Skip to content

[PROD RELEASE V6] #1702

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
kkartunov merged 150 commits into from
Nov 2, 2025

Merge pull request #1700 from topcoder-platform/pm-2640

473d443
Select commit
Loading
Failed to load commit list.
Merged

[PROD RELEASE V6] #1702

Merge pull request #1700 from topcoder-platform/pm-2640
473d443
Select commit
Loading
Failed to load commit list.
GitHub Advanced Security / Trivy failed Nov 2, 2025 in 5s

70 new alerts including 4 critical severity security vulnerabilities

New alerts in code changed by this pull request

Security Alerts:

  • 4 critical
  • 31 high
  • 29 medium
  • 6 low

Alerts not introduced by this pull request might have been detected because the code changes were too large.

See annotations below for details.

View all branch alerts.

Annotations

Check notice on line 1 in docker/Dockerfile

See this annotation in the file changed.

Code scanning / Trivy

No HEALTHCHECK defined Low

Artifact: docker/Dockerfile
Type: dockerfile
Vulnerability DS026
Severity: LOW
Message: Add HEALTHCHECK instruction in your Dockerfile
Link: DS026

Check warning on line 1 in pnpm-lock.yaml

See this annotation in the file changed.

Code scanning / Trivy

Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups Medium

Package: @babel/runtime
Installed Version: 7.3.1
Vulnerability CVE-2025-27789
Severity: MEDIUM
Fixed Version: 7.26.10, 8.0.0-alpha.17
Link: CVE-2025-27789

Check failure on line 1 in pnpm-lock.yaml

See this annotation in the file changed.

Code scanning / Trivy

auth0-js Privilege Escalation Vulnerability High

Package: auth0-js
Installed Version: 6.8.4
Vulnerability CVE-2017-17068
Severity: HIGH
Fixed Version: 8.12.0
Link: CVE-2017-17068

Check failure on line 1 in pnpm-lock.yaml

See this annotation in the file changed.

Code scanning / Trivy

Cross-Site Request Forgery (CSRF) in Auth0 High

Package: auth0-js
Installed Version: 6.8.4
Vulnerability CVE-2018-6874
Severity: HIGH
Fixed Version: 9.0.0
Link: CVE-2018-6874

Check failure on line 1 in pnpm-lock.yaml

See this annotation in the file changed.

Code scanning / Trivy

Auth0-js bypasses CSRF checks High

Package: auth0-js
Installed Version: 6.8.4
Vulnerability CVE-2018-7307
Severity: HIGH
Fixed Version: 9.3.0
Link: CVE-2018-7307

Check failure on line 1 in pnpm-lock.yaml

See this annotation in the file changed.

Code scanning / Trivy

nodejs-axios: Regular expression denial of service in trim function High

Package: axios
Installed Version: 0.12.0
Vulnerability CVE-2021-3749
Severity: HIGH
Fixed Version: 0.21.2
Link: CVE-2021-3749

Check failure on line 1 in pnpm-lock.yaml

See this annotation in the file changed.

Code scanning / Trivy

axios: Possible SSRF and Credential Leakage via Absolute URL in axios Requests High

Package: axios
Installed Version: 0.12.0
Vulnerability CVE-2025-27152
Severity: HIGH
Fixed Version: 1.8.2, 0.30.0
Link: CVE-2025-27152

Check failure on line 1 in pnpm-lock.yaml

See this annotation in the file changed.

Code scanning / Trivy

axios: Axios DoS via lack of data size check High

Package: axios
Installed Version: 0.19.2
Vulnerability CVE-2025-58754
Severity: HIGH
Fixed Version: 1.12.0, 0.30.2
Link: CVE-2025-58754

Check warning on line 1 in pnpm-lock.yaml

See this annotation in the file changed.

Code scanning / Trivy

nodejs-axios: allows an attacker to bypass a proxy by providing a URL that responds with a redirect to a restricted host or IP address Medium

Package: axios
Installed Version: 0.12.0
Vulnerability CVE-2020-28168
Severity: MEDIUM
Fixed Version: 0.21.1
Link: CVE-2020-28168

Check warning on line 1 in pnpm-lock.yaml

See this annotation in the file changed.

Code scanning / Trivy

axios: exposure of confidential data stored in cookies Medium

Package: axios
Installed Version: 0.12.0
Vulnerability CVE-2023-45857
Severity: MEDIUM
Fixed Version: 1.6.0, 0.28.0
Link: CVE-2023-45857

Check failure on line 1 in pnpm-lock.yaml

See this annotation in the file changed.

Code scanning / Trivy

babel: arbitrary code execution Critical

Package: babel-traverse
Installed Version: 6.26.0
Vulnerability CVE-2023-45133
Severity: CRITICAL
Fixed Version: 7.23.2
Link: CVE-2023-45133

Check failure on line 1 in pnpm-lock.yaml

See this annotation in the file changed.

Code scanning / Trivy

braces: fails to limit the number of characters it can handle High

Package: braces
Installed Version: 1.8.5
Vulnerability CVE-2024-4068
Severity: HIGH
Fixed Version: 3.0.3
Link: CVE-2024-4068

Check notice on line 1 in pnpm-lock.yaml

See this annotation in the file changed.

Code scanning / Trivy

nodejs-braces: Regular Expression Denial of Service (ReDoS) in lib/parsers.js Low

Package: braces
Installed Version: 1.8.5
Vulnerability CVE-2018-1109
Severity: LOW
Fixed Version: 2.3.1
Link: CVE-2018-1109

Check notice on line 1 in pnpm-lock.yaml

See this annotation in the file changed.

Code scanning / Trivy

Regular Expression Denial of Service in braces Low

Package: braces
Installed Version: 1.8.5
Vulnerability GHSA-g95f-p29q-9xw4
Severity: LOW
Fixed Version: 2.3.1
Link: GHSA-g95f-p29q-9xw4

Check failure on line 1 in pnpm-lock.yaml

See this annotation in the file changed.

Code scanning / Trivy

braces: fails to limit the number of characters it can handle High

Package: braces
Installed Version: 2.3.2
Vulnerability CVE-2024-4068
Severity: HIGH
Fixed Version: 3.0.3
Link: CVE-2024-4068

Check warning on line 1 in pnpm-lock.yaml

See this annotation in the file changed.

Code scanning / Trivy

browserslist: parsing of invalid queries could result in Regular Expression Denial of Service (ReDoS) Medium

Package: browserslist
Installed Version: 4.4.1
Vulnerability CVE-2021-23364
Severity: MEDIUM
Fixed Version: 4.16.5
Link: CVE-2021-23364

Check failure on line 1 in pnpm-lock.yaml

See this annotation in the file changed.

Code scanning / Trivy

cross-spawn: regular expression denial of service High

Package: cross-spawn
Installed Version: 6.0.5
Vulnerability CVE-2024-21538
Severity: HIGH
Fixed Version: 7.0.5, 6.0.6
Link: CVE-2024-21538

Check failure on line 1 in pnpm-lock.yaml

See this annotation in the file changed.

Code scanning / Trivy

cross-spawn: regular expression denial of service High

Package: cross-spawn
Installed Version: 6.0.5
Vulnerability CVE-2024-21538
Severity: HIGH
Fixed Version: 7.0.5, 6.0.6
Link: CVE-2024-21538

Check failure on line 1 in pnpm-lock.yaml

See this annotation in the file changed.

Code scanning / Trivy

follow-redirects: Exposure of Private Personal Information to an Unauthorized Actor High

Package: follow-redirects
Installed Version: 0.0.7
Vulnerability CVE-2022-0155
Severity: HIGH
Fixed Version: 1.14.7
Link: CVE-2022-0155

Check warning on line 1 in pnpm-lock.yaml

See this annotation in the file changed.

Code scanning / Trivy

follow-redirects: Exposure of Sensitive Information via Authorization Header leak Medium

Package: follow-redirects
Installed Version: 0.0.7
Vulnerability CVE-2022-0536
Severity: MEDIUM
Fixed Version: 1.14.8
Link: CVE-2022-0536

Check warning on line 1 in pnpm-lock.yaml

See this annotation in the file changed.

Code scanning / Trivy

follow-redirects: Improper Input Validation due to the improper handling of URLs by the url.parse() Medium

Package: follow-redirects
Installed Version: 0.0.7
Vulnerability CVE-2023-26159
Severity: MEDIUM
Fixed Version: 1.15.4
Link: CVE-2023-26159

Check warning on line 1 in pnpm-lock.yaml

See this annotation in the file changed.

Code scanning / Trivy

follow-redirects: Possible credential leak Medium

Package: follow-redirects
Installed Version: 0.0.7
Vulnerability CVE-2024-28849
Severity: MEDIUM
Fixed Version: 1.15.6
Link: CVE-2024-28849

Check failure on line 1 in pnpm-lock.yaml

See this annotation in the file changed.

Code scanning / Trivy

form-data: Unsafe random function in form-data Critical

Package: form-data
Installed Version: 2.3.3
Vulnerability CVE-2025-7783
Severity: CRITICAL
Fixed Version: 2.5.4, 3.0.4, 4.0.4
Link: CVE-2025-7783

Check failure on line 1 in pnpm-lock.yaml

See this annotation in the file changed.

Code scanning / Trivy

http-proxy-middleware: Denial of Service High

Package: http-proxy-middleware
Installed Version: 0.19.1
Vulnerability CVE-2024-21536
Severity: HIGH
Fixed Version: 2.0.7, 3.0.3
Link: CVE-2024-21536

Check failure on line 1 in pnpm-lock.yaml

See this annotation in the file changed.

Code scanning / Trivy

json5: Prototype Pollution in JSON5 via Parse Method High

Package: json5
Installed Version: 0.5.1
Vulnerability CVE-2022-46175
Severity: HIGH
Fixed Version: 2.2.2, 1.0.2
Link: CVE-2022-46175