[Aikido] Fix 9 security issues in lodash, @actions/github, @octokit/core and 1 more

[aikido-autofix]

Upgrade lodash, @actions/github, @octokit/core, and uuid to fix critical RCE vulnerability in template compilation via options.imports injection and HIGH severity buffer overflow in UUID generation. This update includes breaking changes that require manual migration.

⚠️ Incomplete breaking changes analysis (2/4 analyzed)

⚠️ Breaking changes analysis not available for: @actions/github, @octokit/core

⚠️ The upgrade has breaking changes that affect this codebase:

@octokit packages - Node.js version requirement (v7.0.0+, v8.0.0+)

• Where your code is affected: action.yml:7 specifies using: node24, and all octokit usage in src/gh.js:9, 22, 35

• Impact: The upgraded @octokit packages require Node.js >= 18. While the action currently runs on Node.js 24 (which satisfies this requirement), the package-lock.json shows the currently installed versions have no such requirement. This creates a hard dependency on Node.js 18+ that wasn't there before.

• Remediation: Verify that all environments where this action runs support Node.js 18 or higher, and update documentation to reflect this minimum requirement.

@octokit/request - Removal of custom request options (v8.0.0)

• Where your code is affected: src/gh.js:9, 22, 35 where github.getOctokit() is called

• Impact: The upgrade removes the ability to pass custom request options except for method, headers, body, signal, and data. While the current code doesn't explicitly pass custom options, the @actions/github package internally configures a proxy agent via Utils.getProxyAgent() (visible in dist/index.js). This proxy agent configuration may no longer work with v8.0.0.

• Remediation: Review the @actions/github package compatibility with the new @octokit/request version to ensure proxy support still functions correctly, or migrate to using fetch dispatchers as documented in the new version.

All breaking changes by upgrading lodash from version 4.17.21 to 4.18.1 (CHANGELOG)

Version	Description
4.18.0	_.unset / _.omit now block constructor and prototype as non-terminal path keys unconditionally. Calls that previously returned true and deleted the property now return false and leave the target untouched.
4.18.0	_.template now throws "Invalid imports option passed into _.template" when imports keys contain forbidden identifier characters, which were previously allowed.

✅ 9 CVEs resolved by this upgrade, including 1 critical 🚨 CVE

This PR will resolve the following CVEs:

Issue	Severity	Description
CVE-2026-4800	🚨 CRITICAL	[lodash] A vulnerability in _.template allows arbitrary code execution through untrusted key names in options.imports or prototype pollution, as validation was incomplete after a prior CVE fix. An attacker can inject malicious code that executes during template compilation.
CVE-2025-13465	MEDIUM	[lodash] A prototype pollution vulnerability in _.unset and _.omit functions allows attackers to delete methods from global prototypes via crafted paths. While this prevents property overwriting, it can cause denial of service by removing critical functionality.
CVE-2026-2950	MEDIUM	[lodash] Prototype pollution vulnerability in _.unset and _.omit functions allows attackers to bypass previous fixes using array-wrapped path segments, enabling deletion of properties from built-in prototypes. While this doesn't allow overwriting prototype behavior, it can cause denial of service or unexpected application behavior.
CVE-2026-41907	HIGH	[uuid] A buffer overflow vulnerability allows v3, v5, and v6 UUID functions to write beyond caller-provided buffer boundaries when given small buffers or large offsets, causing silent data corruption. This can lead to memory corruption and potential code execution or information disclosure.
AIKIDO-2026-10892	MEDIUM	[uuid] UUID functions v3(), v5(), and v6() can write past the end of a caller-provided buffer due to missing offset validation, enabling buffer overflow attacks. The fix adds bounds checks to prevent out-of-range writes.
AIKIDO-2025-10094	LOW	[@octokit/endpoint] Improper header parsing for GraphQL endpoints allows attackers to craft malicious inputs triggering ReDoS through excessive regex backtracking, causing denial of service and performance degradation.
CVE-2025-25288	LOW	[@octokit/plugin-paginate-rest] A ReDoS (Regular Expression Denial of Service) vulnerability exists in the pagination iterator when processing malicious link headers, allowing attackers to cause denial of service through specially crafted requests.
CVE-2025-25290	LOW	[@octokit/request] A ReDoS vulnerability in the link header parsing regex allows attackers to cause excessive CPU usage and service unavailability through specially crafted HTTP responses. The unbounded regex pattern is susceptible to catastrophic backtracking when processing malicious input.
CVE-2025-25289	LOW	[@octokit/request-error] A Regular Expression Denial of Service (ReDoS) vulnerability in HTTP header processing allows attackers to cause excessive resource consumption and DoS by sending malformed authorization headers with long space sequences. This can significantly degrade performance or crash services.

[aikido-pr-checks]

4 Open source vulnerabilities detected - critical severity
Aikido detected 4 vulnerabilities across 1 package, it includes 1 critical and 3 high vulnerabilities.

Details

Remediation:

• undici — 4 CVEs (critical) — fixed in 6.24.0

_{Reply @AikidoSec ignore: [REASON] to ignore this issue.
More info}