Sync Collecting Fix Commits: Tue Aug 11 21:26:22 UTC 2026

Signed-off-by: AboutCode Automation <automation@aboutcode.org>

Author: aboutcode-automation

data/fix-commits/advisory-database-b78f1d41.json

@@ -1,6 +1,41 @@
 {
   "vcs_url": "https://github.com/github/advisory-database",
   "vulnerabilities": {
+    "GHSA-9MRH-PW7C-9MQM": {
+      "e5d2459446d2155eb51cae59233db5752ae5ecae": "Publish GHSA-9mrh-pw7c-9mqm"
+    },
+    "GHSA-VG44-H755-9HW7": {
+      "4c4902ec390613a15c8f9fe87d8a54a2be27edc5": "Publish GHSA-vg44-h755-9hw7"
+    },
+    "GHSA-FX4Q-GJRX-2JW6": {
+      "376f28636f48b824466277a9e3cd3b427abb703c": "Publish GHSA-fx4q-gjrx-2jw6"
+    },
+    "GHSA-GG8C-3338-XW2F": {
+      "49606c41a98fb879ef6002d1c337617bd697b649": "Publish GHSA-gg8c-3338-xw2f"
+    },
+    "GHSA-4C3C-R6P8-C863": {
+      "3b5b8d0df74ca562f071187a069981188418ed93": "Publish GHSA-4c3c-r6p8-c863",
+      "42aaed8d7e8da8cb9c127a415e13af1002b5d771": "Publish Advisories\n\nGHSA-4c3c-r6p8-c863\nGHSA-5w7q-77mv-v69f\nGHSA-98x5-vq43-vc5p\nGHSA-cgwc-pv48-fhj5"
+    },
+    "GHSA-9MR8-PWPW-3J2W": {
+      "3d5a7ece6db62a69713b1766a33187f9333ba7c3": "Publish GHSA-9mr8-pwpw-3j2w"
+    },
+    "GHSA-JQHP-238X-QHGF": {
+      "a030d1e2051dc3bc94a2d278171b95835ab81855": "Publish GHSA-jqhp-238x-qhgf"
+    },
+    "GHSA-M93F-WJ8C-RP8P": {
+      "da8da86bb2b97d8815d8545ba0adc1eaf76d1b22": "Publish GHSA-m93f-wj8c-rp8p"
+    },
+    "GHSA-R6MH-95JW-G7QG": {
+      "862f487fdb513ba1c7a2fb1ea41cf4f75100c277": "Publish GHSA-r6mh-95jw-g7qg"
+    },
+    "GHSA-Q7CG-43MG-QP69": {
+      "4eb4fd4b45ade583f100a98592f20d3bf935f7b7": "Publish GHSA-q7cg-43mg-qp69",
+      "3fa7f26a3e7d23d5fd4feb255720d53d27f68286": "Publish Advisories\n\nGHSA-q7cg-43mg-qp69\nGHSA-cfqj-9g2g-w7q6\nGHSA-phwq-j96m-2c2q\nGHSA-mfhv-gwf8-4m88\nGHSA-hm53-hrhh-gwfq\nGHSA-8x94-hmjh-97hq"
+    },
+    "GHSA-87FV-VQQR-M4JR": {
+      "db308485b9bda6981175647782e8fb83bc08aa93": "Publish GHSA-87fv-vqqr-m4jr"
+    },
     "GHSA-6V23-65FJ-8G7C": {
       "e0c7c9bae9bc6901f61717979fab356b72922558": "Publish Advisories\n\nGHSA-6v23-65fj-8g7c\nGHSA-8vgw-m5fh-hwg3\nGHSA-9f5f-7wxj-73g8\nGHSA-f3xx-69mr-6rx6\nGHSA-gcr6-hgjr-2h8p\nGHSA-hgvh-9fpj-948w\nGHSA-vhwm-f68v-4vg9"
     },
@@ -13113,9 +13148,6 @@
     "GHSA-RHQ6-9RGH-V45C": {
       "7d47c66ea198f924e335698c7cc019dcba2873de": "Publish Advisories\n\nGHSA-fhp4-pr5j-46m5\nGHSA-j7f5-gfqm-pcx3\nGHSA-rhq6-9rgh-v45c"
     },
-    "GHSA-4C3C-R6P8-C863": {
-      "42aaed8d7e8da8cb9c127a415e13af1002b5d771": "Publish Advisories\n\nGHSA-4c3c-r6p8-c863\nGHSA-5w7q-77mv-v69f\nGHSA-98x5-vq43-vc5p\nGHSA-cgwc-pv48-fhj5"
-    },
     "GHSA-5W7Q-77MV-V69F": {
       "42aaed8d7e8da8cb9c127a415e13af1002b5d771": "Publish Advisories\n\nGHSA-4c3c-r6p8-c863\nGHSA-5w7q-77mv-v69f\nGHSA-98x5-vq43-vc5p\nGHSA-cgwc-pv48-fhj5"
     },
@@ -264704,9 +264736,6 @@
     "GHSA-PF2J-9QMP-JQR2": {
       "bb4cb4fc1e14e520aa4497081110d0361aefeec9": "Publish Advisories\n\nGHSA-ff7x-qrg7-qggm\nGHSA-pf2j-9qmp-jqr2"
     },
-    "GHSA-Q7CG-43MG-QP69": {
-      "3fa7f26a3e7d23d5fd4feb255720d53d27f68286": "Publish Advisories\n\nGHSA-q7cg-43mg-qp69\nGHSA-cfqj-9g2g-w7q6\nGHSA-phwq-j96m-2c2q\nGHSA-mfhv-gwf8-4m88\nGHSA-hm53-hrhh-gwfq\nGHSA-8x94-hmjh-97hq"
-    },
     "GHSA-CFQJ-9G2G-W7Q6": {
       "3fa7f26a3e7d23d5fd4feb255720d53d27f68286": "Publish Advisories\n\nGHSA-q7cg-43mg-qp69\nGHSA-cfqj-9g2g-w7q6\nGHSA-phwq-j96m-2c2q\nGHSA-mfhv-gwf8-4m88\nGHSA-hm53-hrhh-gwfq\nGHSA-8x94-hmjh-97hq"
     },

data/fix-commits/buildroot-0b809119.json

@@ -1,6 +1,12 @@
 {
   "vcs_url": "https://github.com/caddyserver/caddy",
   "vulnerabilities": {
+    "GHSA-F59H-Q822-G45G": {
+      "947087cadd596c6e391e0df09e7e975afd2b4cbc": "Merge commit from fork\n\nCaddy's underscore header filter (GHSA-f59h-q822-g45g) only checked\nfor `_`. PHP folds `.` to `_` when registering $_SERVER keys the same\nway CGI/FastCGI folds `-` to `_`, so a dotted alias (e.g. Remote.User)\nsurvived the filter and collided with the legitimate hyphenated\nheader once it reached a PHP/FastCGI backend, bypassing forward_auth\ncopy_headers the same way the underscore alias did.\n\nExtends the filter to drop `.` symmetrically, adds an\n`expected_dot_headers` allowlist mirroring `expected_underscore_headers`,\nand handles header names containing both separators (only an exact\nallowlist entry is honored there, since a prefix glob's free-form\nsuffix can't be vetted for an embedded second separator).\n\nRoot cause identified by @iliaal in the FrankenPHP advisory\nGHSA-49wc-4hcv-v58q."
+    },
+    "GHSA-49WC-4HCV-V58Q": {
+      "947087cadd596c6e391e0df09e7e975afd2b4cbc": "Merge commit from fork\n\nCaddy's underscore header filter (GHSA-f59h-q822-g45g) only checked\nfor `_`. PHP folds `.` to `_` when registering $_SERVER keys the same\nway CGI/FastCGI folds `-` to `_`, so a dotted alias (e.g. Remote.User)\nsurvived the filter and collided with the legitimate hyphenated\nheader once it reached a PHP/FastCGI backend, bypassing forward_auth\ncopy_headers the same way the underscore alias did.\n\nExtends the filter to drop `.` symmetrically, adds an\n`expected_dot_headers` allowlist mirroring `expected_underscore_headers`,\nand handles header names containing both separators (only an exact\nallowlist entry is honored there, since a prefix glob's free-form\nsuffix can't be vetted for an embedded second separator).\n\nRoot cause identified by @iliaal in the FrankenPHP advisory\nGHSA-49wc-4hcv-v58q."
+    },
     "GHSA-VCC4-2C75-VC9V": {
       "e2eee6a7fce366321294c9c2a79f3146891dcbdf": "templates: Patch for GHSA-vcc4-2c75-vc9v (#7785)\n\n* Patch GHSA-vcc4-2c75-vc9v in stripHTML\n\ntemplates: fix funcStripHTML bypass via depth counter\r\n\r\nThe previous false-start approach allowed XSS bypass via inputs like <<>img src=x onerror=alert(1)> and failed on stacked angle brackets.\r\n\r\nReplace the tagStart/inTag state machine with a depth counter that mirrors PHP strip_tags behaviour: each '<' increments depth, each '>' decrements it, and text is only emitted at depth zero. Quoted attribute values (both single and double) are tracked so '>' inside href values does not prematurely close a tag.\n\nSigned-off-by: JM Sanchez <77505889+jmrcsnchz@users.noreply.github.com>\n\n* Update tplcontext_test.go\n\nTemplates: expand TestStripHTML with attack path coverage\n\nSigned-off-by: JM Sanchez <77505889+jmrcsnchz@users.noreply.github.com>\n\n---------\n\nSigned-off-by: JM Sanchez <77505889+jmrcsnchz@users.noreply.github.com>"
     },