Merge "ballerina-5.12.5" into "stable/ballerina"

.trivyignore

@@ -33,7 +33,7 @@ CVE-2026-31808
 # upstream has not backported it, so no release on the 1.x or 2.x line is out
 # of range. 5.x is not a drop-in replacement for those lines either — it
 # dropped the CommonJS default export that minimatch 3.x/5.x call — so forcing
-# them to 5.0.8 would break them at runtime. The 5.x line IS bumped to 5.0.8
+# them to 5.0.8 would break them at runtime. The 5.x line IS bumped past 5.0.8
 # via globalOverrides; this entry only covers the 1.x/2.x transitives reached
 # through minimatch 3.1.5 and 5.1.8. Remove it once upstream backports the fix,
 # or once nothing depends on minimatch below v9.

common/autoinstallers/rush-plugins/package.json

@@ -7,8 +7,8 @@
       "fast-xml-parser": "5.7.0",
       "fast-xml-builder": "1.1.7",
       "minimatch": "3.1.5",
-      "brace-expansion": "1.1.16",
-      "undici": "6.27.0"
+      "brace-expansion": "1.1.18",
+      "undici": "6.28.0"
     }
   },
   "dependencies": {

common/config/rush/.pnpmfile.cjs

@@ -34,26 +34,26 @@ module.exports = {
         if (deps['xmldom']) deps['xmldom'] = 'npm:@xmldom/xmldom@0.8.10';
         if (deps['braces']) deps['braces'] = '3.0.3';
         if (deps['micromatch']) deps['micromatch'] = '4.0.8';
-        if (deps['js-yaml']) deps['js-yaml'] = '4.3.0';
+        if (deps['js-yaml']) deps['js-yaml'] = '4.3.1';
         if (deps['diff']) deps['diff'] = '8.0.3';
         if (deps['eslint']) deps['eslint'] = '^9.27.0';
         if (deps['fast-xml-parser']) deps['fast-xml-parser'] = '5.7.0';
         if (deps['fast-xml-builder']) deps['fast-xml-builder'] = '1.1.7';
-        if (deps['fast-uri']) deps['fast-uri'] = '3.1.4';
+        if (deps['fast-uri']) deps['fast-uri'] = '3.1.5';
         if (deps['esbuild']) deps['esbuild'] = '0.25.12';
         if (deps['lodash']) deps['lodash'] = '4.18.0';
         if (deps['qs']) deps['qs'] = '6.15.2';
-        if (deps['hono']) deps['hono'] = '4.12.27';
+        if (deps['hono']) deps['hono'] = '4.12.34';
         if (deps['shell-quote']) deps['shell-quote'] = '1.9.0';
         if (deps['@hono/node-server']) deps['@hono/node-server'] = '2.0.10';
         if (deps['@tootallnate/once']) deps['@tootallnate/once'] = '3.0.1';
-        if (deps['dompurify']) deps['dompurify'] = '3.4.12';
+        if (deps['dompurify']) deps['dompurify'] = '3.4.13';
         if (deps['axios']) deps['axios'] = '1.18.0';
-        if (deps['ip-address']) deps['ip-address'] = '10.1.1';
+        if (deps['ip-address']) deps['ip-address'] = '10.3.1';
         if (deps['follow-redirects']) deps['follow-redirects'] = '1.16.0';
         if (deps['express-rate-limit']) deps['express-rate-limit'] = '8.2.2';
         if (deps['file-type']) deps['file-type'] = '21.3.2';
-        if (deps['postcss']) deps['postcss'] = '8.5.18';
+        if (deps['postcss']) deps['postcss'] = '8.5.23';
         if (deps['linkify-it'] && (deps['linkify-it'].startsWith('^5') || deps['linkify-it'].startsWith('5'))) {
           deps['linkify-it'] = '5.0.2';
         }
@@ -131,13 +131,13 @@ module.exports = {
           const currentVersion = deps['brace-expansion'];
           let newVersion;
           if (currentVersion.startsWith('^1') || currentVersion.startsWith('1')) {
-            newVersion = '1.1.16';
+            newVersion = '1.1.18';
           } else if (currentVersion.startsWith('^2') || currentVersion.startsWith('2')) {
-            newVersion = '2.1.2';
+            newVersion = '2.1.4';
           } else if (currentVersion.startsWith('^3') || currentVersion.startsWith('3')) {
             newVersion = '3.0.6';
           } else if (currentVersion.startsWith('^5') || currentVersion.startsWith('5')) {
-            newVersion = '5.0.8';
+            newVersion = '5.0.9';
           } else {
             context.log(`Unexpected brace-expansion version: ${currentVersion}`);
             newVersion = currentVersion;

common/config/rush/pnpm-config.json

@@ -100,15 +100,15 @@
       // while newer advisories accumulate against it. Exact pins move the
       // lockfile the moment this file changes.
       "lodash": ">=4.18.0",
-      // brace-expansion CVE-2026-13149 is fixed per line (1.1.16 / 2.1.2 /
-      // 5.0.7); CVE-2026-14257 covers everything <= 5.0.7 and is only fixed in
-      // 5.0.8, which upstream has not backported to 1.x/2.x. 5.0.8 is not a
-      // drop-in replacement for those lines (it dropped the CommonJS default
-      // export that minimatch 3.x/5.x call), so they stay on the 13149 fix
-      // version and the residual 14257 finding is scoped out in .trivyignore.
-      "brace-expansion@>=1 <2": "1.1.16",
-      "brace-expansion@>=2 <3": "2.1.2",
-      "brace-expansion@>=5.0.0 <6": "5.0.8",
+      // brace-expansion CVE-2026-69152 is fixed per line (1.1.18 / 2.1.4 /
+      // 3.0.6 / 5.0.9). CVE-2026-14257's fix remains 5.0.8-only (not
+      // backported to 1.x/2.x, and 5.x is not a drop-in replacement for those
+      // lines — it dropped the CommonJS default export that minimatch 3.x/5.x
+      // call), so the residual 14257 finding on 1.x/2.x is scoped out in
+      // .trivyignore.
+      "brace-expansion@>=1 <2": "1.1.18",
+      "brace-expansion@>=2 <3": "2.1.4",
+      "brace-expansion@>=5.0.0 <6": "5.0.9",
       "@babel/core": ">=7.29.6",
       // Security fix: no 1.x fix; force the 2.x line, at the version fixing a
       // follow-up advisory on the earlier 2.x releases. Transitive-only, pulled
@@ -119,13 +119,17 @@
       // Both lines are affected by CVE-2026-12590 and each has its own fix.
       "body-parser@>=1 <2": "1.20.6",
       "body-parser@>=2 <3": "2.3.0",
-      "dompurify": "3.4.12",
-      // Security fix: 3.1.4 is the first 3.x release fixing both reported
-      // findings.
-      "fast-uri": "3.1.4",
+      "dompurify": "3.4.13",
+      // Security fix: 3.1.5 fixes CVE-2026-18446 (host confusion via
+      // backslash in URI authority) on top of the two earlier findings fixed
+      // in 3.1.4.
+      "fast-uri": "3.1.5",
       "form-data": ">=4.0.6",
-      "hono": "4.12.27",
+      "hono": "4.12.34",
       "http-proxy-middleware": ">=3.0.6",
+      // Security fix: 10.3.1 fixes CVE-2026-69192 plus the two SSRF advisories
+      // fixed in 10.2.1/10.2.2.
+      "ip-address": "10.3.1",
       // The 3.x line has no fix for CVE-2026-59879/59880 and stays pinned in
       // .pnpmfile.cjs for swagger-ui-react (see .trivyignore). sass declares
       // `immutable: ^5.0.2`, so hold the 5.x line at the first patched release
@@ -134,18 +138,25 @@
       // js-yaml v3 has no in-line fix; the fix only lands in v4.3.0+. Force
       // all consumers to v4 — revert with a narrower selector if a workspace
       // package needs the v3 sync API.
-      "js-yaml": "4.3.0",
+      "js-yaml": "4.3.1",
       // Security fix: scoped to the 5.x line (the only one in the tree, via
       // markdown-it 14) so a v6 consumer is not forced backwards.
       "linkify-it@5": "5.0.2",
       "markdown-it": ">=14.2.0",
-      // Security fix: path traversal via source map auto-loading (8.5.18) on
-      // top of the earlier information-disclosure fix (8.5.12).
-      "postcss@8": "8.5.18",
+      // Security fix: CVE-2026-67213/67214 (infinite loops in ID generation)
+      // are fixed per line — scoped so neither line is forced across a major.
+      "nanoid@>=3 <4": "3.3.18",
+      "nanoid@>=5 <6": "5.1.16",
+      // Security fix: information disclosure via crafted sourceMappingURL
+      // (8.5.23) on top of the earlier fixes in 8.5.12/8.5.18.
+      "postcss@8": "8.5.23",
       "protobufjs@>=7 <8": "7.6.5",
       "shell-quote": "1.9.0",
       "tmp": ">=0.2.7",
-      "undici": ">=7.28.0",
+      // Security fix: 8.9.0 is the first 8.x release fixing the Cache-Control
+      // parsing (CVE-2026-13697/14643), header-injection, retry-desync and
+      // cookie-attribute advisories. Exact pin per the note above.
+      "undici": "8.9.0",
       // Security fix: scoped to the 5.x line so a future 6.x consumer is not
       // forced backwards.
       "webpack-dev-server@>=5 <6": "5.2.6"