Skip to content

Commit b3103bd

Browse files
aboutcode-automationaboutcode-automation
committed
Sync Collecting Fix Commits: Sat Jul 25 20:44:33 UTC 2026
Signed-off-by: AboutCode Automation <automation@aboutcode.org>
1 parent df194d6 commit b3103bd

3 files changed

Lines changed: 13 additions & 10 deletions

File tree

‎data/fix-commits/advisory-database-b78f1d41.json‎

Lines changed: 8 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,14 @@
11
{
22
"vcs_url": "https://github.com/github/advisory-database",
33
"vulnerabilities": {
4+
"GHSA-3988-H75V-HWF6": {
5+
"b7900c50878835e104f717313e7e0fc48b26ebe6": "Improve GHSA-3988-h75v-hwf6",
6+
"3705732a405bd01c9fcc0982ea6fdd928eb02727": "Publish GHSA-3988-h75v-hwf6"
7+
},
8+
"GHSA-MHFV-8RC9-W38C": {
9+
"1edc93c32e7675109b2247b2053f966817851b1d": "Improve GHSA-mhfv-8rc9-w38c",
10+
"97ebfc065fda112625f8665a071e4f70094d5528": "Publish GHSA-mhfv-8rc9-w38c"
11+
},
412
"GHSA-6QX8-MXXJ-98FC": {
513
"458762a518138a26e597ac195eb82ce6c30238eb": "Publish Advisories\n\nGHSA-6qx8-mxxj-98fc\nGHSA-g685-9q2w-88f4\nGHSA-xghp-9m6j-2mx2"
614
},
@@ -461024,12 +461032,6 @@
461024461032
"3d803fb199e7f5244c3cb484dd56f0f7ab1c256c": "Publish GHSA-fcx7-c5c8-wvr9",
461025461033
"f6a68eb77d453dda41bd1444f04b7d7e24f771ba": "Publish GHSA-fcx7-c5c8-wvr9"
461026461034
},
461027-
"GHSA-3988-H75V-HWF6": {
461028-
"3705732a405bd01c9fcc0982ea6fdd928eb02727": "Publish GHSA-3988-h75v-hwf6"
461029-
},
461030-
"GHSA-MHFV-8RC9-W38C": {
461031-
"97ebfc065fda112625f8665a071e4f70094d5528": "Publish GHSA-mhfv-8rc9-w38c"
461032-
},
461033461035
"GHSA-FC56-476W-J7FM": {
461034461036
"26d9d1de69439d5772577724f55207cd08295c50": "Publish GHSA-fc56-476w-j7fm",
461035461037
"ad2b7d06813896b11f184c307101c36a5fd3bb6a": "Publish GHSA-fc56-476w-j7fm"

‎data/fix-commits/langchainjs-af8f3570.json‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@
22
"vcs_url": "https://github.com/langchain-ai/langchainjs",
33
"vulnerabilities": {
44
"GHSA-9MQV-5HH9-4CGG": {
5+
"5226cddb0d0b31d33bb78fc51230e4283cd6cc64": "chore(deps-dev): bump @hono/node-server from 2.0.4 to 2.0.10 in /libs/langchain in the npm_and_yarn group across 1 directory (#11243)\n\nBumps the npm_and_yarn group with 1 update in the /libs/langchain\ndirectory: [@hono/node-server](https://github.com/honojs/node-server).\n\nUpdates `@hono/node-server` from 2.0.4 to 2.0.10\n<details>\n<summary>Release notes</summary>\n<p><em>Sourced from <a\nhref=\"https://github.com/honojs/node-server/releases\">@\u200bhono/node-server's\nreleases</a>.</em></p>\n<blockquote>\n<h2>v2.0.10</h2>\n<h2>Security fixes</h2>\n<p>This release includes a fix for the following security issue:</p>\n<h3>Unauthenticated memory-leak DoS via aborted WebSocket handshake</h3>\n<p>Affects: <code>upgradeWebSocket</code>. A WebSocket upgrade request\nwith a missing or malformed <code>Sec-WebSocket-Key</code> header leaked\nthe request's <code>IncomingMessage</code> and left a promise pending,\neven though no connection was established. Since the route is reachable\npre-handshake without authentication, an attacker could flood it to\ngradually exhaust memory. <a\nhref=\"https://github.com/honojs/node-server/security/advisories/GHSA-9mqv-5hh9-4cgg\">GHSA-9mqv-5hh9-4cgg</a></p>\n<hr />\n<p>Users of <code>upgradeWebSocket</code> are encouraged to upgrade to\nthis version.</p>\n<h2>v2.0.9</h2>\n<h2>What's Changed</h2>\n<ul>\n<li>fix(websocket): polyfill missing ErrorEvent global by <a\nhref=\"https://github.com/otnc\"><code>@\u200botnc</code></a> in <a\nhref=\"https://redirect.github.com/honojs/node-server/pull/371\">honojs/node-server#371</a></li>\n<li>fix(serve-static): correct Range header parsing edge cases by <a\nhref=\"https://github.com/otnc\"><code>@\u200botnc</code></a> in <a\nhref=\"https://redirect.github.com/honojs/node-server/pull/372\">honojs/node-server#372</a></li>\n<li>fix: recover complete request bodies after client disconnect by <a\nhref=\"https://github.com/usualoma\"><code>@\u200busualoma</code></a> in <a\nhref=\"https://redirect.github.com/honojs/node-server/pull/375\">honojs/node-server#375</a></li>\n</ul>\n<h2>New Contributors</h2>\n<ul>\n<li><a href=\"https://github.com/otnc\"><code>@\u200botnc</code></a> made their\nfirst contribution in <a\nhref=\"https://redirect.github.com/honojs/node-server/pull/371\">honojs/node-server#371</a></li>\n</ul>\n<p><strong>Full Changelog</strong>: <a\nhref=\"https://github.com/honojs/node-server/compare/v2.0.8...v2.0.9\">https://github.com/honojs/node-server/compare/v2.0.8...v2.0.9</a></p>\n<h2>v2.0.8</h2>\n<h2>What's Changed</h2>\n<ul>\n<li>ci(release): add <code>--no-git-checks</code> option for <code>pnpm\nstage publish</code> by <a\nhref=\"https://github.com/yusukebe\"><code>@\u200byusukebe</code></a> in <a\nhref=\"https://redirect.github.com/honojs/node-server/pull/369\">honojs/node-server#369</a></li>\n</ul>\n<p><strong>Full Changelog</strong>: <a\nhref=\"https://github.com/honojs/node-server/compare/v2.0.7...v2.0.8\">https://github.com/honojs/node-server/compare/v2.0.7...v2.0.8</a></p>\n<h2>v2.0.7</h2>\n<h2>What's Changed</h2>\n<ul>\n<li>chore: migrate to pnpm by <a\nhref=\"https://github.com/BlankParticle\"><code>@\u200bBlankParticle</code></a>\nin <a\nhref=\"https://redirect.github.com/honojs/node-server/pull/367\">honojs/node-server#367</a></li>\n<li>fix(serve-static): serve precompressed files for\napplication/octet-stream by <a\nhref=\"https://github.com/yusukebe\"><code>@\u200byusukebe</code></a> in <a\nhref=\"https://redirect.github.com/honojs/node-server/pull/366\">honojs/node-server#366</a></li>\n<li>chore: bump <code>supertest</code> by <a\nhref=\"https://github.com/yusukebe\"><code>@\u200byusukebe</code></a> in <a\nhref=\"https://redirect.github.com/honojs/node-server/pull/368\">honojs/node-server#368</a></li>\n</ul>\n<p><strong>Full Changelog</strong>: <a\nhref=\"https://github.com/honojs/node-server/compare/v2.0.6...v2.0.7\">https://github.com/honojs/node-server/compare/v2.0.6...v2.0.7</a></p>\n<h2>v2.0.6</h2>\n<h2>What's Changed</h2>\n<ul>\n<li>ci: publish to npm from CI with OIDC trusted publishing and bump\n<code>np</code> by <a\nhref=\"https://github.com/yusukebe\"><code>@\u200byusukebe</code></a> in <a\nhref=\"https://redirect.github.com/honojs/node-server/pull/361\">honojs/node-server#361</a></li>\n<li>ci: use npm Staged publishing by <a\nhref=\"https://github.com/yusukebe\"><code>@\u200byusukebe</code></a> in <a\nhref=\"https://redirect.github.com/honojs/node-server/pull/364\">honojs/node-server#364</a></li>\n<li>fix: preserve status and statusText when cloning a Response with\nliveheaders by <a\nhref=\"https://github.com/usualoma\"><code>@\u200busualoma</code></a> in <a\nhref=\"https://redirect.github.com/honojs/node-server/pull/363\">honojs/node-server#363</a></li>\n</ul>\n<p><strong>Full Changelog</strong>: <a\nhref=\"https://github.com/honojs/node-server/compare/v2.0.5...v2.0.6\">https://github.com/honojs/node-server/compare/v2.0.5...v2.0.6</a></p>\n<h2>v2.0.5</h2>\n<!-- raw HTML omitted -->\n</blockquote>\n<p>... (truncated)</p>\n</details>\n<details>\n<summary>Commits</summary>\n<ul>\n<li><a\nhref=\"https://github.com/honojs/node-server/commit/7c1457ed5536c02fdd2f001129fae67bcbca54a1\"><code>7c1457e</code></a>\n2.0.10</li>\n<li><a\nhref=\"https://github.com/honojs/node-server/commit/3a21938c418340e980cb7ffa88e78369f78392d1\"><code>3a21938</code></a>\nMerge commit from fork</li>\n<li><a\nhref=\"https://github.com/honojs/node-server/commit/98420217e53a17a238ef1aa1a6bef0b2b70136c5\"><code>9842021</code></a>\n2.0.9</li>\n<li><a\nhref=\"https://github.com/honojs/node-server/commit/51f3bf56f56d9691ec0f7e1562a96f0b485a7dd9\"><code>51f3bf5</code></a>\nfix: recover complete request bodies after client disconnect (<a\nhref=\"https://redirect.github.com/honojs/node-server/issues/375\">#375</a>)</li>\n<li><a\nhref=\"https://github.com/honojs/node-server/commit/fdb87badbe313cfbfe6bb2355e9893dc0698d2bd\"><code>fdb87ba</code></a>\nfix(serve-static): correct Range header parsing edge cases (<a\nhref=\"https://redirect.github.com/honojs/node-server/issues/372\">#372</a>)</li>\n<li><a\nhref=\"https://github.com/honojs/node-server/commit/912e3fd80c4311756f724bd566de1433c8d772d9\"><code>912e3fd</code></a>\nfix(websocket): polyfill missing ErrorEvent global (<a\nhref=\"https://redirect.github.com/honojs/node-server/issues/371\">#371</a>)</li>\n<li><a\nhref=\"https://github.com/honojs/node-server/commit/114c15efb38dabaf81af774ddb764409e3d156d8\"><code>114c15e</code></a>\n2.0.8</li>\n<li><a\nhref=\"https://github.com/honojs/node-server/commit/5db2d5df662cd69ff5c4cc23b8ecb3a6f63e4e38\"><code>5db2d5d</code></a>\nci(release): add <code>--no-git-checks</code> option for <code>pnpm\nstage publish</code> (<a\nhref=\"https://redirect.github.com/honojs/node-server/issues/369\">#369</a>)</li>\n<li><a\nhref=\"https://github.com/honojs/node-server/commit/a528a77ed2c28dc12775c849abc6b6df6d4cb44c\"><code>a528a77</code></a>\n2.0.7</li>\n<li><a\nhref=\"https://github.com/honojs/node-server/commit/b2d610c1e37a96639fbb2eae662e858800aa8906\"><code>b2d610c</code></a>\nchore: bump <code>supertest</code> (<a\nhref=\"https://redirect.github.com/honojs/node-server/issues/368\">#368</a>)</li>\n<li>Additional commits viewable in <a\nhref=\"https://github.com/honojs/node-server/compare/v2.0.4...v2.0.10\">compare\nview</a></li>\n</ul>\n</details>\n<details>\n<summary>Maintainer changes</summary>\n<p>This version was pushed to npm by <a\nhref=\"https://www.npmjs.com/~GitHub%20Actions\">GitHub Actions</a>, a new\nreleaser for <code>@\u200bhono/node-server</code> since your current\nversion.</p>\n</details>\n<br />\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>\nCo-authored-by: John Kennedy <65985482+jkennedyvz@users.noreply.github.com>",
56
"741f380ae54afd2e920495b3042ea6346865836a": "chore(deps): bump @hono/node-server from 2.0.4 to 2.0.10 (#11244)\n\nBumps [@hono/node-server](https://github.com/honojs/node-server) from\n2.0.4 to 2.0.10.\n<details>\n<summary>Release notes</summary>\n<p><em>Sourced from <a\nhref=\"https://github.com/honojs/node-server/releases\">@\u200bhono/node-server's\nreleases</a>.</em></p>\n<blockquote>\n<h2>v2.0.10</h2>\n<h2>Security fixes</h2>\n<p>This release includes a fix for the following security issue:</p>\n<h3>Unauthenticated memory-leak DoS via aborted WebSocket handshake</h3>\n<p>Affects: <code>upgradeWebSocket</code>. A WebSocket upgrade request\nwith a missing or malformed <code>Sec-WebSocket-Key</code> header leaked\nthe request's <code>IncomingMessage</code> and left a promise pending,\neven though no connection was established. Since the route is reachable\npre-handshake without authentication, an attacker could flood it to\ngradually exhaust memory. <a\nhref=\"https://github.com/honojs/node-server/security/advisories/GHSA-9mqv-5hh9-4cgg\">GHSA-9mqv-5hh9-4cgg</a></p>\n<hr />\n<p>Users of <code>upgradeWebSocket</code> are encouraged to upgrade to\nthis version.</p>\n<h2>v2.0.9</h2>\n<h2>What's Changed</h2>\n<ul>\n<li>fix(websocket): polyfill missing ErrorEvent global by <a\nhref=\"https://github.com/otnc\"><code>@\u200botnc</code></a> in <a\nhref=\"https://redirect.github.com/honojs/node-server/pull/371\">honojs/node-server#371</a></li>\n<li>fix(serve-static): correct Range header parsing edge cases by <a\nhref=\"https://github.com/otnc\"><code>@\u200botnc</code></a> in <a\nhref=\"https://redirect.github.com/honojs/node-server/pull/372\">honojs/node-server#372</a></li>\n<li>fix: recover complete request bodies after client disconnect by <a\nhref=\"https://github.com/usualoma\"><code>@\u200busualoma</code></a> in <a\nhref=\"https://redirect.github.com/honojs/node-server/pull/375\">honojs/node-server#375</a></li>\n</ul>\n<h2>New Contributors</h2>\n<ul>\n<li><a href=\"https://github.com/otnc\"><code>@\u200botnc</code></a> made their\nfirst contribution in <a\nhref=\"https://redirect.github.com/honojs/node-server/pull/371\">honojs/node-server#371</a></li>\n</ul>\n<p><strong>Full Changelog</strong>: <a\nhref=\"https://github.com/honojs/node-server/compare/v2.0.8...v2.0.9\">https://github.com/honojs/node-server/compare/v2.0.8...v2.0.9</a></p>\n<h2>v2.0.8</h2>\n<h2>What's Changed</h2>\n<ul>\n<li>ci(release): add <code>--no-git-checks</code> option for <code>pnpm\nstage publish</code> by <a\nhref=\"https://github.com/yusukebe\"><code>@\u200byusukebe</code></a> in <a\nhref=\"https://redirect.github.com/honojs/node-server/pull/369\">honojs/node-server#369</a></li>\n</ul>\n<p><strong>Full Changelog</strong>: <a\nhref=\"https://github.com/honojs/node-server/compare/v2.0.7...v2.0.8\">https://github.com/honojs/node-server/compare/v2.0.7...v2.0.8</a></p>\n<h2>v2.0.7</h2>\n<h2>What's Changed</h2>\n<ul>\n<li>chore: migrate to pnpm by <a\nhref=\"https://github.com/BlankParticle\"><code>@\u200bBlankParticle</code></a>\nin <a\nhref=\"https://redirect.github.com/honojs/node-server/pull/367\">honojs/node-server#367</a></li>\n<li>fix(serve-static): serve precompressed files for\napplication/octet-stream by <a\nhref=\"https://github.com/yusukebe\"><code>@\u200byusukebe</code></a> in <a\nhref=\"https://redirect.github.com/honojs/node-server/pull/366\">honojs/node-server#366</a></li>\n<li>chore: bump <code>supertest</code> by <a\nhref=\"https://github.com/yusukebe\"><code>@\u200byusukebe</code></a> in <a\nhref=\"https://redirect.github.com/honojs/node-server/pull/368\">honojs/node-server#368</a></li>\n</ul>\n<p><strong>Full Changelog</strong>: <a\nhref=\"https://github.com/honojs/node-server/compare/v2.0.6...v2.0.7\">https://github.com/honojs/node-server/compare/v2.0.6...v2.0.7</a></p>\n<h2>v2.0.6</h2>\n<h2>What's Changed</h2>\n<ul>\n<li>ci: publish to npm from CI with OIDC trusted publishing and bump\n<code>np</code> by <a\nhref=\"https://github.com/yusukebe\"><code>@\u200byusukebe</code></a> in <a\nhref=\"https://redirect.github.com/honojs/node-server/pull/361\">honojs/node-server#361</a></li>\n<li>ci: use npm Staged publishing by <a\nhref=\"https://github.com/yusukebe\"><code>@\u200byusukebe</code></a> in <a\nhref=\"https://redirect.github.com/honojs/node-server/pull/364\">honojs/node-server#364</a></li>\n<li>fix: preserve status and statusText when cloning a Response with\nliveheaders by <a\nhref=\"https://github.com/usualoma\"><code>@\u200busualoma</code></a> in <a\nhref=\"https://redirect.github.com/honojs/node-server/pull/363\">honojs/node-server#363</a></li>\n</ul>\n<p><strong>Full Changelog</strong>: <a\nhref=\"https://github.com/honojs/node-server/compare/v2.0.5...v2.0.6\">https://github.com/honojs/node-server/compare/v2.0.5...v2.0.6</a></p>\n<h2>v2.0.5</h2>\n<!-- raw HTML omitted -->\n</blockquote>\n<p>... (truncated)</p>\n</details>\n<details>\n<summary>Commits</summary>\n<ul>\n<li><a\nhref=\"https://github.com/honojs/node-server/commit/7c1457ed5536c02fdd2f001129fae67bcbca54a1\"><code>7c1457e</code></a>\n2.0.10</li>\n<li><a\nhref=\"https://github.com/honojs/node-server/commit/3a21938c418340e980cb7ffa88e78369f78392d1\"><code>3a21938</code></a>\nMerge commit from fork</li>\n<li><a\nhref=\"https://github.com/honojs/node-server/commit/98420217e53a17a238ef1aa1a6bef0b2b70136c5\"><code>9842021</code></a>\n2.0.9</li>\n<li><a\nhref=\"https://github.com/honojs/node-server/commit/51f3bf56f56d9691ec0f7e1562a96f0b485a7dd9\"><code>51f3bf5</code></a>\nfix: recover complete request bodies after client disconnect (<a\nhref=\"https://redirect.github.com/honojs/node-server/issues/375\">#375</a>)</li>\n<li><a\nhref=\"https://github.com/honojs/node-server/commit/fdb87badbe313cfbfe6bb2355e9893dc0698d2bd\"><code>fdb87ba</code></a>\nfix(serve-static): correct Range header parsing edge cases (<a\nhref=\"https://redirect.github.com/honojs/node-server/issues/372\">#372</a>)</li>\n<li><a\nhref=\"https://github.com/honojs/node-server/commit/912e3fd80c4311756f724bd566de1433c8d772d9\"><code>912e3fd</code></a>\nfix(websocket): polyfill missing ErrorEvent global (<a\nhref=\"https://redirect.github.com/honojs/node-server/issues/371\">#371</a>)</li>\n<li><a\nhref=\"https://github.com/honojs/node-server/commit/114c15efb38dabaf81af774ddb764409e3d156d8\"><code>114c15e</code></a>\n2.0.8</li>\n<li><a\nhref=\"https://github.com/honojs/node-server/commit/5db2d5df662cd69ff5c4cc23b8ecb3a6f63e4e38\"><code>5db2d5d</code></a>\nci(release): add <code>--no-git-checks</code> option for <code>pnpm\nstage publish</code> (<a\nhref=\"https://redirect.github.com/honojs/node-server/issues/369\">#369</a>)</li>\n<li><a\nhref=\"https://github.com/honojs/node-server/commit/a528a77ed2c28dc12775c849abc6b6df6d4cb44c\"><code>a528a77</code></a>\n2.0.7</li>\n<li><a\nhref=\"https://github.com/honojs/node-server/commit/b2d610c1e37a96639fbb2eae662e858800aa8906\"><code>b2d610c</code></a>\nchore: bump <code>supertest</code> (<a\nhref=\"https://redirect.github.com/honojs/node-server/issues/368\">#368</a>)</li>\n<li>Additional commits viewable in <a\nhref=\"https://github.com/honojs/node-server/compare/v2.0.4...v2.0.10\">compare\nview</a></li>\n</ul>\n</details>\n<details>\n<summary>Maintainer changes</summary>\n<p>This version was pushed to npm by <a\nhref=\"https://www.npmjs.com/~GitHub%20Actions\">GitHub Actions</a>, a new\nreleaser for <code>@\u200bhono/node-server</code> since your current\nversion.</p>\n</details>\n<br />\n\n---------\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>\nCo-authored-by: langsmith-fleet[bot] <langsmith-fleet[bot]@users.noreply.github.com>"
67
},
78
"GHSA-XV26-6W52-CPH6": {

‎data/fix-commits/next.js-dcb792d7.json‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,13 @@
11
{
22
"vcs_url": "https://github.com/vercel/next.js",
33
"vulnerabilities": {
4-
"GHSA-6G55-P6WH-862Q": {
5-
"c3a25df7f735bf2f1fb5b544c0ee20ed15a39b76": "Bump postcss to 8.5.21 to patch GHSA-6g55-p6wh-862q"
6-
},
74
"GHSA-Q8WF-6R8G-63CH": {
8-
"c9b0206b7c714f460ecc943df8c6ed79c2c9e1a2": "[test] Retry detectContentType event-loop sampling\n\nThe 1ms blocking bound from #96006 also measures OS scheduler noise in\nthe setImmediate gaps, which trips on Windows CI runners (observed\nfailure: exactly 1.0ms). Keep the bound, since it guards\nGHSA-q8wf-6r8g-63ch, but allow more retries: noise is transient while a\nreal regression blocks deterministically on every attempt.",
5+
"dc63f685055c3c5a28e14dcb5edc428f8465f19f": "[test] Retry detectContentType event-loop sampling\n\nThe 1ms blocking bound from #96006 also measures OS scheduler noise in\nthe setImmediate gaps, which trips on Windows CI runners (observed\nfailure: exactly 1.0ms). Keep the bound, since it guards\nGHSA-q8wf-6r8g-63ch, but allow more retries: noise is transient while a\nreal regression blocks deterministically on every attempt.",
96
"93cb90891402fa4c47798d03cb9e05c13233766c": "fix(next/image): improve performance of detectContentType() (#96006)\n\nhttps://github.com/vercel/next.js/security/advisories/GHSA-q8wf-6r8g-63ch\n\nCo-authored-by: Steven <steven@ceriously.com>"
107
},
8+
"GHSA-6G55-P6WH-862Q": {
9+
"c3a25df7f735bf2f1fb5b544c0ee20ed15a39b76": "Bump postcss to 8.5.21 to patch GHSA-6g55-p6wh-862q"
10+
},
1111
"GHSA-6GPP-XCG3-4W24": {
1212
"6bf4df14508ad6c0cd46af50c6051ee42f2d9151": "Fix Turbopack middleware matcher with i18n single locale (#96014)\n\nhttps://github.com/vercel/next.js/security/advisories/GHSA-6gpp-xcg3-4w24\n\nCo-authored-by: Niklas Mischkulnig <4586894+mischnic@users.noreply.github.com>"
1313
},

0 commit comments

Comments
 (0)