Skip to content

chore(deps): Bump agents from 0.13.0 to 0.20.1 - #70

Merged
github-actions[bot] merged 1 commit into
mainfrom
dependabot/npm_and_yarn/agents-0.20.1
Aug 6, 2026
Merged

chore(deps): Bump agents from 0.13.0 to 0.20.1#70
github-actions[bot] merged 1 commit into
mainfrom
dependabot/npm_and_yarn/agents-0.20.1

chore(deps): Bump agents from 0.13.0 to 0.20.1

31092f1
Select commit
Loading
Failed to load commit list.
Fencer Code / Fencer succeeded Aug 6, 2026 in 1m 0s

Fencer Scan Results

Checks

0 checks failed · 0 failing · 1 passing

  • Audit mode — PASS — 14 vulnerabilities found. Scan is in audit mode and will not fail. Configure thresholds to enable checks.

Hint: You can configure the checks on the repository settings page.

Scan metadata

  • scan: #626368 · branch dependabot/npm_and_yarn/agents-0.20.1 · sha 31092f1b65cc
  • open: 14 — critical=0 high=6 medium=5 low=3 info=0
  • new: 0 — critical=0 high=0 medium=0 low=0 info=0
  • new-secrets: 0
  • resolved: 0
  • ignored: 1

Pre-existing vulnerabilities (14, showing 10)

Present on the base branch before this scan.

VULN-D99 — HIGH

VULN-D9A — HIGH

VULN-E2X — HIGH

VULN-FS0 — HIGH

VULN-FS1 — HIGH

VULN-GBM — HIGH

VULN-9VQ — MEDIUM

VULN-9VR — MEDIUM

VULN-AEH — MEDIUM

  • id: VULN-AEH
  • rule: pnpm missing trustPolicy (no-downgrade recommended)
  • severity: MEDIUM
  • state: pre-existing (present on the base branch)
  • scope: repo
  • location: pnpm-workspace.yaml:1
  • title: Inclusion of Functionality from Untrusted Control Sphere
  • description: Missing or incorrect trustPolicy. Set trustPolicy: no-downgrade to prevent malicious package updates from downgrading security settings. Added in: v10.21.0 Reference: https://pnpm.io/settings#trustpolicy
  • remediation: https://pnpm.io/settings#minimumreleaseage

VULN-AG4 — MEDIUM

  • id: VULN-AG4
  • rule: pnpm workspace missing minimumReleaseAge allowing immediate installs of new packages
  • severity: MEDIUM
  • state: pre-existing (present on the base branch)
  • scope: repo
  • location: pnpm-workspace.yaml:21
  • title: Inclusion of Functionality from Untrusted Control Sphere
  • description: This pnpm workspace configuration does not set a minimum release age. Newly published packages can be malicious or unstable. Add minimumReleaseAge: 10080 (minutes) to wait at least seven days before installing newly published package versions. Added in: v10.16.0 Reference: https://pnpm.io/settings#minimumreleaseage
  • remediation: https://pnpm.io/settings#minimumreleaseage

Showing the first 10 of 14 pre-existing vulnerabilities — see the scan for the rest.

Annotations

Check notice on line 0 in pnpm-lock.yaml

See this annotation in the file changed.

@fencer-code fencer-code / Fencer

Vulnerability: #VULN-D9B 

Found 1 vulnerability in package body-parser version 2.2.2. Upgrade to version 2.3.0 to fix these issues.


This check detects when body-parser accepts an invalid limit configuration value that causes the library to skip request body size enforcement. If an unparseable or non-finite limit disables the size check, applications relying on that option can receive arbitrarily large request bodies. Excessive request payloads can exhaust memory or CPU and lead to denial-of-service of the hosting process. The affected resource is the Node.js body-parser middleware used to parse incoming HTTP request bodies.

Check failure on line 0 in pnpm-lock.yaml

See this annotation in the file changed.

@fencer-code fencer-code / Fencer

Vulnerability: #VULN-FS1 

Found 3 vulnerabilities in package ip-address version 10.2.0. Upgrade to version 10.3.1 to fix these issues.


This check detects incorrect parsing of IPv4 octets with leading zeros by the ip-address library: leading-zero octets are decoded as decimal rather than octal. Because system resolvers and WHATWG parsers decode leading-zero octets as octal, the library and the network stack can produce different resolved hosts for the same input string. This discrepancy can allow SSRF and trust-boundary bypasses when the library's classification is used to approve network requests.

Check failure on line 0 in pnpm-lock.yaml

See this annotation in the file changed.

@fencer-code fencer-code / Fencer

Vulnerability: #VULN-FS0 

Found 1 vulnerability in package fast-uri version 3.1.4. Upgrade to version 3.1.5 to fix these issues.


This check identifies a discrepancy between fast-uri and the WHATWG URL parser in how backslashes are treated as authority introducers. fast-uri requires a literal '//' to recognize an authority, so inputs using backslash variants fold the authority into the path; the WHATWG parser treats backslashes as equivalent to forward slashes for special schemes and extracts a host. The mismatch can lead to host confusion that defeats host-based allowlists, SSRF filters, or redirect validation when different parsers are used in validation and request handling.

Check warning on line 0 in pnpm-lock.yaml

See this annotation in the file changed.

@fencer-code fencer-code / Fencer

Vulnerability: #VULN-FS2 

Found 1 vulnerability in package hono version 4.12.33. Upgrade to version 4.12.34 to fix these issues.


This check detects a regular-expression or parsing weakness in Hono's CORS middleware where specially crafted Access-Control-Request-Headers values can trigger catastrophic backtracking or exponential processing time (ReDoS). An attacker can supply header values that cause excessive CPU consumption when the middleware parses or validates them, potentially leading to denial-of-service for affected servers. The issue affects versions of Hono that include the vulnerable CORS code path.

Check failure on line 0 in pnpm-lock.yaml

See this annotation in the file changed.

@fencer-code fencer-code / Fencer

Vulnerability: #VULN-D9A 

Found 3 vulnerabilities in package brace-expansion version 1.1.14. Upgrade to version 1.1.18 to fix these issues.


This check detects cases where the brace-expansion algorithm can allocate unbounded intermediate arrays that grow exponentially with crafted input, resulting in high CPU and memory usage. An attacker-supplied pattern can therefore cause denial-of-service by exhausting resources during expansion. The vulnerability affects applications and build tooling that use the brace-expansion library to expand patterns without input size limits or safeguards.

Check notice on line 0 in pnpm-lock.yaml

See this annotation in the file changed.

@fencer-code fencer-code / Fencer

Vulnerability: #VULN-BXD 

Found 1 vulnerability in package @babel/core version 7.29.0. Upgrade to version 7.29.6 to fix these issues.


This check detects a version of @babel/core that allows arbitrary file reads via sourceMappingURL comments. When a build or transformation tool fetches source maps from untrusted inputs, attackers can cause the tool to read arbitrary files on the host, leaking sensitive data. The affected technology is JavaScript build/transformation toolchains that process sourceMappingURL entries with @babel/core.

Check failure on line 0 in pnpm-lock.yaml

See this annotation in the file changed.

@fencer-code fencer-code / Fencer

Vulnerability: #VULN-GBM 

Found 5 vulnerabilities in package undici version 7.28.0. Upgrade to version 7.29.0 to fix these issues.


This check detects improper handling of malformed Cache-Control private directives by the undici cache interceptor. Degenerate qualified private directives (for example, empty values) can cause private responses and headers to be stored in a shared cache and later served to other callers, disclosing sensitive data. In addition, certain combinations of qualified and unqualified private directives can trigger an uncaught parser TypeError that rejects requests and may terminate the process depending on consumer error handling. The issue affects applications that use undici's cache interceptor in shared mode (including default configurations).
View more details on Fencer Code