From d2ab612fcb73c84ae4a39756e217f45c2ccd80bc Mon Sep 17 00:00:00 2001 From: sukupate Date: Wed, 2 Sep 2026 14:36:52 +0530 Subject: [PATCH 1/4] =?UTF-8?q?fix(minimatch):=20bump=20minimatch=203.1.2?= =?UTF-8?q?=E2=86=923.1.4=20(VULN-108242)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Severity: high | CVE-2026-26996 Bump: minimatch 3.1.2 → 3.1.4 Files: ui/package.json, ui/package-lock.json Jira: https://splunk.atlassian.net/browse/VULN-108242 --- ui/package-lock.json | 6 +++--- ui/package.json | 3 ++- 2 files changed, 5 insertions(+), 4 deletions(-) diff --git a/ui/package-lock.json b/ui/package-lock.json index 003689f..f9796cc 100644 --- a/ui/package-lock.json +++ b/ui/package-lock.json @@ -15191,9 +15191,9 @@ "license": "ISC" }, "node_modules/minimatch": { - "version": "3.1.2", - "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.2.tgz", - "integrity": "sha512-J7p63hRiAjw1NDEww1W7i37+ByIrOWO5XQQAzZ3VOcL0PNybwpfmV/N05zFAzwQ9USyEcX6t3UO+K5aqBQOIHw==", + "version": "3.1.4", + "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.4.tgz", + "integrity": "sha512-twmL+S8+7yIsE9wsqgzU3E8/LumN3M3QELrBZ20OdmQ9jB2JvW5oZtBEmft84k/Gs5CG9mqtWc6Y9vW+JEzGxw==", "license": "ISC", "dependencies": { "brace-expansion": "^1.1.7" diff --git a/ui/package.json b/ui/package.json index ccacb98..22f28c4 100644 --- a/ui/package.json +++ b/ui/package.json @@ -67,7 +67,8 @@ "react-dom": "16.14.0", "@types/react": "16.14.62", "@types/react-dom": "16.9.25", - "minimatch@3.1.2": { + "minimatch": "3.1.4", + "minimatch@3.1.4": { "brace-expansion": "1.1.18" }, "dompurify": "3.4.12", From a4ba0c56c6e8141880e64226e8a1e23415b89ae2 Mon Sep 17 00:00:00 2001 From: sukupate Date: Wed, 2 Sep 2026 14:51:43 +0530 Subject: [PATCH 2/4] fix(node-forge): bump node-forge to 1.4.0 (VULN-108978) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Severity: high | CVE-2025-66031 Bump: node-forge 1.3.1 → 1.4.0 Files: ui/package.json, ui/package-lock.json Jira: https://splunk.atlassian.net/browse/VULN-108978 --- ui/package-lock.json | 6 +++--- ui/package.json | 1 + 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/ui/package-lock.json b/ui/package-lock.json index f9796cc..1385e5b 100644 --- a/ui/package-lock.json +++ b/ui/package-lock.json @@ -15386,9 +15386,9 @@ "license": "MIT" }, "node_modules/node-forge": { - "version": "1.3.1", - "resolved": "https://registry.npmjs.org/node-forge/-/node-forge-1.3.1.tgz", - "integrity": "sha512-dPEtOeMvF9VMcYV/1Wb8CPoVAXtp6MKMlcbAt4ddqmGqUJ6fQZFXkNZNkNlfevtNkGtaSoXf/vNNNSvgrdXwtA==", + "version": "1.4.0", + "resolved": "https://registry.npmjs.org/node-forge/-/node-forge-1.4.0.tgz", + "integrity": "sha512-LarFH0+6VfriEhqMMcLX2F7SwSXeWwnEAJEsYm5QKWchiVYVvJyV9v7UDvUv+w5HO23ZpQTXDv/GxdDdMyOuoQ==", "license": "(BSD-3-Clause OR GPL-2.0)", "engines": { "node": ">= 6.13.0" diff --git a/ui/package.json b/ui/package.json index 22f28c4..4115032 100644 --- a/ui/package.json +++ b/ui/package.json @@ -76,6 +76,7 @@ "@xmldom/xmldom": "0.8.14", "@babel/plugin-transform-modules-systemjs": "7.29.4", "@babel/runtime": "7.28.6", + "node-forge": "1.4.0", "lodash": "4.18.1", "@babel/helpers": "7.26.10", "lodash-es": "4.18.1", From 4a09c819e79576c4459f426103eccd7f30080899 Mon Sep 17 00:00:00 2001 From: sukupate Date: Wed, 2 Sep 2026 14:51:58 +0530 Subject: [PATCH 3/4] fix(picomatch): bump picomatch to 2.3.2 (VULN-109255) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Severity: high | CVE-2026-33671 Bump: picomatch 2.3.1 → 2.3.2 Files: ui/package.json, ui/package-lock.json Jira: https://splunk.atlassian.net/browse/VULN-109255 --- ui/package-lock.json | 6 +++--- ui/package.json | 1 + 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/ui/package-lock.json b/ui/package-lock.json index 1385e5b..606d4ce 100644 --- a/ui/package-lock.json +++ b/ui/package-lock.json @@ -15892,9 +15892,9 @@ "license": "ISC" }, "node_modules/picomatch": { - "version": "2.3.1", - "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-2.3.1.tgz", - "integrity": "sha512-JU3teHTNjmE2VCGFzuY8EXzCDVwEqB2a8fsIvwaStHhAWJEeVd1o1QD80CU6+ZdEXXSLbSsuLwJjkCBWqRQUVA==", + "version": "2.3.2", + "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-2.3.2.tgz", + "integrity": "sha512-V7+vQEJ06Z+c5tSye8S+nHUfI51xoXIXjHQ99cQtKUkQqqO1kO/KCJUfZXuB47h/YBlDhah2H3hdUGXn8ie0oA==", "license": "MIT", "engines": { "node": ">=8.6" diff --git a/ui/package.json b/ui/package.json index 4115032..38ac768 100644 --- a/ui/package.json +++ b/ui/package.json @@ -77,6 +77,7 @@ "@babel/plugin-transform-modules-systemjs": "7.29.4", "@babel/runtime": "7.28.6", "node-forge": "1.4.0", + "picomatch": "2.3.2", "lodash": "4.18.1", "@babel/helpers": "7.26.10", "lodash-es": "4.18.1", From 10e67e60044001d1013ff21a42f8f262af31dd94 Mon Sep 17 00:00:00 2001 From: sukupate Date: Wed, 2 Sep 2026 16:21:10 +0530 Subject: [PATCH 4/4] chore(deps): scope minimatch overrides (VULN-108242) --- ui/package-lock.json | 14 +++++++------- ui/package.json | 6 +++++- 2 files changed, 12 insertions(+), 8 deletions(-) diff --git a/ui/package-lock.json b/ui/package-lock.json index 606d4ce..fce7a1c 100644 --- a/ui/package-lock.json +++ b/ui/package-lock.json @@ -7418,9 +7418,9 @@ } }, "node_modules/@typescript-eslint/typescript-estree/node_modules/brace-expansion": { - "version": "2.0.1", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.1.tgz", - "integrity": "sha512-XnAIvQ8eM+kC6aULx6wuQiwVsnzsi9d3WxzV3FpWTGA19F621kwdbsAcFKXgKUHZWsy+mY6iL1sHTxWEFCytDA==", + "version": "2.1.4", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.4.tgz", + "integrity": "sha512-hGfVzPxthbf3+2yjg/RBs60cB0FhqBS/zvdV/4wn4/BmN0bNMMHPc4V/BbFieqf1TKAGGAHnY4eSjajCl0f2Xg==", "dev": true, "license": "MIT", "dependencies": { @@ -7428,13 +7428,13 @@ } }, "node_modules/@typescript-eslint/typescript-estree/node_modules/minimatch": { - "version": "9.0.5", - "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-9.0.5.tgz", - "integrity": "sha512-G6T0ZX48xgozx7587koeX9Ys2NYy6Gmv//P89sEte9V9whIapMNF4idKxnW2QtCcLiTWlb/wfCabAtAFWhhBow==", + "version": "9.0.9", + "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-9.0.9.tgz", + "integrity": "sha512-OBwBN9AL4dqmETlpS2zasx+vTeWclWzkblfZk7KTA5j3jeOONz/tRCnZomUyvNg83wL5Zv9Ss6HMJXAgL8R2Yg==", "dev": true, "license": "ISC", "dependencies": { - "brace-expansion": "^2.0.1" + "brace-expansion": "^2.0.2" }, "engines": { "node": ">=16 || 14 >=14.17" diff --git a/ui/package.json b/ui/package.json index 38ac768..a1f2750 100644 --- a/ui/package.json +++ b/ui/package.json @@ -67,10 +67,14 @@ "react-dom": "16.14.0", "@types/react": "16.14.62", "@types/react-dom": "16.9.25", - "minimatch": "3.1.4", + "minimatch@3.1.2": "3.1.4", "minimatch@3.1.4": { "brace-expansion": "1.1.18" }, + "minimatch@9.0.5": { + ".": "9.0.9", + "brace-expansion": "2.1.4" + }, "dompurify": "3.4.12", "shell-quote": "1.9.0", "@xmldom/xmldom": "0.8.14",