Skip to content

fix(deps): update all non-major dependencies - #279

Open
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/all-minor-patch
Open

fix(deps): update all non-major dependencies#279
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/all-minor-patch

Conversation

@renovate

@renovate renovate Bot commented Aug 5, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Change Age Confidence Type Update Pending
Firely.Terminal 3.4.0 → 3.5.0 age confidence minor
fsh-sushi 3.20.0 → 3.20.1 age confidence dependencies patch
hapifhir/org.hl7.fhir.core 6.9.11 → 6.10.2 age confidence minor 6.10.3

Release Notes

fhir/sushi (fsh-sushi)

v3.20.1: SUSHI 3.20.1

Compare Source

SUSHI 3.20.1 improves handling of extension slices and choice slices in certain edge cases. See links to individual PRs below for details.

What's Changed

New Contributors

Install or Update

SUSHI 3.20.1 is the latest stable release of fsh-sushi. To install or update to SUSHI 3.20.1, run the following command:

$ npm install -g fsh-sushi

To check or confirm what version of SUSHI you have installed, you can run the following command:

$ sushi -v

To revert back to the previous version of SUSHI, you can run the following command:

$ npm install -g fsh-sushi@3.20.0

Full Changelog: FHIR/sushi@v3.20.0...v3.20.1

hapifhir/org.hl7.fhir.core (hapifhir/org.hl7.fhir.core)

v6.10.2

Compare Source

Validator Changes

  • language fix validating codes in value sets
  • Setup batch handling for Supplement code validation
  • Armour up code generator - safe from theoretical code attacks
  • Secure fetchTheOldWay links (SSRF related issue)

Other code changes

  • remove unneeded thread invocation for regex
  • Allow Suppression of dependencies when generating packages (for THO)
  • Fix issue where factory generator picks up version from the wrong code system
  • revisit validation batch handling generally
  • remove thread check from JUnit tests
  • fix bugs in ConceptMapRenderer
  • add TestPlan renderer
  • Set up registration for convertors
  • fix problem with tx cache always changing
  • Testing IG Convertors
  • refactor parser and render registration in R5 code
  • update resource generation code
  • COPY in StructureMapUtilities.runTransform update to return a clone
  • Share the HTTP connection pool across ManagedHTTPClient instances

v6.10.1

Compare Source

Validator Changes

  • no changes

Other code changes

  • Fixed setting ManagedWebAccess from fhir-settings.json

v6.10.0

Compare Source

Security: SSRF Protection

  • Internal tooling for http/https requests now prevents server-side request forgeries, as well as the option to bypass these for custom configurations or testing. See documentation here

Validator Changes

  • Pass language to ecosystem when resolving code systems
  • Dont retrieve a code system from a server and use it locally in place of consulting the server for validation/expansion
  • Fix constant evaluation type checking in FHIRPath
  • Fix up testing of server support for a code system, and dont persist failed resolutions between runs
  • Fix error processing of erroneous response from tx.fhir.org
  • Improve canonical URL resolution
  • More regex protection tidy up
  • Do not try to validate Endpoint.address as a definitional URL
  • Add command for code generation for additional resources
  • Clean up txTest parameters issue

Other code changes

  • Delegate FHIRPath custom-function hooks (resolveFunction/checkFunction/executeFunction) to ITransformerServices in StructureMapUtilities
  • Allow unknown resource types when parsing resources
  • Render DiagnosticReport.presentedForm
  • Fix mapping rendering - no empty columns, no duplicate ids
  • Fix NPE Rendering incomplete ratios
  • Add support for new R6 release
  • Language processing clean up
  • Update cache after changing the way code systems are resolved
  • Validation tests tidy up
  • AR language fix
  • Dependency updates: jansi -> 4.3.1, log4j -> 2.26.1

v6.9.12

Compare Source

Validator Changes

  • fix up caching for new sealed parameter
  • fix version bug excluding codes and fix server side handling for excluded valuesets
  • improve validation error message for retired codes
  • fix tx server addresses to https:
  • Fix cache-id double header issue
  • rework cache shutdown
  • fix htmlChecks() implementation on string in validator
  • NPE fix for missing version when doing value set validation

Other code changes

  • RDF R6 move optional concept IRIs + NamingSystem param
  • fix canonical extension utility
  • fix issue with unescaped input to code generator
  • Diff logic isnt handling nested codes (FHIR-54571, FHIR-54489)
  • Fix single argument URL constructor calls
  • fix broken links in comparisons
  • backwards compatibility fix for IValidatorPolicyAdvisor
  • Switch SimpleHTTPClient to okhttp3 (#​2519)
  • Update Dependencies:
    • hapi version to 8.10.0
    • ch.qos.logback:logback-core from 1.5.25 to 1.5.33
    • Jackson -> 2.22.1 + kotlin-stdlib -> 2.4.0
    • Logback -> 1.5.37
    • Saxon HE update

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • Between 12:00 AM and 03:59 AM, on day 1 of the month (* 0-3 1 * *)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@github-actions

github-actions Bot commented Aug 5, 2026 •
edited
Loading

Copy link
Copy Markdown

❌MegaLinter analysis: Error

Descriptor Linter Files Fixed Errors Warnings Elapsed time
✅ ACTION actionlint 4 0 0 0.02s
✅ DOCKERFILE hadolint 1 0 0 0.36s
✅ JSON jsonlint 5 0 0 0.3s
✅ JSON npm-package-json-lint yes no no 0.65s
✅ JSON prettier 5 0 0 0.7s
✅ JSON v8r 5 0 0 9.13s
✅ MARKDOWN markdownlint 2 0 0 0.99s
✅ MARKDOWN markdown-table-formatter 2 0 0 0.47s
✅ REPOSITORY checkov yes no no 33.33s
✅ REPOSITORY dustilock yes no no 0.16s
✅ REPOSITORY gitleaks yes no no 0.36s
✅ REPOSITORY git_diff yes no no 0.01s
❌ REPOSITORY grype yes 11 12 85.76s
⚠️ REPOSITORY kics yes no 1 43.77s
✅ REPOSITORY kingfisher yes no no 6.86s
✅ REPOSITORY secretlint yes no no 1.56s
✅ REPOSITORY syft yes no no 4.82s
❌ REPOSITORY trivy yes 11 no 21.28s
✅ REPOSITORY trivy-sbom yes no no 0.84s
✅ REPOSITORY trufflehog yes no no 5.91s
✅ YAML prettier 10 0 0 0.65s
✅ YAML v8r 10 0 0 9.27s
✅ YAML yamllint 10 0 0 0.64s

Detailed Issues

❌ REPOSITORY / grype - 11 errors 
error: A critical vulnerability in npm package: tar, version 7.5.15 was found at: /package-lock.json

error: A high vulnerability in npm package: brace-expansion, version 1.1.14 was found at: /package-lock.json

error: A high vulnerability in npm package: form-data, version 4.0.5 was found at: /package-lock.json

error: A high vulnerability in npm package: brace-expansion, version 1.1.14 was found at: /package-lock.json

error: A high vulnerability in npm package: tar, version 7.5.15 was found at: /package-lock.json

warning: A medium vulnerability in npm package: tar, version 7.5.15 was found at: /package-lock.json

error: A high vulnerability in npm package: fast-uri, version 3.1.2 was found at: /package-lock.json

error: A high vulnerability in npm package: fast-uri, version 3.1.2 was found at: /package-lock.json

error: A high vulnerability in npm package: tar, version 7.5.15 was found at: /package-lock.json

warning: A medium vulnerability in npm package: tar, version 7.5.15 was found at: /package-lock.json

error: A high vulnerability in npm package: brace-expansion, version 1.1.14 was found at: /package-lock.json

warning: A medium vulnerability in npm package: axios, version 1.16.1 was found at: /package-lock.json

error: A high vulnerability in npm package: fast-uri, version 3.1.2 was found at: /package-lock.json

warning: A medium vulnerability in npm package: tar, version 7.5.15 was found at: /package-lock.json

error: A high vulnerability in npm package: axios, version 1.16.1 was found at: /package-lock.json

warning: A medium vulnerability in npm package: axios, version 1.16.1 was found at: /package-lock.json

warning: A medium vulnerability in npm package: axios, version 1.16.1 was found at: /package-lock.json

warning: A medium vulnerability in npm package: axios, version 1.16.1 was found at: /package-lock.json

warning: A medium vulnerability in npm package: axios, version 1.16.1 was found at: /package-lock.json

warning: A medium vulnerability in npm package: axios, version 1.16.1 was found at: /package-lock.json

warning: A medium vulnerability in npm package: axios, version 1.16.1 was found at: /package-lock.json

warning: A medium vulnerability in npm package: axios, version 1.16.1 was found at: /package-lock.json

warning: A medium vulnerability in npm package: axios, version 1.16.1 was found at: /package-lock.json

warning: 12 warnings emitted
error: 11 errors emitted
❌ REPOSITORY / trivy - 11 errors 
│ │       "version": "1.1.14",
274 │ │       "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.14.tgz",
275 │ │       "integrity": "sha512-MWPGfDxnyzKU7rNOW9SP/c50vi3xrmrua/+6hfPbCS2ABNWfx24vPidzvC7krjU/RTo235sV776ymlsMtGKj8g==",
    · │
280 │ │       }
281 │ │     },
    │ ╰^
    │  
    = brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity
    = brace-expansion through 5.0.6 is vulnerable to denial of service. The expand() function exhibits exponential-time complexity in the number of consecutive non-expanding '{}' brace groups. An attacker who passes a crafted string to expand(), directly or transitively, can cause significant CPU consumption and event-loop blocking. The max option does not mitigate this, as it bounds the output size rather than the recursion work.

error: Package: brace-expansion
Installed Version: 1.1.14
Vulnerability CVE-2026-14257
Severity: HIGH
Fixed Version: 5.0.8, 3.0.3, 2.1.3, 1.1.17
Link: [CVE-2026-14257](https://avd.aquasec.com/nvd/cve-2026-14257)
    ┌─ package-lock.json:272:1
    │  
272 │ ╭     "node_modules/brace-expansion": {
273 │ │       "version": "1.1.14",
274 │ │       "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.14.tgz",
275 │ │       "integrity": "sha512-MWPGfDxnyzKU7rNOW9SP/c50vi3xrmrua/+6hfPbCS2ABNWfx24vPidzvC7krjU/RTo235sV776ymlsMtGKj8g==",
    · │
280 │ │       }
281 │ │     },
    │ ╰^
    │  
    = brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function
    = brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand() function limits the number of results with a max option (default 100,000) but does not bound the length of each result string. By chaining multiple brace groups, an attacker keeps the result count under the limit while making each result progressively longer, so total memory scales with both count and string length until the process hits a fatal, uncatchable out-of-memory error. About 7.5 KB of input ('{a,b}'.repeat(1500)) crashes a default Node.js process. Any application that passes attacker-influenced strings to brace-expansion.expand() - directly or transitively via minimatch / glob brace patterns - can be crashed by a small request. Fixed in 5.0.8 by adding a maxLength option (default 4,000,000) that bounds accumulated output and intermediate arrays.

error: Package: brace-expansion
Installed Version: 1.1.14
Vulnerability CVE-2026-69152
Severity: HIGH
Fixed Version: 1.1.18, 2.1.4, 3.0.6, 5.0.9
Link: [CVE-2026-69152](https://avd.aquasec.com/nvd/cve-2026-69152)
    ┌─ package-lock.json:272:1
    │  
272 │ ╭     "node_modules/brace-expansion": {
273 │ │       "version": "1.1.14",
274 │ │       "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.14.tgz",
275 │ │       "integrity": "sha512-MWPGfDxnyzKU7rNOW9SP/c50vi3xrmrua/+6hfPbCS2ABNWfx24vPidzvC7krjU/RTo235sV776ymlsMtGKj8g==",
    · │
280 │ │       }
281 │ │     },
    │ ╰^
    │  
    = brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation
    = The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.18, 2.1.4, 3.0.6, and 5.0.9, expand() does not apply maxLength while constructing comma-alternative intermediate arrays or padded sequences, allowing attacker-controlled input to exhaust memory or block the event loop. The fix for CVE-2026-14257 is bypassed by the vulnerability. This issue is fixed in versions 1.1.18, 2.1.4, 3.0.6, and 5.0.9.

error: Package: fast-uri
Installed Version: 3.1.2
Vulnerability CVE-2026-13676
Severity: HIGH
Fixed Version: 4.0.1, 3.1.3, 2.4.2
Link: [CVE-2026-13676](https://avd.aquasec.com/nvd/cve-2026-13676)
    ┌─ package-lock.json:570:1
    │  
570 │ ╭     "node_modules/fast-uri": {
571 │ │       "version": "3.1.2",
572 │ │       "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.2.tgz",
573 │ │       "integrity": "sha512-rVjf7ArG3LTk+FS6Yw81V1DLuZl1bRbNrev6Tmd/9RaroeeRRJhAt7jg/6YFxbvAQXUCavSoZhPPj6oOx+5KjQ==",
    · │
584 │ │       "license": "BSD-3-Clause"
585 │ │     },
    │ ╰^
    │  
    = fast-uri: fast-uri: Security policy bypass due to improper Unicode hostname canonicalization
    = fast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fail to canonicalize Unicode (IDN) hostnames for HTTP-family URLs. The IDN conversion path calls a helper that does not exist on the global URL constructor, silently leaving the host in its original Unicode form while normalize() and equal() still return values that differ from a WHATWG-compatible URL parser. Applications that use fast-uri to enforce host-based policy (denylists, loopback filtering, redirect validation, outbound proxy routing) before passing the same URL to Node's URL or fetch can be bypassed when the two implementations resolve the same input to different hosts. Patches: upgrade to fast-uri 3.1.3 for the 3.x line or 4.0.1 for the 4.x line. Workarounds: enforce host policy using the same URL parser used for the actual request, or reject non-ASCII hosts before policy checks.

error: Package: fast-uri
Installed Version: 3.1.2
Vulnerability CVE-2026-16221
Severity: HIGH
Fixed Version: 2.4.3, 3.1.4, 4.1.1
Link: [CVE-2026-16221](https://avd.aquasec.com/nvd/cve-2026-16221)
    ┌─ package-lock.json:570:1
    │  
570 │ ╭     "node_modules/fast-uri": {
571 │ │       "version": "3.1.2",
572 │ │       "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.2.tgz",
573 │ │       "integrity": "sha512-rVjf7ArG3LTk+FS6Yw81V1DLuZl1bRbNrev6Tmd/9RaroeeRRJhAt7jg/6YFxbvAQXUCavSoZhPPj6oOx+5KjQ==",
    · │
584 │ │       "license": "BSD-3-Clause"
585 │ │     },
    │ ╰^
    │  
    = fast-uri: Fast-uri: Security policy bypass due to URL parsing inconsistency
    = Impact: fast-uri versions from 2.3.1 through 4.1.0 (including the 3.x line up to 3.1.3 and the 2.x line up to 2.4.2) do not treat a literal backslash character (U+005C) as an authority delimiter. Node's native WHATWG URL parser, used by fetch, undici, and Node's http and https clients, normalizes the backslash to a forward slash for special schemes such as http, https, ws, wss, ftp, and file. As a result, the two parsers extract different hosts from the same input string. Applications that use fast-uri to enforce host-based policy such as allowlists, denylists, loopback or SSRF filtering, redirect validation, or outbound proxy routing before passing the same URL into Node's URL or fetch consumers can be steered to an unintended destination, including cloud metadata endpoints, loopback, or internal hosts. 
      
      Patches: upgrade to fast-uri 4.1.1, 3.1.4, or 2.4.3.
      
      Workarounds: none.

error: Package: fast-uri
Installed Version: 3.1.2
Vulnerability CVE-2026-18446
Severity: HIGH
Fixed Version: 2.4.4, 3.1.5, 4.1.2
Link: [CVE-2026-18446](https://avd.aquasec.com/nvd/cve-2026-18446)
    ┌─ package-lock.json:570:1
    │  
570 │ ╭     "node_modules/fast-uri": {
571 │ │       "version": "3.1.2",
572 │ │       "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.2.tgz",
573 │ │       "integrity": "sha512-rVjf7ArG3LTk+FS6Yw81V1DLuZl1bRbNrev6Tmd/9RaroeeRRJhAt7jg/6YFxbvAQXUCavSoZhPPj6oOx+5KjQ==",
    · │
584 │ │       "license": "BSD-3-Clause"
585 │ │     },
    │ ╰^
    │  
    = fast-uri: fast-uri: Host confusion vulnerability via backslash in URI authority
    = fast-uri before 4.1.2, 3.1.5, and 2.4.4 requires a literal double forward slash to recognize a URI authority, so a reference that uses a backslash based introducer in place of it (backslash backslash, forward slash backslash, or backslash forward slash) is parsed with no authority and folds into the path. Node's native WHATWG URL parser instead treats a backslash as interchangeable with a forward slash for special schemes, so the two parsers extract different hosts from the same input. Applications that use fast-uri to enforce host based policy such as allowlists, SSRF filtering, or redirect validation before passing the same URL into Node's URL or fetch consumers can be steered to an unintended host. Upgrade to fast-uri 4.1.2, 3.1.5, or 2.4.4.

error: Package: form-data
Installed Version: 4.0.5
Vulnerability CVE-2026-12143
Severity: HIGH
Fixed Version: 2.5.6, 3.0.5, 4.0.6
Link: [CVE-2026-12143](https://avd.aquasec.com/nvd/cve-2026-12143)
    ┌─ package-lock.json:671:1
    │  
671 │ ╭     "node_modules/form-data": {
672 │ │       "version": "4.0.5",
673 │ │       "resolved": "https://registry.npmjs.org/form-data/-/form-data-4.0.5.tgz",
674 │ │       "integrity": "sha512-8RipRLol37bNs2bhoV67fiTEvdTrbMUYcFTiy3+wuuOnUog2QBHCZWXDRijWQfAkhBj2Uf5UnVaiWwA5vdd82w==",
    · │
685 │ │       }
686 │ │     },
    │ ╰^
    │  
    = form-data: form-data: Form field override via CRLF injection
    = form-data is a library for creating readable multipart/form-data streams. In versions through 4.0.5, the `field` argument to `FormData#append` and the `filename` option are concatenated verbatim into the `Content-Disposition` header without escaping carriage return (CR), line feed (LF), or double-quote (") characters. An application that passes attacker-controlled data as a field name or filename (for example, an API gateway that turns JSON object keys into multipart field names) allows the attacker to terminate the header line and inject additional headers, or to smuggle entire additional multipart parts, into the request the application forwards to a backend. This can let the attacker add or override form fields (e.g. set `is_admin=true`) seen by the downstream parser. This is an instance of CWE-93 (CRLF injection). The fix escapes CR, LF, and `"` as `%0D`, `%0A`, and `%22` in field names and filenames, matching the serialization browsers use per the WHATWG HTML multipart/form-data encoding algorithm. Exploitation requires the consuming application to use untrusted input as a field name or filename; applications that use only fixed/trusted field names are not affected. Fixed in 2.5.6, 3.0.5, and 4.0.6.

error: Package: tar
Installed Version: 7.5.15
Vulnerability CVE-2026-59873
Severity: CRITICAL
Fixed Version: 7.5.19
Link: [CVE-2026-59873](https://avd.aquasec.com/nvd/cve-2026-59873)
     ┌─ package-lock.json:1379:1
     │  
1379 │ ╭     "node_modules/tar": {
1380 │ │       "version": "7.5.15",
1381 │ │       "resolved": "https://registry.npmjs.org/tar/-/tar-7.5.15.tgz",
1382 │ │       "integrity": "sha512-dzGK0boVlC4W5QFuQN1EFSl3bIDYsk7Tj40U6eIBnK2k/8ml7TZ5agbI5j5+qnoVcAA+rNtBml8SEiLxZpNqRQ==",
     · │
1393 │ │       }
1394 │ │     },
     │ ╰^
     │  
     = tar: node-tar: Denial of Service via crafted gzip bomb
     = node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.19, node-tar does not enforce hard upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths such as src/extract.ts, allowing a small crafted gzip bomb to exhaust disk space and CPU. This issue is fixed in version 7.5.19.

error: Package: tar
Installed Version: 7.5.15
Vulnerability CVE-2026-59874
Severity: HIGH
Fixed Version: 7.5.18
Link: [CVE-2026-59874](https://avd.aquasec.com/nvd/cve-2026-59874)
     ┌─ package-lock.json:1379:1
     │  
1379 │ ╭     "node_modules/tar": {
1380 │ │       "version": "7.5.15",
1381 │ │       "resolved": "https://registry.npmjs.org/tar/-/tar-7.5.15.tgz",
1382 │ │       "integrity": "sha512-dzGK0boVlC4W5QFuQN1EFSl3bIDYsk7Tj40U6eIBnK2k/8ml7TZ5agbI5j5+qnoVcAA+rNtBml8SEiLxZpNqRQ==",
     · │
1393 │ │       }
1394 │ │     },
     │ ╰^
     │  
     = tar: Node-tar: Denial of Service via malformed tar archive header
     = node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, tar.replace accepts a checksum-valid tar header with a negative base-256 encoded entry size, causing the archive scanner to make no progress while repeatedly parsing the same header. This issue is fixed in version 7.5.18.

error: Package: tar
Installed Version: 7.5.15
Vulnerability CVE-2026-73566
Severity: HIGH
Fixed Version: 7.5.21
Link: [CVE-2026-73566](https://avd.aquasec.com/nvd/cve-2026-73566)
     ┌─ package-lock.json:1379:1
     │  
1379 │ ╭     "node_modules/tar": {
1380 │ │       "version": "7.5.15",
1381 │ │       "resolved": "https://registry.npmjs.org/tar/-/tar-7.5.15.tgz",
1382 │ │       "integrity": "sha512-dzGK0boVlC4W5QFuQN1EFSl3bIDYsk7Tj40U6eIBnK2k/8ml7TZ5agbI5j5+qnoVcAA+rNtBml8SEiLxZpNqRQ==",
     · │
1393 │ │       }
1394 │ │     },
     │ ╰^
     │  
     = tar: node-tar: Denial of Service via crafted long-path tar archive
     = node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.21, node-tar's filesFilter in src/list.ts uses the recursive mapHas helper to walk an archive entry path upward with path.dirname() and no segment cap when tar.t(...) or tar.x(...) receives a non-empty member-selection list. A crafted GNU L or PAX x long-path header with thousands of slash-separated segments reaches this.filter(entry.path, entry) in Parser[CONSUMEHEADER] in src/parse.ts before Unpack[CHECKPATH] applies maxDepth, causing an uncatchable RangeError stack overflow that terminates asynchronous and streaming Node.js consumers. This issue is fixed in version 7.5.21.

error: 11 errors emitted

(Truncated to last 13333 characters out of 34487)
⚠️ REPOSITORY / kics - 1 warning 
warning: Dockerfile doesn't contain instruction 'HEALTHCHECK'
  ┌─ Dockerfile:1:1
  │
1 │ FROM docker.io/library/eclipse-temurin:21-jre-noble@sha256:5ea5c6c4c4f75be58b4391e91b14f72f53c3e7e43a304d537ceecd3f5513260d
  │ ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  │
  = Healthcheck Instruction Missing
  = Ensure that HEALTHCHECK is being used. The HEALTHCHECK instruction tells Docker how to test a container to check that it is still working

warning: 1 warnings emitted

See detailed reports in MegaLinter artifacts

Your project could benefit from a custom flavor, which would allow you to run only the linters you need, and thus improve runtime performances. (Skip this info by defining FLAVOR_SUGGESTIONS: false)

  • Documentation: Custom Flavors
  • Command: npx mega-linter-runner@9.4.0 --custom-flavor-setup --custom-flavor-linters ACTION_ACTIONLINT,DOCKERFILE_HADOLINT,JSON_JSONLINT,JSON_V8R,JSON_PRETTIER,JSON_NPM_PACKAGE_JSON_LINT,MARKDOWN_MARKDOWNLINT,MARKDOWN_MARKDOWN_TABLE_FORMATTER,REPOSITORY_CHECKOV,REPOSITORY_DUSTILOCK,REPOSITORY_GIT_DIFF,REPOSITORY_GITLEAKS,REPOSITORY_GRYPE,REPOSITORY_KICS,REPOSITORY_SECRETLINT,REPOSITORY_SYFT,REPOSITORY_TRIVY,REPOSITORY_TRIVY_SBOM,REPOSITORY_TRUFFLEHOG,REPOSITORY_KINGFISHER,YAML_PRETTIER,YAML_YAMLLINT,YAML_V8R

MegaLinter is graciously provided by OX Security
Show us your support by starring ⭐ the repository

@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 3 times, most recently from 1e8b24d to 6d865dd Compare August 21, 2026 17:01
@renovate renovate Bot changed the title chore(deps): update all non-major dependencies fix(deps): update all non-major dependencies Aug 21, 2026
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 2 times, most recently from 2c3afb9 to 5a4916e Compare August 23, 2026 14:52
@renovate

renovate Bot commented Aug 23, 2026

Copy link
Copy Markdown
Contributor Author

ℹ️ Artifact update notice

File name: package-lock.json

npm --before could not be enforced because existing locked packages were published after the minimumReleaseAge cutoff. This will resolve after the next lock file maintenance run.

@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch from 5a4916e to d60d13d Compare August 27, 2026 06:08
@github-actions

github-actions Bot commented Aug 27, 2026

Copy link
Copy Markdown

Trivy image scan report

ghcr.io/miracum/ig-build-tools:pr-279 (ubuntu 24.04)

130 known vulnerabilities found (MEDIUM: 102 LOW: 24 CRITICAL: 0 HIGH: 4)

Show detailed table of vulnerabilities
Package ID Severity Installed Version Fixed Version
aspnetcore-runtime-8.0 CVE-2026-62899 MEDIUM 8.0.29-0ubuntu1~24.04.1 8.0.130-8.0.30-0ubuntu1~24.04.1
aspnetcore-runtime-8.0 CVE-2026-62900 MEDIUM 8.0.29-0ubuntu1~24.04.1 8.0.130-8.0.30-0ubuntu1~24.04.1
aspnetcore-runtime-8.0 CVE-2026-62901 MEDIUM 8.0.29-0ubuntu1~24.04.1 8.0.130-8.0.30-0ubuntu1~24.04.1
aspnetcore-runtime-8.0 CVE-2026-62909 MEDIUM 8.0.29-0ubuntu1~24.04.1 8.0.130-8.0.30-0ubuntu1~24.04.1
aspnetcore-targeting-pack-8.0 CVE-2026-62899 MEDIUM 8.0.29-0ubuntu1~24.04.1 8.0.130-8.0.30-0ubuntu1~24.04.1
aspnetcore-targeting-pack-8.0 CVE-2026-62900 MEDIUM 8.0.29-0ubuntu1~24.04.1 8.0.130-8.0.30-0ubuntu1~24.04.1
aspnetcore-targeting-pack-8.0 CVE-2026-62901 MEDIUM 8.0.29-0ubuntu1~24.04.1 8.0.130-8.0.30-0ubuntu1~24.04.1
aspnetcore-targeting-pack-8.0 CVE-2026-62909 MEDIUM 8.0.29-0ubuntu1~24.04.1 8.0.130-8.0.30-0ubuntu1~24.04.1
curl CVE-2026-11856 MEDIUM 8.5.0-2ubuntu10.11 8.5.0-2ubuntu10.12
curl CVE-2026-8932 LOW 8.5.0-2ubuntu10.11 8.5.0-2ubuntu10.13
dotnet-apphost-pack-8.0 CVE-2026-62899 MEDIUM 8.0.29-0ubuntu1~24.04.1 8.0.130-8.0.30-0ubuntu1~24.04.1
dotnet-apphost-pack-8.0 CVE-2026-62900 MEDIUM 8.0.29-0ubuntu1~24.04.1 8.0.130-8.0.30-0ubuntu1~24.04.1
dotnet-apphost-pack-8.0 CVE-2026-62901 MEDIUM 8.0.29-0ubuntu1~24.04.1 8.0.130-8.0.30-0ubuntu1~24.04.1
dotnet-apphost-pack-8.0 CVE-2026-62909 MEDIUM 8.0.29-0ubuntu1~24.04.1 8.0.130-8.0.30-0ubuntu1~24.04.1
dotnet-host-8.0 CVE-2026-62899 MEDIUM 8.0.29-0ubuntu1~24.04.1 8.0.130-8.0.30-0ubuntu1~24.04.1
dotnet-host-8.0 CVE-2026-62900 MEDIUM 8.0.29-0ubuntu1~24.04.1 8.0.130-8.0.30-0ubuntu1~24.04.1
dotnet-host-8.0 CVE-2026-62901 MEDIUM 8.0.29-0ubuntu1~24.04.1 8.0.130-8.0.30-0ubuntu1~24.04.1
dotnet-host-8.0 CVE-2026-62909 MEDIUM 8.0.29-0ubuntu1~24.04.1 8.0.130-8.0.30-0ubuntu1~24.04.1
dotnet-hostfxr-8.0 CVE-2026-62899 MEDIUM 8.0.29-0ubuntu1~24.04.1 8.0.130-8.0.30-0ubuntu1~24.04.1
dotnet-hostfxr-8.0 CVE-2026-62900 MEDIUM 8.0.29-0ubuntu1~24.04.1 8.0.130-8.0.30-0ubuntu1~24.04.1
dotnet-hostfxr-8.0 CVE-2026-62901 MEDIUM 8.0.29-0ubuntu1~24.04.1 8.0.130-8.0.30-0ubuntu1~24.04.1
dotnet-hostfxr-8.0 CVE-2026-62909 MEDIUM 8.0.29-0ubuntu1~24.04.1 8.0.130-8.0.30-0ubuntu1~24.04.1
dotnet-runtime-8.0 CVE-2026-62899 MEDIUM 8.0.29-0ubuntu1~24.04.1 8.0.130-8.0.30-0ubuntu1~24.04.1
dotnet-runtime-8.0 CVE-2026-62900 MEDIUM 8.0.29-0ubuntu1~24.04.1 8.0.130-8.0.30-0ubuntu1~24.04.1
dotnet-runtime-8.0 CVE-2026-62901 MEDIUM 8.0.29-0ubuntu1~24.04.1 8.0.130-8.0.30-0ubuntu1~24.04.1
dotnet-runtime-8.0 CVE-2026-62909 MEDIUM 8.0.29-0ubuntu1~24.04.1 8.0.130-8.0.30-0ubuntu1~24.04.1
dotnet-sdk-8.0 CVE-2026-62899 MEDIUM 8.0.129-0ubuntu1~24.04.1 8.0.130-8.0.30-0ubuntu1~24.04.1
dotnet-sdk-8.0 CVE-2026-62900 MEDIUM 8.0.129-0ubuntu1~24.04.1 8.0.130-8.0.30-0ubuntu1~24.04.1
dotnet-sdk-8.0 CVE-2026-62901 MEDIUM 8.0.129-0ubuntu1~24.04.1 8.0.130-8.0.30-0ubuntu1~24.04.1
dotnet-sdk-8.0 CVE-2026-62909 MEDIUM 8.0.129-0ubuntu1~24.04.1 8.0.130-8.0.30-0ubuntu1~24.04.1
dotnet-targeting-pack-8.0 CVE-2026-62899 MEDIUM 8.0.29-0ubuntu1~24.04.1 8.0.130-8.0.30-0ubuntu1~24.04.1
dotnet-targeting-pack-8.0 CVE-2026-62900 MEDIUM 8.0.29-0ubuntu1~24.04.1 8.0.130-8.0.30-0ubuntu1~24.04.1
dotnet-targeting-pack-8.0 CVE-2026-62901 MEDIUM 8.0.29-0ubuntu1~24.04.1 8.0.130-8.0.30-0ubuntu1~24.04.1
dotnet-targeting-pack-8.0 CVE-2026-62909 MEDIUM 8.0.29-0ubuntu1~24.04.1 8.0.130-8.0.30-0ubuntu1~24.04.1
dotnet-templates-8.0 CVE-2026-62899 MEDIUM 8.0.129-0ubuntu1~24.04.1 8.0.130-8.0.30-0ubuntu1~24.04.1
dotnet-templates-8.0 CVE-2026-62900 MEDIUM 8.0.129-0ubuntu1~24.04.1 8.0.130-8.0.30-0ubuntu1~24.04.1
dotnet-templates-8.0 CVE-2026-62901 MEDIUM 8.0.129-0ubuntu1~24.04.1 8.0.130-8.0.30-0ubuntu1~24.04.1
dotnet-templates-8.0 CVE-2026-62909 MEDIUM 8.0.129-0ubuntu1~24.04.1 8.0.130-8.0.30-0ubuntu1~24.04.1
gzip CVE-2026-41991 MEDIUM 1.12-1ubuntu3.1 1.12-1ubuntu3.2
gzip CVE-2026-41992 MEDIUM 1.12-1ubuntu3.1 1.12-1ubuntu3.2
libcurl3t64-gnutls CVE-2026-11856 MEDIUM 8.5.0-2ubuntu10.11 8.5.0-2ubuntu10.12
libcurl3t64-gnutls CVE-2026-8932 LOW 8.5.0-2ubuntu10.11 8.5.0-2ubuntu10.13
libcurl4t64 CVE-2026-11856 MEDIUM 8.5.0-2ubuntu10.11 8.5.0-2ubuntu10.12
libcurl4t64 CVE-2026-8932 LOW 8.5.0-2ubuntu10.11 8.5.0-2ubuntu10.13
libgcrypt20 CVE-2026-41989 MEDIUM 1.10.3-2build1 1.10.3-2ubuntu0.1
libgnutls30t64 CVE-2026-33845 MEDIUM 3.8.3-1.1ubuntu3.5 3.8.3-1.1ubuntu3.6
libgnutls30t64 CVE-2026-33846 MEDIUM 3.8.3-1.1ubuntu3.5 3.8.3-1.1ubuntu3.6
libgnutls30t64 CVE-2026-3832 MEDIUM 3.8.3-1.1ubuntu3.5 3.8.3-1.1ubuntu3.6
libgnutls30t64 CVE-2026-3833 MEDIUM 3.8.3-1.1ubuntu3.5 3.8.3-1.1ubuntu3.6
libgnutls30t64 CVE-2026-42009 MEDIUM 3.8.3-1.1ubuntu3.5 3.8.3-1.1ubuntu3.6
libgnutls30t64 CVE-2026-42010 MEDIUM 3.8.3-1.1ubuntu3.5 3.8.3-1.1ubuntu3.6
libgnutls30t64 CVE-2026-42011 MEDIUM 3.8.3-1.1ubuntu3.5 3.8.3-1.1ubuntu3.6
libgnutls30t64 CVE-2026-42012 MEDIUM 3.8.3-1.1ubuntu3.5 3.8.3-1.1ubuntu3.6
libgnutls30t64 CVE-2026-42013 MEDIUM 3.8.3-1.1ubuntu3.5 3.8.3-1.1ubuntu3.6
libgnutls30t64 CVE-2026-42014 MEDIUM 3.8.3-1.1ubuntu3.5 3.8.3-1.1ubuntu3.6
libgnutls30t64 CVE-2026-42015 MEDIUM 3.8.3-1.1ubuntu3.5 3.8.3-1.1ubuntu3.6
libgnutls30t64 CVE-2026-5260 MEDIUM 3.8.3-1.1ubuntu3.5 3.8.3-1.1ubuntu3.6
libgnutls30t64 CVE-2026-5419 MEDIUM 3.8.3-1.1ubuntu3.5 3.8.3-1.1ubuntu3.6
libgssapi-krb5-2 CVE-2026-11850 MEDIUM 1.20.1-6ubuntu2.6 1.20.1-6ubuntu2.7
libgssapi-krb5-2 CVE-2026-40355 MEDIUM 1.20.1-6ubuntu2.6 1.20.1-6ubuntu2.7
libgssapi-krb5-2 CVE-2026-40356 MEDIUM 1.20.1-6ubuntu2.6 1.20.1-6ubuntu2.7
libk5crypto3 CVE-2026-11850 MEDIUM 1.20.1-6ubuntu2.6 1.20.1-6ubuntu2.7
libk5crypto3 CVE-2026-40355 MEDIUM 1.20.1-6ubuntu2.6 1.20.1-6ubuntu2.7
libk5crypto3 CVE-2026-40356 MEDIUM 1.20.1-6ubuntu2.6 1.20.1-6ubuntu2.7
libkrb5-3 CVE-2026-11850 MEDIUM 1.20.1-6ubuntu2.6 1.20.1-6ubuntu2.7
libkrb5-3 CVE-2026-40355 MEDIUM 1.20.1-6ubuntu2.6 1.20.1-6ubuntu2.7
libkrb5-3 CVE-2026-40356 MEDIUM 1.20.1-6ubuntu2.6 1.20.1-6ubuntu2.7
libkrb5support0 CVE-2026-11850 MEDIUM 1.20.1-6ubuntu2.6 1.20.1-6ubuntu2.7
libkrb5support0 CVE-2026-40355 MEDIUM 1.20.1-6ubuntu2.6 1.20.1-6ubuntu2.7
libkrb5support0 CVE-2026-40356 MEDIUM 1.20.1-6ubuntu2.6 1.20.1-6ubuntu2.7
libnghttp2-14 CVE-2026-58055 MEDIUM 1.59.0-1ubuntu0.3 1.59.0-1ubuntu0.4
libpam-modules CVE-2026-54411 MEDIUM 1.5.3-5ubuntu5.5 1.5.3-5ubuntu5.6
libpam-modules-bin CVE-2026-54411 MEDIUM 1.5.3-5ubuntu5.5 1.5.3-5ubuntu5.6
libpam-runtime CVE-2026-54411 MEDIUM 1.5.3-5ubuntu5.5 1.5.3-5ubuntu5.6
libpam0g CVE-2026-54411 MEDIUM 1.5.3-5ubuntu5.5 1.5.3-5ubuntu5.6
libsqlite3-0 CVE-2026-11822 MEDIUM 3.45.1-1ubuntu2.5 3.45.1-1ubuntu2.6
libsqlite3-0 CVE-2026-11824 MEDIUM 3.45.1-1ubuntu2.5 3.45.1-1ubuntu2.6
libsqlite3-0 CVE-2026-50812 MEDIUM 3.45.1-1ubuntu2.5 3.45.1-1ubuntu2.7
libsqlite3-0 CVE-2026-50813 MEDIUM 3.45.1-1ubuntu2.5 3.45.1-1ubuntu2.7
libssl3t64 CVE-2026-45447 HIGH 3.0.13-0ubuntu3.9 3.0.13-0ubuntu3.11
libssl3t64 CVE-2026-34182 MEDIUM 3.0.13-0ubuntu3.9 3.0.13-0ubuntu3.11
libssl3t64 CVE-2026-45445 MEDIUM 3.0.13-0ubuntu3.9 3.0.13-0ubuntu3.11
libssl3t64 CVE-2026-63072 MEDIUM 3.0.13-0ubuntu3.9 3.0.13-0ubuntu3.15
libssl3t64 CVE-2026-63076 MEDIUM 3.0.13-0ubuntu3.9 3.0.13-0ubuntu3.15
libssl3t64 CVE-2026-34180 LOW 3.0.13-0ubuntu3.9 3.0.13-0ubuntu3.11
libssl3t64 CVE-2026-42766 LOW 3.0.13-0ubuntu3.9 3.0.13-0ubuntu3.11
libssl3t64 CVE-2026-42767 LOW 3.0.13-0ubuntu3.9 3.0.13-0ubuntu3.11
libssl3t64 CVE-2026-42770 LOW 3.0.13-0ubuntu3.9 3.0.13-0ubuntu3.11
libssl3t64 CVE-2026-45446 LOW 3.0.13-0ubuntu3.9 3.0.13-0ubuntu3.11
libssl3t64 CVE-2026-54874 LOW 3.0.13-0ubuntu3.9 3.0.13-0ubuntu3.15
libssl3t64 CVE-2026-63074 LOW 3.0.13-0ubuntu3.9 3.0.13-0ubuntu3.15
libssl3t64 CVE-2026-7383 LOW 3.0.13-0ubuntu3.9 3.0.13-0ubuntu3.11
libssl3t64 CVE-2026-75803 LOW 3.0.13-0ubuntu3.9 3.0.13-0ubuntu3.15
libssl3t64 CVE-2026-9076 LOW 3.0.13-0ubuntu3.9 3.0.13-0ubuntu3.11
libsystemd0 CVE-2026-15059 MEDIUM 255.4-1ubuntu8.15 255.4-1ubuntu8.17
libsystemd0 CVE-2026-16742 MEDIUM 255.4-1ubuntu8.15 255.4-1ubuntu8.17
libsystemd0 CVE-2026-40226 MEDIUM 255.4-1ubuntu8.15 255.4-1ubuntu8.16
libudev1 CVE-2026-15059 MEDIUM 255.4-1ubuntu8.15 255.4-1ubuntu8.17
libudev1 CVE-2026-16742 MEDIUM 255.4-1ubuntu8.15 255.4-1ubuntu8.17
libudev1 CVE-2026-40226 MEDIUM 255.4-1ubuntu8.15 255.4-1ubuntu8.16
linux-libc-dev CVE-2026-53224 HIGH 6.8.0-137.137 6.8.0-138.138
linux-libc-dev CVE-2026-64531 HIGH 6.8.0-137.137 6.8.0-138.138
linux-libc-dev CVE-2026-53246 MEDIUM 6.8.0-137.137 6.8.0-138.138
linux-libc-dev CVE-2026-53247 LOW 6.8.0-137.137 6.8.0-138.138
netstandard-targeting-pack-2.1-8.0 CVE-2026-62899 MEDIUM 8.0.129-0ubuntu1~24.04.1 8.0.130-8.0.30-0ubuntu1~24.04.1
netstandard-targeting-pack-2.1-8.0 CVE-2026-62900 MEDIUM 8.0.129-0ubuntu1~24.04.1 8.0.130-8.0.30-0ubuntu1~24.04.1
netstandard-targeting-pack-2.1-8.0 CVE-2026-62901 MEDIUM 8.0.129-0ubuntu1~24.04.1 8.0.130-8.0.30-0ubuntu1~24.04.1
netstandard-targeting-pack-2.1-8.0 CVE-2026-62909 MEDIUM 8.0.129-0ubuntu1~24.04.1 8.0.130-8.0.30-0ubuntu1~24.04.1
openssl CVE-2026-45447 HIGH 3.0.13-0ubuntu3.9 3.0.13-0ubuntu3.11
openssl CVE-2026-34182 MEDIUM 3.0.13-0ubuntu3.9 3.0.13-0ubuntu3.11
openssl CVE-2026-45445 MEDIUM 3.0.13-0ubuntu3.9 3.0.13-0ubuntu3.11
openssl CVE-2026-63072 MEDIUM 3.0.13-0ubuntu3.9 3.0.13-0ubuntu3.15
openssl CVE-2026-63076 MEDIUM 3.0.13-0ubuntu3.9 3.0.13-0ubuntu3.15
openssl CVE-2026-34180 LOW 3.0.13-0ubuntu3.9 3.0.13-0ubuntu3.11
openssl CVE-2026-42766 LOW 3.0.13-0ubuntu3.9 3.0.13-0ubuntu3.11
openssl CVE-2026-42767 LOW 3.0.13-0ubuntu3.9 3.0.13-0ubuntu3.11
openssl CVE-2026-42770 LOW 3.0.13-0ubuntu3.9 3.0.13-0ubuntu3.11
openssl CVE-2026-45446 LOW 3.0.13-0ubuntu3.9 3.0.13-0ubuntu3.11
openssl CVE-2026-54874 LOW 3.0.13-0ubuntu3.9 3.0.13-0ubuntu3.15
openssl CVE-2026-63074 LOW 3.0.13-0ubuntu3.9 3.0.13-0ubuntu3.15
openssl CVE-2026-7383 LOW 3.0.13-0ubuntu3.9 3.0.13-0ubuntu3.11
openssl CVE-2026-75803 LOW 3.0.13-0ubuntu3.9 3.0.13-0ubuntu3.15
openssl CVE-2026-9076 LOW 3.0.13-0ubuntu3.9 3.0.13-0ubuntu3.11
tar CVE-2025-45582 MEDIUM 1.35+dfsg-3build1 1.35+dfsg-3ubuntu0.2
tar CVE-2026-5704 MEDIUM 1.35+dfsg-3build1 1.35+dfsg-3ubuntu0.4
wget CVE-2026-15146 MEDIUM 1.21.4-1ubuntu4.1 1.21.4-1ubuntu4.4
wget CVE-2026-58469 MEDIUM 1.21.4-1ubuntu4.1 1.21.4-1ubuntu4.3
wget CVE-2026-58470 MEDIUM 1.21.4-1ubuntu4.1 1.21.4-1ubuntu4.3
wget CVE-2026-58471 MEDIUM 1.21.4-1ubuntu4.1 1.21.4-1ubuntu4.3
wget CVE-2026-58472 MEDIUM 1.21.4-1ubuntu4.1 1.21.4-1ubuntu4.3

No Misconfigurations found

Java

54 known vulnerabilities found (CRITICAL: 11 HIGH: 27 MEDIUM: 12 LOW: 4)

Show detailed table of vulnerabilities
Package ID Severity Installed Version Fixed Version
ca.uhn.hapi.fhir:org.hl7.fhir.convertors CVE-2026-33180 CRITICAL 6.4.0 6.9.0
ca.uhn.hapi.fhir:org.hl7.fhir.convertors CVE-2026-55470 HIGH 6.4.0 6.9.10
ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 CVE-2026-33180 CRITICAL 6.4.0 6.9.0
ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 CVE-2026-45367 HIGH 6.4.0 6.9.7
ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 CVE-2026-49485 HIGH 6.4.0 6.9.9, 6.9.4.2
ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 CVE-2026-55470 HIGH 6.4.0 6.9.10
ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may CVE-2026-33180 CRITICAL 6.4.0 6.9.0
ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may CVE-2026-45367 HIGH 6.4.0 6.9.7
ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may CVE-2026-49485 HIGH 6.4.0 6.9.9, 6.9.4.2
ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 CVE-2026-33180 CRITICAL 6.4.0 6.9.0
ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 CVE-2026-45367 HIGH 6.4.0 6.9.7
ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 CVE-2026-49485 HIGH 6.4.0 6.9.9, 6.9.4.2
ca.uhn.hapi.fhir:org.hl7.fhir.r4 CVE-2026-33180 CRITICAL 6.4.0 6.9.0
ca.uhn.hapi.fhir:org.hl7.fhir.r4 CVE-2026-45367 HIGH 6.4.0 6.9.7
ca.uhn.hapi.fhir:org.hl7.fhir.r4 CVE-2026-49485 HIGH 6.4.0 6.9.9, 6.9.4.2
ca.uhn.hapi.fhir:org.hl7.fhir.r4b CVE-2026-33180 CRITICAL 6.4.0 6.9.0
ca.uhn.hapi.fhir:org.hl7.fhir.r4b CVE-2026-45367 HIGH 6.4.0 6.9.7
ca.uhn.hapi.fhir:org.hl7.fhir.r4b CVE-2026-49485 HIGH 6.4.0 6.9.9, 6.9.4.2
ca.uhn.hapi.fhir:org.hl7.fhir.r5 CVE-2026-33180 CRITICAL 6.4.0 6.9.0
ca.uhn.hapi.fhir:org.hl7.fhir.r5 CVE-2026-45367 HIGH 6.4.0 6.9.7
ca.uhn.hapi.fhir:org.hl7.fhir.r5 CVE-2026-49485 HIGH 6.4.0 6.9.9, 6.9.4.2
ca.uhn.hapi.fhir:org.hl7.fhir.utilities CVE-2026-33180 CRITICAL 6.4.0 6.9.0
ca.uhn.hapi.fhir:org.hl7.fhir.utilities CVE-2026-55471 CRITICAL 6.4.0 6.9.10
ca.uhn.hapi.fhir:org.hl7.fhir.utilities CVE-2026-34359 HIGH 6.4.0 6.9.4
ca.uhn.hapi.fhir:org.hl7.fhir.validation CVE-2026-33180 CRITICAL 6.4.0 6.9.0
ca.uhn.hapi.fhir:org.hl7.fhir.validation CVE-2026-34361 CRITICAL 6.4.0 6.9.4
ca.uhn.hapi.fhir:org.hl7.fhir.validation CVE-2026-45367 HIGH 6.4.0 6.9.7
ca.uhn.hapi.fhir:org.hl7.fhir.validation CVE-2026-49485 HIGH 6.4.0 6.9.9, 6.9.4.2
ca.uhn.hapi.fhir:org.hl7.fhir.validation CVE-2026-55470 HIGH 6.4.0 6.9.10
ch.qos.logback:logback-core CVE-2024-12798 MEDIUM 1.2.13 1.5.13, 1.3.15
ch.qos.logback:logback-core CVE-2025-11226 MEDIUM 1.2.13 1.5.19, 1.3.16
ch.qos.logback:logback-core CVE-2024-12801 LOW 1.2.13 1.5.13, 1.3.15
ch.qos.logback:logback-core CVE-2026-10532 LOW 1.2.13 1.5.34
ch.qos.logback:logback-core CVE-2026-1225 LOW 1.2.13 1.5.25
ch.qos.logback:logback-core CVE-2026-9828 LOW 1.2.13 1.5.33
com.fasterxml.jackson.core:jackson-core GHSA-r7wm-3cxj-wff9 HIGH 2.17.0 2.18.8, 2.21.4
com.fasterxml.jackson.core:jackson-core GHSA-72hv-8253-57qq MEDIUM 2.17.0 2.21.1, 2.18.6
com.fasterxml.jackson.core:jackson-databind CVE-2026-54512 HIGH 2.17.0 2.18.8, 3.1.4, 2.21.4
com.fasterxml.jackson.core:jackson-databind CVE-2026-54513 HIGH 2.17.0 2.18.8, 2.21.4, 3.1.4
com.fasterxml.jackson.core:jackson-databind CVE-2026-54514 MEDIUM 2.17.0 2.18.8, 2.21.4, 3.1.4
com.fasterxml.jackson.core:jackson-databind CVE-2026-54515 MEDIUM 2.17.0 3.1.4, 2.18.9, 2.21.5, 2.22.1
com.fasterxml.jackson.core:jackson-databind CVE-2026-59888 MEDIUM 2.17.0 2.18.8, 2.21.4
com.nimbusds:nimbus-jose-jwt CVE-2025-53864 MEDIUM 9.37.3 10.0.2, 9.37.4
commons-beanutils:commons-beanutils CVE-2025-48734 HIGH 1.9.4 1.11.0
org.apache.commons:commons-lang3 CVE-2025-48924 MEDIUM 3.14.0 3.18.0
org.apache.httpcomponents.client5:httpclient5 CVE-2026-64607 MEDIUM 5.1.3 5.6.3
org.apache.httpcomponents.core5:httpcore5 CVE-2026-54399 HIGH 5.1.3 5.4.3, 5.5-beta2
org.apache.httpcomponents.core5:httpcore5-h2 CVE-2026-54428 HIGH 5.1.3 5.4.3, 5.5-beta2
org.apache.logging.log4j:log4j-api CVE-2026-49844 MEDIUM 2.17.1 2.25.5, 2.26.1
org.fhir:ucum CVE-2024-55887 HIGH 1.0.3 1.0.9
org.hl7.fhir.publisher:org.hl7.fhir.publisher.cli CVE-2024-52807 HIGH 1.7.1 1.7.4
org.hl7.fhir.publisher:org.hl7.fhir.publisher.cli CVE-2025-24363 MEDIUM 1.7.1 1.8.9
org.hl7.fhir.publisher:org.hl7.fhir.publisher.core CVE-2024-52807 HIGH 1.7.1 1.7.4
org.hl7.fhir.publisher:org.hl7.fhir.publisher.core CVE-2025-24363 MEDIUM 1.7.1 1.8.9

No Misconfigurations found

Node.js

41 known vulnerabilities found (CRITICAL: 2 HIGH: 17 MEDIUM: 20 LOW: 2)

Show detailed table of vulnerabilities
Package ID Severity Installed Version Fixed Version
axios GHSA-gcfj-64vw-6mp9 HIGH 1.16.1 0.33.0, 1.18.0
axios CVE-2026-67314 MEDIUM 1.16.1 1.18.0
axios GHSA-42h9-826w-cgv3 MEDIUM 1.16.1 0.33.0, 1.18.0
axios GHSA-7q8q-rj6j-mhjq MEDIUM 1.16.1 0.33.0, 1.18.0
axios GHSA-f4gw-2p7v-4548 MEDIUM 1.16.1 1.18.0, 0.33.0
axios GHSA-hcpx-6fm6-wx23 MEDIUM 1.16.1 0.33.0, 1.18.0
axios GHSA-jqh4-m9w3-8hp9 MEDIUM 1.16.1 1.18.0
axios GHSA-mmx7-hfxf-jppx MEDIUM 1.16.1 1.18.0, 0.33.0
axios GHSA-mwf2-3pr3-8698 MEDIUM 1.16.1 1.18.0
axios GHSA-pmv8-rq9r-6j72 MEDIUM 1.16.1 0.33.0, 1.18.0
brace-expansion CVE-2026-13149 HIGH 1.1.14 5.0.7, 1.1.16, 2.1.2
brace-expansion CVE-2026-14257 HIGH 1.1.14 5.0.8, 3.0.3, 2.1.3, 1.1.17
brace-expansion CVE-2026-69152 HIGH 1.1.14 1.1.18, 2.1.4, 3.0.6, 5.0.9
brace-expansion CVE-2026-13149 HIGH 5.0.6 5.0.7, 1.1.16, 2.1.2
brace-expansion CVE-2026-14257 HIGH 5.0.6 5.0.8, 3.0.3, 2.1.3, 1.1.17
brace-expansion CVE-2026-69152 HIGH 5.0.6 1.1.18, 2.1.4, 3.0.6, 5.0.9
fast-uri CVE-2026-13676 HIGH 3.1.2 4.0.1, 3.1.3, 2.4.2
fast-uri CVE-2026-16221 HIGH 3.1.2 2.4.3, 3.1.4, 4.1.1
fast-uri CVE-2026-18446 HIGH 3.1.2 2.4.4, 3.1.5, 4.1.2
form-data CVE-2026-12143 HIGH 4.0.5 2.5.6, 3.0.5, 4.0.6
ip-address CVE-2026-69192 HIGH 10.2.0 10.3.1
ip-address CVE-2026-54272 MEDIUM 10.2.0 10.2.1
ip-address CVE-2026-69198 MEDIUM 10.2.0 10.2.2
tar CVE-2026-59873 CRITICAL 7.5.15 7.5.19
tar CVE-2026-59874 HIGH 7.5.15 7.5.18
tar CVE-2026-73566 HIGH 7.5.15 7.5.21
tar CVE-2026-53655 MEDIUM 7.5.15 7.5.16
tar CVE-2026-59871 MEDIUM 7.5.15 7.5.18
tar CVE-2026-59875 MEDIUM 7.5.15 7.5.17
tar CVE-2026-59873 CRITICAL 7.5.16 7.5.19
tar CVE-2026-59874 HIGH 7.5.16 7.5.18
tar CVE-2026-73566 HIGH 7.5.16 7.5.21
tar CVE-2026-59871 MEDIUM 7.5.16 7.5.18
tar CVE-2026-59875 MEDIUM 7.5.16 7.5.17
undici CVE-2026-12151 HIGH 6.26.0 6.27.0, 7.28.0, 8.5.0
undici CVE-2026-15157 MEDIUM 6.26.0 6.28.0, 7.29.0, 8.9.0
undici CVE-2026-16728 MEDIUM 6.26.0 6.28.0, 7.29.0, 8.9.0
undici CVE-2026-16729 MEDIUM 6.26.0 6.28.0, 7.29.0, 8.9.0
undici CVE-2026-9679 MEDIUM 6.26.0 6.27.0, 7.28.0, 8.5.0
undici CVE-2026-11525 LOW 6.26.0 6.27.0, 7.28.0, 8.5.0
undici CVE-2026-6733 LOW 6.26.0 6.27.0, 7.28.0, 8.5.0

No Misconfigurations found

Ruby

No Vulnerabilities found

No Misconfigurations found

root/.dotnet/tools/.store/firely.terminal/3.5.0/firely.terminal/3.5.0/tools/net8.0/any/Firely.Terminal.deps.json

11 known vulnerabilities found (CRITICAL: 0 HIGH: 2 MEDIUM: 9 LOW: 0)

Show detailed table of vulnerabilities
Package ID Severity Installed Version Fixed Version
MessagePack CVE-2026-48109 HIGH 2.5.187 2.5.301, 3.1.7
MessagePack CVE-2026-48506 HIGH 2.5.187 2.5.301, 3.1.7
MessagePack CVE-2026-48509 MEDIUM 2.5.187 2.5.301, 3.1.7
MessagePack CVE-2026-48510 MEDIUM 2.5.187 2.5.301, 3.1.7
MessagePack CVE-2026-48511 MEDIUM 2.5.187 2.5.301, 3.1.7
MessagePack CVE-2026-48512 MEDIUM 2.5.187 2.5.301, 3.1.7
MessagePack CVE-2026-48513 MEDIUM 2.5.187 2.5.301, 3.1.7
MessagePack CVE-2026-48514 MEDIUM 2.5.187 2.5.301, 3.1.7
MessagePack CVE-2026-48515 MEDIUM 2.5.187 2.5.301, 3.1.7
MessagePack CVE-2026-48516 MEDIUM 2.5.187 2.5.301, 3.1.7
MessagePack CVE-2026-48517 MEDIUM 2.5.187 2.5.301, 3.1.7

No Misconfigurations found

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants