security: refresh vulnerable npm fixture locks by joseguzman1337 · Pull Request #2 · fossabot/trivy

joseguzman1337 · 2026-03-19T21:59:49Z

Summary

update npm fixture lockfiles used by security analyzers
bump jquery, body-parser, and express in test fixtures to patched versions
keep fixture coverage aligned with modern vulnerable-package metadata

Validation

lockfile-only fixture refresh

Bumps [github.com/testcontainers/testcontainers-go](https://github.com/testcontainers/testcontainers-go) from 0.36.0 to 0.37.0. - [Release notes](https://github.com/testcontainers/testcontainers-go/releases) - [Commits](testcontainers/testcontainers-go@v0.36.0...v0.37.0) --- updated-dependencies: - dependency-name: github.com/testcontainers/testcontainers-go dependency-version: 0.37.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>

…tainers-go-0.37.0'

Bumps [github.com/aws/aws-sdk-go-v2/service/ec2](https://github.com/aws/aws-sdk-go-v2) from 1.206.0 to 1.213.0. - [Release notes](https://github.com/aws/aws-sdk-go-v2/releases) - [Changelog](https://github.com/aws/aws-sdk-go-v2/blob/main/changelog-template.json) - [Commits](aws/aws-sdk-go-v2@service/ec2/v1.206.0...service/ec2/v1.213.0) --- updated-dependencies: - dependency-name: github.com/aws/aws-sdk-go-v2/service/ec2 dependency-version: 1.213.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>

…ice/ec2-1.213.0'

Bumps [github.com/aws/aws-sdk-go-v2/service/ecr](https://github.com/aws/aws-sdk-go-v2) from 1.42.0 to 1.44.0. - [Release notes](https://github.com/aws/aws-sdk-go-v2/releases) - [Changelog](https://github.com/aws/aws-sdk-go-v2/blob/main/changelog-template.json) - [Commits](aws/aws-sdk-go-v2@service/s3/v1.42.0...service/s3/v1.44.0) --- updated-dependencies: - dependency-name: github.com/aws/aws-sdk-go-v2/service/ecr dependency-version: 1.44.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>

…ice/ecr-1.44.0'

Bumps the go_modules group with 1 update: [github.com/open-policy-agent/opa](https://github.com/open-policy-agent/opa). Updates `github.com/open-policy-agent/opa` from 1.2.0 to 1.4.0 - [Release notes](https://github.com/open-policy-agent/opa/releases) - [Changelog](https://github.com/open-policy-agent/opa/blob/main/CHANGELOG.md) - [Commits](open-policy-agent/opa@v1.2.0...v1.4.0) --- updated-dependencies: - dependency-name: github.com/open-policy-agent/opa dependency-version: 1.4.0 dependency-type: direct:production dependency-group: go_modules ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps [aquaproj/aqua-installer](https://github.com/aquaproj/aqua-installer) from 3.1.2 to 4.0.0. - [Release notes](https://github.com/aquaproj/aqua-installer/releases) - [Commits](aquaproj/aqua-installer@v3.1.2...v4.0.0) --- updated-dependencies: - dependency-name: aquaproj/aqua-installer dependency-version: 4.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps [golangci/golangci-lint-action](https://github.com/golangci/golangci-lint-action) from 7.0.0 to 8.0.0. - [Release notes](https://github.com/golangci/golangci-lint-action/releases) - [Commits](golangci/golangci-lint-action@v7.0.0...v8.0.0) --- updated-dependencies: - dependency-name: golangci/golangci-lint-action dependency-version: 8.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps [github.com/tetratelabs/wazero](https://github.com/tetratelabs/wazero) from 1.8.2 to 1.9.0. - [Release notes](https://github.com/tetratelabs/wazero/releases) - [Commits](wazero/wazero@v1.8.2...v1.9.0) --- updated-dependencies: - dependency-name: github.com/tetratelabs/wazero dependency-version: 1.9.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps [golang.org/x/net](https://github.com/golang/net) from 0.39.0 to 0.40.0. - [Commits](golang/net@v0.39.0...v0.40.0) --- updated-dependencies: - dependency-name: golang.org/x/net dependency-version: 0.40.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps [github.com/aws/aws-sdk-go-v2/service/s3](https://github.com/aws/aws-sdk-go-v2) from 1.79.3 to 1.80.0. - [Release notes](https://github.com/aws/aws-sdk-go-v2/releases) - [Changelog](https://github.com/aws/aws-sdk-go-v2/blob/main/changelog-template.json) - [Commits](aws/aws-sdk-go-v2@service/s3/v1.79.3...service/s3/v1.80.0) --- updated-dependencies: - dependency-name: github.com/aws/aws-sdk-go-v2/service/s3 dependency-version: 1.80.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps [github.com/owenrumney/squealer](https://github.com/owenrumney/squealer) from 1.2.4 to 1.2.11. - [Release notes](https://github.com/owenrumney/squealer/releases) - [Changelog](https://github.com/owenrumney/squealer/blob/main/.goreleaser.yml) - [Commits](owenrumney/squealer@v1.2.4...v1.2.11) --- updated-dependencies: - dependency-name: github.com/owenrumney/squealer dependency-version: 1.2.11 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps [github.com/hashicorp/terraform-exec](https://github.com/hashicorp/terraform-exec) from 0.22.0 to 0.23.0. - [Release notes](https://github.com/hashicorp/terraform-exec/releases) - [Changelog](https://github.com/hashicorp/terraform-exec/blob/main/CHANGELOG.md) - [Commits](hashicorp/terraform-exec@v0.22.0...v0.23.0) --- updated-dependencies: - dependency-name: github.com/hashicorp/terraform-exec dependency-version: 0.23.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps [k8s.io/api](https://github.com/kubernetes/api) from 0.33.0 to 0.33.1. - [Commits](kubernetes/api@v0.33.0...v0.33.1) --- updated-dependencies: - dependency-name: k8s.io/api dependency-version: 0.33.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>

…ice/s3-1.80.0'

…2.11'

…ec-0.23.0'

Bumps [github.com/Azure/azure-sdk-for-go/sdk/azidentity](https://github.com/Azure/azure-sdk-for-go) from 1.8.2 to 1.10.0. - [Release notes](https://github.com/Azure/azure-sdk-for-go/releases) - [Changelog](https://github.com/Azure/azure-sdk-for-go/blob/main/documentation/go-mgmt-sdk-release-guideline.md) - [Commits](Azure/azure-sdk-for-go@sdk/azidentity/v1.8.2...sdk/azcore/v1.10.0) --- updated-dependencies: - dependency-name: github.com/Azure/azure-sdk-for-go/sdk/azidentity dependency-version: 1.10.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps [github.com/aws/aws-sdk-go-v2/service/ec2](https://github.com/aws/aws-sdk-go-v2) from 1.213.0 to 1.224.0. - [Release notes](https://github.com/aws/aws-sdk-go-v2/releases) - [Changelog](https://github.com/aws/aws-sdk-go-v2/blob/main/changelog-template.json) - [Commits](aws/aws-sdk-go-v2@service/ec2/v1.213.0...service/ec2/v1.224.0) --- updated-dependencies: - dependency-name: github.com/aws/aws-sdk-go-v2/service/ec2 dependency-version: 1.224.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps [github.com/aquasecurity/table](https://github.com/aquasecurity/table) from 1.9.0 to 1.10.0. - [Release notes](https://github.com/aquasecurity/table/releases) - [Commits](aquasecurity/table@v1.9.0...v1.10.0) --- updated-dependencies: - dependency-name: github.com/aquasecurity/table dependency-version: 1.10.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps [github.com/moby/buildkit](https://github.com/moby/buildkit) from 0.20.2 to 0.22.0. - [Release notes](https://github.com/moby/buildkit/releases) - [Commits](moby/buildkit@v0.20.2...v0.22.0) --- updated-dependencies: - dependency-name: github.com/moby/buildkit dependency-version: 0.22.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps [github.com/cheggaaa/pb/v3](https://github.com/cheggaaa/pb) from 3.1.6 to 3.1.7. - [Commits](cheggaaa/pb@v3.1.6...v3.1.7) --- updated-dependencies: - dependency-name: github.com/cheggaaa/pb/v3 dependency-version: 3.1.7 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps [github.com/aquasecurity/go-pep440-version](https://github.com/aquasecurity/go-pep440-version) from 0.0.0-20210121094942-22b2f8951d46 to 0.0.1. - [Release notes](https://github.com/aquasecurity/go-pep440-version/releases) - [Commits](https://github.com/aquasecurity/go-pep440-version/commits/v0.0.1) --- updated-dependencies: - dependency-name: github.com/aquasecurity/go-pep440-version dependency-version: 0.0.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>

…-connections-0.6.0

…iners/testcontainers-go-0.40.0

…ity/table-1.11.0

…staller-4.0.4

…hub.com/secure-systems-lab/go-securesystemslib-0.10.0 chore(deps): bump github.com/secure-systems-lab/go-securesystemslib from 0.9.1 to 0.10.0

…mantic-pull-request-6

…-connections-0.6.0

…iners/testcontainers-go-0.40.0

…ng-action-2.8.0

…staller-4.0.4

…mantic-pull-request-6

…/actions/cache-5.0.3 chore(deps): bump actions/cache from 4.2.3 to 5.0.3

…ng-action-2.8.0

…hub.com/aws/aws-sdk-go-v2/service/ecr-1.55.1 chore(deps): bump github.com/aws/aws-sdk-go-v2/service/ecr from 1.45.1 to 1.55.1

…hub.com/aquasecurity/table-1.11.0 chore(deps): bump github.com/aquasecurity/table from 1.10.0 to 1.11.0

…hub.com/docker/go-connections-0.6.0 chore(deps): bump github.com/docker/go-connections from 0.5.0 to 0.6.0

…hub.com/testcontainers/testcontainers-go-0.40.0 chore(deps): bump github.com/testcontainers/testcontainers-go from 0.37.0 to 0.40.0

…/aquaproj/aqua-installer-4.0.4 chore(deps): bump aquaproj/aqua-installer from 4.0.2 to 4.0.4

…/amannn/action-semantic-pull-request-6 chore(deps): bump amannn/action-semantic-pull-request from 5 to 6

…3.23.3 chore(deps): bump alpine from 3.23.2 to 3.23.3

…/helm/chart-testing-action-2.8.0 chore(deps): bump helm/chart-testing-action from 2.7.0 to 2.8.0

Bumps the go_modules group with 4 updates in the / directory: [github.com/cloudflare/circl](https://github.com/cloudflare/circl), [github.com/docker/cli](https://github.com/docker/cli), [go.opentelemetry.io/otel/sdk](https://github.com/open-telemetry/opentelemetry-go) and [google.golang.org/grpc](https://github.com/grpc/grpc-go). Updates `github.com/cloudflare/circl` from 1.6.1 to 1.6.3 - [Release notes](https://github.com/cloudflare/circl/releases) - [Commits](cloudflare/circl@v1.6.1...v1.6.3) Updates `github.com/docker/cli` from 29.0.3+incompatible to 29.2.0+incompatible - [Commits](docker/cli@v29.0.3...v29.2.0) Updates `go.opentelemetry.io/otel/sdk` from 1.38.0 to 1.40.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-go@v1.38.0...v1.40.0) Updates `google.golang.org/grpc` from 1.78.0 to 1.79.3 - [Release notes](https://github.com/grpc/grpc-go/releases) - [Commits](grpc/grpc-go@v1.78.0...v1.79.3) --- updated-dependencies: - dependency-name: github.com/cloudflare/circl dependency-version: 1.6.3 dependency-type: indirect dependency-group: go_modules - dependency-name: github.com/docker/cli dependency-version: 29.2.0+incompatible dependency-type: indirect dependency-group: go_modules - dependency-name: go.opentelemetry.io/otel/sdk dependency-version: 1.40.0 dependency-type: indirect dependency-group: go_modules - dependency-name: google.golang.org/grpc dependency-version: 1.79.3 dependency-type: indirect dependency-group: go_modules ... Signed-off-by: dependabot[bot] <support@github.com>

…modules-0461fc8ab8 chore(deps): bump the go_modules group across 1 directory with 4 updates

dependabot bot and others added 30 commits May 1, 2025 09:32

Merge branch 'dependabot/go_modules/github.com/testcontainers/testcon…

6a685dd

…tainers-go-0.37.0'

Merge branch 'dependabot/go_modules/github.com/aws/aws-sdk-go-v2/serv…

67b16c1

…ice/ec2-1.213.0'

Merge branch 'dependabot/go_modules/github.com/go-git/go-git/v5-5.16.0'

0d0ac49

Merge branch 'dependabot/go_modules/github.com/aws/aws-sdk-go-v2/serv…

1f95974

…ice/ecr-1.44.0'

Merge branch 'dependabot/go_modules/go_modules-23d8c868eb'

e7b48c6

Merge branch 'dependabot/github_actions/aquaproj/aqua-installer-4.0.0'

2a97649

Merge branch 'dependabot/go_modules/github.com/tetratelabs/wazero-1.9.0'

d596268

Merge branch 'dependabot/go_modules/golang.org/x/net-0.40.0'

f1ce6fd

Merge branch 'dependabot/go_modules/github.com/aws/aws-sdk-go-v2/serv…

2e886a2

…ice/s3-1.80.0'

Merge branch 'dependabot/go_modules/github.com/owenrumney/squealer-1.…

1194333

…2.11'

Merge branch 'dependabot/go_modules/github.com/hashicorp/terraform-ex…

bc189b9

…ec-0.23.0'

Merge branch 'dependabot/go_modules/k8s.io/api-0.33.1'

b041dd1

joseguzman1337 and others added 30 commits March 12, 2026 22:26

Merge branch 'master' into dependabot/go_modules/github.com/docker/go…

deafb64

…-connections-0.6.0

Merge branch 'master' into dependabot/go_modules/github.com/testconta…

52612f0

…iners/testcontainers-go-0.40.0

Merge branch 'master' into dependabot/go_modules/github.com/aquasecur…

d215e1c

…ity/table-1.11.0

Merge branch 'master' into dependabot/github_actions/aquaproj/aqua-in…

8f2f3f6

…staller-4.0.4

Merge pull request #940 from joseguzman1337/dependabot/go_modules/git…

50f4442

…hub.com/secure-systems-lab/go-securesystemslib-0.10.0 chore(deps): bump github.com/secure-systems-lab/go-securesystemslib from 0.9.1 to 0.10.0

Merge branch 'master' into dependabot/github_actions/amannn/action-se…

a8a6eef

…mantic-pull-request-6

Merge branch 'master' into dependabot/github_actions/actions/cache-5.0.3

ee1f1c6

Merge branch 'master' into dependabot/go_modules/github.com/docker/go…

f07080d

…-connections-0.6.0

Merge branch 'master' into dependabot/docker/alpine-3.23.3

c36899f

Merge branch 'master' into dependabot/go_modules/github.com/testconta…

701d8b3

…iners/testcontainers-go-0.40.0

Merge branch 'master' into dependabot/github_actions/helm/chart-testi…

af21dd4

…ng-action-2.8.0

Merge branch 'master' into dependabot/github_actions/aquaproj/aqua-in…

58cbd47

…staller-4.0.4

Merge branch 'master' into dependabot/github_actions/amannn/action-se…

5b323ad

…mantic-pull-request-6

Merge pull request #934 from joseguzman1337/dependabot/github_actions…

243eb64

…/actions/cache-5.0.3 chore(deps): bump actions/cache from 4.2.3 to 5.0.3

Merge branch 'master' into dependabot/docker/alpine-3.23.3

4f65eab

Merge branch 'master' into dependabot/github_actions/helm/chart-testi…

90e341d

…ng-action-2.8.0

Merge pull request #944 from joseguzman1337/dependabot/go_modules/git…

036f916

…hub.com/aws/aws-sdk-go-v2/service/ecr-1.55.1 chore(deps): bump github.com/aws/aws-sdk-go-v2/service/ecr from 1.45.1 to 1.55.1

Merge pull request #941 from joseguzman1337/dependabot/go_modules/git…

bc9b4af

…hub.com/aquasecurity/table-1.11.0 chore(deps): bump github.com/aquasecurity/table from 1.10.0 to 1.11.0

Merge pull request #938 from joseguzman1337/dependabot/go_modules/git…

77a3ea3

…hub.com/docker/go-connections-0.6.0 chore(deps): bump github.com/docker/go-connections from 0.5.0 to 0.6.0

Merge pull request #937 from joseguzman1337/dependabot/go_modules/git…

77bf794

…hub.com/testcontainers/testcontainers-go-0.40.0 chore(deps): bump github.com/testcontainers/testcontainers-go from 0.37.0 to 0.40.0

Merge pull request #936 from joseguzman1337/dependabot/github_actions…

f6c4823

…/aquaproj/aqua-installer-4.0.4 chore(deps): bump aquaproj/aqua-installer from 4.0.2 to 4.0.4

Merge pull request #935 from joseguzman1337/dependabot/github_actions…

37eb987

…/amannn/action-semantic-pull-request-6 chore(deps): bump amannn/action-semantic-pull-request from 5 to 6

Merge pull request #933 from joseguzman1337/dependabot/docker/alpine-…

80ce219

…3.23.3 chore(deps): bump alpine from 3.23.2 to 3.23.3

Merge pull request #932 from joseguzman1337/dependabot/github_actions…

27b0f27

…/helm/chart-testing-action-2.8.0 chore(deps): bump helm/chart-testing-action from 2.7.0 to 2.8.0

Merge pull request #949 from joseguzman1337/dependabot/go_modules/go_…

1406d2b

…modules-0461fc8ab8 chore(deps): bump the go_modules group across 1 directory with 4 updates

chore(sync): incorporate AI agents work and sync

41fcbbf

chore(sync): incorporate AI agents work and sync

b9d7b12

security: refresh vulnerable npm fixture locks

7a1b685

[CRUSH] chore(repo): checkpoint pending changes #TASK-000

16aa9c6

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

security: refresh vulnerable npm fixture locks#2

security: refresh vulnerable npm fixture locks#2
joseguzman1337 wants to merge 3476 commits intofossabot:masterfrom
joseguzman1337:security/dependabot-fixtures

joseguzman1337 commented Mar 19, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

joseguzman1337 commented Mar 19, 2026

Summary

Validation

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant