[github-actions]

Ran the modules update and recorded every module lock in antelope-lock/ again.

Modules

No module moved. Their locks were resolved again.

Dependencies of the modules

Module	Dependency	From	To
@antelopejs/api@1.3.0	@antelopejs/interface-api	0.3.0	0.3.2
@antelopejs/api@1.3.0	@antelopejs/interface-core	0.4.0	0.4.1
@antelopejs/api@1.3.0	ws	8.22.1	8.23.0

93 locked package versions were added or removed across all locks.

Security advisories

37 advisories still affect a locked package

• high basic-ftp 5.3.1: basic-ftp: Quadratic-time CPU denial of service in Client.list() Unix directory-listing parser (RE_LINE backtracking) (vulnerable: <=6.2.0)
• moderate basic-ftp 5.3.1: basic-ftp: Uncaught TypeError in MLSD directory-listing parser via proto fact name causes DoS in Client.list() (vulnerable: <=6.2.3)
• moderate basic-ftp 5.3.1: basic-ftp: Uncaught exception crashes the Node.js process when a password (or resumed-download path) contains CR/LF (vulnerable: <=6.2.2)
• moderate minimatch 10.2.6: minimatch has potential denial of service via globparts amplification (vulnerable: >=7.0.0 <11.0.1)
• high tar 6.2.1: node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal (vulnerable: <7.5.7)
• high tar 6.2.1: node-tar is Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization (vulnerable: <=7.5.2)
• high tar 6.2.1: Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in node-tar Extraction (vulnerable: <7.5.8)
• high tar 6.2.1: tar has Hardlink Path Traversal via Drive-Relative Linkpath (vulnerable: <=7.5.9)
• high tar 6.2.1: node-tar Symlink Path Traversal via Drive-Relative Linkpath (vulnerable: <=7.5.10)
• high tar 6.2.1: Race Condition in node-tar Path Reservations via Unicode Ligature Collisions on macOS APFS (vulnerable: <=7.5.3)
• moderate tar 6.2.1: node-tar applies PAX size override to intermediary GNU long-name/long-link headers, causing tar parser interpretation differential (file smuggling) (vulnerable: <=7.5.15)
• moderate tar 6.2.1: node-tar: Process crash via PAX numeric path type confusion (vulnerable: <=7.5.17)
• critical tar 6.2.1: node-tar: Decompression/parse DoS via unlimited input (vulnerable: <=7.5.18)
• high tar 6.2.1: node-tar: Negative tar entry size causes infinite loop in archive replace (vulnerable: <=7.5.17)
• moderate tar 6.2.1: node-tar: Uncaught Exception DoS via NUL byte in PAX path/linkpath records (vulnerable: <=7.5.16)
• high tar 6.2.1: node-tar: Uncontrolled recursion in mapHas/filesFilter allows uncatchable stack-overflow DoS via crafted long-path tar with member selection (vulnerable: <=7.5.20)
• critical tinypool 2.1.0: Tinypool: Prototype Pollution gadget in worker options leads to Remote Code Execution (vulnerable: <=2.1.0)
• critical tinypool 2.1.0: Tinypool: Prototype Pollution Gadget to RCE in run() options (vulnerable: <2.1.2)
• high undici 6.23.0: Undici: Malicious WebSocket 64-bit length overflows parser and crashes the client (vulnerable: >=6.0.0 <6.24.0)
• moderate undici 6.23.0: Undici has an HTTP Request/Response Smuggling issue (vulnerable: <6.24.0)
• high undici 6.23.0: Undici has Unbounded Memory Consumption in WebSocket permessage-deflate Decompression (vulnerable: <6.24.0)
• high undici 6.23.0: Undici has Unhandled Exception in WebSocket Client Due to Invalid server_max_window_bits Validation (vulnerable: <6.24.0)
• moderate undici 6.23.0: Undici has CRLF Injection in undici via upgrade option (vulnerable: <6.24.0)
• moderate undici 6.23.0: undici vulnerable to HTTP header injection via Set-Cookie percent-decoding (vulnerable: <6.27.0)
• low undici 6.23.0: undici vulnerable to Set-Cookie SameSite attribute downgrade via permissive substring matching (vulnerable: <6.27.0)
• moderate undici 6.23.0: undici vulnerable to downstream response desynchronization via retry interceptor (vulnerable: <6.28.0)
• moderate undici 6.23.0: undici vulnerable to CRLF Injection via blob-like body 'type' property (vulnerable: <6.28.0)
• moderate undici 6.23.0: undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fields (vulnerable: <6.28.0)
• low undici 6.23.0: undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse (vulnerable: <6.27.0)
• low undici 6.23.0: undici vulnerable to downstream response splitting via retry interceptor (vulnerable: <6.28.1)
• high undici 6.23.0: undici vulnerable to Denial of Service via unrequested WebSocket subprotocol (vulnerable: >=6.7.0 <6.28.1)
• moderate undici 6.23.0: undici vulnerable to Denial of Service via unbounded memory in the EventSource parser (vulnerable: >=6.5.0 <6.29.1)
• high undici 6.23.0: undici vulnerable to Denial of Service via unhandled error on excessive content-encodings (vulnerable: >=6.23.0 <6.29.1)
• high undici 6.23.0: undici vulnerable to TLS certificate validation bypass via dropped tls options in Agent (vulnerable: >=4.0.0 <6.29.1)
• high undici 6.23.0: undici vulnerable to Denial of Service via TLS 1.2 certificate-changing renegotiation (vulnerable: >=4.2.1 <6.29.1)
• moderate undici 6.23.0: undici WebSocket client vulnerable to Denial of Service via unbounded automatic PONG buffering (vulnerable: >=5.15.0 <6.29.1)
• high undici 6.23.0: undici WebSocket client vulnerable to denial of service via fragment count bypass (vulnerable: <6.27.0)

Opened by the modules update workflow.