Skip to content

ngg846/update upstream 260408#7

Merged
marcusmai-telia merged 42 commits intomainfrom
ngg846/update-upstream-260408
Apr 8, 2026
Merged

ngg846/update upstream 260408#7
marcusmai-telia merged 42 commits intomainfrom
ngg846/update-upstream-260408

Conversation

@marcusmai-telia
Copy link
Copy Markdown
Collaborator

@marcusmai-telia marcusmai-telia commented Apr 8, 2026

ferrarimarco and others added 30 commits March 20, 2026 12:05
@ferrarimarco
chore: fix npm build (super-linter#7649)
ea3113b
@coliff
chore: upgrade actions/checkout to version 6 (super-linter#7645)
58a6e5d 
Updated actions/checkout from v5 to v6 in README
@dependabot
deps(bundler): bump rubocop-github in /dependencies in the rubocop gr…
a88d75e 
…oup (super-linter#7640)

Bumps the rubocop group in /dependencies with 1 update: [rubocop-github](https://github.com/github/rubocop-github).


Updates `rubocop-github` from 0.26.0 to 0.27.0
- [Release notes](https://github.com/github/rubocop-github/releases)
- [Changelog](https://github.com/github/rubocop-github/blob/main/CHANGELOG.md)
- [Commits](github/rubocop-github@v0.26.0...v0.27.0)

---
updated-dependencies:
- dependency-name: rubocop-github
  dependency-version: 0.27.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: rubocop
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
deps(docker): bump the docker group with 2 updates (super-linter#7641)
7293e37 
Bumps the docker group with 2 updates: alpine/terragrunt and dotnet/sdk.


Updates `alpine/terragrunt` from 1.14.6 to 1.14.7

Updates `dotnet/sdk` from 10.0.200-alpine3.23 to 10.0.201-alpine3.23

---
updated-dependencies:
- dependency-name: alpine/terragrunt
  dependency-version: 1.14.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: docker
- dependency-name: dotnet/sdk
  dependency-version: 10.0.201-alpine3.23
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: docker
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
deps(python): bump the pip group across 1 directory with 3 updates (s…
2e8137a 
…uper-linter#7648)

Bumps the pip group with 3 updates in the /dependencies/python directory: [snakemake](https://github.com/snakemake/snakemake), [checkov](https://github.com/bridgecrewio/checkov) and [cfn-lint](https://github.com/aws-cloudformation/cfn-lint).


Updates `snakemake` from 9.16.3 to 9.17.2
- [Release notes](https://github.com/snakemake/snakemake/releases)
- [Changelog](https://github.com/snakemake/snakemake/blob/main/CHANGELOG.md)
- [Commits](snakemake/snakemake@v9.16.3...v9.17.2)

Updates `checkov` from 3.2.508 to 3.2.510
- [Release notes](https://github.com/bridgecrewio/checkov/releases)
- [Changelog](https://github.com/bridgecrewio/checkov/blob/main/CHANGELOG.md)
- [Commits](bridgecrewio/checkov@3.2.508...3.2.510)

Updates `cfn-lint` from 1.46.0 to 1.47.0
- [Release notes](https://github.com/aws-cloudformation/cfn-lint/releases)
- [Changelog](https://github.com/aws-cloudformation/cfn-lint/blob/main/CHANGELOG.md)
- [Commits](aws-cloudformation/cfn-lint@v1.46.0...v1.47.0)

---
updated-dependencies:
- dependency-name: snakemake
  dependency-version: 9.17.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip
- dependency-name: checkov
  dependency-version: 3.2.510
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip
- dependency-name: cfn-lint
  dependency-version: 1.47.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
deps(npm): bump the npm group across 1 directory with 7 updates (supe…
946725f 
…r-linter#7651)

Bumps the npm group with 7 updates in the /dependencies directory:

| Package | From | To |
| --- | --- | --- |
| [@biomejs/biome](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome) | `2.4.6` | `2.4.8` |
| [@commitlint/config-conventional](https://github.com/conventional-changelog/commitlint/tree/HEAD/@commitlint/config-conventional) | `20.4.4` | `20.5.0` |
| [@typescript-eslint/eslint-plugin](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin) | `8.57.0` | `8.57.1` |
| [commitlint](https://github.com/conventional-changelog/commitlint/tree/HEAD/@alias/commitlint) | `20.4.4` | `20.5.0` |
| [react-intl](https://github.com/formatjs/formatjs) | `8.1.3` | `10.1.0` |
| [renovate](https://github.com/renovatebot/renovate) | `43.64.5` | `43.84.0` |
| [stylelint](https://github.com/stylelint/stylelint) | `17.4.0` | `17.5.0` |



Updates `@biomejs/biome` from 2.4.6 to 2.4.8
- [Release notes](https://github.com/biomejs/biome/releases)
- [Changelog](https://github.com/biomejs/biome/blob/main/packages/@biomejs/biome/CHANGELOG.md)
- [Commits](https://github.com/biomejs/biome/commits/@biomejs/biome@2.4.8/packages/@biomejs/biome)

Updates `@commitlint/config-conventional` from 20.4.4 to 20.5.0
- [Release notes](https://github.com/conventional-changelog/commitlint/releases)
- [Changelog](https://github.com/conventional-changelog/commitlint/blob/master/@commitlint/config-conventional/CHANGELOG.md)
- [Commits](https://github.com/conventional-changelog/commitlint/commits/v20.5.0/@commitlint/config-conventional)

Updates `@typescript-eslint/eslint-plugin` from 8.57.0 to 8.57.1
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/eslint-plugin/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.57.1/packages/eslint-plugin)

Updates `commitlint` from 20.4.4 to 20.5.0
- [Release notes](https://github.com/conventional-changelog/commitlint/releases)
- [Changelog](https://github.com/conventional-changelog/commitlint/blob/master/@alias/commitlint/CHANGELOG.md)
- [Commits](https://github.com/conventional-changelog/commitlint/commits/v20.5.0/@alias/commitlint)

Updates `react-intl` from 8.1.3 to 10.1.0
- [Release notes](https://github.com/formatjs/formatjs/releases)
- [Commits](https://github.com/formatjs/formatjs/compare/react-intl@8.1.3...react-intl@10.1.0)

Updates `renovate` from 43.64.5 to 43.84.0
- [Release notes](https://github.com/renovatebot/renovate/releases)
- [Commits](renovatebot/renovate@43.64.5...43.84.0)

Updates `stylelint` from 17.4.0 to 17.5.0
- [Release notes](https://github.com/stylelint/stylelint/releases)
- [Changelog](https://github.com/stylelint/stylelint/blob/main/CHANGELOG.md)
- [Commits](stylelint/stylelint@17.4.0...17.5.0)

---
updated-dependencies:
- dependency-name: "@biomejs/biome"
  dependency-version: 2.4.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: "@commitlint/config-conventional"
  dependency-version: 20.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm
- dependency-name: "@typescript-eslint/eslint-plugin"
  dependency-version: 8.57.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: commitlint
  dependency-version: 20.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm
- dependency-name: react-intl
  dependency-version: 10.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: npm
- dependency-name: renovate
  dependency-version: 43.84.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm
- dependency-name: stylelint
  dependency-version: 17.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@ferrarimarco
chore: fix npm build (super-linter#7657)
6d120fe
@ferrarimarco
fix: set markdownlint glob paths from rules file (super-linter#7652)
53eb3bb 
Use MARKDOWN_LINTER_RULES to get the path to custom glob rules files,
instead of duplicating the logic to get the path to the configuration
files directory.

Fix super-linter#7650
@dependabot
deps(python): bump ruff (super-linter#7659)
576d1c4 
Bumps the pip group with 1 update in the /dependencies/python directory: [ruff](https://github.com/astral-sh/ruff).


Updates `ruff` from 0.15.6 to 0.15.7
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.15.6...0.15.7)

---
updated-dependencies:
- dependency-name: ruff
  dependency-version: 0.15.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
deps(docker): bump the docker group with 2 updates (super-linter#7663)
eabfa25 
Bumps the docker group with 2 updates: golangci/golangci-lint and zricethezav/gitleaks.


Updates `golangci/golangci-lint` from v2.11.3 to v2.11.4

Updates `zricethezav/gitleaks` from v8.30.0 to v8.30.1

---
updated-dependencies:
- dependency-name: golangci/golangci-lint
  dependency-version: v2.11.4
  dependency-type: direct:production
  dependency-group: docker
- dependency-name: zricethezav/gitleaks
  dependency-version: v8.30.1
  dependency-type: direct:production
  dependency-group: docker
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
deps(bundler): bump rubocop in /dependencies in the rubocop group (su…
bfb2fd9 
…per-linter#7662)

Bumps the rubocop group in /dependencies with 1 update: [rubocop](https://github.com/rubocop/rubocop).


Updates `rubocop` from 1.85.1 to 1.86.0
- [Release notes](https://github.com/rubocop/rubocop/releases)
- [Changelog](https://github.com/rubocop/rubocop/blob/master/CHANGELOG.md)
- [Commits](rubocop/rubocop@v1.85.1...v1.86.0)

---
updated-dependencies:
- dependency-name: rubocop
  dependency-version: 1.86.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: rubocop
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
deps(npm): bump the npm group across 1 directory with 2 updates (supe…
7e22df4 
…r-linter#7664)

Bumps the npm group with 2 updates in the /dependencies directory: [next](https://github.com/vercel/next.js) and [renovate](https://github.com/renovatebot/renovate).


Updates `next` from 16.2.0 to 16.2.1
- [Release notes](https://github.com/vercel/next.js/releases)
- [Changelog](https://github.com/vercel/next.js/blob/canary/release.js)
- [Commits](vercel/next.js@v16.2.0...v16.2.1)

Updates `renovate` from 43.84.0 to 43.86.1
- [Release notes](https://github.com/renovatebot/renovate/releases)
- [Commits](renovatebot/renovate@43.84.0...43.86.1)

---
updated-dependencies:
- dependency-name: next
  dependency-version: 16.2.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: renovate
  dependency-version: 43.86.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
deps(python): bump snakefmt (super-linter#7668)
1723a83 
Bumps the pip group with 1 update in the /dependencies/python directory: [snakefmt](https://github.com/snakemake/snakefmt).


Updates `snakefmt` from 0.11.5 to 1.0.0
- [Release notes](https://github.com/snakemake/snakefmt/releases)
- [Changelog](https://github.com/snakemake/snakefmt/blob/master/CHANGELOG.md)
- [Commits](snakemake/snakefmt@v0.11.5...v1.0.0)

---
updated-dependencies:
- dependency-name: snakefmt
  dependency-version: 1.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: pip
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
ci(dev-npm): bump yaml (super-linter#7677)
70db47b 
Bumps the npm_and_yarn group with 1 update in the /dev-dependencies directory: [yaml](https://github.com/eemeli/yaml).


Updates `yaml` from 2.3.4 to 2.8.3
- [Release notes](https://github.com/eemeli/yaml/releases)
- [Commits](eemeli/yaml@v2.3.4...v2.8.3)

---
updated-dependencies:
- dependency-name: yaml
  dependency-version: 2.8.3
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
deps(npm): bump smol-toml from 1.6.0 to 1.6.1 in /dependencies (super…
d015498 
…-linter#7676)

Bumps [smol-toml](https://github.com/squirrelchat/smol-toml) from 1.6.0 to 1.6.1.
- [Release notes](https://github.com/squirrelchat/smol-toml/releases)
- [Commits](squirrelchat/smol-toml@v1.6.0...v1.6.1)

---
updated-dependencies:
- dependency-name: smol-toml
  dependency-version: 1.6.1
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
deps(npm): bump picomatch in /dependencies (super-linter#7675)
df4f15e 
Bumps  and [picomatch](https://github.com/micromatch/picomatch). These dependencies needed to be updated together.

Updates `picomatch` from 2.3.1 to 2.3.2
- [Release notes](https://github.com/micromatch/picomatch/releases)
- [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md)
- [Commits](micromatch/picomatch@2.3.1...2.3.2)

Updates `picomatch` from 4.0.3 to 4.0.4
- [Release notes](https://github.com/micromatch/picomatch/releases)
- [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md)
- [Commits](micromatch/picomatch@2.3.1...2.3.2)

Updates `picomatch` from 4.0.2 to 4.0.4
- [Release notes](https://github.com/micromatch/picomatch/releases)
- [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md)
- [Commits](micromatch/picomatch@2.3.1...2.3.2)

---
updated-dependencies:
- dependency-name: picomatch
  dependency-version: 2.3.2
  dependency-type: indirect
- dependency-name: picomatch
  dependency-version: 4.0.4
  dependency-type: indirect
- dependency-name: picomatch
  dependency-version: 4.0.4
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
deps(npm): bump path-to-regexp from 8.3.0 to 8.4.0 in /dependencies (s…
309fb55 
…uper-linter#7687)

Bumps [path-to-regexp](https://github.com/pillarjs/path-to-regexp) from 8.3.0 to 8.4.0.
- [Release notes](https://github.com/pillarjs/path-to-regexp/releases)
- [Changelog](https://github.com/pillarjs/path-to-regexp/blob/master/History.md)
- [Commits](pillarjs/path-to-regexp@v8.3.0...v8.4.0)

---
updated-dependencies:
- dependency-name: path-to-regexp
  dependency-version: 8.4.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
deps(npm): bump brace-expansion from 1.1.12 to 1.1.13 in /dependencies (
92c4cea 
super-linter#7685)

Bumps [brace-expansion](https://github.com/juliangruber/brace-expansion) from 1.1.12 to 1.1.13.
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@v1.1.12...v1.1.13)

---
updated-dependencies:
- dependency-name: brace-expansion
  dependency-version: 1.1.13
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
ci(dev-npm): bump handlebars (super-linter#7683)
1b3e7cd 
Bumps the npm_and_yarn group with 1 update in the /dev-dependencies directory: [handlebars](https://github.com/handlebars-lang/handlebars.js).


Updates `handlebars` from 4.7.8 to 4.7.9
- [Release notes](https://github.com/handlebars-lang/handlebars.js/releases)
- [Changelog](https://github.com/handlebars-lang/handlebars.js/blob/v4.7.9/release-notes.md)
- [Commits](handlebars-lang/handlebars.js@v4.7.8...v4.7.9)

---
updated-dependencies:
- dependency-name: handlebars
  dependency-version: 4.7.9
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
ci(dev-docker): bump node in /dev-dependencies (super-linter#7678)
f35a407 
Bumps node from 25.8.1-bookworm to 25.8.2-bookworm.

---
updated-dependencies:
- dependency-name: node
  dependency-version: 25.8.2-bookworm
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
ci(dev-npm): bump the npm_and_yarn group across 1 directory with 1 up…
c5ec78d 
…date (super-linter#7691)

Bumps the npm_and_yarn group with 1 update in the /dev-dependencies directory: [brace-expansion](https://github.com/juliangruber/brace-expansion).


Updates `brace-expansion` from 2.0.2 to 2.0.3
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@v2.0.2...v2.0.3)

Updates `brace-expansion` from 1.1.12 to 1.1.13
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@v2.0.2...v2.0.3)

---
updated-dependencies:
- dependency-name: brace-expansion
  dependency-version: 2.0.3
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: brace-expansion
  dependency-version: 1.1.13
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
deps(npm): bump the npm group across 1 directory with 9 updates (supe…
db85efc 
…r-linter#7690)

Bumps the npm group with 9 updates in the /dependencies directory:

| Package | From | To |
| --- | --- | --- |
| [@biomejs/biome](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome) | `2.4.8` | `2.4.9` |
| [@typescript-eslint/eslint-plugin](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin) | `8.57.1` | `8.57.2` |
| [eslint-plugin-jest](https://github.com/jest-community/eslint-plugin-jest) | `29.15.0` | `29.15.1` |
| [npm-groovy-lint](https://github.com/nvuillam/npm-groovy-lint) | `17.0.0` | `17.0.2` |
| [react-intl](https://github.com/formatjs/formatjs) | `10.1.0` | `10.1.1` |
| [react-router-dom](https://github.com/remix-run/react-router/tree/HEAD/packages/react-router-dom) | `7.13.1` | `7.13.2` |
| [renovate](https://github.com/renovatebot/renovate) | `43.86.1` | `43.100.1` |
| [stylelint](https://github.com/stylelint/stylelint) | `17.5.0` | `17.6.0` |
| [typescript](https://github.com/microsoft/TypeScript) | `5.9.3` | `6.0.2` |



Updates `@biomejs/biome` from 2.4.8 to 2.4.9
- [Release notes](https://github.com/biomejs/biome/releases)
- [Changelog](https://github.com/biomejs/biome/blob/main/packages/@biomejs/biome/CHANGELOG.md)
- [Commits](https://github.com/biomejs/biome/commits/@biomejs/biome@2.4.9/packages/@biomejs/biome)

Updates `@typescript-eslint/eslint-plugin` from 8.57.1 to 8.57.2
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/eslint-plugin/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.57.2/packages/eslint-plugin)

Updates `eslint-plugin-jest` from 29.15.0 to 29.15.1
- [Release notes](https://github.com/jest-community/eslint-plugin-jest/releases)
- [Changelog](https://github.com/jest-community/eslint-plugin-jest/blob/main/CHANGELOG.md)
- [Commits](jest-community/eslint-plugin-jest@v29.15.0...v29.15.1)

Updates `npm-groovy-lint` from 17.0.0 to 17.0.2
- [Release notes](https://github.com/nvuillam/npm-groovy-lint/releases)
- [Changelog](https://github.com/nvuillam/npm-groovy-lint/blob/main/CHANGELOG.md)
- [Commits](nvuillam/npm-groovy-lint@v17.0.0...v17.0.2)

Updates `react-intl` from 10.1.0 to 10.1.1
- [Release notes](https://github.com/formatjs/formatjs/releases)
- [Commits](https://github.com/formatjs/formatjs/compare/react-intl@10.1.0...react-intl@10.1.1)

Updates `react-router-dom` from 7.13.1 to 7.13.2
- [Release notes](https://github.com/remix-run/react-router/releases)
- [Changelog](https://github.com/remix-run/react-router/blob/main/packages/react-router-dom/CHANGELOG.md)
- [Commits](https://github.com/remix-run/react-router/commits/react-router-dom@7.13.2/packages/react-router-dom)

Updates `renovate` from 43.86.1 to 43.100.1
- [Release notes](https://github.com/renovatebot/renovate/releases)
- [Commits](renovatebot/renovate@43.86.1...43.100.1)

Updates `stylelint` from 17.5.0 to 17.6.0
- [Release notes](https://github.com/stylelint/stylelint/releases)
- [Changelog](https://github.com/stylelint/stylelint/blob/main/CHANGELOG.md)
- [Commits](stylelint/stylelint@17.5.0...17.6.0)

Updates `typescript` from 5.9.3 to 6.0.2
- [Release notes](https://github.com/microsoft/TypeScript/releases)
- [Commits](microsoft/TypeScript@v5.9.3...v6.0.2)

---
updated-dependencies:
- dependency-name: "@biomejs/biome"
  dependency-version: 2.4.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: "@typescript-eslint/eslint-plugin"
  dependency-version: 8.57.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: eslint-plugin-jest
  dependency-version: 29.15.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: npm-groovy-lint
  dependency-version: 17.0.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: react-intl
  dependency-version: 10.1.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: react-router-dom
  dependency-version: 7.13.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: renovate
  dependency-version: 43.100.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm
- dependency-name: stylelint
  dependency-version: 17.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm
- dependency-name: typescript
  dependency-version: 6.0.2
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: npm
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@ferrarimarco
chore: update ruby and npm deps (super-linter#7694)
eb8ddc7
@ferrarimarco
feat: improve zsh scripts support (super-linter#7674)
6a65d3a 
- Enable formatting ZSH scripts with the .zsh extension using shfmt
- Enable formatting ZSH scripts without extension using shfmt
- Enable checking ZSH scripts with or without extension using bash-exec
- Don't lint ZSH scripts without extension with shellcheck

Close super-linter#7618
@dependabot
deps(python): bump the pip group across 1 directory with 5 updates (s…
cb17f60 
…uper-linter#7684)

Bumps the pip group with 5 updates in the /dependencies/python directory:

| Package | From | To |
| --- | --- | --- |
| [ruff](https://github.com/astral-sh/ruff) | `0.15.7` | `0.15.8` |
| [checkov](https://github.com/bridgecrewio/checkov) | `3.2.510` | `3.2.512` |
| [snakemake](https://github.com/snakemake/snakemake) | `9.17.2` | `9.18.2` |
| [cfn-lint](https://github.com/aws-cloudformation/cfn-lint) | `1.47.0` | `1.47.1` |
| [sqlfluff](https://github.com/sqlfluff/sqlfluff) | `4.0.4` | `4.1.0` |



Updates `ruff` from 0.15.7 to 0.15.8
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.15.7...0.15.8)

Updates `checkov` from 3.2.510 to 3.2.512
- [Release notes](https://github.com/bridgecrewio/checkov/releases)
- [Changelog](https://github.com/bridgecrewio/checkov/blob/main/CHANGELOG.md)
- [Commits](bridgecrewio/checkov@3.2.510...3.2.512)

Updates `snakemake` from 9.17.2 to 9.18.2
- [Release notes](https://github.com/snakemake/snakemake/releases)
- [Changelog](https://github.com/snakemake/snakemake/blob/main/CHANGELOG.md)
- [Commits](snakemake/snakemake@v9.17.2...v9.18.2)

Updates `cfn-lint` from 1.47.0 to 1.47.1
- [Release notes](https://github.com/aws-cloudformation/cfn-lint/releases)
- [Changelog](https://github.com/aws-cloudformation/cfn-lint/blob/main/CHANGELOG.md)
- [Commits](aws-cloudformation/cfn-lint@v1.47.0...v1.47.1)

Updates `sqlfluff` from 4.0.4 to 4.1.0
- [Release notes](https://github.com/sqlfluff/sqlfluff/releases)
- [Changelog](https://github.com/sqlfluff/sqlfluff/blob/main/CHANGELOG.md)
- [Commits](sqlfluff/sqlfluff@4.0.4...4.1.0)

---
updated-dependencies:
- dependency-name: ruff
  dependency-version: 0.15.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip
- dependency-name: checkov
  dependency-version: 3.2.512
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip
- dependency-name: snakemake
  dependency-version: 9.18.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip
- dependency-name: cfn-lint
  dependency-version: 1.47.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip
- dependency-name: sqlfluff
  dependency-version: 4.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
deps(java): bump com.puppycrawl.tools:checkstyle (super-linter#7689)
4c66d9d 
Bumps the java-gradle group with 1 update in the /dependencies/checkstyle directory: [com.puppycrawl.tools:checkstyle](https://github.com/checkstyle/checkstyle).


Updates `com.puppycrawl.tools:checkstyle` from 13.3.0 to 13.4.0
- [Release notes](https://github.com/checkstyle/checkstyle/releases)
- [Commits](checkstyle/checkstyle@checkstyle-13.3.0...checkstyle-13.4.0)

---
updated-dependencies:
- dependency-name: com.puppycrawl.tools:checkstyle
  dependency-version: 13.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: java-gradle
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
deps(docker): bump the docker group across 1 directory with 4 updates (…
11c750e 
…super-linter#7698)

Bumps the docker group with 4 updates in the / directory: alpine/terragrunt, goreleaser/goreleaser, hashicorp/terraform and rhysd/actionlint.


Updates `alpine/terragrunt` from 1.14.7 to 1.14.8

Updates `goreleaser/goreleaser` from v2.14.3 to v2.15.1

Updates `hashicorp/terraform` from 1.14.7 to 1.14.8

Updates `rhysd/actionlint` from 1.7.11 to 1.7.12

---
updated-dependencies:
- dependency-name: alpine/terragrunt
  dependency-version: 1.14.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: docker
- dependency-name: goreleaser/goreleaser
  dependency-version: v2.15.1
  dependency-type: direct:production
  dependency-group: docker
- dependency-name: hashicorp/terraform
  dependency-version: 1.14.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: docker
- dependency-name: rhysd/actionlint
  dependency-version: 1.7.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: docker
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
deps(npm): bump renovate (super-linter#7699)
b91627f 
Bumps the npm group with 1 update in the /dependencies directory: [renovate](https://github.com/renovatebot/renovate).


Updates `renovate` from 43.101.2 to 43.101.3
- [Release notes](https://github.com/renovatebot/renovate/releases)
- [Commits](renovatebot/renovate@43.101.2...43.101.3)

---
updated-dependencies:
- dependency-name: renovate
  dependency-version: 43.101.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@github-actions
chore(main): release 8.6.0 (super-linter#7512)
9e86335 
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
@dependabot
ci(dev-npm): bump @xmldom/xmldom (super-linter#7701)
06b4165 
Bumps the npm_and_yarn group with 1 update in the /dev-dependencies directory: [@xmldom/xmldom](https://github.com/xmldom/xmldom).


Updates `@xmldom/xmldom` from 0.8.10 to 0.8.12
- [Release notes](https://github.com/xmldom/xmldom/releases)
- [Changelog](https://github.com/xmldom/xmldom/blob/master/CHANGELOG.md)
- [Commits](xmldom/xmldom@0.8.10...0.8.12)

---
updated-dependencies:
- dependency-name: "@xmldom/xmldom"
  dependency-version: 0.8.12
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
ferrarimarco and others added 12 commits April 3, 2026 17:09
@ferrarimarco
chore: update deps (super-linter#7713)
31ee13d
@ferrarimarco
fix(docs): don't mention extension in bash-exec (super-linter#7708)
56c7c3c 
BASH_EXEC_IGNORE_LIBRARIES doesn't take extensions into account, but
only the presence of a shebang.
@dependabot
deps(docker): bump goreleaser/goreleaser in the docker group (super-l…
487d0d8 
…inter#7705)

Bumps the docker group with 1 update: goreleaser/goreleaser.


Updates `goreleaser/goreleaser` from v2.15.1 to v2.15.2

---
updated-dependencies:
- dependency-name: goreleaser/goreleaser
  dependency-version: v2.15.2
  dependency-type: direct:production
  dependency-group: docker
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
deps(python): bump the pip group across 1 directory with 4 updates (s…
42b2592 
…uper-linter#7711)

Bumps the pip group with 4 updates in the /dependencies/python directory: [ruff](https://github.com/astral-sh/ruff), [mypy](https://github.com/python/mypy), [cfn-lint](https://github.com/aws-cloudformation/cfn-lint) and [ansible-lint](https://github.com/ansible/ansible-lint).


Updates `ruff` from 0.15.8 to 0.15.9
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.15.8...0.15.9)

Updates `mypy` from 1.19.1 to 1.20.0
- [Changelog](https://github.com/python/mypy/blob/master/CHANGELOG.md)
- [Commits](python/mypy@v1.19.1...v1.20.0)

Updates `cfn-lint` from 1.47.1 to 1.48.1
- [Release notes](https://github.com/aws-cloudformation/cfn-lint/releases)
- [Changelog](https://github.com/aws-cloudformation/cfn-lint/blob/main/CHANGELOG.md)
- [Commits](aws-cloudformation/cfn-lint@v1.47.1...v1.48.1)

Updates `ansible-lint` from 26.3.0 to 26.4.0
- [Release notes](https://github.com/ansible/ansible-lint/releases)
- [Commits](ansible/ansible-lint@v26.3.0...v26.4.0)

---
updated-dependencies:
- dependency-name: ruff
  dependency-version: 0.15.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip
- dependency-name: mypy
  dependency-version: 1.20.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip
- dependency-name: cfn-lint
  dependency-version: 1.48.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip
- dependency-name: ansible-lint
  dependency-version: 26.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
ci(github-actions): bump docker/login-action in the dev-ci-tools group (
b8dec80 
super-linter#7710)

Bumps the dev-ci-tools group with 1 update: [docker/login-action](https://github.com/docker/login-action).


Updates `docker/login-action` from 4.0.0 to 4.1.0
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](docker/login-action@v4.0.0...v4.1.0)

---
updated-dependencies:
- dependency-name: docker/login-action
  dependency-version: 4.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dev-ci-tools
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
ci(dev-docker): bump node in /dev-dependencies (super-linter#7709)
6c807f7 
Bumps node from 25.8.2-bookworm to 25.9.0-bookworm.

---
updated-dependencies:
- dependency-name: node
  dependency-version: 25.9.0-bookworm
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
deps(npm): bump the npm group across 1 directory with 3 updates (supe…
4b9bbc3 
…r-linter#7712)

Bumps the npm group with 3 updates in the /dependencies directory: [next](https://github.com/vercel/next.js), [react-router-dom](https://github.com/remix-run/react-router/tree/HEAD/packages/react-router-dom) and [renovate](https://github.com/renovatebot/renovate).


Updates `next` from 16.2.1 to 16.2.2
- [Release notes](https://github.com/vercel/next.js/releases)
- [Changelog](https://github.com/vercel/next.js/blob/canary/release.js)
- [Commits](vercel/next.js@v16.2.1...v16.2.2)

Updates `react-router-dom` from 7.13.2 to 7.14.0
- [Release notes](https://github.com/remix-run/react-router/releases)
- [Changelog](https://github.com/remix-run/react-router/blob/main/packages/react-router-dom/CHANGELOG.md)
- [Commits](https://github.com/remix-run/react-router/commits/react-router-dom@7.14.0/packages/react-router-dom)

Updates `renovate` from 43.101.3 to 43.104.1
- [Release notes](https://github.com/renovatebot/renovate/releases)
- [Commits](renovatebot/renovate@43.101.3...43.104.1)

---
updated-dependencies:
- dependency-name: next
  dependency-version: 16.2.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: react-router-dom
  dependency-version: 7.14.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm
- dependency-name: renovate
  dependency-version: 43.104.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
deps(npm): bump renovate (super-linter#7719)
c2f30f5 
Bumps the npm group with 1 update in the /dependencies directory: [renovate](https://github.com/renovatebot/renovate).


Updates `renovate` from 43.104.7 to 43.108.1
- [Release notes](https://github.com/renovatebot/renovate/releases)
- [Commits](renovatebot/renovate@43.104.7...43.108.1)

---
updated-dependencies:
- dependency-name: renovate
  dependency-version: 43.108.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
deps(python): bump checkov (super-linter#7717)
b7acd07 
Bumps the pip group with 1 update in the /dependencies/python directory: [checkov](https://github.com/bridgecrewio/checkov).


Updates `checkov` from 3.2.513 to 3.2.517
- [Release notes](https://github.com/bridgecrewio/checkov/releases)
- [Changelog](https://github.com/bridgecrewio/checkov/blob/main/CHANGELOG.md)
- [Commits](bridgecrewio/checkov@3.2.513...3.2.517)

---
updated-dependencies:
- dependency-name: checkov
  dependency-version: 3.2.517
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
deps(docker): bump mvdan/shfmt in the docker group (super-linter#7718)
a1fc30a 
Bumps the docker group with 1 update: mvdan/shfmt.


Updates `mvdan/shfmt` from v3.13.0 to v3.13.1

---
updated-dependencies:
- dependency-name: mvdan/shfmt
  dependency-version: v3.13.1
  dependency-type: direct:production
  dependency-group: docker
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
ci(dev-npm): bump release-please in /dev-dependencies (super-linter#7716
654b1be 
)

Bumps [release-please](https://github.com/googleapis/release-please) from 17.3.0 to 17.4.0.
- [Release notes](https://github.com/googleapis/release-please/releases)
- [Changelog](https://github.com/googleapis/release-please/blob/main/CHANGELOG.md)
- [Commits](googleapis/release-please@v17.3.0...v17.4.0)

---
updated-dependencies:
- dependency-name: release-please
  dependency-version: 17.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@marcusmai-telia
Merge remote-tracking branch 'upstream/main' into ngg846/update-upstr…
ac46249 
…eam-260408
@marcusmai-telia marcusmai-telia merged commit 504d018 into main Apr 8, 2026
28 of 29 checks passed
@marcusmai-telia marcusmai-telia deleted the ngg846/update-upstream-260408 branch April 8, 2026 14:44
@github-actions
Copy link
Copy Markdown

github-actions bot commented Apr 8, 2026

Super-linter summary

Language Validation result
BIOME_FORMAT Pass ✅
BIOME_LINT Pass ✅
CHECKOV Pass ✅
GIT_COMMITLINT Pass ✅
JSCPD Pass ✅
PRE_COMMIT Pass ✅
TRIVY Fail ❌

Super-linter detected linting errors

For more information, see the
GitHub Actions workflow run

Powered by Super-linter

TRIVY 
trivy filesystem --config /github/workspace/.github/linters/trivy.yaml /github/workspace

Report Summary

┌─────────────────────────────────────┬────────────┬─────────────────┬───────────────────┬─────────┐
│               Target                │    Type    │ Vulnerabilities │ Misconfigurations │ Secrets │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ dependencies/Gemfile.lock           │  bundler   │        0        │         -         │    -    │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ dependencies/composer/composer.lock │  composer  │        0        │         -         │    -    │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ dependencies/package-lock.json      │    npm     │        6        │         -         │    -    │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ dev-dependencies/package-lock.json  │    npm     │        0        │         -         │    -    │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ Dockerfile                          │ dockerfile │        -        │         0         │    -    │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ dev-dependencies/Dockerfile         │ dockerfile │        -        │         0         │    -    │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ test/linters/trivy/good/Dockerfile  │ dockerfile │        -        │         0         │    -    │
└─────────────────────────────────────┴────────────┴─────────────────┴───────────────────┴─────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)


For OSS Maintainers: VEX Notice
--------------------------------
If you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement.
VEX allows you to communicate the actual status of vulnerabilities in your project, improving security transparency and reducing false positives for your users.
Learn more and start using VEX: https://trivy.dev/docs/v0.69/guide/supply-chain/vex/repo#publishing-vex-documents

To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable.


dependencies/package-lock.json (npm)
====================================
Total: 6 (UNKNOWN: 0, LOW: 0, MEDIUM: 6, HIGH: 0, CRITICAL: 0)

┌───────────────────┬─────────────────────┬──────────┬────────┬───────────────────┬───────────────┬──────────────────────────────────────────────────────────────┐
│      Library      │    Vulnerability    │ Severity │ Status │ Installed Version │ Fixed Version │                            Title                             │
├───────────────────┼─────────────────────┼──────────┼────────┼───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ @hono/node-server │ CVE-2026-39406      │ MEDIUM   │ fixed  │ 1.19.11           │ 1.19.13       │ @hono/node-server: Middleware bypass via repeated slashes in │
│                   │                     │          │        │                   │               │ serveStatic                                                  │
│                   │                     │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-39406                   │
├───────────────────┼─────────────────────┤          │        ├───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ hono              │ CVE-2026-39407      │          │        │ 4.12.7            │ 4.12.12       │ Hono: Middleware bypass via repeated slashes in serveStatic  │
│                   │                     │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-39407                   │
│                   ├─────────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│                   │ CVE-2026-39408      │          │        │                   │               │ Hono: Path traversal in toSSG() allows writing files outside │
│                   │                     │          │        │                   │               │ the output directory...                                      │
│                   │                     │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-39408                   │
│                   ├─────────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│                   │ CVE-2026-39409      │          │        │                   │               │ Hono has incorrect IP matching in ipRestriction() for        │
│                   │                     │          │        │                   │               │ IPv4-mapped IPv6 addresses                                   │
│                   │                     │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-39409                   │
│                   ├─────────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│                   │ CVE-2026-39410      │          │        │                   │               │ Hono: Non-breaking space prefix bypass in cookie name        │
│                   │                     │          │        │                   │               │ handling in getCookie()                                      │
│                   │                     │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-39410                   │
│                   ├─────────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│                   │ GHSA-26pp-8wgv-hjvm │          │        │                   │               │ Hono missing validation of cookie name on write path in      │
│                   │                     │          │        │                   │               │ setCookie()                                                  │
│                   │                     │          │        │                   │               │ https://github.com/advisories/GHSA-26pp-8wgv-hjvm            │
└───────────────────┴─────────────────────┴──────────┴────────┴───────────────────┴───────────────┴──────────────────────────────────────────────────────────────┘

1 similar comment
@github-actions
Copy link
Copy Markdown

github-actions bot commented Apr 8, 2026

Super-linter summary

Language Validation result
BIOME_FORMAT Pass ✅
BIOME_LINT Pass ✅
CHECKOV Pass ✅
GIT_COMMITLINT Pass ✅
JSCPD Pass ✅
PRE_COMMIT Pass ✅
TRIVY Fail ❌

Super-linter detected linting errors

For more information, see the
GitHub Actions workflow run

Powered by Super-linter

TRIVY 
trivy filesystem --config /github/workspace/.github/linters/trivy.yaml /github/workspace

Report Summary

┌─────────────────────────────────────┬────────────┬─────────────────┬───────────────────┬─────────┐
│               Target                │    Type    │ Vulnerabilities │ Misconfigurations │ Secrets │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ dependencies/Gemfile.lock           │  bundler   │        0        │         -         │    -    │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ dependencies/composer/composer.lock │  composer  │        0        │         -         │    -    │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ dependencies/package-lock.json      │    npm     │        6        │         -         │    -    │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ dev-dependencies/package-lock.json  │    npm     │        0        │         -         │    -    │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ Dockerfile                          │ dockerfile │        -        │         0         │    -    │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ dev-dependencies/Dockerfile         │ dockerfile │        -        │         0         │    -    │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ test/linters/trivy/good/Dockerfile  │ dockerfile │        -        │         0         │    -    │
└─────────────────────────────────────┴────────────┴─────────────────┴───────────────────┴─────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)


For OSS Maintainers: VEX Notice
--------------------------------
If you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement.
VEX allows you to communicate the actual status of vulnerabilities in your project, improving security transparency and reducing false positives for your users.
Learn more and start using VEX: https://trivy.dev/docs/v0.69/guide/supply-chain/vex/repo#publishing-vex-documents

To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable.


dependencies/package-lock.json (npm)
====================================
Total: 6 (UNKNOWN: 0, LOW: 0, MEDIUM: 6, HIGH: 0, CRITICAL: 0)

┌───────────────────┬─────────────────────┬──────────┬────────┬───────────────────┬───────────────┬──────────────────────────────────────────────────────────────┐
│      Library      │    Vulnerability    │ Severity │ Status │ Installed Version │ Fixed Version │                            Title                             │
├───────────────────┼─────────────────────┼──────────┼────────┼───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ @hono/node-server │ CVE-2026-39406      │ MEDIUM   │ fixed  │ 1.19.11           │ 1.19.13       │ @hono/node-server: Middleware bypass via repeated slashes in │
│                   │                     │          │        │                   │               │ serveStatic                                                  │
│                   │                     │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-39406                   │
├───────────────────┼─────────────────────┤          │        ├───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ hono              │ CVE-2026-39407      │          │        │ 4.12.7            │ 4.12.12       │ Hono: Middleware bypass via repeated slashes in serveStatic  │
│                   │                     │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-39407                   │
│                   ├─────────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│                   │ CVE-2026-39408      │          │        │                   │               │ Hono: Path traversal in toSSG() allows writing files outside │
│                   │                     │          │        │                   │               │ the output directory...                                      │
│                   │                     │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-39408                   │
│                   ├─────────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│                   │ CVE-2026-39409      │          │        │                   │               │ Hono has incorrect IP matching in ipRestriction() for        │
│                   │                     │          │        │                   │               │ IPv4-mapped IPv6 addresses                                   │
│                   │                     │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-39409                   │
│                   ├─────────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│                   │ CVE-2026-39410      │          │        │                   │               │ Hono: Non-breaking space prefix bypass in cookie name        │
│                   │                     │          │        │                   │               │ handling in getCookie()                                      │
│                   │                     │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-39410                   │
│                   ├─────────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│                   │ GHSA-26pp-8wgv-hjvm │          │        │                   │               │ Hono missing validation of cookie name on write path in      │
│                   │                     │          │        │                   │               │ setCookie()                                                  │
│                   │                     │          │        │                   │               │ https://github.com/advisories/GHSA-26pp-8wgv-hjvm            │
└───────────────────┴─────────────────────┴──────────┴────────┴───────────────────┴───────────────┴──────────────────────────────────────────────────────────────┘

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@marcusmai-telia @ferrarimarco @coliff