[github-actions]

Ran the modules update and recorded every module lock in antelope-lock/ again.

Modules

Module	From	To
@antelopejs/dms	0.18.0, 0.18.2, 0.19.1	0.19.1

Dependencies of the modules

Module	Dependency	From	To
@antelopejs/api@1.7.0	@antelopejs/interface-api	0.3.0	0.3.1
@antelopejs/api@1.7.0	@antelopejs/interface-api-util	0.3.0	0.3.1
@antelopejs/api@1.7.0	@antelopejs/interface-core	0.4.0	0.4.1
@antelopejs/api@1.7.0	ws	8.22.1	8.22.2
@antelopejs/auth-jwt@1.1.0	@antelopejs/interface-api	0.3.0	0.3.1
@antelopejs/auth-jwt@1.1.0	@antelopejs/interface-core	0.4.0	0.4.1
@antelopejs/file-storage-local@0.2.0	@antelopejs/interface-api	0.3.0	0.3.1
@antelopejs/file-storage-local@0.2.0	@antelopejs/interface-core	0.4.0	0.4.1
@antelopejs/nodemailer@0.0.6	@antelopejs/interface-core	0.4.0	0.4.1
@antelopejs/nodemailer@0.0.6	@antelopejs/interface-email	0.1.1	0.2.0

68 locked package versions were added or removed across all locks.

Security advisories

63 advisories still affect a locked package

• high basic-ftp 5.3.1: basic-ftp: Quadratic-time CPU denial of service in Client.list() Unix directory-listing parser (RE_LINE backtracking) (vulnerable: <=6.2.0)
• moderate glob 10.5.0, 13.0.7: Glob: AbortSignal cancellation bypass allows post-timeout filesystem traversal (vulnerable: >=9.0.0 <=14.0.1)
• high lodash 4.17.21: lodash vulnerable to Code Injection via _.template imports key names (vulnerable: >=4.0.0 <=4.17.23)
• moderate lodash 4.17.21: Lodash has Prototype Pollution Vulnerability in _.unset, _.omit, and _.pullAt functions (vulnerable: >=4.0.0 <=4.17.22)
• moderate minimatch 9.0.9, 10.2.6: minimatch has potential denial of service via globparts amplification (vulnerable: >=7.0.0 <11.0.1)
• moderate nodemailer 6.10.1: Nodemailer: Email to an unintended domain can occur due to Interpretation Conflict (vulnerable: <7.0.7)
• low nodemailer 6.10.1: Nodemailer has SMTP command injection due to unsanitized envelope.size parameter (vulnerable: <8.0.4)
• moderate nodemailer 6.10.1: Nodemailer Vulnerable to SMTP Command Injection via CRLF in Transport name Option (EHLO/HELO) (vulnerable: <=8.0.4)
• moderate nodemailer 6.10.1: Nodemailer: CRLF injection in Nodemailer List-* header comments allows arbitrary message header injection (vulnerable: <=8.0.8)
• moderate nodemailer 6.10.1: Nodemailer jsonTransport bypasses disableFileAccess and disableUrlAccess during message normalization (vulnerable: <=8.0.8)
• high nodemailer 6.10.1: Nodemailer’s addressparser is vulnerable to DoS caused by recursive calls (vulnerable: >=3.0.0 <=7.0.10)
• high nodemailer 6.10.1: Nodemailer: Message-level raw option bypasses disableFileAccess/disableUrlAccess, enabling arbitrary file read and full-response SSRF in the delivered message (vulnerable: <=9.0.0)
• moderate nodemailer 6.10.1: Nodemailer: resolveContent() on a MailMessage bypasses disableFileAccess/disableUrlAccess when called with the legacy signature (vulnerable: <=9.1.0)
• moderate nodemailer 6.10.1: Nodemailer: IDN/Punycode domain allow-list bypass leads to email delivery to an attacker-controlled domain (vulnerable: <9.1.0)
• high nodemailer 6.10.1: Nodemailer: Quadratic (O(n²)) time complexity in addressparser allows remote denial of service via a crafted address list (vulnerable: <9.1.0)
• moderate nodemailer 6.10.1: Nodemailer: Recipient-domain validation bypass via RFC 5322 comment mis-parsing leads to email delivery to an attacker-controlled domain (vulnerable: >=6.9.16 <9.1.0)
• moderate nodemailer 6.10.1: Nodemailer: Process-global DNS cache reuses TLS servername across transports, enabling cross-tenant SMTP credential disclosure (vulnerable: >=5.0.0 <10.0.2)
• moderate nodemailer 6.10.1: Nodemailer: Nested structured recipient arrays bypass the parser depth limit and cause stack exhaustion DoS (vulnerable: <10.0.2)
• high nodemailer 6.10.1: Nodemailer: Quadratic backtracking in the addressparser free-text fallback allows remote denial of service (vulnerable: <=10.0.5)
• high nodemailer 6.10.1: Nodemailer: Improper TLS Certificate Validation in OAuth2 Token Fetch Enables Credential Interception (vulnerable: <=8.0.7)
• moderate nodemailer 6.10.1: Nodemailer: Quadratic (O(n^2)) DKIM header unfolding lets a large folded header cause remote denial of service during signing (vulnerable: >=3.0.0 <=10.0.9)
• moderate nodemailer 6.10.1: Nodemailer: A nested comment ends early in addressparser, releasing the rest of the comment as a recipient (vulnerable: >=3.0.0 <10.1.4)
• moderate nodemailer 6.10.1: Nodemailer: A ";" inside a quoted string or comment ends an address group early in addressparser, turning display text into a recipient (vulnerable: >=3.0.0 <10.1.4)
• moderate nodemailer 6.10.1: Nodemailer: A ">" inside a quoted local part ends an angle-addr early in addressparser, delivering to a domain the header does not name (vulnerable: >=3.0.0 <10.1.4)
• moderate nodemailer 6.10.1: Nodemailer: Quadratic backtracking in SMTP AUTH mechanism detection regexes allows pre-auth remote denial of service (vulnerable: >=3.0.0 <=10.0.12)
• moderate nodemailer 6.10.1: Nodemailer: RFC 5322 comment inside an angle-bracket address is never stripped (vulnerable: >=3.0.0 <=10.0.12)
• moderate nodemailer 6.10.1: Nodemailer: Quadratic (O(n^2)) SMTP client reply parsing lets a malicious server or MITM cause a pre-auth remote denial of service (vulnerable: >=3.0.0 <=10.0.9)
• high tar 6.2.1: node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal (vulnerable: <7.5.7)
• high tar 6.2.1: node-tar is Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization (vulnerable: <=7.5.2)
• high tar 6.2.1: Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in node-tar Extraction (vulnerable: <7.5.8)
• high tar 6.2.1: tar has Hardlink Path Traversal via Drive-Relative Linkpath (vulnerable: <=7.5.9)
• high tar 6.2.1: node-tar Symlink Path Traversal via Drive-Relative Linkpath (vulnerable: <=7.5.10)
• high tar 6.2.1: Race Condition in node-tar Path Reservations via Unicode Ligature Collisions on macOS APFS (vulnerable: <=7.5.3)
• moderate tar 6.2.1: node-tar applies PAX size override to intermediary GNU long-name/long-link headers, causing tar parser interpretation differential (file smuggling) (vulnerable: <=7.5.15)
• moderate tar 6.2.1: node-tar: Process crash via PAX numeric path type confusion (vulnerable: <=7.5.17)
• critical tar 6.2.1: node-tar: Decompression/parse DoS via unlimited input (vulnerable: <=7.5.18)
• high tar 6.2.1: node-tar: Negative tar entry size causes infinite loop in archive replace (vulnerable: <=7.5.17)
• moderate tar 6.2.1: node-tar: Uncaught Exception DoS via NUL byte in PAX path/linkpath records (vulnerable: <=7.5.16)
• high tar 6.2.1: node-tar: Uncontrolled recursion in mapHas/filesFilter allows uncatchable stack-overflow DoS via crafted long-path tar with member selection (vulnerable: <=7.5.20)
• critical tinypool 2.1.0: Tinypool: Prototype Pollution gadget in worker options leads to Remote Code Execution (vulnerable: <=2.1.0)
• critical tinypool 2.1.0: Tinypool: Prototype Pollution Gadget to RCE in run() options (vulnerable: <2.1.2)
• low tmp 0.0.33: tmp allows arbitrary temporary file / directory write via symbolic link dir parameter (vulnerable: <=0.2.3)
• high tmp 0.0.33: tmp has Path Traversal via unsanitized prefix/postfix that enables directory escape (vulnerable: <0.2.6)
• high undici 6.23.0: Undici: Malicious WebSocket 64-bit length overflows parser and crashes the client (vulnerable: >=6.0.0 <6.24.0)
• moderate undici 6.23.0: Undici has an HTTP Request/Response Smuggling issue (vulnerable: <6.24.0)
• high undici 6.23.0: Undici has Unbounded Memory Consumption in WebSocket permessage-deflate Decompression (vulnerable: <6.24.0)
• high undici 6.23.0: Undici has Unhandled Exception in WebSocket Client Due to Invalid server_max_window_bits Validation (vulnerable: <6.24.0)
• moderate undici 6.23.0: Undici has CRLF Injection in undici via upgrade option (vulnerable: <6.24.0)
• moderate undici 6.23.0: undici vulnerable to HTTP header injection via Set-Cookie percent-decoding (vulnerable: <6.27.0)
• low undici 6.23.0: undici vulnerable to Set-Cookie SameSite attribute downgrade via permissive substring matching (vulnerable: <6.27.0)
• moderate undici 6.23.0: undici vulnerable to downstream response desynchronization via retry interceptor (vulnerable: <6.28.0)
• moderate undici 6.23.0: undici vulnerable to CRLF Injection via blob-like body 'type' property (vulnerable: <6.28.0)
• moderate undici 6.23.0: undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fields (vulnerable: <6.28.0)
• low undici 6.23.0: undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse (vulnerable: <6.27.0)
• low undici 6.23.0: undici vulnerable to downstream response splitting via retry interceptor (vulnerable: <6.28.1)
• high undici 6.23.0: undici vulnerable to Denial of Service via unrequested WebSocket subprotocol (vulnerable: >=6.7.0 <6.28.1)
• moderate undici 6.23.0: undici vulnerable to Denial of Service via unbounded memory in the EventSource parser (vulnerable: >=6.5.0 <6.29.1)
• high undici 6.23.0: undici vulnerable to Denial of Service via unhandled error on excessive content-encodings (vulnerable: >=6.23.0 <6.29.1)
• high undici 6.23.0: undici vulnerable to TLS certificate validation bypass via dropped tls options in Agent (vulnerable: >=4.0.0 <6.29.1)
• high undici 6.23.0: undici vulnerable to Denial of Service via TLS 1.2 certificate-changing renegotiation (vulnerable: >=4.2.1 <6.29.1)
• moderate undici 6.23.0: undici WebSocket client vulnerable to Denial of Service via unbounded automatic PONG buffering (vulnerable: >=5.15.0 <6.29.1)
• high undici 6.23.0: undici WebSocket client vulnerable to denial of service via fragment count bypass (vulnerable: <6.27.0)
• high zod 3.24.4: Zod can exhaust memory while validating oversized constrained collections (vulnerable: <4.6.6)

Opened by the modules update workflow.