Repository navigation
Add Github release workflow - #30
pedropiloto wants to merge 1 commit into
Conversation
![cycode-readonly-pr[bot]](https://avatars.githubusercontent.com/in/408170?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull request overview
This PR introduces GitHub Actions automation for CI testing and releases, and updates the repository tooling/docs to align with the new release process.
Changes:
- Add a GitHub Actions “Tests” workflow to run lint + unit tests.
- Add a manual GitHub Actions “Release” workflow intended to bump version, rebuild
dist, updateCHANGELOG.md, publish to npm, and create a GitHub release. - Migrate release tooling to
release-itand update the README badges/release instructions.
Reviewed changes
Copilot reviewed 5 out of 6 changed files in this pull request and generated 6 comments.
Show a summary per file
| File | Description |
|---|---|
| README.md | Updates CI badge and documents the new automated release workflow. |
| package.json | Adds release-it and changelog generator deps and introduces a release script. |
| .release-it.js | Adds release-it configuration and hooks for changelog + dist generation. |
| .github/workflows/tests.yaml | Adds CI workflow for linting and tests. |
| .github/workflows/release.yaml | Adds manual release workflow for publishing and GitHub releases. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| @@ -0,0 +1,25 @@ | |||
| module.exports = { | |||
| git: { | |||
| changelog: 'echo "## Changelog\\n\\n$(npx @uphold/github-changelog-generator -f unreleased | tail -n +4 -f)"', | |||
| 'yarn transpile', | ||
| 'echo "$(npx @uphold/github-changelog-generator -f v${version})\n$(tail -n +2 CHANGELOG.md)" > CHANGELOG.md', | ||
| 'git add CHANGELOG.md dist --all' |
| - name: Checkout code | ||
| uses: actions/checkout@v6 | ||
| with: | ||
| persist-credentials: false | ||
|
|
| - name: Install dependencies | ||
| run: yarn install --frozen-lockfile |
e1b0378 to
05a998d
Compare
| resolved "https://registry.yarnpkg.com/typedarray/-/typedarray-0.0.6.tgz#867ac74e3864187b1d3d47d996a78ec5c8830777" | ||
| integrity sha512-/aCDEGatGvZ2BIk+HmLf4ifCJFwvKFNb9/JeZPMulfgFracn9QFcAf5GO8B/mweUjSoblS5In0cWhqpfs/5PQA== | ||
|
|
||
| undici@7.28.0: |
There was a problem hiding this comment.
❗Cycode: Security vulnerabilities found in newly introduced dependency.
| Ecosystem | NPM |
| Dependency | undici |
| Dependency Paths | release-it 20.2.1 -> undici 7.28.0 |
| Direct Dependency | No |
| Development Dependency | Yes |
The following vulnerabilities were introduced:
| GHSA | CVE | Severity | Fixed Version |
|---|---|---|---|
| GHSA-4cwx-7wf7-3272 | CVE-2026-13697 | HIGH | 7.29.0 |
Highest fixed version: 7.29.0
Description
Detects when new vulnerabilities affect your dependencies.
Company Remediation Guideline
If you have any doubts about how to fix this vulnerability, or any improvement feedback for the Application Security team (@alex.sa, @diogo.salvador) regarding the tool, please reach out to them.
Currently, the alerts created by Cycode are being used for visibility purposes, instead of as a restrictive quality gate. Basically, you can provide a reason to ignore the alert and proceed with the merge.
If you want to have early visibility of security vulnerabilities before even committing the code, you can use the Cycode CLI or IDE Extension as documented in our Notion workspace: https://www.notion.so/uphold/Security-tools-in-developer-workflows-Cycode-CLI-IDE-Plugin-27f6261a4ab781e59d3ec003582526c5
Tell us how you wish to proceed using one of the following commands:
| Tag | Short Description |
|---|---|
| #cycode_ignore_package_here <reason> | Applies to this manifest for this package in this request only |
| resolved "https://registry.yarnpkg.com/core-util-is/-/core-util-is-1.0.3.tgz#a6042d3634c2b27e9328f837b965fac83808db85" | ||
| integrity sha512-ZQBvi1DcpJ4GDqanjucZ2Hj3wEO5pZDS89BWbkcrvdxksJorwUDDZamX9ldFkp9aw2lmBDLgkObEA4DWNJ9FYQ== | ||
|
|
||
| cross-spawn@^5.0.1: |
There was a problem hiding this comment.
❗Cycode: Security vulnerabilities found in newly introduced dependency.
| Ecosystem | NPM |
| Dependency | cross-spawn |
| Dependency Paths | pre-commit 1.2.2 -> cross-spawn 5.1.0 |
| Direct Dependency | No |
| Development Dependency | Yes |
The following vulnerabilities were introduced:
| GHSA | CVE | Severity | Fixed Version |
|---|---|---|---|
| GHSA-3xgq-45jj-v275 | CVE-2024-21538 | HIGH | 6.0.6 |
Highest fixed version: 6.0.6
Description
Detects when new vulnerabilities affect your dependencies.
Company Remediation Guideline
If you have any doubts about how to fix this vulnerability, or any improvement feedback for the Application Security team (@alex.sa, @diogo.salvador) regarding the tool, please reach out to them.
Currently, the alerts created by Cycode are being used for visibility purposes, instead of as a restrictive quality gate. Basically, you can provide a reason to ignore the alert and proceed with the merge.
If you want to have early visibility of security vulnerabilities before even committing the code, you can use the Cycode CLI or IDE Extension as documented in our Notion workspace: https://www.notion.so/uphold/Security-tools-in-developer-workflows-Cycode-CLI-IDE-Plugin-27f6261a4ab781e59d3ec003582526c5
Tell us how you wish to proceed using one of the following commands:
| Tag | Short Description |
|---|---|
| #cycode_ignore_package_here <reason> | Applies to this manifest for this package in this request only |
| preserve "^0.2.0" | ||
| repeat-element "^1.1.2" | ||
|
|
||
| braces@^2.3.1: |
There was a problem hiding this comment.
❗Cycode: Security vulnerabilities found in newly introduced dependency.
| Ecosystem | NPM |
| Dependency | braces |
| Dependency Paths | babel-cli 6.26.0 -> chokidar 1.7.0 -> readdirp 2.2.1 -> micromatch 3.1.10 -> braces 2.3.2 |
| Direct Dependency | No |
| Development Dependency | No |
The following vulnerabilities were introduced:
| GHSA | CVE | Severity | Fixed Version |
|---|---|---|---|
| GHSA-grv7-fg5c-xmjg | CVE-2024-4068 | HIGH | 3.0.3 |
Highest fixed version: 3.0.3
Description
Detects when new vulnerabilities affect your dependencies.
Company Remediation Guideline
If you have any doubts about how to fix this vulnerability, or any improvement feedback for the Application Security team (@alex.sa, @diogo.salvador) regarding the tool, please reach out to them.
Currently, the alerts created by Cycode are being used for visibility purposes, instead of as a restrictive quality gate. Basically, you can provide a reason to ignore the alert and proceed with the merge.
If you want to have early visibility of security vulnerabilities before even committing the code, you can use the Cycode CLI or IDE Extension as documented in our Notion workspace: https://www.notion.so/uphold/Security-tools-in-developer-workflows-Cycode-CLI-IDE-Plugin-27f6261a4ab781e59d3ec003582526c5
Tell us how you wish to proceed using one of the following commands:
| Tag | Short Description |
|---|---|
| #cycode_ignore_package_here <reason> | Applies to this manifest for this package in this request only |
| dependencies: | ||
| balanced-match "^4.0.2" | ||
|
|
||
| braces@^1.8.2: |
There was a problem hiding this comment.
❗Cycode: Security vulnerabilities found in newly introduced dependency.
| Ecosystem | NPM |
| Dependency | braces |
| Dependency Paths | babel-cli 6.26.0 -> chokidar 1.7.0 -> anymatch 1.3.2 -> micromatch 2.3.11 -> braces 1.8.5 |
| Direct Dependency | No |
| Development Dependency | No |
The following vulnerabilities were introduced:
| GHSA | CVE | Severity | Fixed Version |
|---|---|---|---|
| GHSA-grv7-fg5c-xmjg | CVE-2024-4068 | HIGH | 3.0.3 |
Highest fixed version: 3.0.3
Description
Detects when new vulnerabilities affect your dependencies.
Company Remediation Guideline
If you have any doubts about how to fix this vulnerability, or any improvement feedback for the Application Security team (@alex.sa, @diogo.salvador) regarding the tool, please reach out to them.
Currently, the alerts created by Cycode are being used for visibility purposes, instead of as a restrictive quality gate. Basically, you can provide a reason to ignore the alert and proceed with the merge.
If you want to have early visibility of security vulnerabilities before even committing the code, you can use the Cycode CLI or IDE Extension as documented in our Notion workspace: https://www.notion.so/uphold/Security-tools-in-developer-workflows-Cycode-CLI-IDE-Plugin-27f6261a4ab781e59d3ec003582526c5
Tell us how you wish to proceed using one of the following commands:
| Tag | Short Description |
|---|---|
| #cycode_ignore_package_here <reason> | Applies to this manifest for this package in this request only |
| resolved "https://registry.yarnpkg.com/graceful-fs/-/graceful-fs-4.2.11.tgz#4183e4e8bf08bb6e05bbb2f7d2e0c8f712ca40e3" | ||
| integrity sha512-RbJ5/jmFcNNCcDV5o9eTnBLJ/HszWV0P73bc+Ff4nS/rJj+YaS6IGyiOL0VoBYX+l1Wrl3k63h/KrH+nhJ0XvQ== | ||
|
|
||
| growl@1.9.2: |
There was a problem hiding this comment.
❗Cycode: Security vulnerabilities found in newly introduced dependency.
| Ecosystem | NPM |
| Dependency | growl |
| Dependency Paths | mocha 2.5.3 -> growl 1.9.2 |
| Direct Dependency | No |
| Development Dependency | Yes |
The following vulnerabilities were introduced:
| GHSA | CVE | Severity | Fixed Version |
|---|---|---|---|
| GHSA-qh2h-chj9-jffq | CVE-2017-16042 | CRITICAL | 1.10.0 |
Highest fixed version: 1.10.0
Description
Detects when new vulnerabilities affect your dependencies.
Company Remediation Guideline
If you have any doubts about how to fix this vulnerability, or any improvement feedback for the Application Security team (@alex.sa, @diogo.salvador) regarding the tool, please reach out to them.
Currently, the alerts created by Cycode are being used for visibility purposes, instead of as a restrictive quality gate. Basically, you can provide a reason to ignore the alert and proceed with the merge.
If you want to have early visibility of security vulnerabilities before even committing the code, you can use the Cycode CLI or IDE Extension as documented in our Notion workspace: https://www.notion.so/uphold/Security-tools-in-developer-workflows-Cycode-CLI-IDE-Plugin-27f6261a4ab781e59d3ec003582526c5
Tell us how you wish to proceed using one of the following commands:
| Tag | Short Description |
|---|---|
| #cycode_ignore_package_here <reason> | Applies to this manifest for this package in this request only |
| resolved "https://registry.yarnpkg.com/dayjs/-/dayjs-1.11.21.tgz#57f87562e62de76f3c704bd2b8d522fc33068eb2" | ||
| integrity sha512-98IT+HOahAisibz/yjKbzuOBwYcjJ7BCLPzARyHiyEBmRz4fatF+KPJszEHXsGYjUG234aH/cOjW1wwTbKUZlA== | ||
|
|
||
| debug@2.2.0: |
There was a problem hiding this comment.
❗Cycode: Security vulnerabilities found in newly introduced dependency.
| Ecosystem | NPM |
| Dependency | debug |
| Dependency Paths | mocha 2.5.3 -> debug 2.2.0 |
| Direct Dependency | No |
| Development Dependency | Yes |
The following vulnerabilities were introduced:
| GHSA | CVE | Severity | Fixed Version |
|---|---|---|---|
| GHSA-9vvw-cc9w-f27h | CVE-2017-20165 | HIGH | 2.6.9 |
Highest fixed version: 2.6.9
Description
Detects when new vulnerabilities affect your dependencies.
Company Remediation Guideline
If you have any doubts about how to fix this vulnerability, or any improvement feedback for the Application Security team (@alex.sa, @diogo.salvador) regarding the tool, please reach out to them.
Currently, the alerts created by Cycode are being used for visibility purposes, instead of as a restrictive quality gate. Basically, you can provide a reason to ignore the alert and proceed with the merge.
If you want to have early visibility of security vulnerabilities before even committing the code, you can use the Cycode CLI or IDE Extension as documented in our Notion workspace: https://www.notion.so/uphold/Security-tools-in-developer-workflows-Cycode-CLI-IDE-Plugin-27f6261a4ab781e59d3ec003582526c5
Tell us how you wish to proceed using one of the following commands:
| Tag | Short Description |
|---|---|
| #cycode_ignore_package_here <reason> | Applies to this manifest for this package in this request only |
| dependencies: | ||
| repeating "^2.0.0" | ||
|
|
||
| diff@1.4.0: |
There was a problem hiding this comment.
❗Cycode: Security vulnerabilities found in newly introduced dependency.
| Ecosystem | NPM |
| Dependency | diff |
| Dependency Paths | mocha 2.5.3 -> diff 1.4.0 |
| Direct Dependency | No |
| Development Dependency | Yes |
The following vulnerabilities were introduced:
| GHSA | CVE | Severity | Fixed Version |
|---|---|---|---|
| GHSA-h6ch-v84p-w6p9 | HIGH | 3.5.0 |
Highest fixed version: 3.5.0
Description
Detects when new vulnerabilities affect your dependencies.
Company Remediation Guideline
If you have any doubts about how to fix this vulnerability, or any improvement feedback for the Application Security team (@alex.sa, @diogo.salvador) regarding the tool, please reach out to them.
Currently, the alerts created by Cycode are being used for visibility purposes, instead of as a restrictive quality gate. Basically, you can provide a reason to ignore the alert and proceed with the merge.
If you want to have early visibility of security vulnerabilities before even committing the code, you can use the Cycode CLI or IDE Extension as documented in our Notion workspace: https://www.notion.so/uphold/Security-tools-in-developer-workflows-Cycode-CLI-IDE-Plugin-27f6261a4ab781e59d3ec003582526c5
Tell us how you wish to proceed using one of the following commands:
| Tag | Short Description |
|---|---|
| #cycode_ignore_package_here <reason> | Applies to this manifest for this package in this request only |
| resolved "https://registry.yarnpkg.com/mimic-function/-/mimic-function-5.0.1.tgz#acbe2b3349f99b9deaca7fb70e48b83e94e67076" | ||
| integrity sha512-VP79XUPxV2CigYP3jWwAUFSku2aKqBH7uTAapFWCBqutsbmDo96KY5o8uh6U+/YSIn5OxJnXp73beVkpqMIGhA== | ||
|
|
||
| minimatch@0.3: |
There was a problem hiding this comment.
❗Cycode: Security vulnerabilities found in newly introduced dependency.
| Ecosystem | NPM |
| Dependency | minimatch |
| Dependency Paths | mocha 2.5.3 -> glob 3.2.11 -> minimatch 0.3.0 |
| Direct Dependency | No |
| Development Dependency | Yes |
The following vulnerabilities were introduced:
| GHSA | CVE | Severity | Fixed Version |
|---|---|---|---|
| GHSA-7r86-cg39-jmmj | CVE-2026-27903 | HIGH | 3.1.3 |
| GHSA-23c5-xmqv-rm74 | CVE-2026-27904 | HIGH | 3.1.4 |
| GHSA-3ppc-4f35-3m26 | CVE-2026-26996 | HIGH | 3.1.3 |
| GHSA-f8q6-p94x-37v3 | CVE-2022-3517 | HIGH | 3.0.5 |
| GHSA-hxm2-r34f-qmc5 | CVE-2016-10540 | HIGH | 3.0.2 |
Highest fixed version: 3.1.4
Description
Detects when new vulnerabilities affect your dependencies.
Company Remediation Guideline
If you have any doubts about how to fix this vulnerability, or any improvement feedback for the Application Security team (@alex.sa, @diogo.salvador) regarding the tool, please reach out to them.
Currently, the alerts created by Cycode are being used for visibility purposes, instead of as a restrictive quality gate. Basically, you can provide a reason to ignore the alert and proceed with the merge.
If you want to have early visibility of security vulnerabilities before even committing the code, you can use the Cycode CLI or IDE Extension as documented in our Notion workspace: https://www.notion.so/uphold/Security-tools-in-developer-workflows-Cycode-CLI-IDE-Plugin-27f6261a4ab781e59d3ec003582526c5
Tell us how you wish to proceed using one of the following commands:
| Tag | Short Description |
|---|---|
| #cycode_ignore_package_here <reason> | Applies to this manifest for this package in this request only |
| resolved "https://registry.yarnpkg.com/json-with-bigint/-/json-with-bigint-3.5.10.tgz#1de608a5520ec47749e5147b0b3a686c979b1c7c" | ||
| integrity sha512-Vcx+JVNEBts/xfcoCS69sKrOhOk/3TVlvlT+XzUOefVKnnrbYSCKpDCm10pohsJFtsJVYnwa/cXRZ4eElzaM6w== | ||
|
|
||
| json5@^0.5.1: |
There was a problem hiding this comment.
❗Cycode: Security vulnerabilities found in newly introduced dependency.
| Ecosystem | NPM |
| Dependency | json5 |
| Dependency Paths | babel-cli 6.26.0 -> babel-core 6.26.3 -> json5 0.5.1, babel-register 6.26.0 -> babel-core 6.26.3 -> json5 0.5.1 |
| Direct Dependency | No |
| Development Dependency | Yes |
The following vulnerabilities were introduced:
| GHSA | CVE | Severity | Fixed Version |
|---|---|---|---|
| GHSA-9c47-m6qq-7p4h | CVE-2022-46175 | HIGH | 1.0.2 |
Highest fixed version: 1.0.2
Description
Detects when new vulnerabilities affect your dependencies.
Company Remediation Guideline
If you have any doubts about how to fix this vulnerability, or any improvement feedback for the Application Security team (@alex.sa, @diogo.salvador) regarding the tool, please reach out to them.
Currently, the alerts created by Cycode are being used for visibility purposes, instead of as a restrictive quality gate. Basically, you can provide a reason to ignore the alert and proceed with the merge.
If you want to have early visibility of security vulnerabilities before even committing the code, you can use the Cycode CLI or IDE Extension as documented in our Notion workspace: https://www.notion.so/uphold/Security-tools-in-developer-workflows-Cycode-CLI-IDE-Plugin-27f6261a4ab781e59d3ec003582526c5
Tell us how you wish to proceed using one of the following commands:
| Tag | Short Description |
|---|---|
| #cycode_ignore_package_here <reason> | Applies to this manifest for this package in this request only |
| dependencies: | ||
| brace-expansion "^1.1.7" | ||
|
|
||
| minimist@0.0.8: |
There was a problem hiding this comment.
❗Cycode: Security vulnerabilities found in newly introduced dependency.
| Ecosystem | NPM |
| Dependency | minimist |
| Dependency Paths | mocha 2.5.3 -> mkdirp 0.5.1 -> minimist 0.0.8 |
| Direct Dependency | No |
| Development Dependency | Yes |
The following vulnerabilities were introduced:
| GHSA | CVE | Severity | Fixed Version |
|---|---|---|---|
| GHSA-xvch-5gv4-984h | CVE-2021-44906 | CRITICAL | 0.2.4 |
Highest fixed version: 0.2.4
Description
Detects when new vulnerabilities affect your dependencies.
Company Remediation Guideline
If you have any doubts about how to fix this vulnerability, or any improvement feedback for the Application Security team (@alex.sa, @diogo.salvador) regarding the tool, please reach out to them.
Currently, the alerts created by Cycode are being used for visibility purposes, instead of as a restrictive quality gate. Basically, you can provide a reason to ignore the alert and proceed with the merge.
If you want to have early visibility of security vulnerabilities before even committing the code, you can use the Cycode CLI or IDE Extension as documented in our Notion workspace: https://www.notion.so/uphold/Security-tools-in-developer-workflows-Cycode-CLI-IDE-Plugin-27f6261a4ab781e59d3ec003582526c5
Tell us how you wish to proceed using one of the following commands:
| Tag | Short Description |
|---|---|
| #cycode_ignore_package_here <reason> | Applies to this manifest for this package in this request only |
c6baaa9 to
99a0bf7
Compare
| babylon "^6.18.0" | ||
| lodash "^4.17.4" | ||
|
|
||
| babel-traverse@^6.24.1, babel-traverse@^6.26.0: |
There was a problem hiding this comment.
❗Cycode: Security vulnerabilities found in newly introduced dependency.
| Ecosystem | NPM |
| Dependency | babel-traverse |
| Dependency Paths | babel-plugin-add-module-exports 0.1.4 -> babel-template 6.26.0 -> babel-traverse 6.26.0, babel-plugin-static-fs 1.2.1 -> babel-template 6.26.0 -> babel-traverse 6.26.0, babel-preset-es2015 6.5.0 -> babel-plugin-transform-es2015-computed-properties 6.24.1 -> babel-template 6.26.0 -> babel-traverse 6.26.0, babel-cli 6.26.0 -> babel-core 6.26.3 -> babel-traverse 6.26.0, babel-register 6.26.0 -> babel-core 6.26.3 -> babel-traverse 6.26.0 |
| Direct Dependency | No |
| Development Dependency | Yes |
The following vulnerabilities were introduced:
| GHSA | CVE | Severity | Fixed Version |
|---|---|---|---|
| GHSA-67hx-6x53-jw92 | CVE-2023-45133 | CRITICAL |
Description
Detects when new vulnerabilities affect your dependencies.
Company Remediation Guideline
If you have any doubts about how to fix this vulnerability, or any improvement feedback for the Application Security team (@alex.sa, @diogo.salvador) regarding the tool, please reach out to them.
Currently, the alerts created by Cycode are being used for visibility purposes, instead of as a restrictive quality gate. Basically, you can provide a reason to ignore the alert and proceed with the merge.
If you want to have early visibility of security vulnerabilities before even committing the code, you can use the Cycode CLI or IDE Extension as documented in our Notion workspace: https://www.notion.so/uphold/Security-tools-in-developer-workflows-Cycode-CLI-IDE-Plugin-27f6261a4ab781e59d3ec003582526c5
Tell us how you wish to proceed using one of the following commands:
| Tag | Short Description |
|---|---|
| #cycode_ignore_package_here <reason> | Applies to this manifest for this package in this request only |
| resolved "https://registry.yarnpkg.com/shebang-regex/-/shebang-regex-1.0.0.tgz#da42f49740c0b42db2ca9728571cb190c98efea3" | ||
| integrity sha512-wpoSFAxys6b2a2wHZ1XpDSgD7N9iVjg29Ph9uV/uaP9Ex/KXlkTZTeddxDPSYQpgvzKLGJke2UU0AzoGCjNIvQ== | ||
|
|
||
| shelljs@^0.5.3: |
There was a problem hiding this comment.
❗Cycode: Security vulnerabilities found in newly introduced dependency.
| Ecosystem | NPM |
| Dependency | shelljs |
| Dependency Paths | eslint 1.10.3 -> shelljs 0.5.3 |
| Direct Dependency | No |
| Development Dependency | Yes |
The following vulnerabilities were introduced:
| GHSA | CVE | Severity | Fixed Version |
|---|---|---|---|
| GHSA-4rq4-32rv-6wp6 | CVE-2022-0144 | HIGH | 0.8.5 |
Highest fixed version: 0.8.5
Description
Detects when new vulnerabilities affect your dependencies.
Company Remediation Guideline
If you have any doubts about how to fix this vulnerability, or any improvement feedback for the Application Security team (@alex.sa, @diogo.salvador) regarding the tool, please reach out to them.
Currently, the alerts created by Cycode are being used for visibility purposes, instead of as a restrictive quality gate. Basically, you can provide a reason to ignore the alert and proceed with the merge.
If you want to have early visibility of security vulnerabilities before even committing the code, you can use the Cycode CLI or IDE Extension as documented in our Notion workspace: https://www.notion.so/uphold/Security-tools-in-developer-workflows-Cycode-CLI-IDE-Plugin-27f6261a4ab781e59d3ec003582526c5
Tell us how you wish to proceed using one of the following commands:
| Tag | Short Description |
|---|---|
| #cycode_ignore_package_here <reason> | Applies to this manifest for this package in this request only |
| resolved "https://registry.yarnpkg.com/pathe/-/pathe-2.0.3.tgz#3ecbec55421685b70a9da872b2cff3e1cbed1716" | ||
| integrity sha512-WUjGcAqP1gQacoQe+OBJsFA7Ld4DyXuUIjZ5cc75cLHvJ7dtNsTugphxIADwspS+AraAUePCKrSVtPLFj/F88w== | ||
|
|
||
| pathval@~0.1.1: |
There was a problem hiding this comment.
❗Cycode: Security vulnerabilities found in newly introduced dependency.
| Ecosystem | NPM |
| Dependency | pathval |
| Dependency Paths | jscs 2.11.0 -> pathval 0.1.1, jscs-config-seegno 1.1.0 -> jscs 2.11.0 -> pathval 0.1.1 |
| Direct Dependency | No |
| Development Dependency | Yes |
The following vulnerabilities were introduced:
| GHSA | CVE | Severity | Fixed Version |
|---|---|---|---|
| GHSA-g6ww-v8xp-vmwg | CVE-2020-7751 | HIGH | 1.1.1 |
Highest fixed version: 1.1.1
Description
Detects when new vulnerabilities affect your dependencies.
Company Remediation Guideline
If you have any doubts about how to fix this vulnerability, or any improvement feedback for the Application Security team (@alex.sa, @diogo.salvador) regarding the tool, please reach out to them.
Currently, the alerts created by Cycode are being used for visibility purposes, instead of as a restrictive quality gate. Basically, you can provide a reason to ignore the alert and proceed with the merge.
If you want to have early visibility of security vulnerabilities before even committing the code, you can use the Cycode CLI or IDE Extension as documented in our Notion workspace: https://www.notion.so/uphold/Security-tools-in-developer-workflows-Cycode-CLI-IDE-Plugin-27f6261a4ab781e59d3ec003582526c5
Tell us how you wish to proceed using one of the following commands:
| Tag | Short Description |
|---|---|
| #cycode_ignore_package_here <reason> | Applies to this manifest for this package in this request only |
| resolved "https://registry.yarnpkg.com/json5/-/json5-0.4.0.tgz#054352e4c4c80c86c0923877d449de176a732c8d" | ||
| integrity sha512-5EEuuI7oad0d6c2PcrTRLoLH2JNuI/aJxHsVT2hVFK6fKHu+MXONdhzzzNAlb3JXMeuN1o+kDU78fV1YH6VmKQ== | ||
|
|
||
| json5@^0.5.1: |
There was a problem hiding this comment.
❗Cycode: Security vulnerabilities found in newly introduced dependency.
| Ecosystem | NPM |
| Dependency | json5 |
| Dependency Paths | babel-cli 6.26.0 -> babel-core 6.26.3 -> json5 0.5.1, babel-register 6.26.0 -> babel-core 6.26.3 -> json5 0.5.1 |
| Direct Dependency | No |
| Development Dependency | Yes |
The following vulnerabilities were introduced:
| GHSA | CVE | Severity | Fixed Version |
|---|---|---|---|
| GHSA-9c47-m6qq-7p4h | CVE-2022-46175 | HIGH | 1.0.2 |
Highest fixed version: 1.0.2
Description
Detects when new vulnerabilities affect your dependencies.
Company Remediation Guideline
If you have any doubts about how to fix this vulnerability, or any improvement feedback for the Application Security team (@alex.sa, @diogo.salvador) regarding the tool, please reach out to them.
Currently, the alerts created by Cycode are being used for visibility purposes, instead of as a restrictive quality gate. Basically, you can provide a reason to ignore the alert and proceed with the merge.
If you want to have early visibility of security vulnerabilities before even committing the code, you can use the Cycode CLI or IDE Extension as documented in our Notion workspace: https://www.notion.so/uphold/Security-tools-in-developer-workflows-Cycode-CLI-IDE-Plugin-27f6261a4ab781e59d3ec003582526c5
Tell us how you wish to proceed using one of the following commands:
| Tag | Short Description |
|---|---|
| #cycode_ignore_package_here <reason> | Applies to this manifest for this package in this request only |
| resolved "https://registry.yarnpkg.com/lodash.merge/-/lodash.merge-4.6.2.tgz#558aa53b43b661e1925a0afdfa36a9a1085fe57a" | ||
| integrity sha512-0KpjqXRVvrYyCsX1swR/XTK0va6VQkQM6MNo7PqW77ByjAhoARA8EfrP1N4+KlKj8YS0ZUCtRT/YUuhyYDujIQ== | ||
|
|
||
| lodash.merge@^3.3.2: |
There was a problem hiding this comment.
❗Cycode: Security vulnerabilities found in newly introduced dependency.
| Ecosystem | NPM |
| Dependency | lodash.merge |
| Dependency Paths | eslint 1.10.3 -> lodash.merge 3.3.2 |
| Direct Dependency | No |
| Development Dependency | Yes |
The following vulnerabilities were introduced:
| GHSA | CVE | Severity | Fixed Version |
|---|---|---|---|
| GHSA-2m96-9w4j-wgv7 | HIGH | 4.6.1 | |
| GHSA-h726-x36v-rx45 | HIGH | 4.6.2 |
Highest fixed version: 4.6.2
Description
Detects when new vulnerabilities affect your dependencies.
Company Remediation Guideline
If you have any doubts about how to fix this vulnerability, or any improvement feedback for the Application Security team (@alex.sa, @diogo.salvador) regarding the tool, please reach out to them.
Currently, the alerts created by Cycode are being used for visibility purposes, instead of as a restrictive quality gate. Basically, you can provide a reason to ignore the alert and proceed with the merge.
If you want to have early visibility of security vulnerabilities before even committing the code, you can use the Cycode CLI or IDE Extension as documented in our Notion workspace: https://www.notion.so/uphold/Security-tools-in-developer-workflows-Cycode-CLI-IDE-Plugin-27f6261a4ab781e59d3ec003582526c5
Tell us how you wish to proceed using one of the following commands:
| Tag | Short Description |
|---|---|
| #cycode_ignore_package_here <reason> | Applies to this manifest for this package in this request only |
| argparse "^1.0.2" | ||
| esprima "^2.6.0" | ||
|
|
||
| js-yaml@~3.4.0: |
There was a problem hiding this comment.
❗Cycode: Security vulnerabilities found in newly introduced dependency.
| Ecosystem | NPM |
| Dependency | js-yaml |
| Dependency Paths | jscs 2.11.0 -> js-yaml 3.4.6, jscs-config-seegno 1.1.0 -> jscs 2.11.0 -> js-yaml 3.4.6 |
| Direct Dependency | No |
| Development Dependency | Yes |
The following vulnerabilities were introduced:
| GHSA | CVE | Severity | Fixed Version |
|---|---|---|---|
| GHSA-5p4m-2wfm-xmqj | HIGH | 3.15.1 | |
| GHSA-52cp-r559-cp3m | CVE-2026-59869 | HIGH | 3.15.0 |
| GHSA-8j8c-7jfh-h6hx | HIGH | 3.13.1 |
Highest fixed version: 3.15.1
Description
Detects when new vulnerabilities affect your dependencies.
Company Remediation Guideline
If you have any doubts about how to fix this vulnerability, or any improvement feedback for the Application Security team (@alex.sa, @diogo.salvador) regarding the tool, please reach out to them.
Currently, the alerts created by Cycode are being used for visibility purposes, instead of as a restrictive quality gate. Basically, you can provide a reason to ignore the alert and proceed with the merge.
If you want to have early visibility of security vulnerabilities before even committing the code, you can use the Cycode CLI or IDE Extension as documented in our Notion workspace: https://www.notion.so/uphold/Security-tools-in-developer-workflows-Cycode-CLI-IDE-Plugin-27f6261a4ab781e59d3ec003582526c5
Tell us how you wish to proceed using one of the following commands:
| Tag | Short Description |
|---|---|
| #cycode_ignore_package_here <reason> | Applies to this manifest for this package in this request only |
| dependencies: | ||
| brace-expansion "^1.1.7" | ||
|
|
||
| minimatch@^2.0.3: |
There was a problem hiding this comment.
❗Cycode: Security vulnerabilities found in newly introduced dependency.
| Ecosystem | NPM |
| Dependency | minimatch |
| Dependency Paths | babel-eslint 4.1.8 -> babel-core 5.8.38 -> minimatch 2.0.10, jscs 2.11.0 -> babel-jscs 2.0.5 -> babel-core 5.8.38 -> minimatch 2.0.10, jscs-config-seegno 1.1.0 -> jscs 2.11.0 -> babel-jscs 2.0.5 -> babel-core 5.8.38 -> minimatch 2.0.10 |
| Direct Dependency | No |
| Development Dependency | Yes |
The following vulnerabilities were introduced:
| GHSA | CVE | Severity | Fixed Version |
|---|---|---|---|
| GHSA-7r86-cg39-jmmj | CVE-2026-27903 | HIGH | 3.1.3 |
| GHSA-23c5-xmqv-rm74 | CVE-2026-27904 | HIGH | 3.1.4 |
| GHSA-3ppc-4f35-3m26 | CVE-2026-26996 | HIGH | 3.1.3 |
| GHSA-f8q6-p94x-37v3 | CVE-2022-3517 | HIGH | 3.0.5 |
| GHSA-hxm2-r34f-qmc5 | CVE-2016-10540 | HIGH | 3.0.2 |
Highest fixed version: 3.1.4
Description
Detects when new vulnerabilities affect your dependencies.
Company Remediation Guideline
If you have any doubts about how to fix this vulnerability, or any improvement feedback for the Application Security team (@alex.sa, @diogo.salvador) regarding the tool, please reach out to them.
Currently, the alerts created by Cycode are being used for visibility purposes, instead of as a restrictive quality gate. Basically, you can provide a reason to ignore the alert and proceed with the merge.
If you want to have early visibility of security vulnerabilities before even committing the code, you can use the Cycode CLI or IDE Extension as documented in our Notion workspace: https://www.notion.so/uphold/Security-tools-in-developer-workflows-Cycode-CLI-IDE-Plugin-27f6261a4ab781e59d3ec003582526c5
Tell us how you wish to proceed using one of the following commands:
| Tag | Short Description |
|---|---|
| #cycode_ignore_package_here <reason> | Applies to this manifest for this package in this request only |
| resolved "https://registry.yarnpkg.com/core-util-is/-/core-util-is-1.0.3.tgz#a6042d3634c2b27e9328f837b965fac83808db85" | ||
| integrity sha512-ZQBvi1DcpJ4GDqanjucZ2Hj3wEO5pZDS89BWbkcrvdxksJorwUDDZamX9ldFkp9aw2lmBDLgkObEA4DWNJ9FYQ== | ||
|
|
||
| cross-spawn@^5.0.1: |
There was a problem hiding this comment.
❗Cycode: Security vulnerabilities found in newly introduced dependency.
| Ecosystem | NPM |
| Dependency | cross-spawn |
| Dependency Paths | pre-commit 1.2.2 -> cross-spawn 5.1.0 |
| Direct Dependency | No |
| Development Dependency | Yes |
The following vulnerabilities were introduced:
| GHSA | CVE | Severity | Fixed Version |
|---|---|---|---|
| GHSA-3xgq-45jj-v275 | CVE-2024-21538 | HIGH | 6.0.6 |
Highest fixed version: 6.0.6
Description
Detects when new vulnerabilities affect your dependencies.
Company Remediation Guideline
If you have any doubts about how to fix this vulnerability, or any improvement feedback for the Application Security team (@alex.sa, @diogo.salvador) regarding the tool, please reach out to them.
Currently, the alerts created by Cycode are being used for visibility purposes, instead of as a restrictive quality gate. Basically, you can provide a reason to ignore the alert and proceed with the merge.
If you want to have early visibility of security vulnerabilities before even committing the code, you can use the Cycode CLI or IDE Extension as documented in our Notion workspace: https://www.notion.so/uphold/Security-tools-in-developer-workflows-Cycode-CLI-IDE-Plugin-27f6261a4ab781e59d3ec003582526c5
Tell us how you wish to proceed using one of the following commands:
| Tag | Short Description |
|---|---|
| #cycode_ignore_package_here <reason> | Applies to this manifest for this package in this request only |
| resolved "https://registry.yarnpkg.com/js-tokens/-/js-tokens-3.0.2.tgz#9866df395102130e38f7f996bceb65443209c25b" | ||
| integrity sha512-RjTcuD4xjtthQkaWH7dFlH85L+QaVtSoOyGdZ3g6HFhS9dFNDfLyqgm2NFe2X6cQpeFmt0452FJjFG5UameExg== | ||
|
|
||
| js-yaml@3.4.5: |
There was a problem hiding this comment.
❗Cycode: Security vulnerabilities found in newly introduced dependency.
| Ecosystem | NPM |
| Dependency | js-yaml |
| Dependency Paths | eslint 1.10.3 -> js-yaml 3.4.5 |
| Direct Dependency | No |
| Development Dependency | Yes |
The following vulnerabilities were introduced:
| GHSA | CVE | Severity | Fixed Version |
|---|---|---|---|
| GHSA-5p4m-2wfm-xmqj | HIGH | 3.15.1 | |
| GHSA-52cp-r559-cp3m | CVE-2026-59869 | HIGH | 3.15.0 |
| GHSA-8j8c-7jfh-h6hx | HIGH | 3.13.1 |
Highest fixed version: 3.15.1
Description
Detects when new vulnerabilities affect your dependencies.
Company Remediation Guideline
If you have any doubts about how to fix this vulnerability, or any improvement feedback for the Application Security team (@alex.sa, @diogo.salvador) regarding the tool, please reach out to them.
Currently, the alerts created by Cycode are being used for visibility purposes, instead of as a restrictive quality gate. Basically, you can provide a reason to ignore the alert and proceed with the merge.
If you want to have early visibility of security vulnerabilities before even committing the code, you can use the Cycode CLI or IDE Extension as documented in our Notion workspace: https://www.notion.so/uphold/Security-tools-in-developer-workflows-Cycode-CLI-IDE-Plugin-27f6261a4ab781e59d3ec003582526c5
Tell us how you wish to proceed using one of the following commands:
| Tag | Short Description |
|---|---|
| #cycode_ignore_package_here <reason> | Applies to this manifest for this package in this request only |
| dependencies: | ||
| brace-expansion "^1.0.0" | ||
|
|
||
| minimatch@~3.0.0: |
There was a problem hiding this comment.
❗Cycode: Security vulnerabilities found in newly introduced dependency.
| Ecosystem | NPM |
| Dependency | minimatch |
| Dependency Paths | jscs 2.11.0 -> minimatch 3.0.8, jscs-config-seegno 1.1.0 -> jscs 2.11.0 -> minimatch 3.0.8 |
| Direct Dependency | No |
| Development Dependency | Yes |
The following vulnerabilities were introduced:
| GHSA | CVE | Severity | Fixed Version |
|---|---|---|---|
| GHSA-7r86-cg39-jmmj | CVE-2026-27903 | HIGH | 3.1.3 |
| GHSA-23c5-xmqv-rm74 | CVE-2026-27904 | HIGH | 3.1.4 |
| GHSA-3ppc-4f35-3m26 | CVE-2026-26996 | HIGH | 3.1.3 |
Highest fixed version: 3.1.4
Description
Detects when new vulnerabilities affect your dependencies.
Company Remediation Guideline
If you have any doubts about how to fix this vulnerability, or any improvement feedback for the Application Security team (@alex.sa, @diogo.salvador) regarding the tool, please reach out to them.
Currently, the alerts created by Cycode are being used for visibility purposes, instead of as a restrictive quality gate. Basically, you can provide a reason to ignore the alert and proceed with the merge.
If you want to have early visibility of security vulnerabilities before even committing the code, you can use the Cycode CLI or IDE Extension as documented in our Notion workspace: https://www.notion.so/uphold/Security-tools-in-developer-workflows-Cycode-CLI-IDE-Plugin-27f6261a4ab781e59d3ec003582526c5
Tell us how you wish to proceed using one of the following commands:
| Tag | Short Description |
|---|---|
| #cycode_ignore_package_here <reason> | Applies to this manifest for this package in this request only |
| resolved "https://registry.yarnpkg.com/mimic-function/-/mimic-function-5.0.1.tgz#acbe2b3349f99b9deaca7fb70e48b83e94e67076" | ||
| integrity sha512-VP79XUPxV2CigYP3jWwAUFSku2aKqBH7uTAapFWCBqutsbmDo96KY5o8uh6U+/YSIn5OxJnXp73beVkpqMIGhA== | ||
|
|
||
| minimatch@0.3: |
There was a problem hiding this comment.
❗Cycode: Security vulnerabilities found in newly introduced dependency.
| Ecosystem | NPM |
| Dependency | minimatch |
| Dependency Paths | mocha 2.5.3 -> glob 3.2.11 -> minimatch 0.3.0 |
| Direct Dependency | No |
| Development Dependency | Yes |
The following vulnerabilities were introduced:
| GHSA | CVE | Severity | Fixed Version |
|---|---|---|---|
| GHSA-7r86-cg39-jmmj | CVE-2026-27903 | HIGH | 3.1.3 |
| GHSA-23c5-xmqv-rm74 | CVE-2026-27904 | HIGH | 3.1.4 |
| GHSA-3ppc-4f35-3m26 | CVE-2026-26996 | HIGH | 3.1.3 |
| GHSA-f8q6-p94x-37v3 | CVE-2022-3517 | HIGH | 3.0.5 |
| GHSA-hxm2-r34f-qmc5 | CVE-2016-10540 | HIGH | 3.0.2 |
Highest fixed version: 3.1.4
Description
Detects when new vulnerabilities affect your dependencies.
Company Remediation Guideline
If you have any doubts about how to fix this vulnerability, or any improvement feedback for the Application Security team (@alex.sa, @diogo.salvador) regarding the tool, please reach out to them.
Currently, the alerts created by Cycode are being used for visibility purposes, instead of as a restrictive quality gate. Basically, you can provide a reason to ignore the alert and proceed with the merge.
If you want to have early visibility of security vulnerabilities before even committing the code, you can use the Cycode CLI or IDE Extension as documented in our Notion workspace: https://www.notion.so/uphold/Security-tools-in-developer-workflows-Cycode-CLI-IDE-Plugin-27f6261a4ab781e59d3ec003582526c5
Tell us how you wish to proceed using one of the following commands:
| Tag | Short Description |
|---|---|
| #cycode_ignore_package_here <reason> | Applies to this manifest for this package in this request only |
| acorn "^5.2.1" | ||
| defined "^1.0.0" | ||
|
|
||
| diff@1.4.0: |
There was a problem hiding this comment.
❗Cycode: Security vulnerabilities found in newly introduced dependency.
| Ecosystem | NPM |
| Dependency | diff |
| Dependency Paths | mocha 2.5.3 -> diff 1.4.0 |
| Direct Dependency | No |
| Development Dependency | Yes |
The following vulnerabilities were introduced:
| GHSA | CVE | Severity | Fixed Version |
|---|---|---|---|
| GHSA-h6ch-v84p-w6p9 | HIGH | 3.5.0 |
Highest fixed version: 3.5.0
Description
Detects when new vulnerabilities affect your dependencies.
Company Remediation Guideline
If you have any doubts about how to fix this vulnerability, or any improvement feedback for the Application Security team (@alex.sa, @diogo.salvador) regarding the tool, please reach out to them.
Currently, the alerts created by Cycode are being used for visibility purposes, instead of as a restrictive quality gate. Basically, you can provide a reason to ignore the alert and proceed with the merge.
If you want to have early visibility of security vulnerabilities before even committing the code, you can use the Cycode CLI or IDE Extension as documented in our Notion workspace: https://www.notion.so/uphold/Security-tools-in-developer-workflows-Cycode-CLI-IDE-Plugin-27f6261a4ab781e59d3ec003582526c5
Tell us how you wish to proceed using one of the following commands:
| Tag | Short Description |
|---|---|
| #cycode_ignore_package_here <reason> | Applies to this manifest for this package in this request only |
| preserve "^0.2.0" | ||
| repeat-element "^1.1.2" | ||
|
|
||
| braces@^2.3.1: |
There was a problem hiding this comment.
❗Cycode: Security vulnerabilities found in newly introduced dependency.
| Ecosystem | NPM |
| Dependency | braces |
| Dependency Paths | babel-cli 6.26.0 -> chokidar 1.7.0 -> readdirp 2.2.1 -> micromatch 3.1.10 -> braces 2.3.2 |
| Direct Dependency | No |
| Development Dependency | No |
The following vulnerabilities were introduced:
| GHSA | CVE | Severity | Fixed Version |
|---|---|---|---|
| GHSA-grv7-fg5c-xmjg | CVE-2024-4068 | HIGH | 3.0.3 |
Highest fixed version: 3.0.3
Description
Detects when new vulnerabilities affect your dependencies.
Company Remediation Guideline
If you have any doubts about how to fix this vulnerability, or any improvement feedback for the Application Security team (@alex.sa, @diogo.salvador) regarding the tool, please reach out to them.
Currently, the alerts created by Cycode are being used for visibility purposes, instead of as a restrictive quality gate. Basically, you can provide a reason to ignore the alert and proceed with the merge.
If you want to have early visibility of security vulnerabilities before even committing the code, you can use the Cycode CLI or IDE Extension as documented in our Notion workspace: https://www.notion.so/uphold/Security-tools-in-developer-workflows-Cycode-CLI-IDE-Plugin-27f6261a4ab781e59d3ec003582526c5
Tell us how you wish to proceed using one of the following commands:
| Tag | Short Description |
|---|---|
| #cycode_ignore_package_here <reason> | Applies to this manifest for this package in this request only |
| resolved "https://registry.yarnpkg.com/uglify-js/-/uglify-js-3.19.3.tgz#82315e9bbc6f2b25888858acd1fff8441035b77f" | ||
| integrity sha512-v3Xu+yuwBXisp6QYTcH4UbH+xYJXqnq2m/LtQVWKWzYc1iehYnLixoQDN9FH6/j9/oybfd6W9Ghwkl8+UMKTKQ== | ||
|
|
||
| underscore@~1.6.0: |
There was a problem hiding this comment.
❗Cycode: Security vulnerabilities found in newly introduced dependency.
| Ecosystem | NPM |
| Dependency | underscore |
| Dependency Paths | jscs 2.11.0 -> jsonlint 1.6.3 -> nomnom 1.8.1 -> underscore 1.6.0, jscs-config-seegno 1.1.0 -> jscs 2.11.0 -> jsonlint 1.6.3 -> nomnom 1.8.1 -> underscore 1.6.0 |
| Direct Dependency | No |
| Development Dependency | Yes |
The following vulnerabilities were introduced:
| GHSA | CVE | Severity | Fixed Version |
|---|---|---|---|
| GHSA-qpx9-hpmf-5gmw | CVE-2026-27601 | HIGH | 1.13.8 |
| GHSA-cf4h-3jhx-xvhq | CVE-2021-23358 | CRITICAL | 1.12.1 |
Highest fixed version: 1.13.8
Description
Detects when new vulnerabilities affect your dependencies.
Company Remediation Guideline
If you have any doubts about how to fix this vulnerability, or any improvement feedback for the Application Security team (@alex.sa, @diogo.salvador) regarding the tool, please reach out to them.
Currently, the alerts created by Cycode are being used for visibility purposes, instead of as a restrictive quality gate. Basically, you can provide a reason to ignore the alert and proceed with the merge.
If you want to have early visibility of security vulnerabilities before even committing the code, you can use the Cycode CLI or IDE Extension as documented in our Notion workspace: https://www.notion.so/uphold/Security-tools-in-developer-workflows-Cycode-CLI-IDE-Plugin-27f6261a4ab781e59d3ec003582526c5
Tell us how you wish to proceed using one of the following commands:
| Tag | Short Description |
|---|---|
| #cycode_ignore_package_here <reason> | Applies to this manifest for this package in this request only |
| dependencies: | ||
| brace-expansion "^1.1.7" | ||
|
|
||
| minimist@0.0.8: |
There was a problem hiding this comment.
❗Cycode: Security vulnerabilities found in newly introduced dependency.
| Ecosystem | NPM |
| Dependency | minimist |
| Dependency Paths | mocha 2.5.3 -> mkdirp 0.5.1 -> minimist 0.0.8 |
| Direct Dependency | No |
| Development Dependency | Yes |
The following vulnerabilities were introduced:
| GHSA | CVE | Severity | Fixed Version |
|---|---|---|---|
| GHSA-xvch-5gv4-984h | CVE-2021-44906 | CRITICAL | 0.2.4 |
Highest fixed version: 0.2.4
Description
Detects when new vulnerabilities affect your dependencies.
Company Remediation Guideline
If you have any doubts about how to fix this vulnerability, or any improvement feedback for the Application Security team (@alex.sa, @diogo.salvador) regarding the tool, please reach out to them.
Currently, the alerts created by Cycode are being used for visibility purposes, instead of as a restrictive quality gate. Basically, you can provide a reason to ignore the alert and proceed with the merge.
If you want to have early visibility of security vulnerabilities before even committing the code, you can use the Cycode CLI or IDE Extension as documented in our Notion workspace: https://www.notion.so/uphold/Security-tools-in-developer-workflows-Cycode-CLI-IDE-Plugin-27f6261a4ab781e59d3ec003582526c5
Tell us how you wish to proceed using one of the following commands:
| Tag | Short Description |
|---|---|
| #cycode_ignore_package_here <reason> | Applies to this manifest for this package in this request only |
| resolved "https://registry.yarnpkg.com/lodash.uniqby/-/lodash.uniqby-4.7.0.tgz#d99c07a669e9e6d24e1362dfe266c67616af1302" | ||
| integrity sha512-e/zcLx6CSbmaEgFHCA7BnoQKyCtKMxnuWrJygbwPs/AIn+IMKl66L8/s+wBUn5LRw2pZx3bUHibiV1b6aTWIww== | ||
|
|
||
| lodash@^3.10.0, lodash@^3.3.1, lodash@^3.5.0, lodash@^3.7.0, lodash@^3.9.3, lodash@~3.10.0: |
There was a problem hiding this comment.
❗Cycode: Security vulnerabilities found in newly introduced dependency.
| Ecosystem | NPM |
| Dependency | lodash |
| Dependency Paths | babel-eslint 4.1.8 -> babel-core 5.8.38 -> lodash 3.10.1, eslint 1.10.3 -> inquirer 0.11.4 -> lodash 3.10.1, jscs 2.11.0 -> lodash 3.10.1, jscs-config-seegno 1.1.0 -> jscs 2.11.0 -> lodash 3.10.1 |
| Direct Dependency | No |
| Development Dependency | Yes |
The following vulnerabilities were introduced:
| GHSA | CVE | Severity | Fixed Version |
|---|---|---|---|
| GHSA-35jh-r3h4-6jhm | CVE-2021-23337 | HIGH | 4.17.21 |
| GHSA-4xc9-xhrj-v574 | CVE-2018-16487 | HIGH | 4.17.11 |
| GHSA-jf85-cpcp-j695 | CVE-2019-10744 | CRITICAL | 4.17.12 |
| GHSA-p6mc-m468-83gw | CVE-2020-8203 | HIGH | 4.17.19 |
Highest fixed version: 4.17.21
Description
Detects when new vulnerabilities affect your dependencies.
Company Remediation Guideline
If you have any doubts about how to fix this vulnerability, or any improvement feedback for the Application Security team (@alex.sa, @diogo.salvador) regarding the tool, please reach out to them.
Currently, the alerts created by Cycode are being used for visibility purposes, instead of as a restrictive quality gate. Basically, you can provide a reason to ignore the alert and proceed with the merge.
If you want to have early visibility of security vulnerabilities before even committing the code, you can use the Cycode CLI or IDE Extension as documented in our Notion workspace: https://www.notion.so/uphold/Security-tools-in-developer-workflows-Cycode-CLI-IDE-Plugin-27f6261a4ab781e59d3ec003582526c5
Tell us how you wish to proceed using one of the following commands:
| Tag | Short Description |
|---|---|
| #cycode_ignore_package_here <reason> | Applies to this manifest for this package in this request only |
| resolved "https://registry.yarnpkg.com/json-with-bigint/-/json-with-bigint-3.5.10.tgz#1de608a5520ec47749e5147b0b3a686c979b1c7c" | ||
| integrity sha512-Vcx+JVNEBts/xfcoCS69sKrOhOk/3TVlvlT+XzUOefVKnnrbYSCKpDCm10pohsJFtsJVYnwa/cXRZ4eElzaM6w== | ||
|
|
||
| json5@^0.4.0: |
There was a problem hiding this comment.
❗Cycode: Security vulnerabilities found in newly introduced dependency.
| Ecosystem | NPM |
| Dependency | json5 |
| Dependency Paths | babel-eslint 4.1.8 -> babel-core 5.8.38 -> json5 0.4.0, jscs 2.11.0 -> babel-jscs 2.0.5 -> babel-core 5.8.38 -> json5 0.4.0, jscs-config-seegno 1.1.0 -> jscs 2.11.0 -> babel-jscs 2.0.5 -> babel-core 5.8.38 -> json5 0.4.0 |
| Direct Dependency | No |
| Development Dependency | Yes |
The following vulnerabilities were introduced:
| GHSA | CVE | Severity | Fixed Version |
|---|---|---|---|
| GHSA-9c47-m6qq-7p4h | CVE-2022-46175 | HIGH | 1.0.2 |
Highest fixed version: 1.0.2
Description
Detects when new vulnerabilities affect your dependencies.
Company Remediation Guideline
If you have any doubts about how to fix this vulnerability, or any improvement feedback for the Application Security team (@alex.sa, @diogo.salvador) regarding the tool, please reach out to them.
Currently, the alerts created by Cycode are being used for visibility purposes, instead of as a restrictive quality gate. Basically, you can provide a reason to ignore the alert and proceed with the merge.
If you want to have early visibility of security vulnerabilities before even committing the code, you can use the Cycode CLI or IDE Extension as documented in our Notion workspace: https://www.notion.so/uphold/Security-tools-in-developer-workflows-Cycode-CLI-IDE-Plugin-27f6261a4ab781e59d3ec003582526c5
Tell us how you wish to proceed using one of the following commands:
| Tag | Short Description |
|---|---|
| #cycode_ignore_package_here <reason> | Applies to this manifest for this package in this request only |
| balanced-match "^1.0.0" | ||
| concat-map "0.0.1" | ||
|
|
||
| braces@^1.8.2: |
There was a problem hiding this comment.
❗Cycode: Security vulnerabilities found in newly introduced dependency.
| Ecosystem | NPM |
| Dependency | braces |
| Dependency Paths | babel-cli 6.26.0 -> chokidar 1.7.0 -> anymatch 1.3.2 -> micromatch 2.3.11 -> braces 1.8.5 |
| Direct Dependency | No |
| Development Dependency | No |
The following vulnerabilities were introduced:
| GHSA | CVE | Severity | Fixed Version |
|---|---|---|---|
| GHSA-grv7-fg5c-xmjg | CVE-2024-4068 | HIGH | 3.0.3 |
Highest fixed version: 3.0.3
Description
Detects when new vulnerabilities affect your dependencies.
Company Remediation Guideline
If you have any doubts about how to fix this vulnerability, or any improvement feedback for the Application Security team (@alex.sa, @diogo.salvador) regarding the tool, please reach out to them.
Currently, the alerts created by Cycode are being used for visibility purposes, instead of as a restrictive quality gate. Basically, you can provide a reason to ignore the alert and proceed with the merge.
If you want to have early visibility of security vulnerabilities before even committing the code, you can use the Cycode CLI or IDE Extension as documented in our Notion workspace: https://www.notion.so/uphold/Security-tools-in-developer-workflows-Cycode-CLI-IDE-Plugin-27f6261a4ab781e59d3ec003582526c5
Tell us how you wish to proceed using one of the following commands:
| Tag | Short Description |
|---|---|
| #cycode_ignore_package_here <reason> | Applies to this manifest for this package in this request only |
| resolved "https://registry.yarnpkg.com/graceful-readlink/-/graceful-readlink-1.0.1.tgz#4cafad76bc62f02fa039b2f94e9a3dd3a391a725" | ||
| integrity sha512-8tLu60LgxF6XpdbK8OW3FA+IfTNBn1ZHGHKF4KQbEeSkajYw5PlYJcKluntgegDPTg8UkHjpet1T82vk6TQ68w== | ||
|
|
||
| growl@1.9.2: |
There was a problem hiding this comment.
❗Cycode: Security vulnerabilities found in newly introduced dependency.
| Ecosystem | NPM |
| Dependency | growl |
| Dependency Paths | mocha 2.5.3 -> growl 1.9.2 |
| Direct Dependency | No |
| Development Dependency | Yes |
The following vulnerabilities were introduced:
| GHSA | CVE | Severity | Fixed Version |
|---|---|---|---|
| GHSA-qh2h-chj9-jffq | CVE-2017-16042 | CRITICAL | 1.10.0 |
Highest fixed version: 1.10.0
Description
Detects when new vulnerabilities affect your dependencies.
Company Remediation Guideline
If you have any doubts about how to fix this vulnerability, or any improvement feedback for the Application Security team (@alex.sa, @diogo.salvador) regarding the tool, please reach out to them.
Currently, the alerts created by Cycode are being used for visibility purposes, instead of as a restrictive quality gate. Basically, you can provide a reason to ignore the alert and proceed with the merge.
If you want to have early visibility of security vulnerabilities before even committing the code, you can use the Cycode CLI or IDE Extension as documented in our Notion workspace: https://www.notion.so/uphold/Security-tools-in-developer-workflows-Cycode-CLI-IDE-Plugin-27f6261a4ab781e59d3ec003582526c5
Tell us how you wish to proceed using one of the following commands:
| Tag | Short Description |
|---|---|
| #cycode_ignore_package_here <reason> | Applies to this manifest for this package in this request only |
| resolved "https://registry.yarnpkg.com/data-uri-to-buffer/-/data-uri-to-buffer-8.0.0.tgz#c642ffbc96d8fae76cccecbad43cbddd7818c785" | ||
| integrity sha512-6UHfyCux51b8PTGDgveqtz1tvphBku5DrMKKJbFAZAJOI2zsjDpDoYE1+QGj7FOMS4BdTFNJsJiR3zEB0xH0yQ== | ||
|
|
||
| debug@2.2.0: |
There was a problem hiding this comment.
❗Cycode: Security vulnerabilities found in newly introduced dependency.
| Ecosystem | NPM |
| Dependency | debug |
| Dependency Paths | mocha 2.5.3 -> debug 2.2.0 |
| Direct Dependency | No |
| Development Dependency | Yes |
The following vulnerabilities were introduced:
| GHSA | CVE | Severity | Fixed Version |
|---|---|---|---|
| GHSA-9vvw-cc9w-f27h | CVE-2017-20165 | HIGH | 2.6.9 |
Highest fixed version: 2.6.9
Description
Detects when new vulnerabilities affect your dependencies.
Company Remediation Guideline
If you have any doubts about how to fix this vulnerability, or any improvement feedback for the Application Security team (@alex.sa, @diogo.salvador) regarding the tool, please reach out to them.
Currently, the alerts created by Cycode are being used for visibility purposes, instead of as a restrictive quality gate. Basically, you can provide a reason to ignore the alert and proceed with the merge.
If you want to have early visibility of security vulnerabilities before even committing the code, you can use the Cycode CLI or IDE Extension as documented in our Notion workspace: https://www.notion.so/uphold/Security-tools-in-developer-workflows-Cycode-CLI-IDE-Plugin-27f6261a4ab781e59d3ec003582526c5
Tell us how you wish to proceed using one of the following commands:
| Tag | Short Description |
|---|---|
| #cycode_ignore_package_here <reason> | Applies to this manifest for this package in this request only |
Description
Add Github release workflow.
Related Issues
N/A