chore(deps): bump chalk from 5.6.2 to 6.0.0

[dependabot]

Bumps chalk from 5.6.2 to 6.0.0.

Release notes

Sourced from chalk's releases.

v6.0.0

Breaking

• Require Node.js 22 8a94e0e

Improvements

• Add underline styles and underline colors (#689) 4c304dd
• Improve performance 5729845 fa5cff2

Fixes

• Treat a numeric FORCE_COLOR as an exact level (#688) e912931
• Downsample ansi256() and bgAnsi256() to 16 colors at level 1 (#687) ff549c5

---

chalk/chalk@v5.6.2...v6.0.0

Commits

• 661317e 6.0.0
• 5729845 Improve performance
• 4c304dd Add extended underline styles and underline colors (#689)
• e912931 Fix: Treat a numeric FORCE_COLOR as an exact level (#688)
• 8a94e0e Require Node.js 22
• fa5cff2 Optimize 2-argument calls (#670)
• ff549c5 Fix: Downsample ansi256() and bgAnsi256() to 16 colors at level 1 (#687)
• 678e550 Tweaks
• aa06bb5 Fix typos (#664)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[github-actions]

g0 security scan

Score 55/100 (F)

Severity	Count
Critical	6
High	48
Medium	9
Low	1

Findings

• CRITICAL /home/runner/work/g0/g0/src/endpoint/tetragon-rules.ts:226 — Docker socket mounted into container — full container escape possible. Address AA-SC-130: Docker socket mounted into container — full container escape possible
• CRITICAL analyzers/pipeline-taint.ts:4 — Pipeline taint: shell exfiltration chain. Remove or sandbox shell commands that pipe sensitive data to network endpoints. Use structured APIs instead of shell pipes.
• CRITICAL .:0 — Cross-tool risk: fetch-then-exec. Limit tool capabilities for agent "AgentExecutor". Apply least-privilege: separate data-access tools from network/execution tools.
• CRITICAL .:0 — Cross-tool risk: db-code-exec. Limit tool capabilities for agent "AgentExecutor". Apply least-privilege: separate data-access tools from network/execution tools.
• CRITICAL .:0 — Cross-tool risk: write-then-exec. Limit tool capabilities for agent "AgentExecutor". Apply least-privilege: separate data-access tools from network/execution tools.
• CRITICAL .:0 — Cross-tool risk: shell-network. Limit tool capabilities for agent "AgentExecutor". Apply least-privilege: separate data-access tools from network/execution tools.
• HIGH analyzers/parsers/mcp.ts:102 — Shell execution tool detected. Remove shell execution tool or wrap it with strict input validation and allowlisting.
• HIGH analyzers/parsers/langchain.ts:52 — Shell execution tool detected. Remove shell execution tool or wrap it with strict input validation and allowlisting.
• HIGH analyzers/parsers/langchain.ts:54 — Database tool without input validation. Use parameterized queries and validate all input before database operations.
• HIGH analyzers/parsers/langchain.ts:53 — Code execution tool without sandboxing. Run code execution in a sandboxed environment (Docker, E2B, subprocess with restrictions).

55 more findings

• HIGH analyzers/parsers/langchain.ts:53 — Code execution tool without sandbox. Run code execution tools in a sandboxed environment (Docker, E2B, etc.).
• HIGH analyzers/rules/code-execution.ts:265 — Code execution tool without sandboxing. Run code execution in a sandboxed environment (Docker, E2B, subprocess with restrictions).
• HIGH analyzers/rules/code-execution.ts:265 — Code execution tool without sandbox. Run code execution tools in a sandboxed environment (Docker, E2B, etc.).
• HIGH testing/payloads/openclaw-attacks.ts:66 — OpenAI API key detected in source code. Move secrets to environment variables or a secret manager. Never commit secrets to source code.
• HIGH analyzers/rules/code-execution.ts:163 — new Function() constructor used. Remove new Function() usage. Use safe alternatives.
• HIGH analyzers/rules/code-execution.ts:440 — child_process.exec() usage detected. Use child_process.execFile() or child_process.spawn() instead of exec/execSync to avoid shell injection.
• HIGH analyzers/parsers/langchain.ts:177 — LLM output executed as code. Never pass LLM output to exec() or eval(). Use a sandboxed code interpreter or safe parsing instead.
• HIGH analyzers/parsers/mcp.ts:145 — LLM output executed as code. Never pass LLM output to exec() or eval(). Use a sandboxed code interpreter or safe parsing instead.
• HIGH analyzers/rules/code-execution.ts:804 — Unsandboxed Docker socket access. Avoid mounting the Docker socket directly. Use a restricted Docker API proxy or rootless Docker.
• HIGH analyzers/rules/code-execution.ts:167 — Function() constructor with dynamic input. Avoid new Function() with dynamic input. Use safe alternatives or a sandboxed environment.
• HIGH analyzers/rules/code-execution.ts:980 — Template engine SSTI risk. Never pass user input directly into template strings. Use render_template() with named templates instead.
• HIGH analyzers/rules/code-execution.ts:1840 — ptrace/debugging syscall detected. Block ptrace and debugging syscalls via seccomp profiles. Set Yama ptrace_scope to restricted.
• HIGH /home/runner/work/g0/g0/src/endpoint/mdm-detect.ts:85 — LLM-generated code execution. Sandbox code execution or use allowlisted operations only
• HIGH /home/runner/work/g0/g0/src/endpoint/agentic-browser-scanner.ts:61 — Direct code/command execution — exec, os.system, child_process, Runtime.exec. Address AA-CE-063: Direct code/command execution — exec, os.system, child_process, Runtime.exec
• HIGH /home/runner/work/g0/g0/src/endpoint/host-hardening.ts:10 — Direct code/command execution — exec, os.system, child_process, Runtime.exec. Address AA-CE-063: Direct code/command execution — exec, os.system, child_process, Runtime.exec
• HIGH /home/runner/work/g0/g0/src/endpoint/mdm-detect.ts:56 — Direct code/command execution — exec, os.system, child_process, Runtime.exec. Address AA-CE-063: Direct code/command execution — exec, os.system, child_process, Runtime.exec
• HIGH /home/runner/work/g0/g0/src/endpoint/openclaw-config-hardener.ts:105 — Direct code/command execution — exec, os.system, child_process, Runtime.exec. Address AA-CE-063: Direct code/command execution — exec, os.system, child_process, Runtime.exec
• HIGH /home/runner/work/g0/g0/src/endpoint/openclaw-config-hardener.ts:105 — Agent accesses kernel interfaces. Address AA-RA-047: Agent accesses kernel interfaces
• HIGH /home/runner/work/g0/g0/src/endpoint/process-detector.ts:75 — Direct code/command execution — exec, os.system, child_process, Runtime.exec. Address AA-CE-063: Direct code/command execution — exec, os.system, child_process, Runtime.exec
• HIGH /home/runner/work/g0/g0/src/endpoint/scoring.ts:222 — All environment variables dumped — credential exposure. Address AA-DL-109: All environment variables dumped — credential exposure
• HIGH /home/runner/work/g0/g0/src/endpoint/host-hardening.ts:41 — Agent accesses kernel interfaces. Address AA-RA-047: Agent accesses kernel interfaces
• HIGH /home/runner/work/g0/g0/src/endpoint/host-hardening.ts:63 — Agent accesses kernel interfaces. Address AA-RA-047: Agent accesses kernel interfaces
• HIGH /home/runner/work/g0/g0/src/endpoint/host-hardening.ts:80 — Agent accesses kernel interfaces. Address AA-RA-047: Agent accesses kernel interfaces
• HIGH /home/runner/work/g0/g0/src/endpoint/host-hardening.ts:97 — Agent accesses kernel interfaces. Address AA-RA-047: Agent accesses kernel interfaces
• HIGH /home/runner/work/g0/g0/src/endpoint/host-hardening.ts:114 — Agent accesses kernel interfaces. Address AA-RA-047: Agent accesses kernel interfaces
• HIGH /home/runner/work/g0/g0/src/endpoint/host-hardening.ts:131 — Agent accesses kernel interfaces. Address AA-RA-047: Agent accesses kernel interfaces
• HIGH /home/runner/work/g0/g0/src/endpoint/host-hardening.ts:146 — Agent accesses kernel interfaces. Address AA-RA-047: Agent accesses kernel interfaces
• HIGH /home/runner/work/g0/g0/src/endpoint/host-hardening.ts:161 — Agent accesses kernel interfaces. Address AA-RA-047: Agent accesses kernel interfaces
• HIGH /home/runner/work/g0/g0/src/endpoint/host-hardening.ts:179 — Agent accesses kernel interfaces. Address AA-RA-047: Agent accesses kernel interfaces
• HIGH /home/runner/work/g0/g0/src/endpoint/auditd-rules.ts:55 — Tool has Docker API access — container escape risk. Address AA-TS-128: Tool has Docker API access — container escape risk
• HIGH /home/runner/work/g0/g0/src/endpoint/egress-monitor.ts:63 — Tool has Docker API access — container escape risk. Address AA-TS-128: Tool has Docker API access — container escape risk
• HIGH /home/runner/work/g0/g0/src/endpoint/egress-monitor.ts:70 — Tool has Docker API access — container escape risk. Address AA-TS-128: Tool has Docker API access — container escape risk
• HIGH /home/runner/work/g0/g0/src/endpoint/egress-monitor.ts:570 — Tool has Docker API access — container escape risk. Address AA-TS-128: Tool has Docker API access — container escape risk
• HIGH /home/runner/work/g0/g0/src/endpoint/egress-monitor.ts:637 — Tool has Docker API access — container escape risk. Address AA-TS-128: Tool has Docker API access — container escape risk
• HIGH /home/runner/work/g0/g0/src/endpoint/tetragon-rules.ts:210 — Tool has Docker API access — container escape risk. Address AA-TS-128: Tool has Docker API access — container escape risk
• HIGH /home/runner/work/g0/g0/src/endpoint/tetragon-rules.ts:369 — Tool has Docker API access — container escape risk. Address AA-TS-128: Tool has Docker API access — container escape risk
• HIGH /home/runner/work/g0/g0/src/endpoint/tetragon-rules.ts:513 — Tool has Docker API access — container escape risk. Address AA-TS-128: Tool has Docker API access — container escape risk
• HIGH /home/runner/work/g0/g0/src/endpoint/tetragon-rules.ts:544 — Tool has Docker API access — container escape risk. Address AA-TS-128: Tool has Docker API access — container escape risk
• HIGH /home/runner/work/g0/g0/src/endpoint/tetragon-rules.ts:545 — Tool has Docker API access — container escape risk. Address AA-TS-128: Tool has Docker API access — container escape risk
• HIGH analyzers/parsers/langchain.ts:666 — System prompt has no scope boundaries. Add explicit role definition, allowed actions, and behavioral boundaries to the system prompt.
• HIGH analyzers/rules/tool-safety.ts:1074 — Pipeline taint: shell exfiltration chain. Remove or sandbox shell commands that pipe sensitive data to network endpoints. Use structured APIs instead of shell pipes.
• HIGH endpoint/tetragon-rules.ts:372 — Pipeline taint: shell exfiltration chain. Remove or sandbox shell commands that pipe sensitive data to network endpoints. Use structured APIs instead of shell pipes.
• HIGH .:0 — Cross-tool risk: read-then-exfil. Limit tool capabilities for agent "AgentExecutor". Apply least-privilege: separate data-access tools from network/execution tools.
• HIGH .:0 — Cross-tool risk: db-exfil. Limit tool capabilities for agent "AgentExecutor". Apply least-privilege: separate data-access tools from network/execution tools.
• MEDIUM /home/runner/work/g0/g0/src/endpoint/mdm-detect.ts:128 — Agent accesses kernel interfaces. Address AA-RA-047: Agent accesses kernel interfaces
• MEDIUM /home/runner/work/g0/g0/src/endpoint/egress-monitor.ts:734 — Tool has Docker API access — container escape risk. Address AA-TS-128: Tool has Docker API access — container escape risk
• MEDIUM analyzers/parsers/langchain.ts:55 — Filesystem tool without path validation. Validate and sanitize file paths. Use allowlists for permitted directories.
• MEDIUM enforcement/edm.ts:23 — API key in URL query parameter. Pass API keys in HTTP headers (Authorization, X-API-Key) instead of URL query parameters.
• MEDIUM testing/judge/llm-prompts.ts:69 — API key in URL query parameter. Pass API keys in HTTP headers (Authorization, X-API-Key) instead of URL query parameters.
• MEDIUM /home/runner/work/g0/g0/src/endpoint/sensitive-paths.ts:60 — Untrusted input flows to file path operation — path traversal risk. Address AA-CE-052: Untrusted input flows to file path operation — path traversal risk
• MEDIUM /home/runner/work/g0/g0/src/endpoint/scoring.ts:222 — Agent accesses environment variables. Address AA-RA-043: Agent accesses environment variables
• MEDIUM /home/runner/work/g0/g0/src/endpoint/agent-config-scanner.ts:257 — Tool has email sending capability — phishing and data exfiltration risk. Address AA-TS-105: Tool has email sending capability — phishing and data exfiltration risk
• MEDIUM analyzers/parsers/langchain.ts:56 — Tool has unrestricted network access. Address AA-TS-062: Tool has unrestricted network access
• LOW analyzers/parsers/langchain.ts:204 — Agent has no system prompt — vulnerable to unbounded behavior. Address AA-GI-073: Agent has no system prompt — vulnerable to unbounded behavior
• INFO analyzers/parsers/langchain.ts:204 — Agent has no error handler configured. Address AA-CF-064: Agent has no error handler configured

Gate: PASSED ✅

— See findings across every repo in your org → https://guard0.ai/signup?utm_source=github&utm_medium=pr_comment&utm_campaign=g0_action