Dependency & Actions audit - 2026-07-27

[krakenhavoc]

GitHub Actions Deprecation

NONE — all pinned actions (actions/checkout@v6, actions/setup-node@v6 targeting Node 24, actions/upload-artifact@v6, docker/login-action@v4, docker/setup-buildx-action@v4, docker/metadata-action@v6, docker/build-push-action@v7, peter-evans/repository-dispatch@v4) already run on the Node24 runtime.

npm Dependencies

axios — CVE-2025-62718 / CVE-2026-42043 (SSRF via NO_PROXY hostname-normalization bypass, CVSS 9.3 / 7.2). Fixed only in axios ≥1.15.1.

• frontend/package.json declares axios: "^1.13.6", and frontend/yarn.lock resolves to exactly 1.13.6 — vulnerable, direct dependency. Fix: bump to ^1.16.0+ and re-lock.
• backend/package.json pins axios: "^1.16.0" (patched at the top level), but acme-client@^5.4.0 pulls in a transitive axios@^1.7.2 that backend/yarn.lock resolves to 1.13.4 — also vulnerable, and not controlled by the top-level pin. Fix: add a resolutions/overrides entry pinning axios to ≥1.15.1 across the backend workspace, or upgrade acme-client to a version that itself depends on a patched axios.

Checked and confirmed not vulnerable at resolved yarn.lock versions: nodemailer@8.0.1 (CVE-2025-14874 fixed in 7.0.11), typeorm@0.3.28 (SQL-injection CVE fixed in 0.3.26), class-transformer@0.5.1, jsonwebtoken@9.0.3, ws@8.19.0.

Go Module CVEs

NONE — no go.mod in this repo.

Terraform Providers

NONE — no *.tf files in this repo (infra is delegated to infra-int via repository_dispatch).

---

Note: this re-confirms the axios finding raised in #91 (2026-07-06) — both lockfiles still resolve to vulnerable versions three weeks later.