You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Fix CVE-2026-26278 by upgrading fast-xml-parser to v5.5.6
🐞 Bug fix
Walkthroughs
Description
• Upgrades fast-xml-parser dependency to version 5.5.6
• Addresses security vulnerability CVE-2026-26278 reported by Dependabot
• Ensures the application uses a patched version with the security fix
Diagram
flowchart LR
A["fast-xml-parser<br/>previous version"] -- "security patch" --> B["fast-xml-parser<br/>v5.5.6"]
B -- "fixes" --> C["CVE-2026-26278"]
The GitHub Action failed during the yarn tsc:full TypeScript compilation step with exit code 2.
TypeScript reported TS7016 errors because it could not find type declarations for the uuid module: - plugins/scorecard-backend/src/scheduler/tasks/CleanupExpiredMetricsTask.ts:23 (import { v4 as uuid } from 'uuid';) - plugins/scorecard-backend/src/scheduler/tasks/PullMetricsByProviderTask.ts:31 (import { v4 as uuid } from 'uuid';) This indicates the project is missing @types/uuid (or an equivalent module declaration file), so uuid is treated as any and compilation fails.
Relevant error logs:
1: ##[group]Runner Image Provisioner2: Hosted Compute Agent
...
266: �[93m➤�[39m YN0002: │ �[38;5;173mapp�[39m�[38;5;111m@�[39m�[38;5;111mworkspace:packages/app�[39m doesn't provide �[38;5;166m@types/�[39m�[38;5;173mreact�[39m (�[38;5;111mpceee16�[39m), requested by �[38;5;166m@backstage-community/�[39m�[38;5;173mplugin-rbac�[39m and other dependencies.267: �[93m➤�[39m YN0002: │ �[38;5;173mapp�[39m�[38;5;111m@�[39m�[38;5;111mworkspace:packages/app�[39m doesn't provide �[38;5;173mplaywright-core�[39m (�[38;5;111mp7d9526�[39m), requested by �[38;5;166m@axe-core/�[39m�[38;5;173mplaywright�[39m.268: �[93m➤�[39m YN0002: │ �[38;5;173mapp�[39m�[38;5;111m@�[39m�[38;5;111mworkspace:packages/app�[39m doesn't provide �[38;5;173mwebpack�[39m (�[38;5;111mp299d9a�[39m), requested by �[38;5;166m@backstage/�[39m�[38;5;173mcli�[39m.269: �[93m➤�[39m YN0002: │ �[38;5;173mbackend�[39m�[38;5;111m@�[39m�[38;5;111mworkspace:packages/backend�[39m doesn't provide �[38;5;173mwebpack�[39m (�[38;5;111mp00f29e�[39m), requested by �[38;5;166m@backstage/�[39m�[38;5;173mcli�[39m.270: �[93m➤�[39m YN0086: │ Some peer dependencies are incorrectly met by your project; run �[38;5;111myarn explain peer-requirements <hash>�[39m for details, where �[38;5;111m<hash>�[39m is the six-letter p-prefixed code.271: �[93m➤�[39m YN0086: │ Some peer dependencies are incorrectly met by dependencies; run �[38;5;111myarn explain peer-requirements�[39m for details.272: ##[endgroup]273: �[94m➤�[39m �[90mYN0000�[39m: └ Completed274: �[94m➤�[39m �[90mYN0000�[39m: ┌ Fetch step275: ##[group]Fetch step276: �[94m➤�[39m YN0013: │ �[38;5;220m3118�[39m packages were added to the project (�[38;5;160m+ 1.18 GiB�[39m).277: ##[endgroup]278: �[94m➤�[39m �[90mYN0000�[39m: └ Completed in 16s 554ms279: �[94m➤�[39m �[90mYN0000�[39m: ┌ Link step280: ##[group]Link step281: �[94m➤�[39m YN0007: │ �[38;5;166m@swc/�[39m�[38;5;173mcore�[39m�[38;5;111m@�[39m�[38;5;111mnpm:1.11.1 [7f486]�[39m must be built because it never has been before or the last one failed282: �[94m➤�[39m YN0007: │ �[38;5;173mesbuild�[39m�[38;5;111m@�[39m�[38;5;111mnpm:0.25.0�[39m must be built because it never has been before or the last one failed283: �[94m➤�[39m YN0007: │ �[38;5;173mcore-js�[39m�[38;5;111m@�[39m�[38;5;111mnpm:3.40.0�[39m must be built because it never has been before or the last one failed284: �[94m➤�[39m YN0007: │ �[38;5;173mbetter-sqlite3�[39m�[38;5;111m@�[39m�[38;5;111mnpm:12.2.0�[39m must be built because it never has been before or the last one failed285: �[94m➤�[39m YN0007: │ �[38;5;173mmsw�[39m�[38;5;111m@�[39m�[38;5;111mnpm:1.3.5 [518a2]�[39m must be built because it never has been before or the last one failed286: �[94m➤�[39m YN0007: │ �[38;5;166m@nestjs/�[39m�[38;5;173mcore�[39m�[38;5;111m@�[39m�[38;5;111mnpm:10.4.15 [2d948]�[39m must be built because it never has been before or the last one failed287: �[94m➤�[39m YN0007: │ �[38;5;173misolated-vm�[39m�[38;5;111m@�[39m�[38;5;111mnpm:5.0.4�[39m must be built because it never has been before or the last one failed288: �[94m➤�[39m YN0007: │ �[38;5;166m@scarf/�[39m�[38;5;173mscarf�[39m�[38;5;111m@�[39m�[38;5;111mnpm:1.4.0�[39m must be built because it never has been before or the last one failed289: �[94m➤�[39m YN0007: │ �[38;5;173mprotobufjs�[39m�[38;5;111m@�[39m�[38;5;111mnpm:7.5.4�[39m must be built because it never has been before or the last one failed290: �[94m➤�[39m YN0007: │ �[38;5;173mcore-js-pure�[39m�[38;5;111m@�[39m�[38;5;111mnpm:3.46.0�[39m must be built because it never has been before or the last one failed291: �[94m➤�[39m YN0007: │ �[38;5;173mcpu-features�[39m�[38;5;111m@�[39m�[38;5;111mnpm:0.0.10�[39m must be built because it never has been before or the last one failed292: �[94m➤�[39m YN0007: │ �[38;5;173mtree-sitter�[39m�[38;5;111m@�[39m�[38;5;111mnpm:0.22.4�[39m must be built because it never has been before or the last one failed293: �[94m➤�[39m YN0007: │ �[38;5;173mtree-sitter�[39m�[38;5;111m@�[39m�[38;5;111mnpm:0.21.1�[39m must be built because it never has been before or the last one failed294: �[94m➤�[39m YN0007: │ �[38;5;173mcore-js�[39m�[38;5;111m@�[39m�[38;5;111mnpm:2.6.12�[39m must be built because it never has been before or the last one failed295: �[94m➤�[39m �[90mYN0000�[39m: │ �[38;5;166m@nestjs/�[39m�[38;5;173mcore�[39m�[38;5;111m@�[39m�[38;5;111mnpm:10.4.15 [2d948]�[39m �[31mSTDERR�[39m (node:2629) [DEP0040] DeprecationWarning: The `punycode` module is deprecated. Please use a userland alternative instead.
...
350: �[94m➤�[39m �[90mYN0000�[39m: │ �[38;5;173mcpu-features�[39m�[38;5;111m@�[39m�[38;5;111mnpm:0.0.10�[39m �[32mSTDOUT�[39m CXX(target) Release/obj.target/cpufeatures/src/binding.o351: �[94m➤�[39m �[90mYN0000�[39m: │ �[38;5;173mcpu-features�[39m�[38;5;111m@�[39m�[38;5;111mnpm:0.0.10�[39m �[31mSTDERR�[39m In file included from ../src/binding.cc:1:352: �[94m➤�[39m �[90mYN0000�[39m: │ �[38;5;173mcpu-features�[39m�[38;5;111m@�[39m�[38;5;111mnpm:0.0.10�[39m �[31mSTDERR�[39m /home/runner/.cache/node-gyp/22.22.1/include/node/node.h:1243:7: warning: cast between incompatible function types from ‘void (*)(Nan::ADDON_REGISTER_FUNCTION_ARGS_TYPE)’ {aka ‘void (*)(v8::Local<v8::Object>)’} to ‘node::addon_register_func’ {aka ‘void (*)(v8::Local<v8::Object>, v8::Local<v8::Value>, void*)’} [-Wcast-function-type]353: �[94m➤�[39m �[90mYN0000�[39m: │ �[38;5;173mcpu-features�[39m�[38;5;111m@�[39m�[38;5;111mnpm:0.0.10�[39m �[31mSTDERR�[39m 1243 | (node::addon_register_func) (regfunc), \354: �[94m➤�[39m �[90mYN0000�[39m: │ �[38;5;173mcpu-features�[39m�[38;5;111m@�[39m�[38;5;111mnpm:0.0.10�[39m �[31mSTDERR�[39m | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~355: �[94m➤�[39m �[90mYN0000�[39m: │ �[38;5;173mcpu-features�[39m�[38;5;111m@�[39m�[38;5;111mnpm:0.0.10�[39m �[31mSTDERR�[39m /home/runner/.cache/node-gyp/22.22.1/include/node/node.h:1277:3: note: in expansion of macro ‘NODE_MODULE_X’356: �[94m➤�[39m �[90mYN0000�[39m: │ �[38;5;173mcpu-features�[39m�[38;5;111m@�[39m�[38;5;111mnpm:0.0.10�[39m �[31mSTDERR�[39m 1277 | NODE_MODULE_X(modname, regfunc, NULL, 0) // NOLINT (readability/null_usage)357: �[94m➤�[39m �[90mYN0000�[39m: │ �[38;5;173mcpu-features�[39m�[38;5;111m@�[39m�[38;5;111mnpm:0.0.10�[39m �[31mSTDERR�[39m | ^~~~~~~~~~~~~358: �[94m➤�[39m �[90mYN0000�[39m: │ �[38;5;173mcpu-features�[39m�[38;5;111m@�[39m�[38;5;111mnpm:0.0.10�[39m �[31mSTDERR�[39m ../src/binding.cc:151:1: note: in expansion of macro ‘NODE_MODULE’359: �[94m➤�[39m �[90mYN0000�[39m: │ �[38;5;173mcpu-features�[39m�[38;5;111m@�[39m�[38;5;111mnpm:0.0.10�[39m �[31mSTDERR�[39m 151 | NODE_MODULE(cpufeatures, init)360: �[94m➤�[39m �[90mYN0000�[39m: │ �[38;5;173mcpu-features�[39m�[38;5;111m@�[39m�[38;5;111mnpm:0.0.10�[39m �[31mSTDERR�[39m | ^~~~~~~~~~~361: �[94m➤�[39m �[90mYN0000�[39m: │ �[38;5;173mcpu-features�[39m�[38;5;111m@�[39m�[38;5;111mnpm:0.0.10�[39m �[32mSTDOUT�[39m SOLINK_MODULE(target) Release/obj.target/cpufeatures.node362: �[94m➤�[39m �[90mYN0000�[39m: │ �[38;5;173mcpu-features�[39m�[38;5;111m@�[39m�[38;5;111mnpm:0.0.10�[39m �[32mSTDOUT�[39m COPY Release/cpufeatures.node363: �[94m➤�[39m �[90mYN0000�[39m: │ �[38;5;173mcpu-features�[39m�[38;5;111m@�[39m�[38;5;111mnpm:0.0.10�[39m �[32mSTDOUT�[39m make: Leaving directory '/home/runner/work/rhdh-plugins/rhdh-plugins/workspaces/scorecard/node_modules/cpu-features/build'364: �[94m➤�[39m �[90mYN0000�[39m: │ �[38;5;173mcpu-features�[39m�[38;5;111m@�[39m�[38;5;111mnpm:0.0.10�[39m �[31mSTDERR�[39m gyp info ok 365: �[94m➤�[39m YN0007: │ �[38;5;166m@openapitools/�[39m�[38;5;173mopenapi-generator-cli�[39m�[38;5;111m@�[39m�[38;5;111mnpm:2.16.3�[39m must be built because it never has been before or the last one failed366: �[94m➤�[39m YN0007: │ �[38;5;173mssh2�[39m�[38;5;111m@�[39m�[38;5;111mnpm:1.16.0�[39m must be built because it never has been before or the last one failed367: �[94m➤�[39m YN0007: │ �[38;5;166m@tree-sitter-grammars/�[39m�[38;5;173mtree-sitter-yaml�[39m�[38;5;111m@�[39m�[38;5;111mnpm:0.7.1 [1938f]�[39m must be built because it never has been before or the last one failed368: �[94m➤�[39m YN0007: │ �[38;5;173mtree-sitter-json�[39m�[38;5;111m@�[39m�[38;5;111mnpm:0.24.8 [1a14f]�[39m must be built because it never has been before or the last one failed369: �[94m➤�[39m �[90mYN0000�[39m: │ �[38;5;166m@openapitools/�[39m�[38;5;173mopenapi-generator-cli�[39m�[38;5;111m@�[39m�[38;5;111mnpm:2.16.3�[39m �[31mSTDERR�[39m (node:3097) [DEP0040] DeprecationWarning: The `punycode` module is deprecated. Please use a userland alternative instead.
...
396: �[94m➤�[39m �[90mYN0000�[39m: │ �[38;5;173mssh2�[39m�[38;5;111m@�[39m�[38;5;111mnpm:1.16.0�[39m �[31mSTDERR�[39m gyp info spawn args '--depth=.',397: �[94m➤�[39m �[90mYN0000�[39m: │ �[38;5;173mssh2�[39m�[38;5;111m@�[39m�[38;5;111mnpm:1.16.0�[39m �[31mSTDERR�[39m gyp info spawn args '--no-parallel',398: �[94m➤�[39m �[90mYN0000�[39m: │ �[38;5;173mssh2�[39m�[38;5;111m@�[39m�[38;5;111mnpm:1.16.0�[39m �[31mSTDERR�[39m gyp info spawn args '--generator-output',399: �[94m➤�[39m �[90mYN0000�[39m: │ �[38;5;173mssh2�[39m�[38;5;111m@�[39m�[38;5;111mnpm:1.16.0�[39m �[31mSTDERR�[39m gyp info spawn args 'build',400: �[94m➤�[39m �[90mYN0000�[39m: │ �[38;5;173mssh2�[39m�[38;5;111m@�[39m�[38;5;111mnpm:1.16.0�[39m �[31mSTDERR�[39m gyp info spawn args '-Goutput_dir=.'401: �[94m➤�[39m �[90mYN0000�[39m: │ �[38;5;173mssh2�[39m�[38;5;111m@�[39m�[38;5;111mnpm:1.16.0�[39m �[31mSTDERR�[39m gyp info spawn args ]402: �[94m➤�[39m �[90mYN0000�[39m: │ �[38;5;173mssh2�[39m�[38;5;111m@�[39m�[38;5;111mnpm:1.16.0�[39m �[31mSTDERR�[39m gyp info spawn make403: �[94m➤�[39m �[90mYN0000�[39m: │ �[38;5;173mssh2�[39m�[38;5;111m@�[39m�[38;5;111mnpm:1.16.0�[39m �[31mSTDERR�[39m gyp info spawn args [ 'BUILDTYPE=Release', '-C', 'build' ]404: �[94m➤�[39m �[90mYN0000�[39m: │ �[38;5;173mssh2�[39m�[38;5;111m@�[39m�[38;5;111mnpm:1.16.0�[39m �[32mSTDOUT�[39m make: Entering directory '/home/runner/work/rhdh-plugins/rhdh-plugins/workspaces/scorecard/node_modules/ssh2/lib/protocol/crypto/build'405: �[94m➤�[39m �[90mYN0000�[39m: │ �[38;5;173mssh2�[39m�[38;5;111m@�[39m�[38;5;111mnpm:1.16.0�[39m �[32mSTDOUT�[39m CXX(target) Release/obj.target/sshcrypto/src/binding.o406: �[94m➤�[39m �[90mYN0000�[39m: │ �[38;5;173mssh2�[39m�[38;5;111m@�[39m�[38;5;111mnpm:1.16.0�[39m �[32mSTDOUT�[39m SOLINK_MODULE(target) Release/obj.target/sshcrypto.node407: �[94m➤�[39m �[90mYN0000�[39m: │ �[38;5;173mssh2�[39m�[38;5;111m@�[39m�[38;5;111mnpm:1.16.0�[39m �[32mSTDOUT�[39m COPY Release/sshcrypto.node408: �[94m➤�[39m �[90mYN0000�[39m: │ �[38;5;173mssh2�[39m�[38;5;111m@�[39m�[38;5;111mnpm:1.16.0�[39m �[32mSTDOUT�[39m make: Leaving directory '/home/runner/work/rhdh-plugins/rhdh-plugins/workspaces/scorecard/node_modules/ssh2/lib/protocol/crypto/build'409: �[94m➤�[39m �[90mYN0000�[39m: │ �[38;5;173mssh2�[39m�[38;5;111m@�[39m�[38;5;111mnpm:1.16.0�[39m �[31mSTDERR�[39m gyp info ok 410: �[94m➤�[39m �[90mYN0000�[39m: │ �[38;5;173mssh2�[39m�[38;5;111m@�[39m�[38;5;111mnpm:1.16.0�[39m �[32mSTDOUT�[39m Succeeded in building optional crypto binding411: �[94m➤�[39m YN0007: │ �[38;5;166m@internal/�[39m�[38;5;173mscorecard�[39m�[38;5;111m@�[39m�[38;5;111mworkspace:.�[39m must be built because it never has been before or the last one failed412: �[94m➤�[39m �[90mYN0000�[39m: │ �[38;5;166m@internal/�[39m�[38;5;173mscorecard�[39m�[38;5;111m@�[39m�[38;5;111mworkspace:.�[39m �[32mSTDOUT�[39m �[93m➤�[39m YN0000: Yarn detected that the current workflow is executed from a public pull request. For safety the hardened mode has been enabled.
...
420: �[94m➤�[39m �[90mYN0000�[39m: │ �[38;5;166m@internal/�[39m�[38;5;173mscorecard�[39m�[38;5;111m@�[39m�[38;5;111mworkspace:.�[39m �[32mSTDOUT�[39m �[94m➤�[39m �[90mYN0000�[39m: ┌ Post-resolution validation421: �[94m➤�[39m �[90mYN0000�[39m: │ �[38;5;166m@internal/�[39m�[38;5;173mscorecard�[39m�[38;5;111m@�[39m�[38;5;111mworkspace:.�[39m �[32mSTDOUT�[39m ::group::Post-resolution validation422: �[94m➤�[39m �[90mYN0000�[39m: │ �[38;5;166m@internal/�[39m�[38;5;173mscorecard�[39m�[38;5;111m@�[39m�[38;5;111mworkspace:.�[39m �[32mSTDOUT�[39m �[93m➤�[39m YN0060: │ �[38;5;173mprettier�[39m is listed by your project with version �[38;5;111m3.7.4�[39m (�[38;5;111mpc2ecd8�[39m), which doesn't satisfy what �[38;5;166m@spotify/�[39m�[38;5;173mprettier-config�[39m and other dependencies request (�[38;5;37m^2.0.0�[39m).423: �[94m➤�[39m �[90mYN0000�[39m: │ �[38;5;166m@internal/�[39m�[38;5;173mscorecard�[39m�[38;5;111m@�[39m�[38;5;111mworkspace:.�[39m �[32mSTDOUT�[39m �[93m➤�[39m YN0002: │ �[38;5;166m@redhat-developer/�[39m�[38;5;173mrhdh-plugins�[39m�[38;5;111m@�[39m�[38;5;111mworkspace:.�[39m doesn't provide �[38;5;166m@typescript-eslint/�[39m�[38;5;173mparser�[39m (�[38;5;111mp8d7c5c�[39m), requested by �[38;5;166m@spotify/�[39m�[38;5;173meslint-plugin�[39m.424: �[94m➤�[39m �[90mYN0000�[39m: │ �[38;5;166m@internal/�[39m�[38;5;173mscorecard�[39m�[38;5;111m@�[39m�[38;5;111mworkspace:.�[39m �[32mSTDOUT�[39m �[93m➤�[39m YN0086: │ Some peer dependencies are incorrectly met by your project; run �[38;5;111myarn explain peer-requirements <hash>�[39m for details, where �[38;5;111m<hash>�[39m is the six-letter p-prefixed code.425: �[94m➤�[39m �[90mYN0000�[39m: │ �[38;5;166m@internal/�[39m�[38;5;173mscorecard�[39m�[38;5;111m@�[39m�[38;5;111mworkspace:.�[39m �[32mSTDOUT�[39m �[93m➤�[39m YN0086: │ Some peer dependencies are incorrectly met by dependencies; run �[38;5;111myarn explain peer-requirements�[39m for details.426: �[94m➤�[39m �[90mYN0000�[39m: │ �[38;5;166m@internal/�[39m�[38;5;173mscorecard�[39m�[38;5;111m@�[39m�[38;5;111mworkspace:.�[39m �[32mSTDOUT�[39m ::endgroup::427: �[94m➤�[39m �[90mYN0000�[39m: │ �[38;5;166m@internal/�[39m�[38;5;173mscorecard�[39m�[38;5;111m@�[39m�[38;5;111mworkspace:.�[39m �[32mSTDOUT�[39m �[94m➤�[39m �[90mYN0000�[39m: └ Completed428: �[94m➤�[39m �[90mYN0000�[39m: │ �[38;5;166m@internal/�[39m�[38;5;173mscorecard�[39m�[38;5;111m@�[39m�[38;5;111mworkspace:.�[39m �[32mSTDOUT�[39m �[94m➤�[39m �[90mYN0000�[39m: ┌ Fetch step429: �[94m➤�[39m �[90mYN0000�[39m: │ �[38;5;166m@internal/�[39m�[38;5;173mscorecard�[39m�[38;5;111m@�[39m�[38;5;111mworkspace:.�[39m �[32mSTDOUT�[39m ::group::Fetch step430: �[94m➤�[39m �[90mYN0000�[39m: │ �[38;5;166m@internal/�[39m�[38;5;173mscorecard�[39m�[38;5;111m@�[39m�[38;5;111mworkspace:.�[39m �[32mSTDOUT�[39m �[94m➤�[39m YN0013: │ �[38;5;220m567�[39m packages were added to the project (�[38;5;160m+ 217.15 MiB�[39m).431: �[94m➤�[39m �[90mYN0000�[39m: │ �[38;5;166m@internal/�[39m�[38;5;173mscorecard�[39m�[38;5;111m@�[39m�[38;5;111mworkspace:.�[39m �[32mSTDOUT�[39m ::endgroup::432: �[94m➤�[39m �[90mYN0000�[39m: │ �[38;5;166m@internal/�[39m�[38;5;173mscorecard�[39m�[38;5;111m@�[39m�[38;5;111mworkspace:.�[39m �[32mSTDOUT�[39m �[94m➤�[39m �[90mYN0000�[39m: └ Completed in 3s 904ms433: �[94m➤�[39m �[90mYN0000�[39m: │ �[38;5;166m@internal/�[39m�[38;5;173mscorecard�[39m�[38;5;111m@�[39m�[38;5;111mworkspace:.�[39m �[32mSTDOUT�[39m �[94m➤�[39m �[90mYN0000�[39m: ┌ Link step434: �[94m➤�[39m �[90mYN0000�[39m: │ �[38;5;166m@internal/�[39m�[38;5;173mscorecard�[39m�[38;5;111m@�[39m�[38;5;111mworkspace:.�[39m �[32mSTDOUT�[39m ::group::Link step435: �[94m➤�[39m �[90mYN0000�[39m: │ �[38;5;166m@internal/�[39m�[38;5;173mscorecard�[39m�[38;5;111m@�[39m�[38;5;111mworkspace:.�[39m �[32mSTDOUT�[39m �[94m➤�[39m YN0007: │ �[38;5;173mesbuild�[39m�[38;5;111m@�[39m�[38;5;111mnpm:0.21.5�[39m must be built because it never has been before or the last one failed436: �[94m➤�[39m �[90mYN0000�[39m: │ �[38;5;166m@internal/�[39m�[38;5;173mscorecard�[39m�[38;5;111m@�[39m�[38;5;111mworkspace:.�[39m �[32mSTDOUT�[39m �[94m➤�[39m YN0007: │ �[38;5;166m@swc/�[39m�[38;5;173mcore�[39m�[38;5;111m@�[39m�[38;5;111mnpm:1.4.13 [366d3]�[39m must be built because it never has been before or the last one failed437: �[94m➤�[39m �[90mYN0000�[39m: │ �[38;5;166m@internal/�[39m�[38;5;173mscorecard�[39m�[38;5;111m@�[39m�[38;5;111mworkspace:.�[39m �[32mSTDOUT�[39m �[94m➤�[39m YN0007: │ �[38;5;173mesbuild�[39m�[38;5;111m@�[39m�[38;5;111mnpm:0.23.1�[39m must be built because it never has been before or the last one failed438: �[94m➤�[39m �[90mYN0000�[39m: │ �[38;5;166m@internal/�[39m�[38;5;173mscorecard�[39m�[38;5;111m@�[39m�[38;5;111mworkspace:.�[39m �[32mSTDOUT�[39m �[94m➤�[39m YN0007: │ �[38;5;173mesbuild�[39m�[38;5;111m@�[39m�[38;5;111mnpm:0.20.2�[39m must be built because it never has been before or the last one failed439: �[94m➤�[39m �[90mYN0000�[39m: │ �[38;5;166m@internal/�[39m�[38;5;173mscorecard�[39m�[38;5;111m@�[39m�[38;5;111mworkspace:.�[39m �[32mSTDOUT�[39m �[94m➤�[39m YN0007: │ �[38;5;173mcore-js-pure�[39m�[38;5;111m@�[39m�[38;5;111mnpm:3.36.1�[39m must be built because it never has been before or the last one failed440: �[94m➤�[39m �[90mYN0000�[39m: │ �[38;5;166m@internal/�[39m�[38;5;173mscorecard�[39m�[38;5;111m@�[39m�[38;5;111mworkspace:.�[39m �[32mSTDOUT�[39m �[94m➤�[39m YN0007: │ �[38;5;166m@redhat-developer/�[39m�[38;5;173mrhdh-plugins�[39m�[38;5;111m@�[39m�[38;5;111mworkspace:.�[39m must be built because it never has been before or the last one failed441: �[94m➤�[39m �[90mYN0000�[39m: │ �[38;5;166m@internal/�[39m�[38;5;173mscorecard�[39m�[38;5;111m@�[39m�[38;5;111mworkspace:.�[39m �[32mSTDOUT�[39m ::endgroup::
...
460: CI: true461: NODE_OPTIONS: --max-old-space-size=8192462: NPM_CONFIG_USERCONFIG: /home/runner/work/_temp/.npmrc463: NODE_AUTH_TOKEN: XXXXX-XXXXX-XXXXX-XXXXX464: ##[endgroup]465: Loaded config from app-config.yaml466: ##[group]Run yarn tsc:full467: �[36;1myarn tsc:full�[0m468: shell: /usr/bin/bash -e {0}469: env:470: CI: true471: NODE_OPTIONS: --max-old-space-size=8192472: NPM_CONFIG_USERCONFIG: /home/runner/work/_temp/.npmrc473: NODE_AUTH_TOKEN: XXXXX-XXXXX-XXXXX-XXXXX474: ##[endgroup]475: �[96mplugins/scorecard-backend/src/scheduler/tasks/CleanupExpiredMetricsTask.ts�[0m:�[93m23�[0m:�[93m28�[0m - �[91merror�[0m�[90m TS7016: �[0mCould not find a declaration file for module 'uuid'. '/home/runner/work/rhdh-plugins/rhdh-plugins/workspaces/scorecard/node_modules/uuid/dist/index.js' implicitly has an 'any' type.476: Try `npm i --save-dev @types/uuid` if it exists or add a new declaration (.d.ts) file containing `declare module 'uuid';`477: �[7m23�[0m import { v4 as uuid } from 'uuid';478: �[7m �[0m �[91m ~~~~~~�[0m479: �[96mplugins/scorecard-backend/src/scheduler/tasks/PullMetricsByProviderTask.ts�[0m:�[93m31�[0m:�[93m28�[0m - �[91merror�[0m�[90m TS7016: �[0mCould not find a declaration file for module 'uuid'. '/home/runner/work/rhdh-plugins/rhdh-plugins/workspaces/scorecard/node_modules/uuid/dist/index.js' implicitly has an 'any' type.480: Try `npm i --save-dev @types/uuid` if it exists or add a new declaration (.d.ts) file containing `declare module 'uuid';`481: �[7m31�[0m import { v4 as uuid } from 'uuid';482: �[7m �[0m �[91m ~~~~~~�[0m483: Found 2 errors in 2 files.484: Errors Files485: 1 plugins/scorecard-backend/src/scheduler/tasks/CleanupExpiredMetricsTask.ts�[90m:23�[0m486: 1 plugins/scorecard-backend/src/scheduler/tasks/PullMetricsByProviderTask.ts�[90m:31�[0m487: ##[error]Process completed with exit code 2.488: Post job cleanup.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
It fixes CVE 2026 26278 reported by Dependabot where the fast-xml-parser must be patched to v5.5.6