Skip to content

Bump the npm_and_yarn group across 1 directory with 2 updates#178

Closed
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/docusaurus/npm_and_yarn-1f250a1353
Closed

Bump the npm_and_yarn group across 1 directory with 2 updates#178
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/docusaurus/npm_and_yarn-1f250a1353

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot bot commented on behalf of github Feb 7, 2026

Bumps the npm_and_yarn group with 2 updates in the /docusaurus directory: lodash and webpack.

Updates lodash from 4.17.21 to 4.17.23

Commits

Updates webpack from 5.103.0 to 5.105.0

Release notes

Sourced from webpack's releases.

v5.105.0

Minor Changes

  • Allow resolving worker module by export condition name when using new Worker() (by @​hai-x in #20353)

  • Detect conditional imports to avoid compile-time linking errors for non-existent exports. (by @​hai-x in #20320)

  • Added the tsconfig option for the resolver options (replacement for tsconfig-paths-webpack-plugin). Can be false (disabled), true (use the default tsconfig.json file to search for it), a string path to tsconfig.json, or an object with configFile and references options. (by @​alexander-akait in #20400)

  • Support import.defer() for context modules. (by @​ahabhgk in #20399)

  • Added support for array values ​​to the devtool option. (by @​hai-x in #20191)

  • Improve rendering node built-in modules for ECMA module output. (by @​hai-x in #20255)

  • Unknown import.meta properties are now determined at runtime instead of being statically analyzed at compile time. (by @​xiaoxiaojx in #20312)

Patch Changes

  • Fixed ESM default export handling for .mjs files in Module Federation (by @​y-okt in #20189)

  • Optimized import.meta.env handling in destructuring assignments by using cached stringified environment definitions. (by @​xiaoxiaojx in #20313)

  • Respect the stats.errorStack option in stats output. (by @​samarthsinh2660 in #20258)

  • Fixed a bug where declaring a module variable in module scope would conflict with the default moduleArgument. (by @​xiaoxiaojx in #20265)

  • Fix VirtualUrlPlugin to set resourceData.context for proper module resolution. Previously, when context was not set, it would fallback to the virtual scheme path (e.g., virtual:routes), which is not a valid filesystem path, causing subsequent resolve operations to fail. (by @​xiaoxiaojx in #20390)

  • Fixed Worker self-import handling to support various URL patterns (e.g., import.meta.url, new URL(import.meta.url), new URL(import.meta.url, import.meta.url), new URL("./index.js", import.meta.url)). Workers that resolve to the same module are now properly deduplicated, regardless of the URL syntax used. (by @​xiaoxiaojx in #20381)

  • Reuse the same async entrypoint for the same Worker URL within a module to avoid circular dependency warnings when multiple Workers reference the same resource. (by @​xiaoxiaojx in #20345)

  • Fixed a bug where a self-referencing dependency would have an unused export name when imported inside a web worker. (by @​samarthsinh2660 in #20251)

  • Fix missing export generation when concatenated modules in different chunks share the same runtime in module library bundles. (by @​hai-x in #20346)

  • Fixed import.meta.env.xxx behavior: when accessing a non-existent property, it now returns empty object instead of full object at runtime. (by @​xiaoxiaojx in #20289)

  • Improved parsing error reporting by adding a link to the loader documentation. (by @​gaurav10gg in #20244)

  • Fix typescript types. (by @​alexander-akait in #20305)

  • Add declaration for unused harmony import specifier. (by @​hai-x in #20286)

  • Fix compressibility of modules while retaining portability. (by @​dmichon-msft in #20287)

  • Optimize source map generation: only include ignoreList property when it has content, avoiding empty arrays in source maps. (by @​xiaoxiaojx in #20319)

  • Preserve star exports for dependencies in ECMA module output. (by @​hai-x in #20293)

... (truncated)

Changelog

Sourced from webpack's changelog.

5.105.0

Minor Changes

  • Allow resolving worker module by export condition name when using new Worker() (by @​hai-x in #20353)

  • Detect conditional imports to avoid compile-time linking errors for non-existent exports. (by @​hai-x in #20320)

  • Added the tsconfig option for the resolver options (replacement for tsconfig-paths-webpack-plugin). Can be false (disabled), true (use the default tsconfig.json file to search for it), a string path to tsconfig.json, or an object with configFile and references options. (by @​alexander-akait in #20400)

  • Support import.defer() for context modules. (by @​ahabhgk in #20399)

  • Added support for array values ​​to the devtool option. (by @​hai-x in #20191)

  • Improve rendering node built-in modules for ECMA module output. (by @​hai-x in #20255)

  • Unknown import.meta properties are now determined at runtime instead of being statically analyzed at compile time. (by @​xiaoxiaojx in #20312)

Patch Changes

  • Fixed ESM default export handling for .mjs files in Module Federation (by @​y-okt in #20189)

  • Optimized import.meta.env handling in destructuring assignments by using cached stringified environment definitions. (by @​xiaoxiaojx in #20313)

  • Respect the stats.errorStack option in stats output. (by @​samarthsinh2660 in #20258)

  • Fixed a bug where declaring a module variable in module scope would conflict with the default moduleArgument. (by @​xiaoxiaojx in #20265)

  • Fix VirtualUrlPlugin to set resourceData.context for proper module resolution. Previously, when context was not set, it would fallback to the virtual scheme path (e.g., virtual:routes), which is not a valid filesystem path, causing subsequent resolve operations to fail. (by @​xiaoxiaojx in #20390)

  • Fixed Worker self-import handling to support various URL patterns (e.g., import.meta.url, new URL(import.meta.url), new URL(import.meta.url, import.meta.url), new URL("./index.js", import.meta.url)). Workers that resolve to the same module are now properly deduplicated, regardless of the URL syntax used. (by @​xiaoxiaojx in #20381)

  • Reuse the same async entrypoint for the same Worker URL within a module to avoid circular dependency warnings when multiple Workers reference the same resource. (by @​xiaoxiaojx in #20345)

  • Fixed a bug where a self-referencing dependency would have an unused export name when imported inside a web worker. (by @​samarthsinh2660 in #20251)

  • Fix missing export generation when concatenated modules in different chunks share the same runtime in module library bundles. (by @​hai-x in #20346)

  • Fixed import.meta.env.xxx behavior: when accessing a non-existent property, it now returns empty object instead of full object at runtime. (by @​xiaoxiaojx in #20289)

  • Improved parsing error reporting by adding a link to the loader documentation. (by @​gaurav10gg in #20244)

  • Fix typescript types. (by @​alexander-akait in #20305)

  • Add declaration for unused harmony import specifier. (by @​hai-x in #20286)

  • Fix compressibility of modules while retaining portability. (by @​dmichon-msft in #20287)

  • Optimize source map generation: only include ignoreList property when it has content, avoiding empty arrays in source maps. (by @​xiaoxiaojx in #20319)

... (truncated)

Commits
  • 1486f9a chore(release): new release
  • 1a517f6 feat: added the tsconfig option for the resolver options (#20400)
  • 7b3b0f7 feat: support import.defer() for context modules
  • c4a6a92 refactor: more types and increase types coverage
  • 5ecc58d feat: consider asset module as side-effect-free (#20352)
  • cce0f69 test: avoid comma operator in BinaryMiddleware test (#20398)
  • cd4793d feat: support import specifier guard (#20320)
  • fe48655 docs: update examples (#20397)
  • de107f8 fix(VirtualUrlPlugin): set resourceData.context to avoid invalid fallback (#2...
  • a656ab1 test: add self-import test case for dynamic import (#20389)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for webpack since your current version.


Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Feb 7, 2026
@dependabot dependabot bot requested a review from Nick2bad4u as a code owner February 7, 2026 17:26
@dependabot dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Feb 7, 2026
@Nick2bad4u
Copy link
Copy Markdown
Owner

Nick2bad4u commented Feb 7, 2026

Snyk checks have passed. No issues have been found so far.

Status Scanner Critical High Medium Low Total (0)
Open Source Security 0 0 0 0 0 issues
Code Security 0 0 0 0 0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Feb 7, 2026

Summary of Pull Request:

This pull request proposes to update two dependencies (lodash and webpack) within the /docusaurus directory by bumping their versions to newer releases. These updates are likely aimed at obtaining the benefits of the latest performance improvements, bug fixes, and enhanced features. Here are the details of the changes:

  1. lodash Update

    • Current version: 4.17.21
    • Updated version: 4.17.23
    • Key Changes:
      • Fixes to certain type definitions in JSDoc (e.g., setCacheHas type fix).
      • Addressed prototype pollution vulnerability in the baseUnset function.
      • Added Renovate configuration and other CI-related updates.
  2. webpack Update

    • Current version: 5.103.0
    • Updated version: 5.105.0
    • Key Changes:
      • Minor improvements

@github-actions
Copy link
Copy Markdown
Contributor

Here is a summary of the pull request to explain to the project owner:


Pull Request Summary:

  • Title: Bump the npm_and_yarn group across 1 directory with 2 updates
  • Changes: Updates two dependencies (lodash and webpack) in the /docusaurus directory to newer versions using Dependabot.

Dependency Updates:

  1. lodash:

    • Updated from 4.17.21 to 4.17.23.
    • Includes security fixes (e.g., prevention of prototype pollution in the baseUnset function) and documentation improvements (e.g., updates to JSDoc and falsey value information).
  2. webpack:

    • Updated from 5.103.0 to 5.105.0.
    • Includes both minor changes and patch improvements:
      • Added new features like resolving worker modules via export conditions, supporting `ts

Bumps the npm_and_yarn group with 2 updates in the /docusaurus directory: [lodash](https://github.com/lodash/lodash) and [webpack](https://github.com/webpack/webpack).


Updates `lodash` from 4.17.21 to 4.17.23
- [Release notes](https://github.com/lodash/lodash/releases)
- [Commits](lodash/lodash@4.17.21...4.17.23)

Updates `webpack` from 5.103.0 to 5.105.0
- [Release notes](https://github.com/webpack/webpack/releases)
- [Changelog](https://github.com/webpack/webpack/blob/main/CHANGELOG.md)
- [Commits](webpack/webpack@v5.103.0...v5.105.0)

---
updated-dependencies:
- dependency-name: lodash
  dependency-version: 4.17.23
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: webpack
  dependency-version: 5.105.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot force-pushed the dependabot/npm_and_yarn/docusaurus/npm_and_yarn-1f250a1353 branch from e680f77 to f302868 Compare February 25, 2026 22:04
@github-actions
Copy link
Copy Markdown
Contributor

Summary of the Pull Request:

This pull request updates two dependencies within the /docusaurus directory for the project:

  1. lodash: Upgraded from version 4.17.21 to 4.17.23.

    • Includes various improvements and fixes, such as:
      • Addressing prototype pollution vulnerabilities with the baseUnset function.
      • Improved documentation and JSDoc updates.
      • Removal of deprecated files and updated configuration for better dependency management.
  2. webpack: Upgraded from version 5.103.0 to 5.105.0.

    • Significant updates include:
      • Support for tsconfig resolver options as a replacement for tsconfig-paths-webpack-plugin.
      • Introduction of import.defer() for context modules.
      • Various performance optimizations, including source map generation and deduplication for worker imports.
      • Several bug fixes, such as better handling of

@github-actions
Copy link
Copy Markdown
Contributor

Summary of Pull Request:

This Dependabot pull request proposes an update to two npm and Yarn dependencies—lodash and webpack—used in the /docusaurus directory of your project.

Details of the Updates:

  1. lodash:

    • Updated version: 4.17.21 → 4.17.23
    • Noteworthy changes:
      • Fixed prototype pollution vulnerability in the baseUnset function.
      • Updated documentation and type annotations.
      • General improvements such as: added support for BigInt zeros, removed yarn.lock file from the project, and refined CI configurations.
  2. webpack:

    • Updated version: 5.103.0 → 5.105.0
    • Noteworthy changes:
      • New features, including:
        • Support for tsconfig option in the resolver.
        • Enhanced handling of worker modules

@github-actions
Copy link
Copy Markdown
Contributor

This pull request updates two dependencies, lodash and webpack, in the /docusaurus directory as part of the npm_and_yarn group. Below is a summary of the changes:

Dependency Updates:

  1. Lodash:

    • Version upgrade: 4.17.21 → 4.17.23
    • Key updates:
      • Fixes to the setCacheHas JSDoc return type.
      • Security improvement: prevention of prototype pollution in the baseUnset function.
      • Documentation and maintenance updates, including updated links and removal of the yarn.lock file.
    • Full list of changes is available in the compare view.
  2. Webpack:

    • Version upgrade: 5.103.0 → 5.105.0

@codecov
Copy link
Copy Markdown

codecov bot commented Feb 25, 2026

❌ 8 Tests Failed:

Tests completed Failed Passed Skipped
4489 8 4481 1
View the top 3 failed test(s) by shortest run time
tests/unit/utils/state/core/stateMiddleware.comprehensive.test.ts > StateMiddlewareManager - comprehensive coverage > persistence middleware saves specific paths to localStorage (happy and error paths)
Stack Traces | 0.00474s run time
AssertionError: expected "setItem" to be called at least once
 ❯ .../state/core/stateMiddleware.comprehensive.test.ts:263:28
tests/unit/utils/ui/controls/createPowerZoneControlsSimple.test.ts > createPowerZoneControlsSimple > initializes in collapsed state when stored preference exists
Stack Traces | 0.0113s run time
AssertionError: expected '0' to be '0px' // Object.is equality

Expected: "0px"
Received: "0"

 ❯ .../ui/controls/createPowerZoneControlsSimple.test.ts:96:42
tests/strictTests/createChartStatusIndicatorFromCounts.test.ts > createChartStatusIndicatorFromCounts > Button Interactions > should remove outline after timeout
Stack Traces | 0.0281s run time
AssertionError: expected '0' to be '0px' // Object.is equality

Expected: "0px"
Received: "0"

 ❯ tests/strictTests/createChartStatusIndicatorFromCounts.test.ts:461:55
tests/unit/utils/charts/components/createChartStatusIndicator.test.ts > createChartStatusIndicator > click scrolls to fields section and briefly highlights it
Stack Traces | 0.0308s run time
AssertionError: expected '0' to be '0px' // Object.is equality

Expected: "0px"
Received: "0"

 ❯ .../charts/components/createChartStatusIndicator.test.ts:149:44
tests/unit/utils/ui/controls/createPowerZoneControlsSimple.test.ts > createPowerZoneControlsSimple > creates controls section with collapse toggle and persists state
Stack Traces | 0.0505s run time
AssertionError: expected '0' to be '0px' // Object.is equality

Expected: "0px"
Received: "0"

 ❯ .../ui/controls/createPowerZoneControlsSimple.test.ts:57:42
tests/unit/utils/ui/controls/createHRZoneControls.additional.test.ts > createHRZoneControls additional coverage > honors persisted collapse state and updates hover styles
Stack Traces | 0.0549s run time
AssertionError: expected '0' to be '0px' // Object.is equality

Expected: "0px"
Received: "0"

 ❯ .../ui/controls/createHRZoneControls.additional.test.ts:67:41
tests/strictTests/ui/controls/createPowerZoneControls.test.ts > createPowerZoneControls > creates section and toggles collapse state
Stack Traces | 0.457s run time
AssertionError: expected '0' to be '0px' // Object.is equality

Expected: "0px"
Received: "0"

 ❯ .../ui/controls/createPowerZoneControls.test.ts:26:41
tests/strictTests/ui/controls/createHRZoneControls.test.ts > createHRZoneControls > creates section and toggles collapse state
Stack Traces | 0.491s run time
AssertionError: expected '0' to be '0px' // Object.is equality

Expected: "0px"
Received: "0"

 ❯ .../ui/controls/createHRZoneControls.test.ts:28:41

To view more test analytics, go to the Test Analytics Dashboard
📋 Got 3 mins? Take this short survey to help us improve Test Analytics.

@github-actions
Copy link
Copy Markdown
Contributor

⚠️MegaLinter analysis: Success with warnings

Descriptor Linter Files Fixed Errors Warnings Elapsed time
✅ ACTION actionlint 42 0 0 1.16s
⚠️ BASH bash-exec 1 1 0 0.01s
✅ BASH shellcheck 1 0 0 0.05s
⚠️ BASH shfmt 1 1 0 0.01s
✅ COPYPASTE jscpd yes no no 52.31s
⚠️ CSS stylelint 9 306 0 17.6s
⚠️ HTML djlint 2 2 0 1.83s
✅ HTML htmlhint 2 0 0 0.44s
⚠️ JAVASCRIPT prettier 348 348 0 118.2s
⚠️ JSON jsonlint 28 2 0 5.25s
⚠️ JSON npm-package-json-lint yes 1 no 0.71s
⚠️ JSON prettier 28 23 0 10.7s
⚠️ JSON v8r 28 1 0 61.69s
⚠️ MARKDOWN markdownlint 37 8 0 22.39s
✅ MARKDOWN markdown-table-formatter 29 0 0 7.14s
⚠️ POWERSHELL powershell 5 2 0 7.72s
✅ POWERSHELL powershell_formatter 5 0 0 5.6s
✅ REPOSITORY checkov yes no no 57.96s
⚠️ REPOSITORY devskim yes no 1 9.59s
✅ REPOSITORY dustilock yes no no 4.85s
✅ REPOSITORY gitleaks yes no no 6.45s
✅ REPOSITORY git_diff yes no no 0.38s
⚠️ REPOSITORY grype yes 2 47 88.28s
⚠️ REPOSITORY kics yes 1 1 5.93s
✅ REPOSITORY kingfisher yes no no 8.37s
⚠️ REPOSITORY secretlint yes 3 no 21.73s
✅ REPOSITORY syft yes no no 28.2s
⚠️ REPOSITORY trivy yes 6 11 12.01s
✅ REPOSITORY trivy-sbom yes no no 6.63s
✅ REPOSITORY trufflehog yes no no 14.76s
⚠️ SPELL cspell 826 2963 0 1600.33s
⚠️ SPELL lychee 122 8 0 152.7s
⚠️ TYPESCRIPT ts-standard 311 311 0 128.88s
✅ XML xmllint 1 0 0 1.45s
⚠️ YAML prettier 54 52 104 23.15s
✅ YAML v8r 54 0 0 130.32s
⚠️ YAML yamllint 54 177 0 12.66s

Detailed Issues

⚠️ BASH / bash-exec - 1 error
Results of bash-exec linter (version 5.3.3)
See documentation on https://megalinter.io/9.3.0/descriptors/bash_bash_exec/
-----------------------------------------------

❌ [ERROR] .github/hooks/scripts/log-prompt.sh
    Error: File:[.github/hooks/scripts/log-prompt.sh] is not executable
⚠️ SPELL / cspell - 2963 errors
Results of cspell linter (version 9.4.0)
See documentation on https://megalinter.io/9.3.0/descriptors/spell_cspell/
-----------------------------------------------

✅ [SUCCESS] .checkov.yml
✅ [SUCCESS] .devskim.json
✅ [SUCCESS] .djlintrc
✅ [SUCCESS] .git/FETCH_HEAD
✅ [SUCCESS] .git/HEAD
❌ [ERROR] .git/config
    .git/config:11:13     - Unknown word (gitdir)     -- [includeIf "gitdir:/home/runner/work/FitFileView
    	 Suggestions: [gitdm, gilder, girder, gitter, giddier]
    .git/config:13:13     - Unknown word (gitdir)     -- [includeIf "gitdir:/home/runner/work/FitFileView
    	 Suggestions: [gitdm, gilder, girder, gitter, giddier]
    .git/config:13:71     - Unknown word (worktrees)  -- FileViewer/FitFileViewer/.git/worktrees/*"]
    	 Suggestions: [workers, worker's, workarea, workArea, worries]
    .git/config:15:13     - Unknown word (gitdir)     -- [includeIf "gitdir:.git
    	 Suggestions: [gitdm, gilder, girder, gitter, giddier]
    .git/config:17:13     - Unknown word (gitdir)     -- [includeIf "gitdir:.git
    	 Suggestions: [gitdm, gilder, girder, gitter, giddier]
    .git/config:17:43     - Unknown word (worktrees)  -- .git/worktrees/*"]
    	 Suggestions: [workers, worker's, workarea, workArea, worries]
    CSpell: Files checked: 1, Issues found: 6 in 1 file.

✅ [SUCCESS] .git/description
✅ [SUCCESS] .git/index
✅ [SUCCESS] .git/info/exclude
✅ [SUCCESS] .git/logs/HEAD
✅ [SUCCESS] .git/logs/refs/heads/dependabot/npm_and_yarn/docusaurus/npm_and_yarn-1f250a1353
✅ [SUCCESS] .git/logs/refs/remotes/origin/dependabot/npm_and_yarn/docusaurus/npm_and_yarn-1f250a1353
✅ [SUCCESS] .git/refs/heads/dependabot/npm_and_yarn/docusaurus/npm_and_yarn-1f250a1353
✅ [SUCCESS] .git/refs/remotes/origin/dependabot/npm_and_yarn/docusaurus/npm_and_yarn-1f250a1353
✅ [SUCCESS] .git/shallow
❌ [ERROR] .github/.spellcheck.yml
    .github/.spellcheck.yml:6:11      - Unknown word (wordlists) 

(Truncated to 1904 characters out of 580347)
⚠️ REPOSITORY / devskim - 1 warning
electron-app/tests/strictTests/files/export/gpxExport.test.ts:49:27:49:48 [Moderate] DS137138 Insecure URL
[22:07:40 ERR] Failed to parse Data at the root level is invalid. Line 1, position 1. as a XML document: null
.devskim.json:41:46:41:55 [ManualReview] DS162092 Do not leave debug code in production
.devskim.json:47:66:47:75 [ManualReview] DS162092 Do not leave debug code in production
.devskim.json:53:61:53:70 [ManualReview] DS162092 Do not leave debug code in production
.devskim.json:59:61:59:70 [ManualReview] DS162092 Do not leave debug code in production
[22:07:40 ERR] Failed to parse Data at the root level is invalid. Line 1, position 1. as a XML document: null
[22:07:40 ERR] Failed to parse Data at the root level is invalid. Line 1, position 1. as a XML document: null
[22:07:40 ERR] Failed to parse Data at the root level is invalid. Line 1, position 1. as a XML document: null
electron-app/utils/state/integration/stateIntegration.js:243:67:249:52 [ManualReview] DS172411 Review setTimeout for untrusted data
electron-app/utils/state/integration/stateIntegration.js:346:26:346:35 [ManualReview] DS162092 Do not leave debug code in production
electron-app/utils/state/integration/stateIntegration.js:347:26:347:35 [ManualReview] DS162092 Do not leave debug code in production
electron-app/utils/state/integration/rendererStateIntegration.js:54:4:54:34 [ManualReview] DS172411 Review setTimeout for untrusted data
electron-app/utils.js:545:0:546:49 [ManualReview] DS172411 Review setTimeout for untrusted data
electron-app/tests/unit/main.final-coverage.test.ts:225:20:227:68 [ManualReview] DS172411 Review setTimeout for untrusted data
electron-app/tests/unit/main.final-coverage.test.ts:232:16:232:55 [ManualReview] DS172411 Review setTimeout for untrusted data
electron-app/tests/unit/main.final-coverage.test.ts:237:12:239:21 [ManualReview] DS172411 Review setTimeout for untruste

(Truncated to 1904 characters out of 32627)
⚠️ HTML / djlint - 2 errors
Results of djlint linter (version 1.36.4)
See documentation on https://megalinter.io/9.3.0/descriptors/html_djlint/
-----------------------------------------------

❌ [ERROR] electron-app/ffv/index.html
    
    
    Linting 0/1 files ┈┈┈┈┈┈┈┈┈┈ 00:00    
                                          
    
    Linting 1/1 files ━━━━━━━━━━ 00:00    
    Linting 1/1 files ━━━━━━━━━━ 00:00    
    
    
    electron-app/ffv/index.html
    ───────────────────────────────────────────────────────────────────────────────
    H031 2:0 Consider adding meta keywords. <html lang="en"> 
    H037 7:41 Duplicate attribute found. initial-scale
    
    Linted 1 file, found 2 errors.

✅ [SUCCESS] electron-app/index.html
⚠️ REPOSITORY / grype - 2 errors
warning: A medium vulnerability in npm package: ajv, version 6.12.6 was found at: /docusaurus/package-lock.json

warning: A medium vulnerability in npm package: ajv, version 8.17.1 was found at: /docusaurus/package-lock.json

warning: A medium vulnerability in npm package: ajv, version 8.17.1 was found at: /electron-app/package-lock.json

error: A high vulnerability in npm package: minimatch, version 3.1.2 was found at: /docusaurus/package-lock.json

error: A high vulnerability in npm package: minimatch, version 9.0.5 was found at: /docusaurus/package-lock.json

warning: A medium vulnerability in npm package: lodash, version 4.17.21 was found at: /electron-app/package-lock.json

warning: A medium vulnerability in npm package: lodash-es, version 4.17.21 was found at: /docusaurus/package-lock.json

warning: A medium vulnerability in github-action package: step-security/harden-runner, version v2.14.1 was found at: /.github/workflows/prettier.yml

warning: A medium vulnerability in github-action package: step-security/harden-runner, version v2.14.1 was found at: /.github/workflows/release-stats.yml

warning: A medium vulnerability in github-action package: step-security/harden-runner, version v2.14.1 was found at: /.github/workflows/build-win7.yml

warning: A medium vulnerability in github-action package: step-security/harden-runner, version v2.14.1 was found at: /.github/workflows/cleanReleases.yml

warning: A medium vulnerability in github-action package: step-security/harden-runner, version v2.14.1 was found at: /.github/workflows/codeql.yml

warning: A medium vulnerability in github-action package: step-security/harden-runner, version v2.14.1 was found at: /.github/workflows/dependency-review.yml

warning: A medium vulnerability in github-action package: step-security/harden-runner, version v2.14.1 was found at: /.github/workflows/devskim.yml

warning: A medium vulnerabil

(Truncated to 1904 characters out of 7215)
⚠️ JSON / jsonlint - 2 errors
Results of jsonlint linter (version 16.0.0)
See documentation on https://megalinter.io/9.3.0/descriptors/json_jsonlint/
-----------------------------------------------

✅ [SUCCESS] .devskim.json
✅ [SUCCESS] .github/hooks/hooks.json
✅ [SUCCESS] .jscpd.json
✅ [SUCCESS] .markdown-link-check.json
✅ [SUCCESS] .markdownlint.json
✅ [SUCCESS] .ncurc.json
✅ [SUCCESS] .prettierrc.json
✅ [SUCCESS] .vscode/extensions.json
✅ [SUCCESS] .vscode/launch.json
✅ [SUCCESS] .vscode/settings.json
✅ [SUCCESS] .vscode/tasks.json
✅ [SUCCESS] cspell.json
✅ [SUCCESS] docusaurus/package-lock.json
✅ [SUCCESS] docusaurus/package.json
✅ [SUCCESS] docusaurus/tsconfig.json
✅ [SUCCESS] docusaurus/typedoc.json
✅ [SUCCESS] docusaurus/typedoc.local.json
✅ [SUCCESS] electron-app/.markdown-link-check.json
✅ [SUCCESS] electron-app/.markdownlint.json
✅ [SUCCESS] electron-app/.npmpackagejsonlintrc.json
✅ [SUCCESS] electron-app/.vscode/tasks.json
✅ [SUCCESS] electron-app/ffv/manifest.json
✅ [SUCCESS] electron-app/package-lock.json
✅ [SUCCESS] electron-app/package.json
❌ [ERROR] electron-app/tsconfig.json
    File: electron-app/tsconfig.json
    Parse error on line 57, column 9:
    ...ck": false,        // We use extensive ...
    ----------------------^
    Unexpected token "/"

❌ [ERROR] electron-app/tsconfig.vitest.json
    File: electron-app/tsconfig.vitest.json
    Parse error on line 4, column 9:
    ...Options": {        // Vitest's typechec...
    ----------------------^
    Unexpected token "/"

✅ [SUCCESS] mermaid.config.json
✅ [SUCCESS] package.json
⚠️ REPOSITORY / kics - 1 error
warning: Action is not pinned to a full length commit SHA.
   ┌─ .github/workflows/vitest.yml:92:1
   │
92 │               uses: codecov/test-results-action@v1
   │ ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
   │
   = Unpinned Actions Full Length Commit SHA
   = Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload. When selecting a SHA, you should verify it is from the action's repository and not a repository fork.

warning: 1 warnings emitted
⚠️ SPELL / lychee - 8 errors
Results of lychee linter (version 0.18.0)
See documentation on https://megalinter.io/9.3.0/descriptors/spell_lychee/
-----------------------------------------------

✅ [SUCCESS] .checkov.yml
✅ [SUCCESS] .devskim.json
✅ [SUCCESS] .github/.spellcheck.yml
✅ [SUCCESS] .github/CHANGELOG.md
✅ [SUCCESS] .github/ISSUE_TEMPLATE/bug_report.md
✅ [SUCCESS] .github/ISSUE_TEMPLATE/custom-issue.md
✅ [SUCCESS] .github/ISSUE_TEMPLATE/feature_request.md
✅ [SUCCESS] .github/PROMPTS/Consistency-Check.prompt.md
✅ [SUCCESS] .github/PROMPTS/Continue.prompt.md
✅ [SUCCESS] .github/PROMPTS/Do-ToDo.prompt.md
✅ [SUCCESS] .github/PROMPTS/Fix-Eslint-Errors.prompt.md
❌ [ERROR] .github/PROMPTS/Generate-100%-Test-Coverage.prompt.md
    [ERROR] https://vitest.dev/api/assert.html | Network error: error sending request for url (https://vitest.dev/api/assert.html)
    [200] https://vitest.dev/api/
    [200] https://vitest.dev/guide/mocking.html
    [200] https://vitest.dev/guide/test-context.html
    [200] https://vitest.dev/guide/testing-types.html
    [200] https://vitest.dev/config/#benchmark
    [200] https://vitest.dev/guide/snapshot.html
    
    📝 Summary
    ---------------------
    🔍 Total............7
    ✅ Successful.......6
    ⏳ Timeouts.........0
    🔀 Redirected.......0
    👻 Excluded.........0
    ❓ Unknown..........0
    🚫 Errors...........1
    
    Errors in .github/PROMPTS/Generate-100%-Test-Coverage.prompt.md
    [ERROR] https://vitest.dev/api/assert.html | Network error: error sending request for url (https://vitest.dev/api/assert.html)

✅ [SUCCESS] .github/PROMPTS/Review.prompt.md
✅ [SUCCESS] .github/PULL_REQUEST_TEMPLATE/README.md
✅ [SUCCESS] .github/PULL_REQUEST_TEMPLATE/bugfix.md
✅ [SUCCESS] .github/PULL_REQUEST_TEMPLATE/documentation.md
✅ [SUCCESS] .github/PULL_REQUEST_TEMPLATE/feature.md
✅ [SUCCESS] .github/PULL_REQUEST_TEMPLATE/maintenance.md
✅ [SUCCESS] .github/PULL_REQUEST_TEM

(Truncated to 1904 characters out of 297104)
⚠️ MARKDOWN / markdownlint - 8 errors
Results of markdownlint linter (version 0.47.0)
See documentation on https://megalinter.io/9.3.0/descriptors/markdown_markdownlint/
-----------------------------------------------

✅ [SUCCESS] .github/CHANGELOG.md
✅ [SUCCESS] .github/ISSUE_TEMPLATE/bug_report.md
✅ [SUCCESS] .github/ISSUE_TEMPLATE/custom-issue.md
✅ [SUCCESS] .github/ISSUE_TEMPLATE/feature_request.md
✅ [SUCCESS] .github/PROMPTS/Consistency-Check.prompt.md
✅ [SUCCESS] .github/PROMPTS/Continue.prompt.md
❌ [ERROR] .github/PROMPTS/Do-ToDo.prompt.md
    .github/PROMPTS/Do-ToDo.prompt.md:21:124 error MD026/no-trailing-punctuation Trailing punctuation in heading [Punctuation: '.']

✅ [SUCCESS] .github/PROMPTS/Fix-Eslint-Errors.prompt.md
❌ [ERROR] .github/PROMPTS/Generate-100%-Test-Coverage.prompt.md
    .github/PROMPTS/Generate-100%-Test-Coverage.prompt.md:53:1 error MD029/ol-prefix Ordered list item prefix [Expected: 1; Actual: 6; Style: 1/2/3]
    .github/PROMPTS/Generate-100%-Test-Coverage.prompt.md:54:1 error MD029/ol-prefix Ordered list item prefix [Expected: 2; Actual: 7; Style: 1/2/3]
    .github/PROMPTS/Generate-100%-Test-Coverage.prompt.md:100:32 error MD026/no-trailing-punctuation Trailing punctuation in heading [Punctuation: ':']

✅ [SUCCESS] .github/PROMPTS/Review.prompt.md
✅ [SUCCESS] .github/PULL_REQUEST_TEMPLATE/README.md
✅ [SUCCESS] .github/PULL_REQUEST_TEMPLATE/bugfix.md
✅ [SUCCESS] .github/PULL_REQUEST_TEMPLATE/documentation.md
✅ [SUCCESS] .github/PULL_REQUEST_TEMPLATE/feature.md
✅ [SUCCESS] .github/PULL_REQUEST_TEMPLATE/maintenance.md
✅ [SUCCESS] .github/PULL_REQUEST_TEMPLATE/pull_request_template.md
✅ [SUCCESS] .github/PULL_REQUEST_TEMPLATE/quick-fix.md
✅ [SUCCESS] .github/agents/BeastMode.agent.md
✅ [SUCCESS] .github/copilot-commit-message-instructions.md
✅ [SUCCESS] .github/copilot-instructions.md
✅ [SUCCESS] CHANGELOG.md
✅ [SUCCESS] CODE_OF_CONDUCT.md
✅ [SUCCESS] CONTRIBUTING.md
✅ [SUCCESS] 

(Truncated to 1904 characters out of 3183)
⚠️ JSON / npm-package-json-lint - 1 error
./package.json
✖ require-version - node: version - version is required
1 error
⚠️ POWERSHELL / powershell - 2 errors
Results of powershell linter (version 7.5.4)
See documentation on https://megalinter.io/9.3.0/descriptors/powershell_powershell/
-----------------------------------------------

✅ [SUCCESS] .github/CleanReleases.ps1
✅ [SUCCESS] .github/RepoSize.ps1
✅ [SUCCESS] .github/Update-ChangeLogs.ps1
❌ [ERROR] .github/hooks/scripts/log-prompt.ps1
    
    Severity    RuleName                         ScriptName     Line Message
    --------    --------                         ----------     ---- -------
    Warning     PSUseBOMForUnicodeEncodedFile    log-prompt.ps1      Missing BOM encoding for non-ASCII encoded file 'log-prompt.ps1'
    Information PSAvoidUsingPositionalParameters log-prompt.ps1   17 Cmdlet 'Join-Path' has positional parameter. Please use named parameters instead of p
                                                                     ositional parameters when calling a command.

✅ [SUCCESS] .github/hooks/scripts/remove-temp.ps1
⚠️ JAVASCRIPT / prettier - 348 errors
Results of prettier linter (version 3.7.4)
See documentation on https://megalinter.io/9.3.0/descriptors/javascript_prettier/
-----------------------------------------------

❌ [ERROR] electron-app/__mocks__/electron.js
    Checking formatting...
    [error] Cannot find package 'prettier-plugin-packagejson' imported from noop.js

❌ [ERROR] electron-app/ffv/assets/Results-H2VOSWW7.js
    Checking formatting...
    [error] Cannot find package 'prettier-plugin-packagejson' imported from noop.js

❌ [ERROR] electron-app/ffv/assets/Sprite-BZ4Kwmf3.js
    Checking formatting...
    [error] Cannot find package 'prettier-plugin-packagejson' imported from noop.js

❌ [ERROR] electron-app/ffv/assets/binaryString-DLpsQS3c.js
    Checking formatting...
    [error] Cannot find package 'prettier-plugin-packagejson' imported from noop.js

❌ [ERROR] electron-app/ffv/assets/findFields-C7eiFatx.js
    Checking formatting...
    [error] Cannot find package 'prettier-plugin-packagejson' imported from noop.js

❌ [ERROR] electron-app/ffv/assets/getMessagesForName-CXPND5Gu.js
    Checking formatting...
    [error] Cannot find package 'prettier-plugin-packagejson' imported from noop.js

❌ [ERROR] electron-app/ffv/assets/index-B6xcXKpx.js
    Checking formatting...
    [error] Cannot find package 'prettier-plugin-packagejson' imported from noop.js

❌ [ERROR] electron-app/ffv/assets/index-C1xoUegX.js
    Checking formatting...
    [error] Cannot find package 'prettier-plugin-packagejson' imported from noop.js

❌ [ERROR] electron-app/ffv/assets/index-CQWboq_8.js
    Checking formatting...
    [error] Cannot find package 'prettier-plugin-packagejson' imported from noop.js

❌ [ERROR] electron-app/ffv/assets/index-D4CCfpM1.js
    Checking formatting...
    [error] Cannot find package 'prettier-plugin-packagejson' imported from noop.js

❌ [ERROR] electron-app/ffv/assets/index-LvWRIhnC.js
    Checking form

(Truncated to 1904 characters out of 60113)
⚠️ JSON / prettier - 23 errors
Results of prettier linter (version 3.7.4)
See documentation on https://megalinter.io/9.3.0/descriptors/json_prettier/
-----------------------------------------------

❌ [ERROR] .devskim.json
    Checking formatting...
    [warn] .devskim.json
    [warn] Code style issues found in the above file. Run Prettier with --write to fix.

❌ [ERROR] .github/hooks/hooks.json
    Checking formatting...
    [warn] .github/hooks/hooks.json
    [warn] Code style issues found in the above file. Run Prettier with --write to fix.

❌ [ERROR] .jscpd.json
    Checking formatting...
    [warn] .jscpd.json
    [warn] Code style issues found in the above file. Run Prettier with --write to fix.

❌ [ERROR] .markdown-link-check.json
    Checking formatting...
    [warn] .markdown-link-check.json
    [warn] Code style issues found in the above file. Run Prettier with --write to fix.

❌ [ERROR] .markdownlint.json
    Checking formatting...
    [warn] .markdownlint.json
    [warn] Code style issues found in the above file. Run Prettier with --write to fix.

❌ [ERROR] .ncurc.json
    Checking formatting...
    [warn] .ncurc.json
    [warn] Code style issues found in the above file. Run Prettier with --write to fix.

❌ [ERROR] .prettierrc.json
    Checking formatting...
    [warn] .prettierrc.json
    [warn] Code style issues found in the above file. Run Prettier with --write to fix.

❌ [ERROR] .vscode/extensions.json
    Checking formatting...
    [warn] .vscode/extensions.json
    [warn] Code style issues found in the above file. Run Prettier with --write to fix.

❌ [ERROR] .vscode/launch.json
    Checking formatting...
    [warn] .vscode/launch.json
    [warn] Code style issues found in the above file. Run Prettier with --write to fix.

❌ [ERROR] .vscode/settings.json
    Checking formatting...
    [warn] .vscode/settings.json
    [warn] Code style issues found in the above file. Run Prettier with -

(Truncated to 1904 characters out of 4614)
⚠️ YAML / prettier - 52 errors
Results of prettier linter (version 3.7.4)
See documentation on https://megalinter.io/9.3.0/descriptors/yaml_prettier/
-----------------------------------------------

❌ [ERROR] .checkov.yml
    Checking formatting...
    [warn] .checkov.yml
    [warn] Code style issues found in the above file. Run Prettier with --write to fix.

❌ [ERROR] .github/.spellcheck.yml
    Checking formatting...
    [warn] .github/.spellcheck.yml
    [warn] Code style issues found in the above file. Run Prettier with --write to fix.

❌ [ERROR] .github/dependabot.yml
    Checking formatting...
    [warn] .github/dependabot.yml
    [warn] Code style issues found in the above file. Run Prettier with --write to fix.

❌ [ERROR] .github/workflows/ActionLint.yml
    Checking formatting...
    [warn] .github/workflows/ActionLint.yml
    [warn] Code style issues found in the above file. Run Prettier with --write to fix.

❌ [ERROR] .github/workflows/Build.yml
    Checking formatting...
    [warn] .github/workflows/Build.yml
    [warn] Code style issues found in the above file. Run Prettier with --write to fix.

❌ [ERROR] .github/workflows/VirusTotal.yml
    Checking formatting...
    [warn] .github/workflows/VirusTotal.yml
    [warn] Code style issues found in the above file. Run Prettier with --write to fix.

❌ [ERROR] .github/workflows/build-win7.yml
    Checking formatting...
    [warn] .github/workflows/build-win7.yml
    [warn] Code style issues found in the above file. Run Prettier with --write to fix.

❌ [ERROR] .github/workflows/cleanReleases.yml
    Checking formatting...
    [warn] .github/workflows/cleanReleases.yml
    [warn] Code style issues found in the above file. Run Prettier with --write to fix.

❌ [ERROR] .github/workflows/codeql.yml
    Checking formatting...
    [warn] .github/workflows/codeql.yml
    [warn] Code style issues found in the above file. Run Prettier with --write to fix.


(Truncated to 1904 characters out of 10613)
⚠️ REPOSITORY / secretlint - 3 errors
error: found basic auth credential: *****************************
    ┌─ electron-app/tests/unit/main/ipc/registerExternalHandlers.test.js:201:47
    │
201 │                 shellOpenExternalHandler({}, "https://user:pass@example.com")
    │                                               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
    │
    = secretlint rule(@secretlint/secretlint-rule-preset-recommend > @secretlint/secretlint-rule-basicauth) error

error: found basic auth credential: *****************************
   ┌─ electron-app/tests/unit/main/security/externalUrlPolicy.test.ts:25:34
   │
25 │             validateExternalUrl("https://user:pass@example.com")
   │                                  ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
   │
   = secretlint rule(@secretlint/secretlint-rule-preset-recommend > @secretlint/secretlint-rule-basicauth) error

error: found basic auth credential: *****************************
   ┌─ electron-app/tests/unit/main/updater/setupAutoUpdater.test.ts:78:23
   │
78 │             feedURL: "https://user:pass@example.com/releases",
   │                       ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
   │
   = secretlint rule(@secretlint/secretlint-rule-preset-recommend > @secretlint/secretlint-rule-basicauth) error

error: 3 errors emitted
⚠️ BASH / shfmt - 1 error
Results of shfmt linter (version 3.12.0)
See documentation on https://megalinter.io/9.3.0/descriptors/bash_shfmt/
-----------------------------------------------

❌ [ERROR] .github/hooks/scripts/log-prompt.sh
    diff .github/hooks/scripts/log-prompt.sh.orig .github/hooks/scripts/log-prompt.sh
    --- .github/hooks/scripts/log-prompt.sh.orig
    +++ .github/hooks/scripts/log-prompt.sh
    @@ -13,9 +13,9 @@
     chmod 700 "$LOG_DIR"
     
     jq -n \
    -    --arg ts "$TIMESTAMP_MS" \
    -    --arg cwd "$CWD" \
    -    '{event:"userPromptSubmitted", timestampMs:$ts, cwd:$cwd}' \
    -    >> "$LOG_DIR/audit.jsonl"
    +	--arg ts "$TIMESTAMP_MS" \
    +	--arg cwd "$CWD" \
    +	'{event:"userPromptSubmitted", timestampMs:$ts, cwd:$cwd}' \
    +	>>"$LOG_DIR/audit.jsonl"
     
     exit 0
⚠️ CSS / stylelint - 306 errors
Results of stylelint linter (version 16.26.1)
See documentation on https://megalinter.io/9.3.0/descriptors/css_stylelint/
-----------------------------------------------

❌ [ERROR] docusaurus/src/components/GitHubStats/styles.module.css
    (node:6781) [MODULE_TYPELESS_PACKAGE_JSON] Warning: Module type of file://stylelint.config.js is not specified and it doesn't parse as CommonJS.
    Reparsing as ES module because module syntax was detected. This incurs a performance overhead.
    To eliminate this warning, add "type": "module" to package.json.
    (Use `node --trace-warnings ...` to show where the warning was created)
    
    docusaurus/src/components/GitHubStats/styles.module.css
       1:1  ✖  Expected class selector ".githubStats" to be kebab-case  selector-class-pattern
       8:1  ✖  Expected class selector ".statBadge" to be kebab-case    selector-class-pattern
      22:1  ✖  Expected class selector ".statBadge" to be kebab-case    selector-class-pattern
    
    ✖ 3 problems (3 errors, 0 warnings)

❌ [ERROR] docusaurus/src/components/HomepageFeatures/styles.module.css
    (node:6811) [MODULE_TYPELESS_PACKAGE_JSON] Warning: Module type of file://stylelint.config.js is not specified and it doesn't parse as CommonJS.
    Reparsing as ES module because module syntax was detected. This incurs a performance overhead.
    To eliminate this warning, add "type": "module" to package.json.
    (Use `node --trace-warnings ...` to show where the warning was created)
    
    docusaurus/src/components/HomepageFeatures/styles.module.css
       6:1  ✖  Expected class selector ".featuresTitle" to be kebab-case       selector-class-pattern
      13:1  ✖  Expected class selector ".featureCard" to be kebab-case         selector-class-pattern
      23:1  ✖  Expected class selector ".featureCard" to be kebab-case         selector-class-pattern
      29:1  ✖  Expected class selector

(Truncated to 1904 characters out of 49836)
⚠️ REPOSITORY / trivy - 6 errors
warning: Package: ajv
Installed Version: 6.12.6
Vulnerability CVE-2025-69873
Severity: MEDIUM
Fixed Version: 8.18.0, 6.14.0
Link: [CVE-2025-69873](https://avd.aquasec.com/nvd/cve-2025-69873)
     ┌─ docusaurus/package-lock.json:7254:1
     │  
7254 │ ╭         "node_modules/ajv": {
7255 │ │             "version": "6.12.6",
7256 │ │             "resolved": "https://registry.npmjs.org/ajv/-/ajv-6.12.6.tgz",
7257 │ │             "integrity": "sha512-j3fVLgvTo527anyYyJOGTYJbG+vnnQYvE0m5mmkc1TK+nxAppkCLMIL0aZ4dblVCNoGShhm+kzE4ZUykBoMg4g==",
     · │
7268 │ │             }
7269 │ │         },
     │ ╰^
     │  
     = ajv: ReDoS via $data reference
     = ajv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled. The pattern keyword accepts runtime data via JSON Pointer syntax ($data reference), which is passed directly to the JavaScript RegExp() constructor without validation. An attacker can inject a malicious regex pattern (e.g., "^(a|a)*$") combined with crafted input to cause catastrophic backtracking. A 31-character payload causes approximately 44 seconds of CPU blocking, with each additional character doubling execution time. This enables complete denial of service with a single HTTP request against any API using ajv with $data: true for dynamic schema validation.

warning: Package: ajv
Installed Version: 8.17.1
Vulnerability CVE-2025-69873
Severity: MEDIUM
Fixed Version: 8.18.0, 6.14.0
Link: [CVE-2025-69873](https://avd.aquasec.com/nvd/cve-2025-69873)
      ┌─ docusaurus/package-lock.json:7287:1
      │  
 7287 │ ╭         "node_modules/ajv-formats/node_modules/ajv": {
 7288 │ │             "version": "8.17.1",
 7289 │ │             "resolved": "https://registry.npmjs.org/ajv/-/ajv-8.17.1.tgz",
 7290 │ │             "integrity": "sha512-B/gBuNg5SiMTrPkC+A2+cW0RszwxYmn6VYxB/inlBStS5nx6

(Truncated to 1904 characters out of 17895)
⚠️ TYPESCRIPT / ts-standard - 311 errors
Results of ts-standard linter (version 12.0.2)
See documentation on https://megalinter.io/9.3.0/descriptors/typescript_ts_standard/
-----------------------------------------------

❌ [ERROR] docusaurus/docusaurus.config.ts
    Unable to locate the project file. A project file (tsconfig.json or tsconfig.eslint.json) is required in order to use ts-standard.

❌ [ERROR] docusaurus/sidebars.ts
    Unable to locate the project file. A project file (tsconfig.json or tsconfig.eslint.json) is required in order to use ts-standard.

❌ [ERROR] docusaurus/src/js/modernEnhancements.ts
    Unable to locate the project file. A project file (tsconfig.json or tsconfig.eslint.json) is required in order to use ts-standard.

❌ [ERROR] electron-app/fitsdk.d.ts
    Unable to locate the project file. A project file (tsconfig.json or tsconfig.eslint.json) is required in order to use ts-standard.

❌ [ERROR] electron-app/global.d.ts
    Unable to locate the project file. A project file (tsconfig.json or tsconfig.eslint.json) is required in order to use ts-standard.

❌ [ERROR] electron-app/types/ffv/assets/Results-H2VOSWW7.d.ts
    Unable to locate the project file. A project file (tsconfig.json or tsconfig.eslint.json) is required in order to use ts-standard.

❌ [ERROR] electron-app/types/ffv/assets/Sprite-BZ4Kwmf3.d.ts
    Unable to locate the project file. A project file (tsconfig.json or tsconfig.eslint.json) is required in order to use ts-standard.

❌ [ERROR] electron-app/types/ffv/assets/binaryString-DLpsQS3c.d.ts
    Unable to locate the project file. A project file (tsconfig.json or tsconfig.eslint.json) is required in order to use ts-standard.

❌ [ERROR] electron-app/types/ffv/assets/findFields-C7eiFatx.d.ts
    Unable to locate the project file. A project file (tsconfig.json or tsconfig.eslint.json) is required in order to use ts-standard.

❌ [ERROR] electron-app/types/ffv/assets/getMessag

(Truncated to 1904 characters out of 63493)
⚠️ JSON / v8r - 1 error
Results of v8r linter (version 5.1.0)
See documentation on https://megalinter.io/9.3.0/descriptors/json_v8r/
-----------------------------------------------

✅ [SUCCESS] .devskim.json
✅ [SUCCESS] .github/hooks/hooks.json
✅ [SUCCESS] .jscpd.json
✅ [SUCCESS] .markdown-link-check.json
✅ [SUCCESS] .markdownlint.json
✅ [SUCCESS] .ncurc.json
✅ [SUCCESS] .prettierrc.json
✅ [SUCCESS] .vscode/extensions.json
✅ [SUCCESS] .vscode/launch.json
✅ [SUCCESS] .vscode/settings.json
❌ [ERROR] .vscode/tasks.json
    ℹ No config file found
    ℹ Pre-warming the cache
    ℹ Processing .vscode/tasks.json
    ℹ Found schema in https://www.schemastore.org/api/json/catalog.json ...
    ℹ Validating .vscode/tasks.json against schema from https://www.schemastore.org/task.json ...
    ✖ .vscode/tasks.json is invalid
    
    .vscode/tasks.json#/tasks/7/group must be object
    .vscode/tasks.json#/tasks/7/group must be equal to one of the allowed values
    .vscode/tasks.json#/tasks/7/group must match a schema in anyOf

✅ [SUCCESS] cspell.json
✅ [SUCCESS] docusaurus/package-lock.json
✅ [SUCCESS] docusaurus/package.json
✅ [SUCCESS] docusaurus/tsconfig.json
✅ [SUCCESS] docusaurus/typedoc.json
✅ [SUCCESS] docusaurus/typedoc.local.json
✅ [SUCCESS] electron-app/.markdown-link-check.json
✅ [SUCCESS] electron-app/.markdownlint.json
✅ [SUCCESS] electron-app/.npmpackagejsonlintrc.json
✅ [SUCCESS] electron-app/.vscode/tasks.json
✅ [SUCCESS] electron-app/ffv/manifest.json
✅ [SUCCESS] electron-app/package-lock.json
✅ [SUCCESS] electron-app/package.json
✅ [SUCCESS] electron-app/tsconfig.json
✅ [SUCCESS] electron-app/tsconfig.vitest.json
✅ [SUCCESS] mermaid.config.json
✅ [SUCCESS] package.json
⚠️ YAML / yamllint - 177 errors
Results of yamllint linter (version 1.37.1)
See documentation on https://megalinter.io/9.3.0/descriptors/yaml_yamllint/
-----------------------------------------------

✅ [SUCCESS] .checkov.yml
✅ [SUCCESS] .github/.spellcheck.yml
✅ [SUCCESS] .github/dependabot.yml
✅ [SUCCESS] .github/workflows/ActionLint.yml
❌ [ERROR] .github/workflows/Build.yml
    .github/workflows/Build.yml
      37:81     warning  line too long (106 > 80 characters)  (line-length)
      48:81     warning  line too long (98 > 80 characters)  (line-length)
      54:81     warning  line too long (86 > 80 characters)  (line-length)
      61:81     warning  line too long (88 > 80 characters)  (line-length)
      70:81     warning  line too long (122 > 80 characters)  (line-length)
      97:81     warning  line too long (101 > 80 characters)  (line-length)
      98:81     warning  line too long (82 > 80 characters)  (line-length)
      108:81    warning  line too long (86 > 80 characters)  (line-length)
      111:81    warning  line too long (95 > 80 characters)  (line-length)
      114:81    warning  line too long (98 > 80 characters)  (line-length)
      125:81    warning  line too long (121 > 80 characters)  (line-length)
      130:81    warning  line too long (106 > 80 characters)  (line-length)
      133:81    warning  line too long (96 > 80 characters)  (line-length)
      139:25    warning  wrong indentation: expected 20 but found 24  (indentation)
      145:1     error    trailing spaces  (trailing-spaces)
      148:81    warning  line too long (93 > 80 characters)  (line-length)
      161:81    warning  line too long (163 > 80 characters)  (line-length)
      185:81    warning  line too long (98 > 80 characters)  (line-length)
      190:81    warning  line too long (86 > 80 characters)  (line-length)
      197:81    warning  line too long (88 > 80 characters)  (line-length)
      206:81    warning 

(Truncated to 1904 characters out of 15907)

See detailed reports in MegaLinter artifacts

Your project could benefit from a custom flavor, which would allow you to run only the linters you need, and thus improve runtime performances. (Skip this info by defining FLAVOR_SUGGESTIONS: false)

  • Documentation: Custom Flavors
  • Command: npx mega-linter-runner@9.3.0 --custom-flavor-setup --custom-flavor-linters ACTION_ACTIONLINT,BASH_EXEC,BASH_SHELLCHECK,BASH_SHFMT,COPYPASTE_JSCPD,CSS_STYLELINT,HTML_DJLINT,HTML_HTMLHINT,JAVASCRIPT_PRETTIER,JSON_JSONLINT,JSON_V8R,JSON_PRETTIER,JSON_NPM_PACKAGE_JSON_LINT,MARKDOWN_MARKDOWNLINT,MARKDOWN_MARKDOWN_TABLE_FORMATTER,POWERSHELL_POWERSHELL,POWERSHELL_POWERSHELL_FORMATTER,REPOSITORY_CHECKOV,REPOSITORY_DEVSKIM,REPOSITORY_DUSTILOCK,REPOSITORY_GIT_DIFF,REPOSITORY_GITLEAKS,REPOSITORY_GRYPE,REPOSITORY_KICS,REPOSITORY_SECRETLINT,REPOSITORY_SYFT,REPOSITORY_TRIVY,REPOSITORY_TRIVY_SBOM,REPOSITORY_TRUFFLEHOG,REPOSITORY_KINGFISHER,SPELL_CSPELL,SPELL_LYCHEE,TYPESCRIPT_STANDARD,XML_XMLLINT,YAML_PRETTIER,YAML_YAMLLINT,YAML_V8R

MegaLinter is graciously provided by OX Security

@Nick2bad4u Nick2bad4u closed this Feb 26, 2026
@dependabot @github
Copy link
Copy Markdown
Contributor Author

dependabot bot commented on behalf of github Feb 26, 2026

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

@dependabot dependabot bot deleted the dependabot/npm_and_yarn/docusaurus/npm_and_yarn-1f250a1353 branch February 26, 2026 16:59
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant