Repository navigation
chore(deps, cpp): update mull-22 - #1514
philips-software-forest-releaser[bot] wants to merge 1 commit into
Conversation
philips-software-forest-releaser
Bot
added
apt
dependencies
📦 Container Size AnalysisNote Comparing 📈 Size Comparison Table
|
|
✅
|
| Descriptor | Linter | Files | Fixed | Errors | Max errors | Warnings | Elapsed time |
|---|---|---|---|---|---|---|---|
| ✅ ACTION | actionlint | 23 | 0 | 0 | 0.18s | ||
| ✅ DOCKERFILE | hadolint | 4 | 0 | 0 | 0.32s | ||
| ✅ JSON | npm-package-json-lint | yes | no | no | 0.27s | ||
| ✅ JSON | prettier | 51 | 8 | 0 | 0 | 2.78s | |
| ✅ JSON | v8r | 51 | 0 | 0 | 9.53s | ||
| ✅ MARKDOWN | markdownlint | 13 | 0 | 0 | 0 | 0.49s | |
| ✅ MARKDOWN | markdown-table-formatter | 13 | 1 | 0 | 0 | 0.25s | |
| ✅ REPOSITORY | betterleaks | yes | no | no | 0.95s | ||
| ✅ REPOSITORY | checkov | yes | no | no | 13.92s | ||
| ✅ REPOSITORY | git_diff | yes | no | no | 0.01s | ||
| ✅ REPOSITORY | grype | yes | no | no | 64.81s | ||
| osv-scanner | yes | 1 | 7 | 2.37s | |||
| ✅ REPOSITORY | secretlint | yes | no | no | 0.81s | ||
| ✅ REPOSITORY | syft | yes | no | no | 1.96s | ||
| ✅ REPOSITORY | trivy | yes | no | no | 8.23s | ||
| ✅ REPOSITORY | trivy-sbom | yes | no | no | 0.28s | ||
| ✅ REPOSITORY | trufflehog | yes | no | no | 2.44s | ||
| lychee | 124 | 1 | 0 | 160.21s | |||
| ✅ YAML | prettier | 36 | 0 | 0 | 0 | 0.51s | |
| ✅ YAML | v8r | 36 | 0 | 0 | 7.0s | ||
| ✅ YAML | yamllint | 36 | 0 | 0 | 0.54s |
Detailed Issues
⚠️ SPELL / lychee - 1 error
📝 Summary
---------------------
🔍 Total..........154
🔗 Unique.........126
✅ Successful.....144
⏳ Timeouts.........4
🔀 Redirected......21
👻 Excluded.........0
❓ Unknown..........0
🚫 Errors...........1
⛔ Unsupported......1
Errors in .github/TOOL_VERSION_ISSUE_TEMPLATE.md
[403] https://developer.arm.com/downloads/-/arm-gnu-toolchain-downloads (at 38:7) | Rejected status code: 403 Forbidden
Errors in test/cpp/features/security.feature
[TIMEOUT] https://slsa.dev/spec/v1.0/levels (at 20:30) | Request timed out
[TIMEOUT] https://slsa.dev/spec/v1.0/threats (at 28:19) | Request timed out
[TIMEOUT] https://slsa.dev/spec/v1.0/threats (at 42:44) | Request timed out
[TIMEOUT] https://slsa.dev/spec/v1.0/verifying-artifacts (at 24:25) | Request timed out
Hint: Followed 21 redirects. You might want to consider replacing redirecting URLs with the resolved URLs. Use verbose mode (`-v`/`-vv`) to see redirection details.
Hint: You can configure accepted/rejected response codes with `-a` or `--accept`
⚠️ REPOSITORY / osv-scanner - 1 error
st has already been rejected.
### Details
This was reproduced on glob v13.0.6 (commit e80cb38ae60d6cbff9e75f39032a994858994d35).
The README documents that the signal option cancels the glob walk. However, in src/walker.ts, the following methods call cb() when this.signal?.aborted is true but do not return:
- GlobUtil.walkCB()
- GlobUtil.walkCB2()
- GlobUtil.walkCBSync()
- GlobUtil.walkCB2Sync()
Example vulnerable pattern:
if (this.signal?.aborted) cb()
Because execution continues after cb(), the walker still reaches processor.processPatterns(), readdirCB(), and recursive walkCB2() calls.
The issue was directly demonstrated against v13.0.6. A source-history review shows the same missing-return pattern is present in tagged releases from v9.0.0 through v13.0.6.
The issue affects both glob() and globStream().
Recommended fix:
Change each abort branch to return immediately:
if (this.signal?.aborted) return cb()
### Proof of concept
Environment:
- Linux x86_64
- Node.js v22.23.3
- npm 10.9.9
- glob 13.0.6
Reproduction steps:
1. Install the affected package:
npm init -y
npm install glob@13.0.6
2. Run the attached PoC:
node poc/abort-continues-work.mjs
The PoC aborts after the first readdir() call, waits briefly, and counts how many more directory reads happen after the promise has already rejected.
Observed output on the vulnerable version:
{
"rejection": "Error: probe-abort",
"readdirCalls": 1365,
"readdirCallsAtReject": 5,
"readdirCallsAfterReject": 1360
}
Expected behavior:
readdirCallsAfterReject should be 0.
A second PoC using AbortSignal.timeout() also reproduces the issue:
{
"rejection": "TimeoutError: The operation was aborted due to timeout",
"readdirCalls": 133,
"readdirCallsAtReject": 1,
"readdirCallsAfterReject": 132
}
The same test against a patched build with return cb() in the four abort branches stops immediately:
{
"readdirCalls": 1,
"readdirCallsAtReject": 1,
"readdirCallsAfterReject": 0
}
### Impact
This is an availability issue.
Applications that expose globbing over attacker-influenced patterns or attacker-controlled directory trees and use AbortSignal / AbortSignal.timeout() as a traversal budget can still perform significant filesystem I/O and CPU work after a request has already timed out or been canceled.
Repeated timed-out requests can stack background glob walks and degrade worker throughput or service availability.
No confidentiality or integrity impact was observed.
warning: Package 'qs@6.16.0' is vulnerable to 'CVE-2026-110816' (also known as 'GHSA-6pq8-jhm2-2vcw').
= CVE-2026-110816: qs : qs.stringify with arrayFormat 'comma' throws an uncaught TypeError on array elements carrying a non-callable own toString (DoS)
= ## Summary
`qs.stringify(obj, { arrayFormat: 'comma' })` throws an uncaught `TypeError: Cannot convert object to primitive value` when an array in `obj` contains an element that carries an own, non-callable `toString` property (for example `{ a: [ { toString: 'x' } ] }`). A remote, unauthenticated attacker who can influence an object that the application later re-serializes with the comma array format triggers the throw. In a service that lacks a synchronous error boundary around the serialization call, the uncaught exception crashes the worker process, producing a denial of service.
## Root Cause
When `arrayFormat: 'comma'` is selected, the comma branch collapses the whole array into a single value via `Array.prototype.join`, or, under `encodeValuesOnly: true`, maps each element through the value encoder before joining. Both paths perform an implicit string coercion (`ToPrimitive` with hint `"string"`) on each element. For an object whose own `toString` is a non-callable value, coercion skips the shadowed non-callable `toString`, falls through to `Object.prototype.valueOf` (which returns the object rather than a primitive), and throws. The comma branch runs this coercion before the per-element null and skip handling in the main loop, so nothing downstream can neutralize the hostile element, and the throw is never caught inside the library.
```text
lib/stringify.js (comma-array branch)
line 152-154: obj = utils.maybeMap(obj, function (v) { return v == null ? v : encoder(v); }); // encodeValuesOnly path
line 156: objKeys = [{ value: obj.length > 0 ? obj.join(',') || null : void undefined }]; // default comma path
lib/utils.js
line 292: string = String(str); // value encoder coercion reached via the encodeValuesOnly path
Impact
Prerequisites: the application calls qs.stringify with arrayFormat: 'comma' (a documented, supported option) on an object whose shape can be influenced by attacker input. Attacker-controllable sources include qs.parse(input, { allowPrototypes: true }), which retains a toString segment (Express 4's default query parser, Express 5's extended query parser, and body-parser's extended urlencoded parser all set it), qs.parse(input, { plainObjects: true }), whose null-prototype elements throw even without a toString key (eg, a[][b]=c), and JSON.parse of a request body, which needs no qs parse option at all. No authentication or user interaction is required. Demonstrated capability: a single request forces an uncaught synchronous TypeError in the serialization call. In a naive single-process Node service with no synchronous error boundary, this crashes the process and takes the service offline (availability impact). Under a framework such as Express that traps synchronous handler throws, the plausible outcome is a per-request 500 rather than a full outage; that lower-impact case is noted but not the worst credible supported deployment. There is no confidentiality or integrity impact, no memory unsafety, and no prototype pollution.
Proof of Concept
Install qs at the affected version (for example 6.16.0) and run the following script with Node.js. No network setup is required; it demonstrates the throw in isolation.
var qs = require('qs');
// Source A: qs.parse with allowPrototypes retains the hostile toString segment
qs.stringify(qs.parse('a[0][toString]=x', { allowPrototypes: true }), { arrayFormat: 'comma' });
// Source B: a JSON request body, no qs parse option needed
qs.stringify(JSON.parse('{"a":[{"toString":"x"}]}'), { arrayFormat: 'comma' });
// Also affected: the encodeValuesOnly sub-path
qs.stringify(JSON.parse('{"a":[{"toString":"x"}]}'), { arrayFormat: 'comma', encodeValuesOnly: true });A default-join (allowPrototypes) => THREW: TypeError: Cannot convert object to primitive value
B default-join (JSON.parse) => THREW: TypeError: Cannot convert object to primitive value
C encodeValuesOnly path => THREW: TypeError: Cannot convert object to primitive value
N2 callable toString => NO THROW; output="a=z"
N3 isBuffer vector (CVE-2026-82417) => NO THROW; output="a%5Bconstructor%5D%5BisBuffer%5D=x"
qs version: 6.16.0
Attack Chain
- Exposure: A remote, unauthenticated request reaches an endpoint whose handler eventually serializes attacker-influenced data with
qs.stringify(obj, { arrayFormat: 'comma' }). - Control: The attacker supplies data that becomes
{ a: [ { toString: <non-callable value> } ] }, either viaa[0][toString]=xparsed withallowPrototypes, or via a JSON body{"a":[{"toString":"x"}]}. - Path: In
stringify, the primitive/buffer guard atlib/stringify.js:134is false for an array, so control reaches the comma branch atlib/stringify.js:149. - Guard: On the
encodeValuesOnlypath, the closurev == null ? v : encoder(v)atlib/stringify.js:152-154passes onlynull/undefinedthrough; a non-null object still reaches the encoder. The default path skips that closure entirely and reachesobj.join(',')atlib/stringify.js:156with no guard at all. - Primitive: The element is coerced to a string (
Array.prototype.join, orString(str)atlib/utils.js:292).ToPrimitiveskips the non-callable owntoString,valueOfreturns the object, and aTypeErroris thrown. - Result: The uncaught synchronous exception propagates out of the serialization call, failing the request and, in a service without a synchronous error boundary, crashing the process (denial of service).
Bypass Evidence
This is a different element type on the code path CVE-2026-8723 (GHSA-q8mj-m7cp-5q26) patched, plus the default comma path, which that fix never covered. CVE-2026-8723 addressed a TypeError crash on null/undefined entries in the comma plus encodeValuesOnly path. Its fix (commit 21f80b3) wraps the encoder in function (v) { return v == null ? v : encoder(v); }, so it only passes null and undefined through. A non-null element with a hostile own toString fails the v == null test, so the encoder still runs and still throws; the encodeValuesOnly case (case C above) throws on the exact fixed code. The default comma path (encodeValuesOnly unset, the library default) never entered that fix at all: git log -S "obj.join(','" -- lib/stringify.js shows no security fix has ever touched the obj.join(',') line, and cases A and B throw with encodeValuesOnly unset. The related isBuffer hardening for CVE-2026-82417 (commit e83d321) is a different sink at the lib/stringify.js:134 guard, which is never entered for the array element; the negative control {a:{constructor:{isBuffer:'x'}}} serializes cleanly. Disproof attempts that failed: a valueOf-only object does not throw (it serializes to [object Object]), confirming the trigger is an element with no callable toString (an own non-callable toString, or a null-prototype object with no toString at all, as qs.parse produces under plainObjects); nested arrays ({"a":[[{"toString":"x"}]]}) throw the same way; a callable toString serializes cleanly; and the default (non-comma) array format serializes cleanly, confirming the comma format is required. All positive and negative cases were reproduced on the exact published 6.16.0 artifact.
Affected Versions
Ecosystem: npmPackage: qsConfirmed affected range: >= 6.7.0, <= 6.16.0Latest release checked: 6.16.0 (npm latest; git tag v6.16.0)Fix status: fixed in 6.16.1 (a952e75)
The arrayFormat: 'comma' join sink was introduced in qs 6.7.0, so 6.7.0 is the lower boundary; releases before 6.7.0 lack the sink. No released version fixes this vector, and the latest published release (6.16.0) reproduces the throw, so the closed upper bound <= 6.16.0 covers every affected release. The encodeValuesOnly sub-path was added later, but the default comma-join vector already affects 6.7.0, so 6.7.0 governs the lower boundary.
Suggested Fix
The comma array serialization must not allow an implicit string coercion of an array element to throw an uncaught exception. Coercion of each comma element should be performed defensively (for example by wrapping the join and per-element encode so that a coercion failure is caught and handled), and this protection must cover both the default obj.join(',') path and the encodeValuesOnly encoder path, not only the previously patched null/undefined case. As an interim mitigation without a code change, applications can avoid arrayFormat: 'comma' when serializing data derived from untrusted input, sanitize parsed objects (avoid allowPrototypes/plainObjects on untrusted input and strip unexpected own properties), or wrap qs.stringify calls in a synchronous error boundary so a coercion failure cannot crash the process.
Reported by zx (GitHub: Daniel Coles (@manus-pi)).
Independent report by Lucidsec
The following was reported separately, after this advisory, and is merged here as a duplicate.
Summary
In project qs, in versions >= 6.7.0, <= 6.16.0 (every version that supports arrayFormat: 'comma'), qs.stringify with arrayFormat: 'comma' can throw an uncaught TypeError: Cannot convert object to primitive value when an array element has a non-callable own toString. It is fixed in 6.16.1. Related: CWE-248 and CWE-704.
Technical Details
qs.stringify with arrayFormat: 'comma' joins an array at lib/stringify.js:156 via obj.join(','). An element whose own toString is not callable makes Array.prototype.join throw. There is no type check and no catch on that path.
A second path exists with encodeValuesOnly: at lib/stringify.js:151-154, maybeMap only skips v == null, then lib/utils.js:292 does String(str) and throws the same TypeError (this second site exists since v6.11.1; before that, the same input throws at join).
Who can trigger: someone who can shape an array element passed to stringify. The host must use non-default arrayFormat: 'comma'. Default arrayFormat indices does not fold arrays and is not affected. A parse-then-stringify path also needs plainObjects: true (null-prototype elements from lib/parse.js:200) or allowPrototypes: true (which Express 4's default query parser, Express 5's extended query parser, and body-parser's extended urlencoded parser all set). Default qs.parse('a[0][toString]=x') returns {} because the prototype guard drops toString. Direct JSON handed to stringify can supply {"a":[{"toString":"x"}]}.
Cause: the comma fold at lib/stringify.js:149-156 collapses the array into a single value before the main loop at lib/stringify.js:172-212, so skipNulls and strictNullHandling only ever see the joined value, never individual elements. isNonNullishPrimitive / isBuffer at lib/stringify.js:134 inspect the whole value, not each element. A normal object uses Object.prototype.toString and becomes [object Object]. An own non-callable toString is skipped, valueOf returns the object, and join throws. (The skipped TODO test at test/stringify.js:684-689 uses a plain { b: 1 } element, which does not throw; it covers the separate question of what comma format should output for object elements, not this crash.) Earlier comma crash fixes did not cover object elements.
Impact
One small input makes that serialization path throw a synchronous, catchable TypeError. Behind a framework error boundary (eg, a synchronous Express handler), the request fails with a 500 and the process survives. In a host with no error boundary (eg, a bare http.createServer handler), the uncaught exception exits the process (the client sees ECONNRESET). Availability only.
Proof of Concept
Show the proof of concept
Checked on the latest commit that was checked: 07b1d4d82c8f9301c105ea4b94fa2302cfd6e8b4. Still present. Demonstrated.
- Payload
{"a":[{"toString":"x"}]}throws atlib/stringify.js:156. - Baseline
{"a":["x","y"]}returns 200 with bodya=x%2Cy. - A plain object element stringifies to
a=%5Bobject%20Object%5Dand does not throw. encodeValuesOnly: truethrows viautils.js:292.plainObjectsparse plus comma throws.
Suggested Fix
Before join, map elements with the existing primitive check; skip or replace non-primitives so join cannot throw. On the encodeValuesOnly path, do not send non-primitives into String(). Optionally guard lib/utils.js:292. Add new regression tests.
warning: Package 'minimatch@10.2.6' is vulnerable to 'CVE-2026-118764' (also known as 'GHSA-g3hv-75wg-m249').
= CVE-2026-118764: minimatch has potential denial of service via globparts amplification
= minimatch 10.2.6 contains an attacker-controlled pattern amplification in firstPhasePreProcess() when optimizationLevel >= 2.
researcher: Reid Downing (b1nv0id)
files:
- src/index.ts: 690-770
- src/index.ts: 780-796
issue:
input-controlled growth of globParts during first-phase preprocessing, followed by quadratic second-phase processing.
the **/../ transformation clones a globparts entry and appends the clone to the same globparts array:
parts.splice(gs, 1)
const other = parts.slice(0)
other[gs] = '**'
globParts.push(other)
this occurs inside a do...while (didSomething) fixpoint loop, allowing generated entries to be processed again.
the expanded globparts array is subsequently processed by secondPhasePreProcess(), which performs pairwise comparisons:
for (let i = 0; i < globParts.length - 1; i++) {
for (let j = i + 1; j < globParts.length; j++) {
this.partsMatch(...)
}
}
an attacker who can supply a glob pattern can therefore cause additional pattern entries to be generated during preprocessing, followed by quadratic pairwise processing, resulting in excessive cpu and memory consumption.
warning: Package 'minimatch@10.2.4' is vulnerable to 'CVE-2026-118764' (also known as 'GHSA-g3hv-75wg-m249').
= CVE-2026-118764: minimatch has potential denial of service via globparts amplification
= minimatch 10.2.6 contains an attacker-controlled pattern amplification in firstPhasePreProcess() when optimizationLevel >= 2.
researcher: Reid Downing (b1nv0id)
files:
- src/index.ts: 690-770
- src/index.ts: 780-796
issue:
input-controlled growth of globParts during first-phase preprocessing, followed by quadratic second-phase processing.
the **/../ transformation clones a globparts entry and appends the clone to the same globparts array:
parts.splice(gs, 1)
const other = parts.slice(0)
other[gs] = '**'
globParts.push(other)
this occurs inside a do...while (didSomething) fixpoint loop, allowing generated entries to be processed again.
the expanded globparts array is subsequently processed by secondPhasePreProcess(), which performs pairwise comparisons:
for (let i = 0; i < globParts.length - 1; i++) {
for (let j = i + 1; j < globParts.length; j++) {
this.partsMatch(...)
}
}
an attacker who can supply a glob pattern can therefore cause additional pattern entries to be generated during preprocessing, followed by quadratic pairwise processing, resulting in excessive cpu and memory consumption.
warning: Package '@azure/msal-node@5.6.0' is vulnerable to 'CVE-2026-109461' (also known as 'GHSA-xcx6-jx8p-x3h5').
= CVE-2026-109461: MSAL Node authorization code flow may disclose parameters to an attacker-controlled endpoint
= ### Impact
Origin validation error in Microsoft Authentication Library (MSAL) for Node.js allows an unauthorized attacker to disclose information over a network. This affects the auth_code flow.
Patches
Version 7.1.0 and higher are patched.
Workarounds
Ensure you pass in only the auth_code to to acquireTokenByCode
warning: Package 'bare-metal@0.2.5' is vulnerable to 'RUSTSEC-2026-0110'.
= RUSTSEC-2026-0110: bare-metal is deprecated
= The bare-metal crate has been deprecated and archived.
For Mutex and CriticalSection, see the critical-section crate instead.
warning: Package 'bare-metal@0.2.5' is vulnerable to 'RUSTSEC-2026-0110'.
= RUSTSEC-2026-0110: bare-metal is deprecated
= The bare-metal crate has been deprecated and archived.
For Mutex and CriticalSection, see the critical-section crate instead.
warning: 7 warnings emitted
(Truncated to last 20000 characters out of 20600)
</details>
See detailed reports in [MegaLinter artifacts](https://github.com/philips-software/amp-devcontainer/actions/runs/41265796276)
You could have the same capabilities but better runtime performances if you use a MegaLinter flavor:
- [oxsecurity/megalinter/flavors/salesforce@v10.1.0](https://megalinter.io/10.1.0/flavors/salesforce/) (58 linters)
Your project could benefit from a custom flavor, which would allow you to run only the linters you need, and thus improve runtime performances. (Skip this info by defining `FLAVOR_SUGGESTIONS: false`)
- Documentation: [Custom Flavors](https://megalinter.io/10.1.0/custom-flavors/)
- Command: `npx mega-linter-runner@10.1.0 --custom-flavor-setup --custom-flavor-linters ACTION_ACTIONLINT,DOCKERFILE_HADOLINT,JSON_V8R,JSON_PRETTIER,JSON_NPM_PACKAGE_JSON_LINT,MARKDOWN_MARKDOWNLINT,MARKDOWN_MARKDOWN_TABLE_FORMATTER,REPOSITORY_CHECKOV,REPOSITORY_GIT_DIFF,REPOSITORY_BETTERLEAKS,REPOSITORY_GRYPE,REPOSITORY_OSV_SCANNER,REPOSITORY_SECRETLINT,REPOSITORY_SYFT,REPOSITORY_TRIVY,REPOSITORY_TRIVY_SBOM,REPOSITORY_TRUFFLEHOG,SPELL_LYCHEE,YAML_PRETTIER,YAML_YAMLLINT,YAML_V8R`
[](https://www.ox.security/?ref=megalinter)
Show us your support by [**starring ⭐ the repository**](https://github.com/oxsecurity/megalinter)
<!-- megalinter: github-comment-reporter workflow='Linting & Formatting' jobid='linter' -->
📦 Container Size AnalysisNote Comparing 📈 Size Comparison Table
|
📦 Container Size AnalysisNote Comparing 📈 Size Comparison Table
|
📦 Container Size AnalysisNote Comparing 📈 Size Comparison Table
|
📦 Container Size AnalysisNote Comparing 📈 Size Comparison Table
|
Automated changes by create-pull-request GitHub action