   │                  ├──────────────────────────────────────────────────────────────┤
│                │ CVE-2025-37909 │          │        │                   │                  │ kernel: net: lan743x: Fix memleak issue when GSO enabled     │
│                │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2025-37909                   │
│                ├────────────────┤          │        │                   │                  ├──────────────────────────────────────────────────────────────┤
│                │ CVE-2025-37911 │          │        │                   │                  │ kernel: bnxt_en: Fix out-of-bound memcpy() during ethtool -w │
│                │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2025-37911                   │
│                ├────────────────┤          │        │                   │                  ├──────────────────────────────────────────────────────────────┤
│                │ CVE-2025-37912 │          │        │                   │                  │ kernel: ice: Check VF VSI Pointer Value in                   │
│                │                │          │        │                   │                  │ ice_vc_add_fdir_fltr()                                       │
│                │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2025-37912                   │
│                ├────────────────┤          │        │                   │                  ├──────────────────────────────────────────────────────────────┤
│                │ CVE-2025-37914 │          │        │                   │                  │ kernel: net_sched: ets: Fix double list add in class with    │
│                │                │          │        │                   │                  │ netem as...                                                  │
│                │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2025-37914                   │
│                ├────────────────┤          │        │                   │                  ├──────────────────────────────────────────────────────────────┤
│                │ CVE-2025-37917 │          │        │                   │                  │ kernel: net: ethernet: mtk-star-emac: fix spinlock recursion │
│                │                │          │        │                   │                  │ issues on rx/tx poll                                         │
│                │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2025-37917                   │
│                ├────────────────┤          │        │                   │                  ├──────────────────────────────────────────────────────────────┤
│                │ CVE-2025-37921 │          │        │                   │                  │ kernel: vxlan: vnifilter: Fix unlocked deletion of default   │
│                │                │          │        │                   │                  │ FDB entry                                                    │
│                │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2025-37921                   │
│                ├────────────────┤          │        │                   │                  ├──────────────────────────────────────────────────────────────┤
│                │ CVE-2025-37923 │          │        │                   │                  │ kernel: tracing: Fix oob write in trace_seq_to_buffer()      │
│                │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2025-37923                   │
│                ├────────────────┤          │        │                   │                  ├──────────────────────────────────────────────────────────────┤
│                │ CVE-2025-37928 │          │        │                   │                  │ kernel: dm-bufio: don't schedule in atomic context           │
│                │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2025-37928                   │
│                ├────────────────┤          │        │                   │                  ├──────────────────────────────────────────────────────────────┤
│                │ CVE-2025-37929 │          │        │                   │                  │ kernel: arm64: errata: Add missing sentinels to Spectre-BHB  │
│                │                │          │        │                   │                  │ MIDR arrays                                                  │
│                │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2025-37929                   │
│                ├────────────────┤          │        │                   │                  ├──────────────────────────────────────────────────────────────┤
│                │ CVE-2025-37932 │          │        │                   │                  │ kernel: sch_htb: make htb_qlen_notify() idempotent           │
│                │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2025-37932                   │
│                ├────────────────┤          │        │                   │                  ├──────────────────────────────────────────────────────────────┤
│                │ CVE-2025-37936 │          │        │                   │                  │ kernel: perf/x86/intel: KVM: Mask PEBS_ENABLE loaded for     │
│                │                │          │        │                   │                  │ guest with vCPU's value.                                     │
│                │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2025-37936                   │
│                ├────────────────┤          │        │                   │                  ├──────────────────────────────────────────────────────────────┤
│                │ CVE-2025-37948 │          │        │                   │                  │ kernel: arm64: bpf: Add BHB mitigation to the epilogue for   │
│                │                │          │        │                   │                  │ cBPF programs...                                             │
│                │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2025-37948                   │
│                ├────────────────┤          │        │                   │                  ├──────────────────────────────────────────────────────────────┤
│                │ CVE-2025-37949 │          │        │                   │                  │ kernel: xenbus: Use kref to track req lifetime               │
│                │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2025-37949                   │
│                ├────────────────┤          │        │                   │                  ├──────────────────────────────────────────────────────────────┤
│                │ CVE-2025-37951 │          │        │                   │                  │ kernel: drm/v3d: Add job to pending list if the reset was    │
│                │                │          │        │                   │                  │ skipped...                                                   │
│                │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2025-37951                   │
│                ├────────────────┤          │        │                   │                  ├──────────────────────────────────────────────────────────────┤
│                │ CVE-2025-37953 │          │        │                   │                  │ kernel: sch_htb: make htb_deactivate() idempotent            │
│                │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2025-37953                   │
│                ├────────────────┤          │        │                   │                  ├──────────────────────────────────────────────────────────────┤
│                │ CVE-2025-37959 │          │        │                   │                  │ kernel: bpf: Scrub packet on bpf_redirect_peer               │
│                │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2025-37959                   │
│                ├────────────────┤          │        │                   │                  ├──────────────────────────────────────────────────────────────┤
│                │ CVE-2025-37961 │          │        │                   │                  │ kernel: ipvs: fix uninit-value for saddr in do_output_route4 │
│                │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2025-37961                   │
│                ├────────────────┤          │        │                   │                  ├──────────────────────────────────────────────────────────────┤
│                │ CVE-2025-37963 │          │        │                   │                  │ kernel: arm64: bpf: Only mitigate cBPF programs loaded by    │
│                │                │          │        │                   │                  │ unprivileged users                                           │
│                │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2025-37963                   │
│                ├────────────────┤          │        │                   │                  ├──────────────────────────────────────────────────────────────┤
│                │ CVE-2025-37964 │          │        │                   │                  │ kernel: x86/mm: Eliminate window where TLB flushes may be    │
│                │                │          │        │                   │                  │ inadvertently skipped                                        │
│                │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2025-37964                   │
│                ├────────────────┤          │        │                   │                  ├──────────────────────────────────────────────────────────────┤
│                │ CVE-2025-37967 │          │        │                   │                  │ kernel: usb: typec: ucsi: displayport: Fix deadlock          │
│                │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2025-37967                   │
│                ├────────────────┤          │        │                   │                  ├──────────────────────────────────────────────────────────────┤
│                │ CVE-2025-37969 │          │        │                   │                  │ kernel: iio: imu: st_lsm6dsx: fix possible lockup in         │
│                │                │          │        │                   │                  │ st_lsm6dsx_read_tagged_fifo                                  │
│                │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2025-37969                   │
│                ├────────────────┤          │        │                   │                  ├──────────────────────────────────────────────────────────────┤
│                │ CVE-2025-37970 │          │        │                   │                  │ kernel: iio: imu: st_lsm6dsx: fix possible lockup in         │
│                │                │          │        │                   │                  │ st_lsm6dsx_read_fifo                                         │
│                │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2025-37970                   │
│                ├────────────────┤          │        │                   │                  ├──────────────────────────────────────────────────────────────┤
│                │ CVE-2025-37990 │          │        │                   │                  │ kernel: wifi: brcm80211: fmac: Add error handling for        │
│                │                │          │        │                   │                  │ brcmf_usb_dl_writeimage()                                    │
│                │                │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2025-37990                   │
└────────────────┴────────────────┴──────────┴────────┴───────────────────┴──────────────────┴──────────────────────────────────────────────────────────────┘

Node.js (node-pkg)
==================
Total: 7 (HIGH: 6, CRITICAL: 1)

┌────────────────────────────────────────┬────────────────┬──────────┬────────┬───────────────────┬─────────────────────┬──────────────────────────────────────────────────────────────┐
│                Library                 │ Vulnerability  │ Severity │ Status │ Installed Version │    Fixed Version    │                            Title                             │
├────────────────────────────────────────┼────────────────┼──────────┼────────┼───────────────────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│ @openzeppelin/contracts (package.json) │ CVE-2021-46320 │ HIGH     │ fixed  │ 3.2.0             │ 4.4.1               │ Improper Initialization in OpenZeppelin                      │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2021-46320                   │
│                                        ├────────────────┼──────────┤        ├───────────────────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│                                        │ CVE-2021-39167 │ CRITICAL │        │ 3.3.0             │ 4.3.1, 3.4.2        │ TimelockController vulnerability in OpenZeppelin Contracts   │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2021-39167                   │
│                                        ├────────────────┼──────────┤        │                   ├─────────────────────┼──────────────────────────────────────────────────────────────┤
│                                        │ CVE-2021-46320 │ HIGH     │        │                   │ 4.4.1               │ Improper Initialization in OpenZeppelin                      │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2021-46320                   │
├────────────────────────────────────────┼────────────────┤          │        ├───────────────────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│ axios (package.json)                   │ CVE-2025-27152 │          │        │ 0.21.4            │ 1.8.2, 0.30.0       │ axios: Possible SSRF and Credential Leakage via Absolute URL │
│                                        │                │          │        │                   │                     │ in axios Requests...                                         │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2025-27152                   │
├────────────────────────────────────────┼────────────────┤          │        ├───────────────────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│ cross-spawn (package.json)             │ CVE-2024-21538 │          │        │ 7.0.3             │ 7.0.5, 6.0.6        │ cross-spawn: regular expression denial of service            │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2024-21538                   │
│                                        │                │          │        │                   │                     │                                                              │
│                                        │                │          │        │                   │                     │                                                              │
│                                        │                │          │        │                   │                     │                                                              │
├────────────────────────────────────────┼────────────────┤          │        ├───────────────────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│ semver (package.json)                  │ CVE-2022-25883 │          │        │ 7.3.5             │ 7.5.2, 6.3.1, 5.7.2 │ nodejs-semver: Regular expression denial of service          │
│                                        │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2022-25883                   │
└────────────────────────────────────────┴────────────────┴──────────┴────────┴───────────────────┴─────────────────────┴──────────────────────────────────────────────────────────────┘

@iexec-renovate-app iexec-renovate-app bot force-pushed the renovate/minor-updates branch from 9a0761d to ec54663 Compare June 7, 2025 00:34
Copy link

github-actions bot commented Jun 7, 2025

🔒 Trivy Security Scan Results

Click to expand detailed results

For OSS Maintainers: VEX Notice
--------------------------------
If you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement.
VEX allows you to communicate the actual status of vulnerabilities in your project, improving security transparency and reducing false positives for your users.
Learn more and start using VEX: https://aquasecurity.github.io/trivy/v0.57/docs/supply-chain/vex/repo#publishing-vex-documents

To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable.


vuln-image.tar (debian 12.11)
=============================
Total: 25 (HIGH: 25, CRITICAL: 0)

┌────────────────┬────────────────┬──────────┬────────┬───────────────────┬───────────────┬──────────────────────────────────────────────────────────────┐
│    Library     │ Vulnerability  │ Severity │ Status │ Installed Version │ Fixed Version │                            Title                             │
├────────────────┼────────────────┼──────────┼────────┼───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ linux-libc-dev │ CVE-2024-53203 │ HIGH     │ fixed  │ 6.1.137-1         │ 6.1.140-1     │ kernel: usb: typec: fix potential array underflow in         │
│                │                │          │        │                   │               │ ucsi_ccg_sync_control()                                      │
│                │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2024-53203                   │
│                ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│                │ CVE-2025-37897 │          │        │                   │               │ kernel: wifi: plfxlc: Remove erroneous assert in             │
│                │                │          │        │                   │               │ plfxlc_mac_release                                           │
│                │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2025-37897                   │
│                ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│                │ CVE-2025-37909 │          │        │                   │               │ kernel: net: lan743x: Fix memleak issue when GSO enabled     │
│                │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2025-37909                   │
│                ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│                │ CVE-2025-37911 │          │        │                   │               │ kernel: bnxt_en: Fix out-of-bound memcpy() during ethtool -w │
│                │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2025-37911                   │
│                ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│                │ CVE-2025-37912 │          │        │                   │               │ kernel: ice: Check VF VSI Pointer Value in                   │
│                │                │          │        │                   │               │ ice_vc_add_fdir_fltr()                                       │
│                │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2025-37912                   │
│                ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│                │ CVE-2025-37914 │          │        │                   │               │ kernel: net_sched: ets: Fix double list add in class with    │
│                │                │          │        │                   │               │ netem as...                                                  │
│                │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2025-37914                   │
│                ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│                │ CVE-2025-37917 │          │        │                   │               │ kernel: net: ethernet: mtk-star-emac: fix spinlock recursion │
│                │                │          │        │                   │               │ issues on rx/tx poll                                         │
│                │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2025-37917                   │
│                ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│                │ CVE-2025-37921 │          │        │                   │               │ kernel: vxlan: vnifilter: Fix unlocked deletion of default   │
│                │                │          │        │                   │               │ FDB entry                                                    │
│                │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2025-37921                   │
│                ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│                │ CVE-2025-37923 │          │        │                   │               │ kernel: tracing: Fix oob write in trace_seq_to_buffer()      │
│                │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2025-37923                   │
│                ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│                │ CVE-2025-37928 │          │        │                   │               │ kernel: dm-bufio: don't schedule in atomic context           │
│                │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2025-37928                   │
│                ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│                │ CVE-2025-37929 │          │        │                   │               │ kernel: arm64: errata: Add missing sentinels to Spectre-BHB  │
│                │                │          │        │                   │               │ MIDR arrays                                                  │
│                │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2025-37929                   │
│                ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│                │ CVE-2025-37932 │          │        │                   │               │ kernel: sch_htb: make htb_qlen_notify() idempotent           │
│                │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2025-37932                   │
│                ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│                │ CVE-2025-37936 │          │        │                   │               │ kernel: perf/x86/intel: KVM: Mask PEBS_ENABLE loaded for     │
│                │                │          │        │                   │               │ guest with vCPU's value.                                     │
│                │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2025-37936                   │
│                ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│                │ CVE-2025-37948 │          │        │                   │               │ kernel: arm64: bpf: Add BHB mitigation to the epilogue for   │
│                │                │          │        │                   │               │ cBPF programs...                                             │
│                │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2025-37948                   │
│                ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│                │ CVE-2025-37949 │          │        │                   │               │ kernel: xenbus: Use kref to track req lifetime               │
│                │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2025-37949                   │
│                ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│                │ CVE-2025-37951 │          │        │                   │               │ kernel: drm/v3d: Add job to pending list if the reset was    │
│                │                │          │        │                   │               │ skipped...                                                   │
│                │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2025-37951                   │
│                ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│                │ CVE-2025-37953 │          │        │                   │               │ kernel: sch_htb: make htb_deactivate() idempotent            │
│                │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2025-37953                   │
│                ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│                │ CVE-2025-37959 │          │        │                   │               │ kernel: bpf: Scrub packet on bpf_redirect_peer               │
│                │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2025-37959                   │
│                ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│                │ CVE-2025-37961 │          │        │                   │               │ kernel: ipvs: fix uninit-value for saddr in do_output_route4 │
│                │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2025-37961                   │
│                ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│                │ CVE-2025-37963 │          │        │                   │               │ kernel: arm64: bpf: Only mitigate cBPF programs loaded by    │
│                │                │          │        │                   │               │ unprivileged users                                           │
│                │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2025-37963                   │
│                ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│                │ CVE-2025-37964 │          │        │                   │               │ kernel: x86/mm: Eliminate window where TLB flushes may be    │
│                │                │          │        │                   │               │ inadvertently skipped                                        │
│                │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2025-37964                   │
│                ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│                │ CVE-2025-37967 │          │        │                   │               │ kernel: usb: typec: ucsi: displayport: Fix deadlock          │
│                │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2025-37967                   │
│                ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│                │ CVE-2025-37969 │          │        │                   │               │ kernel: iio: imu: st_lsm6dsx: fix possible lockup in         │
│                │                │          │        │                   │               │ st_lsm6dsx_read_tagged_fifo                                  │
│                │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2025-37969                   │
│                ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│                │ CVE-2025-37970 │          │        │                   │               │ kernel: iio: imu: st_lsm6dsx: fix possible lockup in         │
│                │                │          │        │                   │               │ st_lsm6dsx_read_fifo                                         │
│                │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2025-37970                   │
│                ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│                │ CVE-2025-37990 │          │        │                   │               │ kernel: wifi: brcm80211: fmac: Add error handling for        │
│                │                │          │        │                   │               │ brcmf_usb_dl_writeimage()                                    │
│                │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2025-37990                   │
└────────────────┴────────────────┴──────────┴────────┴───────────────────┴───────────────┴──────────────────────────────────────────────────────────────┘

Node.js (node-pkg)
==================
Total: 9 (HIGH: 8, CRITICAL: 1)

┌────────────────────────────────────────┬────────────────┬──────────┬────────┬───────────────────┬──────────────────────┬──────────────────────────────────────────────────────────────┐
│                Library                 │ Vulnerability  │ Severity │ Status │ Installed Version │    Fixed Version     │                            Title                             │
├────────────────────────────────────────┼────────────────┼──────────┼────────┼───────────────────┼──────────────────────┼──────────────────────────────────────────────────────────────┤
│ @openzeppelin/contracts (package.json) │ CVE-2021-46320 │ HIGH     │ fixed  │ 3.2.0             │ 4.4.1                │ Improper Initialization in OpenZeppelin                      │
│                                        │                │          │        │                   │                      │ https://avd.aquasec.com/nvd/cve-2021-46320                   │
│                                        ├────────────────┼──────────┤        ├───────────────────┼──────────────────────┼──────────────────────────────────────────────────────────────┤
│                                        │ CVE-2021-39167 │ CRITICAL │        │ 3.3.0             │ 4.3.1, 3.4.2         │ TimelockController vulnerability in OpenZeppelin Contracts   │
│                                        │                │          │        │                   │                      │ https://avd.aquasec.com/nvd/cve-2021-39167                   │
│                                        ├────────────────┼──────────┤        │                   ├──────────────────────┼──────────────────────────────────────────────────────────────┤
│                                        │ CVE-2021-46320 │ HIGH     │        │                   │ 4.4.1                │ Improper Initialization in OpenZeppelin                      │
│                                        │                │          │        │                   │                      │ https://avd.aquasec.com/nvd/cve-2021-46320                   │
├────────────────────────────────────────┼────────────────┤          │        ├───────────────────┼──────────────────────┼──────────────────────────────────────────────────────────────┤
│ axios (package.json)                   │ CVE-2025-27152 │          │        │ 0.21.4            │ 1.8.2, 0.30.0        │ axios: Possible SSRF and Credential Leakage via Absolute URL │
│                                        │                │          │        │                   │                      │ in axios Requests...                                         │
│                                        │                │          │        │                   │                      │ https://avd.aquasec.com/nvd/cve-2025-27152                   │
├────────────────────────────────────────┼────────────────┤          │        ├───────────────────┼──────────────────────┼──────────────────────────────────────────────────────────────┤
│ cross-spawn (package.json)             │ CVE-2024-21538 │          │        │ 7.0.3             │ 7.0.5, 6.0.6         │ cross-spawn: regular expression denial of service            │
│                                        │                │          │        │                   │                      │ https://avd.aquasec.com/nvd/cve-2024-21538                   │
│                                        │                │          │        │                   │                      │                                                              │
│                                        │                │          │        │                   │                      │                                                              │
│                                        │                │          │        │                   │                      │                                                              │
├────────────────────────────────────────┼────────────────┤          │        ├───────────────────┼──────────────────────┼──────────────────────────────────────────────────────────────┤
│ semver (package.json)                  │ CVE-2022-25883 │          │        │ 7.3.5             │ 7.5.2, 6.3.1, 5.7.2  │ nodejs-semver: Regular expression denial of service          │
│                                        │                │          │        │                   │                      │ https://avd.aquasec.com/nvd/cve-2022-25883                   │
├────────────────────────────────────────┼────────────────┤          │        ├───────────────────┼──────────────────────┼──────────────────────────────────────────────────────────────┤
│ tar-fs (package.json)                  │ CVE-2025-48387 │          │        │ 2.1.2             │ 1.16.5, 2.1.3, 3.0.9 │ tar-fs: tar-fs has issue where extract can write outside the │
│                                        │                │          │        │                   │                      │ specified dir...                                             │
│                                        │                │          │        │                   │                      │ https://avd.aquasec.com/nvd/cve-2025-48387                   │
│                                        │                │          │        ├───────────────────┤                      │                                                              │
│                                        │                │          │        │ 3.0.8             │                      │                                                              │
│                                        │                │          │        │                   │                      │                                                              │
│                                        │                │          │        │                   │                      │                                                              │
└────────────────────────────────────────┴────────────────┴──────────┴────────┴───────────────────┴──────────────────────┴──────────────────────────────────────────────────────────────┘

@iexec-renovate-app iexec-renovate-app bot force-pushed the renovate/minor-updates branch from ec54663 to b9b288e Compare June 14, 2025 00:35
Copy link

🔒 Trivy Security Scan Results

Click to expand detailed results

For OSS Maintainers: VEX Notice
--------------------------------
If you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement.
VEX allows you to communicate the actual status of vulnerabilities in your project, improving security transparency and reducing false positives for your users.
Learn more and start using VEX: https://aquasecurity.github.io/trivy/v0.57/docs/supply-chain/vex/repo#publishing-vex-documents

To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable.


vuln-image.tar (debian 12.11)
=============================
Total: 0 (HIGH: 0, CRITICAL: 0)


Node.js (node-pkg)
==================
Total: 9 (HIGH: 8, CRITICAL: 1)

┌────────────────────────────────────────┬────────────────┬──────────┬────────┬───────────────────┬──────────────────────┬──────────────────────────────────────────────────────────────┐
│                Library                 │ Vulnerability  │ Severity │ Status │ Installed Version │    Fixed Version     │                            Title                             │
├────────────────────────────────────────┼────────────────┼──────────┼────────┼───────────────────┼──────────────────────┼──────────────────────────────────────────────────────────────┤
│ @openzeppelin/contracts (package.json) │ CVE-2021-46320 │ HIGH     │ fixed  │ 3.2.0             │ 4.4.1                │ Improper Initialization in OpenZeppelin                      │
│                                        │                │          │        │                   │                      │ https://avd.aquasec.com/nvd/cve-2021-46320                   │
│                                        ├────────────────┼──────────┤        ├───────────────────┼──────────────────────┼──────────────────────────────────────────────────────────────┤
│                                        │ CVE-2021-39167 │ CRITICAL │        │ 3.3.0             │ 4.3.1, 3.4.2         │ TimelockController vulnerability in OpenZeppelin Contracts   │
│                                        │                │          │        │                   │                      │ https://avd.aquasec.com/nvd/cve-2021-39167                   │
│                                        ├────────────────┼──────────┤        │                   ├──────────────────────┼──────────────────────────────────────────────────────────────┤
│                                        │ CVE-2021-46320 │ HIGH     │        │                   │ 4.4.1                │ Improper Initialization in OpenZeppelin                      │
│                                        │                │          │        │                   │                      │ https://avd.aquasec.com/nvd/cve-2021-46320                   │
├────────────────────────────────────────┼────────────────┤          │        ├───────────────────┼──────────────────────┼──────────────────────────────────────────────────────────────┤
│ axios (package.json)                   │ CVE-2025-27152 │          │        │ 0.21.4            │ 1.8.2, 0.30.0        │ axios: Possible SSRF and Credential Leakage via Absolute URL │
│                                        │                │          │        │                   │                      │ in axios Requests...                                         │
│                                        │                │          │        │                   │                      │ https://avd.aquasec.com/nvd/cve-2025-27152                   │
├────────────────────────────────────────┼────────────────┤          │        ├───────────────────┼──────────────────────┼──────────────────────────────────────────────────────────────┤
│ cross-spawn (package.json)             │ CVE-2024-21538 │          │        │ 7.0.3             │ 7.0.5, 6.0.6         │ cross-spawn: regular expression denial of service            │
│                                        │                │          │        │                   │                      │ https://avd.aquasec.com/nvd/cve-2024-21538                   │
│                                        │                │          │        │                   │                      │                                                              │
│                                        │                │          │        │                   │                      │                                                              │
│                                        │                │          │        │                   │                      │                                                              │
├────────────────────────────────────────┼────────────────┤          │        ├───────────────────┼──────────────────────┼──────────────────────────────────────────────────────────────┤
│ semver (package.json)                  │ CVE-2022-25883 │          │        │ 7.3.5             │ 7.5.2, 6.3.1, 5.7.2  │ nodejs-semver: Regular expression denial of service          │
│                                        │                │          │        │                   │                      │ https://avd.aquasec.com/nvd/cve-2022-25883                   │
├────────────────────────────────────────┼────────────────┤          │        ├───────────────────┼──────────────────────┼──────────────────────────────────────────────────────────────┤
│ tar-fs (package.json)                  │ CVE-2025-48387 │          │        │ 2.1.2             │ 1.16.5, 2.1.3, 3.0.9 │ tar-fs: tar-fs has issue where extract can write outside the │
│                                        │                │          │        │                   │                      │ specified dir...                                             │
│                                        │                │          │        │                   │                      │ https://avd.aquasec.com/nvd/cve-2025-48387                   │
│                                        │                │          │        ├───────────────────┤                      │                                                              │
│                                        │                │          │        │ 3.0.8             │                      │                                                              │
│                                        │                │          │        │                   │                      │                                                              │
│                                        │                │          │        │                   │                      │                                                              │
└────────────────────────────────────────┴────────────────┴──────────┴────────┴───────────────────┴──────────────────────┴──────────────────────────────────────────────────────────────┘

Base automatically changed from develop to main July 25, 2025 14:27
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants