Skip to content

Update action.yml - #53

Open
Raj-StepSecurity wants to merge 3 commits into
mainfrom
Raj-StepSecurity-patch-5
Open

Update action.yml#53
Raj-StepSecurity wants to merge 3 commits into
mainfrom
Raj-StepSecurity-patch-5

Conversation

@Raj-StepSecurity

@Raj-StepSecurity Raj-StepSecurity commented Jun 11, 2026

Copy link
Copy Markdown
Collaborator

No description provided.

@github-actions

github-actions Bot commented Jun 11, 2026

Copy link
Copy Markdown
Contributor

Super-linter summary

Language Validation result
BIOME_FORMAT Pass ✅
BIOME_LINT Pass ✅
CHECKOV Pass ✅
EDITORCONFIG Pass ✅
GITHUB_ACTIONS_ZIZMOR Pass ✅
GITLEAKS Pass ✅
GIT_COMMITLINT Fail ❌
GIT_MERGE_CONFLICT_MARKERS Pass ✅
JSCPD Pass ✅
PRE_COMMIT Pass ✅
SPELL_CODESPELL Pass ✅
TRIVY Fail ❌
YAML Pass ✅
YAML_PRETTIER Fail ❌

Super-linter detected linting errors

For more information, see the
GitHub Actions workflow run

Powered by Super-linter

GIT_COMMITLINT 
commitlint --verbose --from 01eb9d4a1f13e10d7fa0578d3cebfc14dec82477 --to e58b0e5ecfb2d21ffde74ed95899e849c356224d --cwd /github/workspace
⧗   --- input ---
Update action.yml
✖   subject may not be empty [subject-empty]
✖   type may not be empty [type-empty]

✖   found 2 problems, 0 warnings
ⓘ   Get help: https://www.conventionalcommits.org/

⧗   --- input ---
Update action.yml
✖   subject may not be empty [subject-empty]
✖   type may not be empty [type-empty]

✖   found 2 problems, 0 warnings
ⓘ   Get help: https://www.conventionalcommits.org/

⧗   --- input ---
Update action.yml
✖   subject may not be empty [subject-empty]
✖   type may not be empty [type-empty]

✖   found 2 problems, 0 warnings
ⓘ   Get help: https://www.conventionalcommits.org/
TRIVY 
trivy filesystem --config /github/workspace/.github/linters/trivy.yaml /github/workspace

Report Summary

┌─────────────────────────────────────┬────────────┬─────────────────┬───────────────────┬─────────┐
│               Target                │    Type    │ Vulnerabilities │ Misconfigurations │ Secrets │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ dependencies/Gemfile.lock           │  bundler   │        0        │         -         │    -    │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ dependencies/composer/composer.lock │  composer  │        0        │         -         │    -    │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ dependencies/package-lock.json      │    npm     │       15        │         -         │    -    │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ Dockerfile                          │ dockerfile │        -        │         0         │    -    │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ test/linters/trivy/good/Dockerfile  │ dockerfile │        -        │         0         │    -    │
└─────────────────────────────────────┴────────────┴─────────────────┴───────────────────┴─────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)


For OSS Maintainers: VEX Notice
--------------------------------
If you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement.
VEX allows you to communicate the actual status of vulnerabilities in your project, improving security transparency and reducing false positives for your users.
Learn more and start using VEX: https://trivy.dev/docs/v0.70/guide/supply-chain/vex/repo#publishing-vex-documents

To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable.


dependencies/package-lock.json (npm)
====================================
Total: 15 (UNKNOWN: 0, LOW: 0, MEDIUM: 10, HIGH: 5, CRITICAL: 0)

┌────────────┬────────────────┬──────────┬────────┬───────────────────┬───────────────┬──────────────────────────────────────────────────────────────┐
│  Library   │ Vulnerability  │ Severity │ Status │ Installed Version │ Fixed Version │                            Title                             │
├────────────┼────────────────┼──────────┼────────┼───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ hono       │ CVE-2026-47673 │ MEDIUM   │ fixed  │ 4.12.18           │ 4.12.21       │ Hono: JWT middleware accepts any Authorization scheme, not   │
│            │                │          │        │                   │               │ only Bearer                                                  │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-47673                   │
│            ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│            │ CVE-2026-47674 │          │        │                   │               │ Hono: IP Restriction bypasses static deny rules for          │
│            │                │          │        │                   │               │ non-canonical IPv6                                           │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-47674                   │
│            ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│            │ CVE-2026-47675 │          │        │                   │               │ Hono: Cookie helper does not sanitize sameSite and priority, │
│            │                │          │        │                   │               │ allowing Set-Cookie injection...                             │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-47675                   │
│            ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│            │ CVE-2026-47676 │          │        │                   │               │ Hono: app.mount() strips mount prefix using undecoded path,  │
│            │                │          │        │                   │               │ causing incorrect routing for...                             │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-47676                   │
├────────────┼────────────────┤          │        ├───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ postcss    │ CVE-2026-41305 │          │        │ 8.4.31            │ 8.5.10        │ postcss: PostCSS: Cross-Site Scripting (XSS) via improper    │
│            │                │          │        │                   │               │ escaping of style closing tags...                            │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-41305                   │
├────────────┼────────────────┼──────────┤        ├───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ protobufjs │ CVE-2026-44289 │ HIGH     │        │ 8.0.1             │ 7.5.6, 8.0.2  │ protobuf.js: Denial of service through unbounded protobuf    │
│            │                │          │        │                   │               │ recursion                                                    │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-44289                   │
│            ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│            │ CVE-2026-44290 │          │        │                   │               │ protobuf.js: Process-wide denial of service through unsafe   │
│            │                │          │        │                   │               │ option paths                                                 │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-44290                   │
│            ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│            │ CVE-2026-44291 │          │        │                   │               │ protobuf.js: Code generation gadget after prototype          │
│            │                │          │        │                   │               │ pollution                                                    │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-44291                   │
│            ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│            │ CVE-2026-44293 │          │        │                   │               │ protobuf.js: Code injection through bytes field defaults in  │
│            │                │          │        │                   │               │ generated toObject code                                      │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-44293                   │
│            ├────────────────┼──────────┤        │                   │               ├──────────────────────────────────────────────────────────────┤
│            │ CVE-2026-44288 │ MEDIUM   │        │                   │               │ protobufjs: protobufjs: Security control bypass due to       │
│            │                │          │        │                   │               │ improper handling of overlong UTF-8...                       │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-44288                   │
│            ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│            │ CVE-2026-44292 │          │        │                   │               │ protobuf.js: Prototype injection in generated message        │
│            │                │          │        │                   │               │ constructors                                                 │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-44292                   │
│            ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│            │ CVE-2026-44294 │          │        │                   │               │ protobuf.js: Denial of service from crafted field names in   │
│            │                │          │        │                   │               │ generated code                                               │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-44294                   │
│            ├────────────────┤          │        │                   ├───────────────┼──────────────────────────────────────────────────────────────┤
│            │ CVE-2026-45740 │          │        │                   │ 7.5.8, 8.2.0  │ protobufjs: Denial of Service via unbounded recursive JSON   │
│            │                │          │        │                   │               │ descriptor expansion                                         │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-45740                   │
├────────────┼────────────────┤          │        ├───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ qs         │ CVE-2026-8723  │          │        │ 6.14.2            │ 6.15.2        │ ### Summary `qs.stringify` throws `TypeError` when called    │
│            │                │          │        │                   │               │ with `arr...                                                 │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-8723                    │
├────────────┼────────────────┼──────────┤        ├───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ simple-git │ CVE-2026-6951  │ HIGH     │        │ 3.35.2            │ 3.36.0        │ simple-git: simple-git: Remote Code Execution due to         │
│            │                │          │        │                   │               │ incomplete fix bypass                                        │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-6951                    │
└────────────┴────────────────┴──────────┴────────┴───────────────────┴───────────────┴──────────────────────────────────────────────────────────────┘
YAML_PRETTIER 
prettier --check /github/workspace/action.yml /github/workspace/slim/action.yml
Checking formatting...[warn] action.yml
[warn] slim/action.yml
[warn] Code style issues found in 2 files. Run Prettier with --write to fix.

@github-actions

github-actions Bot commented Jun 11, 2026

Copy link
Copy Markdown
Contributor

Super-linter summary

Language Validation result
BIOME_FORMAT Pass ✅
BIOME_LINT Pass ✅
CHECKOV Pass ✅
EDITORCONFIG Pass ✅
GITHUB_ACTIONS_ZIZMOR Pass ✅
GITLEAKS Pass ✅
GIT_COMMITLINT Fail ❌
GIT_MERGE_CONFLICT_MARKERS Pass ✅
JSCPD Pass ✅
PRE_COMMIT Pass ✅
SPELL_CODESPELL Pass ✅
TRIVY Fail ❌
YAML Pass ✅
YAML_PRETTIER Fail ❌

Super-linter detected linting errors

For more information, see the
GitHub Actions workflow run

Powered by Super-linter

GIT_COMMITLINT 
⧗   --- input ---
Update action.yml
✖   subject may not be empty [subject-empty]
✖   type may not be empty [type-empty]

✖   found 2 problems, 0 warnings
ⓘ   Get help: https://www.conventionalcommits.org/

⧗   --- input ---
Update action.yml
✖   subject may not be empty [subject-empty]
✖   type may not be empty [type-empty]

✖   found 2 problems, 0 warnings
ⓘ   Get help: https://www.conventionalcommits.org/

⧗   --- input ---
Update action.yml
✖   subject may not be empty [subject-empty]
✖   type may not be empty [type-empty]

✖   found 2 problems, 0 warnings
ⓘ   Get help: https://www.conventionalcommits.org/
TRIVY 

Report Summary

┌─────────────────────────────────────┬────────────┬─────────────────┬───────────────────┬─────────┐
│               Target                │    Type    │ Vulnerabilities │ Misconfigurations │ Secrets │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ dependencies/Gemfile.lock           │  bundler   │        0        │         -         │    -    │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ dependencies/composer/composer.lock │  composer  │        0        │         -         │    -    │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ dependencies/package-lock.json      │    npm     │       15        │         -         │    -    │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ Dockerfile                          │ dockerfile │        -        │         0         │    -    │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ test/linters/trivy/good/Dockerfile  │ dockerfile │        -        │         0         │    -    │
└─────────────────────────────────────┴────────────┴─────────────────┴───────────────────┴─────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)


For OSS Maintainers: VEX Notice
--------------------------------
If you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement.
VEX allows you to communicate the actual status of vulnerabilities in your project, improving security transparency and reducing false positives for your users.
Learn more and start using VEX: https://trivy.dev/docs/v0.70/guide/supply-chain/vex/repo#publishing-vex-documents

To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable.


dependencies/package-lock.json (npm)
====================================
Total: 15 (UNKNOWN: 0, LOW: 0, MEDIUM: 10, HIGH: 5, CRITICAL: 0)

┌────────────┬────────────────┬──────────┬────────┬───────────────────┬───────────────┬──────────────────────────────────────────────────────────────┐
│  Library   │ Vulnerability  │ Severity │ Status │ Installed Version │ Fixed Version │                            Title                             │
├────────────┼────────────────┼──────────┼────────┼───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ hono       │ CVE-2026-47673 │ MEDIUM   │ fixed  │ 4.12.18           │ 4.12.21       │ Hono: JWT middleware accepts any Authorization scheme, not   │
│            │                │          │        │                   │               │ only Bearer                                                  │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-47673                   │
│            ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│            │ CVE-2026-47674 │          │        │                   │               │ Hono: IP Restriction bypasses static deny rules for          │
│            │                │          │        │                   │               │ non-canonical IPv6                                           │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-47674                   │
│            ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│            │ CVE-2026-47675 │          │        │                   │               │ Hono: Cookie helper does not sanitize sameSite and priority, │
│            │                │          │        │                   │               │ allowing Set-Cookie injection...                             │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-47675                   │
│            ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│            │ CVE-2026-47676 │          │        │                   │               │ Hono: app.mount() strips mount prefix using undecoded path,  │
│            │                │          │        │                   │               │ causing incorrect routing for...                             │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-47676                   │
├────────────┼────────────────┤          │        ├───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ postcss    │ CVE-2026-41305 │          │        │ 8.4.31            │ 8.5.10        │ postcss: PostCSS: Cross-Site Scripting (XSS) via improper    │
│            │                │          │        │                   │               │ escaping of style closing tags...                            │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-41305                   │
├────────────┼────────────────┼──────────┤        ├───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ protobufjs │ CVE-2026-44289 │ HIGH     │        │ 8.0.1             │ 7.5.6, 8.0.2  │ protobuf.js: Denial of service through unbounded protobuf    │
│            │                │          │        │                   │               │ recursion                                                    │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-44289                   │
│            ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│            │ CVE-2026-44290 │          │        │                   │               │ protobuf.js: Process-wide denial of service through unsafe   │
│            │                │          │        │                   │               │ option paths                                                 │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-44290                   │
│            ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│            │ CVE-2026-44291 │          │        │                   │               │ protobuf.js: Code generation gadget after prototype          │
│            │                │          │        │                   │               │ pollution                                                    │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-44291                   │
│            ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│            │ CVE-2026-44293 │          │        │                   │               │ protobuf.js: Code injection through bytes field defaults in  │
│            │                │          │        │                   │               │ generated toObject code                                      │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-44293                   │
│            ├────────────────┼──────────┤        │                   │               ├──────────────────────────────────────────────────────────────┤
│            │ CVE-2026-44288 │ MEDIUM   │        │                   │               │ protobufjs: protobufjs: Security control bypass due to       │
│            │                │          │        │                   │               │ improper handling of overlong UTF-8...                       │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-44288                   │
│            ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│            │ CVE-2026-44292 │          │        │                   │               │ protobuf.js: Prototype injection in generated message        │
│            │                │          │        │                   │               │ constructors                                                 │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-44292                   │
│            ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│            │ CVE-2026-44294 │          │        │                   │               │ protobuf.js: Denial of service from crafted field names in   │
│            │                │          │        │                   │               │ generated code                                               │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-44294                   │
│            ├────────────────┤          │        │                   ├───────────────┼──────────────────────────────────────────────────────────────┤
│            │ CVE-2026-45740 │          │        │                   │ 7.5.8, 8.2.0  │ protobufjs: Denial of Service via unbounded recursive JSON   │
│            │                │          │        │                   │               │ descriptor expansion                                         │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-45740                   │
├────────────┼────────────────┤          │        ├───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ qs         │ CVE-2026-8723  │          │        │ 6.14.2            │ 6.15.2        │ ### Summary `qs.stringify` throws `TypeError` when called    │
│            │                │          │        │                   │               │ with `arr...                                                 │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-8723                    │
├────────────┼────────────────┼──────────┤        ├───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ simple-git │ CVE-2026-6951  │ HIGH     │        │ 3.35.2            │ 3.36.0        │ simple-git: simple-git: Remote Code Execution due to         │
│            │                │          │        │                   │               │ incomplete fix bypass                                        │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-6951                    │
└────────────┴────────────────┴──────────┴────────┴───────────────────┴───────────────┴──────────────────────────────────────────────────────────────┘
YAML_PRETTIER 
Checking formatting...[warn] action.yml
[warn] slim/action.yml
[warn] Code style issues found in 2 files. Run Prettier with --write to fix.

@github-actions

github-actions Bot commented Jun 11, 2026

Copy link
Copy Markdown
Contributor

Super-linter summary

Language Validation result
BIOME_FORMAT Pass ✅
BIOME_LINT Pass ✅
CHECKOV Pass ✅
EDITORCONFIG Pass ✅
GITHUB_ACTIONS_ZIZMOR Fail ❌
GITLEAKS Pass ✅
GIT_COMMITLINT Fail ❌
GIT_MERGE_CONFLICT_MARKERS Pass ✅
JSCPD Pass ✅
PRE_COMMIT Pass ✅
SPELL_CODESPELL Pass ✅
TRIVY Fail ❌
YAML Pass ✅
YAML_PRETTIER Fail ❌

Super-linter detected linting errors

For more information, see the
GitHub Actions workflow run

Powered by Super-linter

GITHUB_ACTIONS_ZIZMOR 
zizmor --config /github/workspace/.github/linters/zizmor.yaml /github/workspace/action.yml /github/workspace/slim/action.yml
error[unpinned-images]: unpinned image references
 --> /github/workspace/action.yml:7:3
  |
7 |   image: 'docker://ghcr.io/step-security/super-linter:latest'
  |   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ container image is pinned to latest
  |
  = note: audit confidence → High
  = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-images

2 findings (1 suppressed): 0 informational, 0 low, 0 medium, 1 high INFO zizmor: 🌈 zizmor v1.25.2
 INFO audit: zizmor: 🌈 completed /github/workspace/action.yml
 INFO audit: zizmor: 🌈 completed /github/workspace/slim/action.yml
GIT_COMMITLINT 
commitlint --verbose --from 01eb9d4a1f13e10d7fa0578d3cebfc14dec82477 --to e58b0e5ecfb2d21ffde74ed95899e849c356224d --cwd /github/workspace
⧗   --- input ---
Update action.yml
✖   subject may not be empty [subject-empty]
✖   type may not be empty [type-empty]

✖   found 2 problems, 0 warnings
ⓘ   Get help: https://www.conventionalcommits.org/

⧗   --- input ---
Update action.yml
✖   subject may not be empty [subject-empty]
✖   type may not be empty [type-empty]

✖   found 2 problems, 0 warnings
ⓘ   Get help: https://www.conventionalcommits.org/

⧗   --- input ---
Update action.yml
✖   subject may not be empty [subject-empty]
✖   type may not be empty [type-empty]

✖   found 2 problems, 0 warnings
ⓘ   Get help: https://www.conventionalcommits.org/
TRIVY 
trivy filesystem --config /github/workspace/.github/linters/trivy.yaml /github/workspace

Report Summary

┌─────────────────────────────────────┬────────────┬─────────────────┬───────────────────┬─────────┐
│               Target                │    Type    │ Vulnerabilities │ Misconfigurations │ Secrets │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ dependencies/Gemfile.lock           │  bundler   │        0        │         -         │    -    │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ dependencies/composer/composer.lock │  composer  │        0        │         -         │    -    │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ dependencies/package-lock.json      │    npm     │       15        │         -         │    -    │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ Dockerfile                          │ dockerfile │        -        │         0         │    -    │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ test/linters/trivy/good/Dockerfile  │ dockerfile │        -        │         0         │    -    │
└─────────────────────────────────────┴────────────┴─────────────────┴───────────────────┴─────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)


For OSS Maintainers: VEX Notice
--------------------------------
If you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement.
VEX allows you to communicate the actual status of vulnerabilities in your project, improving security transparency and reducing false positives for your users.
Learn more and start using VEX: https://trivy.dev/docs/v0.70/guide/supply-chain/vex/repo#publishing-vex-documents

To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable.


dependencies/package-lock.json (npm)
====================================
Total: 15 (UNKNOWN: 0, LOW: 0, MEDIUM: 10, HIGH: 5, CRITICAL: 0)

┌────────────┬────────────────┬──────────┬────────┬───────────────────┬───────────────┬──────────────────────────────────────────────────────────────┐
│  Library   │ Vulnerability  │ Severity │ Status │ Installed Version │ Fixed Version │                            Title                             │
├────────────┼────────────────┼──────────┼────────┼───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ hono       │ CVE-2026-47673 │ MEDIUM   │ fixed  │ 4.12.18           │ 4.12.21       │ Hono: JWT middleware accepts any Authorization scheme, not   │
│            │                │          │        │                   │               │ only Bearer                                                  │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-47673                   │
│            ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│            │ CVE-2026-47674 │          │        │                   │               │ Hono: IP Restriction bypasses static deny rules for          │
│            │                │          │        │                   │               │ non-canonical IPv6                                           │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-47674                   │
│            ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│            │ CVE-2026-47675 │          │        │                   │               │ Hono: Cookie helper does not sanitize sameSite and priority, │
│            │                │          │        │                   │               │ allowing Set-Cookie injection...                             │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-47675                   │
│            ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│            │ CVE-2026-47676 │          │        │                   │               │ Hono: app.mount() strips mount prefix using undecoded path,  │
│            │                │          │        │                   │               │ causing incorrect routing for...                             │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-47676                   │
├────────────┼────────────────┤          │        ├───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ postcss    │ CVE-2026-41305 │          │        │ 8.4.31            │ 8.5.10        │ postcss: PostCSS: Cross-Site Scripting (XSS) via improper    │
│            │                │          │        │                   │               │ escaping of style closing tags...                            │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-41305                   │
├────────────┼────────────────┼──────────┤        ├───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ protobufjs │ CVE-2026-44289 │ HIGH     │        │ 8.0.1             │ 7.5.6, 8.0.2  │ protobuf.js: Denial of service through unbounded protobuf    │
│            │                │          │        │                   │               │ recursion                                                    │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-44289                   │
│            ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│            │ CVE-2026-44290 │          │        │                   │               │ protobuf.js: Process-wide denial of service through unsafe   │
│            │                │          │        │                   │               │ option paths                                                 │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-44290                   │
│            ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│            │ CVE-2026-44291 │          │        │                   │               │ protobuf.js: Code generation gadget after prototype          │
│            │                │          │        │                   │               │ pollution                                                    │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-44291                   │
│            ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│            │ CVE-2026-44293 │          │        │                   │               │ protobuf.js: Code injection through bytes field defaults in  │
│            │                │          │        │                   │               │ generated toObject code                                      │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-44293                   │
│            ├────────────────┼──────────┤        │                   │               ├──────────────────────────────────────────────────────────────┤
│            │ CVE-2026-44288 │ MEDIUM   │        │                   │               │ protobufjs: protobufjs: Security control bypass due to       │
│            │                │          │        │                   │               │ improper handling of overlong UTF-8...                       │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-44288                   │
│            ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│            │ CVE-2026-44292 │          │        │                   │               │ protobuf.js: Prototype injection in generated message        │
│            │                │          │        │                   │               │ constructors                                                 │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-44292                   │
│            ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│            │ CVE-2026-44294 │          │        │                   │               │ protobuf.js: Denial of service from crafted field names in   │
│            │                │          │        │                   │               │ generated code                                               │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-44294                   │
│            ├────────────────┤          │        │                   ├───────────────┼──────────────────────────────────────────────────────────────┤
│            │ CVE-2026-45740 │          │        │                   │ 7.5.8, 8.2.0  │ protobufjs: Denial of Service via unbounded recursive JSON   │
│            │                │          │        │                   │               │ descriptor expansion                                         │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-45740                   │
├────────────┼────────────────┤          │        ├───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ qs         │ CVE-2026-8723  │          │        │ 6.14.2            │ 6.15.2        │ ### Summary `qs.stringify` throws `TypeError` when called    │
│            │                │          │        │                   │               │ with `arr...                                                 │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-8723                    │
├────────────┼────────────────┼──────────┤        ├───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ simple-git │ CVE-2026-6951  │ HIGH     │        │ 3.35.2            │ 3.36.0        │ simple-git: simple-git: Remote Code Execution due to         │
│            │                │          │        │                   │               │ incomplete fix bypass                                        │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-6951                    │
└────────────┴────────────────┴──────────┴────────┴───────────────────┴───────────────┴──────────────────────────────────────────────────────────────┘
YAML_PRETTIER 
prettier --check /github/workspace/action.yml /github/workspace/slim/action.yml
Checking formatting...[warn] action.yml
[warn] slim/action.yml
[warn] Code style issues found in 2 files. Run Prettier with --write to fix.

@github-actions

github-actions Bot commented Jun 11, 2026

Copy link
Copy Markdown
Contributor

Super-linter summary

Language Validation result
BIOME_FORMAT Pass ✅
BIOME_LINT Pass ✅
CHECKOV Pass ✅
EDITORCONFIG Pass ✅
GITHUB_ACTIONS_ZIZMOR Fail ❌
GITLEAKS Pass ✅
GIT_COMMITLINT Fail ❌
GIT_MERGE_CONFLICT_MARKERS Pass ✅
JSCPD Pass ✅
PRE_COMMIT Pass ✅
SPELL_CODESPELL Pass ✅
TRIVY Fail ❌
YAML Pass ✅
YAML_PRETTIER Fail ❌

Super-linter detected linting errors

For more information, see the
GitHub Actions workflow run

Powered by Super-linter

GITHUB_ACTIONS_ZIZMOR 
error[unpinned-images]: unpinned image references
 --> /github/workspace/action.yml:7:3
  |
7 |   image: 'docker://ghcr.io/step-security/super-linter:latest'
  |   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ container image is pinned to latest
  |
  = note: audit confidence → High
  = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-images

2 findings (1 suppressed): 0 informational, 0 low, 0 medium, 1 high INFO zizmor: 🌈 zizmor v1.25.2
 INFO audit: zizmor: 🌈 completed /github/workspace/action.yml
 INFO audit: zizmor: 🌈 completed /github/workspace/slim/action.yml
GIT_COMMITLINT 
⧗   --- input ---
Update action.yml
✖   subject may not be empty [subject-empty]
✖   type may not be empty [type-empty]

✖   found 2 problems, 0 warnings
ⓘ   Get help: https://www.conventionalcommits.org/

⧗   --- input ---
Update action.yml
✖   subject may not be empty [subject-empty]
✖   type may not be empty [type-empty]

✖   found 2 problems, 0 warnings
ⓘ   Get help: https://www.conventionalcommits.org/

⧗   --- input ---
Update action.yml
✖   subject may not be empty [subject-empty]
✖   type may not be empty [type-empty]

✖   found 2 problems, 0 warnings
ⓘ   Get help: https://www.conventionalcommits.org/
TRIVY 

Report Summary

┌─────────────────────────────────────┬────────────┬─────────────────┬───────────────────┬─────────┐
│               Target                │    Type    │ Vulnerabilities │ Misconfigurations │ Secrets │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ dependencies/Gemfile.lock           │  bundler   │        0        │         -         │    -    │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ dependencies/composer/composer.lock │  composer  │        0        │         -         │    -    │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ dependencies/package-lock.json      │    npm     │       15        │         -         │    -    │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ Dockerfile                          │ dockerfile │        -        │         0         │    -    │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ test/linters/trivy/good/Dockerfile  │ dockerfile │        -        │         0         │    -    │
└─────────────────────────────────────┴────────────┴─────────────────┴───────────────────┴─────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)


For OSS Maintainers: VEX Notice
--------------------------------
If you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement.
VEX allows you to communicate the actual status of vulnerabilities in your project, improving security transparency and reducing false positives for your users.
Learn more and start using VEX: https://trivy.dev/docs/v0.70/guide/supply-chain/vex/repo#publishing-vex-documents

To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable.


dependencies/package-lock.json (npm)
====================================
Total: 15 (UNKNOWN: 0, LOW: 0, MEDIUM: 10, HIGH: 5, CRITICAL: 0)

┌────────────┬────────────────┬──────────┬────────┬───────────────────┬───────────────┬──────────────────────────────────────────────────────────────┐
│  Library   │ Vulnerability  │ Severity │ Status │ Installed Version │ Fixed Version │                            Title                             │
├────────────┼────────────────┼──────────┼────────┼───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ hono       │ CVE-2026-47673 │ MEDIUM   │ fixed  │ 4.12.18           │ 4.12.21       │ Hono: JWT middleware accepts any Authorization scheme, not   │
│            │                │          │        │                   │               │ only Bearer                                                  │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-47673                   │
│            ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│            │ CVE-2026-47674 │          │        │                   │               │ Hono: IP Restriction bypasses static deny rules for          │
│            │                │          │        │                   │               │ non-canonical IPv6                                           │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-47674                   │
│            ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│            │ CVE-2026-47675 │          │        │                   │               │ Hono: Cookie helper does not sanitize sameSite and priority, │
│            │                │          │        │                   │               │ allowing Set-Cookie injection...                             │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-47675                   │
│            ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│            │ CVE-2026-47676 │          │        │                   │               │ Hono: app.mount() strips mount prefix using undecoded path,  │
│            │                │          │        │                   │               │ causing incorrect routing for...                             │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-47676                   │
├────────────┼────────────────┤          │        ├───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ postcss    │ CVE-2026-41305 │          │        │ 8.4.31            │ 8.5.10        │ postcss: PostCSS: Cross-Site Scripting (XSS) via improper    │
│            │                │          │        │                   │               │ escaping of style closing tags...                            │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-41305                   │
├────────────┼────────────────┼──────────┤        ├───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ protobufjs │ CVE-2026-44289 │ HIGH     │        │ 8.0.1             │ 7.5.6, 8.0.2  │ protobuf.js: Denial of service through unbounded protobuf    │
│            │                │          │        │                   │               │ recursion                                                    │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-44289                   │
│            ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│            │ CVE-2026-44290 │          │        │                   │               │ protobuf.js: Process-wide denial of service through unsafe   │
│            │                │          │        │                   │               │ option paths                                                 │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-44290                   │
│            ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│            │ CVE-2026-44291 │          │        │                   │               │ protobuf.js: Code generation gadget after prototype          │
│            │                │          │        │                   │               │ pollution                                                    │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-44291                   │
│            ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│            │ CVE-2026-44293 │          │        │                   │               │ protobuf.js: Code injection through bytes field defaults in  │
│            │                │          │        │                   │               │ generated toObject code                                      │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-44293                   │
│            ├────────────────┼──────────┤        │                   │               ├──────────────────────────────────────────────────────────────┤
│            │ CVE-2026-44288 │ MEDIUM   │        │                   │               │ protobufjs: protobufjs: Security control bypass due to       │
│            │                │          │        │                   │               │ improper handling of overlong UTF-8...                       │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-44288                   │
│            ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│            │ CVE-2026-44292 │          │        │                   │               │ protobuf.js: Prototype injection in generated message        │
│            │                │          │        │                   │               │ constructors                                                 │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-44292                   │
│            ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│            │ CVE-2026-44294 │          │        │                   │               │ protobuf.js: Denial of service from crafted field names in   │
│            │                │          │        │                   │               │ generated code                                               │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-44294                   │
│            ├────────────────┤          │        │                   ├───────────────┼──────────────────────────────────────────────────────────────┤
│            │ CVE-2026-45740 │          │        │                   │ 7.5.8, 8.2.0  │ protobufjs: Denial of Service via unbounded recursive JSON   │
│            │                │          │        │                   │               │ descriptor expansion                                         │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-45740                   │
├────────────┼────────────────┤          │        ├───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ qs         │ CVE-2026-8723  │          │        │ 6.14.2            │ 6.15.2        │ ### Summary `qs.stringify` throws `TypeError` when called    │
│            │                │          │        │                   │               │ with `arr...                                                 │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-8723                    │
├────────────┼────────────────┼──────────┤        ├───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ simple-git │ CVE-2026-6951  │ HIGH     │        │ 3.35.2            │ 3.36.0        │ simple-git: simple-git: Remote Code Execution due to         │
│            │                │          │        │                   │               │ incomplete fix bypass                                        │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-6951                    │
└────────────┴────────────────┴──────────┴────────┴───────────────────┴───────────────┴──────────────────────────────────────────────────────────────┘
YAML_PRETTIER 
Checking formatting...[warn] action.yml
[warn] slim/action.yml
[warn] Code style issues found in 2 files. Run Prettier with --write to fix.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@Raj-StepSecurity