Skip to content

Update dependency puppeteer to v22 #15

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
wants to merge 1 commit into
base: androidx-main
Choose a base branch
from
Open

Update dependency puppeteer to v22 #15

wants to merge 1 commit into from

Conversation

@mend-for-github-com
Copy link

@mend-for-github-com mend-for-github-com bot commented Sep 9, 2025 •
edited
Loading

This PR contains the following updates:

Package Type Update Change
puppeteer (source) dependencies major ^18.2.1 -> ^22.0.0

By merging this PR, the below vulnerabilities will be automatically resolved:

Severity CVSS Score Vulnerability
High High 7.5 CVE-2024-12905
High High 7.5 CVE-2024-37890
High High 7.5 CVE-2025-59343
Low Low 3.1 CVE-2025-5889

Release Notes

puppeteer/puppeteer (puppeteer)

v22.11.2

Compare Source

Miscellaneous Chores
  • puppeteer: Synchronize puppeteer versions
Dependencies
  • The following workspace dependencies were updated
    • dependencies
      • puppeteer-core bumped from 22.11.2 to 22.12.0
Features
Bug Fixes

v22.11.1

Compare Source

Miscellaneous Chores
  • puppeteer: Synchronize puppeteer versions
Dependencies
  • The following workspace dependencies were updated
    • dependencies
      • puppeteer-core bumped from 22.11.1 to 22.11.2
Bug Fixes

v22.11.0

Compare Source

Miscellaneous Chores
  • puppeteer: Synchronize puppeteer versions
Dependencies
  • The following workspace dependencies were updated
    • dependencies
      • puppeteer-core bumped from 22.11.0 to 22.11.1
Bug Fixes

v22.10.1

Compare Source

Features
Dependencies
  • The following workspace dependencies were updated
    • dependencies
      • puppeteer-core bumped from 22.10.1 to 22.11.0
Bug Fixes

v22.10.0

Compare Source

Miscellaneous Chores
  • puppeteer: Synchronize puppeteer versions
Dependencies
  • The following workspace dependencies were updated
    • dependencies
      • puppeteer-core bumped from 22.10.0 to 22.10.1
Bug Fixes

v22.9.0

Compare Source

Miscellaneous Chores
  • puppeteer: Synchronize puppeteer versions
Dependencies
  • The following workspace dependencies were updated
    • dependencies
      • puppeteer-core bumped from 22.9.0 to 22.10.0
Features
Bug Fixes

v22.8.2

Compare Source

Features
Dependencies
  • The following workspace dependencies were updated
    • dependencies
      • puppeteer-core bumped from 22.8.2 to 22.9.0

v22.8.1

Compare Source

Miscellaneous Chores
  • puppeteer: Synchronize puppeteer versions
Dependencies
  • The following workspace dependencies were updated
    • dependencies
      • puppeteer-core bumped from 22.8.1 to 22.8.2
Bug Fixes

v22.8.0

Compare Source

Miscellaneous Chores
  • puppeteer: Synchronize puppeteer versions
Dependencies
  • The following workspace dependencies were updated
    • dependencies
      • puppeteer-core bumped from 22.8.0 to 22.8.1
Bug Fixes

v22.7.1

Compare Source

Miscellaneous Chores
  • puppeteer: Synchronize puppeteer versions
Dependencies
  • The following workspace dependencies were updated
    • dependencies
      • puppeteer-core bumped from 22.7.1 to 22.8.0
Features
Bug Fixes

v22.7.0

Compare Source

Features
Dependencies
  • The following workspace dependencies were updated
    • dependencies
      • puppeteer-core bumped from 22.6.5 to 22.7.0
Bug Fixes

v22.6.5

Compare Source

Features
Dependencies
  • The following workspace dependencies were updated
    • dependencies
      • puppeteer-core bumped from 22.6.5 to 22.7.0
Bug Fixes

v22.6.4

Compare Source

Miscellaneous Chores
  • puppeteer: Synchronize puppeteer versions
Dependencies
  • The following workspace dependencies were updated
    • dependencies
      • puppeteer-core bumped from 22.6.3 to 22.6.4
Bug Fixes

v22.6.3

Compare Source

Miscellaneous Chores
  • puppeteer: Synchronize puppeteer versions
Dependencies
  • The following workspace dependencies were updated
    • dependencies
      • puppeteer-core bumped from 22.6.3 to 22.6.4
Bug Fixes

v22.6.2

Compare Source

Miscellaneous Chores
  • puppeteer: Synchronize puppeteer versions
Dependencies
  • The following workspace dependencies were updated
    • dependencies
      • puppeteer-core bumped from 22.6.1 to 22.6.2
Bug Fixes

v22.6.1

Compare Source

Miscellaneous Chores
  • puppeteer: Synchronize puppeteer versions
Dependencies
  • The following workspace dependencies were updated
    • dependencies
      • puppeteer-core bumped from 22.6.1 to 22.6.2
Bug Fixes

v22.6.0

Compare Source

Miscellaneous Chores
  • puppeteer: Synchronize puppeteer versions
Dependencies
  • The following workspace dependencies were updated
    • dependencies
      • puppeteer-core bumped from 22.6.0 to 22.6.1
Bug Fixes

v22.5.0

Compare Source

Features
Dependencies
  • The following workspace dependencies were updated
    • dependencies
      • puppeteer-core bumped from 22.5.0 to 22.6.0
Bug Fixes

v22.4.1

Compare Source

Miscellaneous Chores
  • puppeteer: Synchronize puppeteer versions
Dependencies
  • The following workspace dependencies were updated
    • dependencies
      • puppeteer-core bumped from 22.4.0 to 22.4.1
Bug Fixes

v22.4.0

Compare Source

Miscellaneous Chores
  • puppeteer: Synchronize puppeteer versions
Dependencies
  • The following workspace dependencies were updated
    • dependencies
      • puppeteer-core bumped from 22.4.0 to 22.4.1
Bug Fixes

v22.3.0

Compare Source

Miscellaneous Chores
  • puppeteer: Synchronize puppeteer versions
Dependencies
  • The following workspace dependencies were updated
    • dependencies
      • puppeteer-core bumped from 22.3.0 to 22.4.0
Features
Bug Fixes
  • roll to Chrome 122.0.6261.94 (r1250580) (#​12012) (7ba5529)
  • webdriver: wait for response if the response has not completed once navigation has finished (#​12018) (6d8831a)

v22.2.0

Compare Source

Miscellaneous Chores
  • puppeteer: Synchronize puppeteer versions
Dependencies
  • The following workspace dependencies were updated
    • dependencies
      • puppeteer-core bumped from 22.2.0 to 22.3.0
Features
Bug Fixes

v22.1.0

Compare Source

Miscellaneous Chores
  • puppeteer: Synchronize puppeteer versions
Dependencies
  • The following workspace dependencies were updated
Features
Bug Fixes

v22.0.0

Compare Source

⚠ BREAKING CHANGES
  • rename createIncognitoBrowserContext to createBrowserContext (#​11834)
  • enable the new-headless mode by default (#​11815)
  • remove networkConditions in favor of PredefinedNetworkConditions (#​11806)
  • use ReadableStreams (#​11805)
  • remove duplicate type names (#​11803)
  • remove add/removeEventListener in favor of on/off (#​11792)
  • make console warn level compatible with WebDriver BiDi (#​11790)
  • remove InterceptResolutionStrategy (#​11788)
  • remove devices in favor of KnownDevices (#​11787)
  • remove $x and waitForXpath (#​11782)
  • remove waitForTimeout (#​11780)
  • generate accessible PDFs by default (#​11778)
  • remove error const, change CustomError to PuppeteerError (#​11777)
  • remove viewport resizing from ElementHandle.screenshot (#​11774)
  • remove PUPPETEER_DOWNLOAD_PATH in favor of PUPPETEER_CACHE_DIR (#​11605)
  • BiDi cookies (#​11532)
  • drop support for node16 (#​10912)
Features
Dependencies
  • The following workspace dependencies were updated
Bug Fixes
Code Refactoring

v21.11.0

Compare Source

Features
Dependencies
  • The following workspace dependencies were updated
    • dependencies
      • puppeteer-core bumped from 21.10.0 to 21.11.0
Bug Fixes

v21.10.0

Compare Source

Features
Dependencies
  • The following workspace dependencies were updated
    • dependencies
      • puppeteer-core bumped from 21.10.0 to 21.11.0
Bug Fixes

v21.9.0

Compare Source

Features
Dependencies
  • The following workspace dependencies were updated
    • dependencies
      • puppeteer-core bumped from 21.9.0 to 21.10.0
Bug Fixes

v21.8.0

Compare Source

Miscellaneous Chores
  • puppeteer: Synchronize puppeteer versions
Dependencies
  • The following workspace dependencies were updated
    • dependencies
      • puppeteer-core bumped from 21.8.0 to 21.9.0
Features

v21.7.0

Compare Source

Miscellaneous Chores
  • puppeteer: Synchronize puppeteer versions
Dependencies
  • The following workspace dependencies were updated
    • dependencies
      • puppeteer-core bumped from 21.7.0 to 21.8.0
Features
Bug Fixes
Reverts

v21.6.1

Compare Source

Miscellaneous Chores
  • puppeteer: Synchronize puppeteer versions
Dependencies
  • The following workspace dependencies were updated
    • dependencies
      • puppeteer-core bumped from 21.6.0 to 21.6.1
Bug Fixes

v21.6.0

Compare Source

Miscellaneous Chores
  • puppeteer: Synchronize puppeteer versions
Dependencies
  • The following workspace dependencies were updated
    • dependencies
      • puppeteer-core bumped from 21.6.0 to 21.6.1
Bug Fixes

v21.5.2

Compare Source

Miscellaneous Chores
  • puppeteer: Synchronize puppeteer versions
Dependencies
  • The following workspace dependencies were updated
    • dependencies
      • puppeteer-core bumped from 21.5.1 to 21.5.2
Bug Fixes

v21.5.1

Compare Source

Miscellaneous Chores
  • puppeteer: Synchronize puppeteer versions
Dependencies
  • The following workspace dependencies were updated
    • dependencies
      • puppeteer-core bumped from 21.5.1 to 21.5.2
Bug Fixes

v21.5.0

Compare Source

Miscellaneous Chores
  • puppeteer: Synchronize puppeteer versions
Dependencies
  • The following workspace dependencies were updated
    • dependencies
      • puppeteer-core bumped from 21.5.0 to 21.5.1
Bug Fixes

v21.4.1

Compare Source

Miscellaneous Chores
  • puppeteer: Synchronize puppeteer versions
Dependencies
  • The following workspace dependencies were updated
    • dependencies
      • puppeteer-core bumped from 21.4.1 to 21.5.0
Features
Bug Fixes

v21.4.0

Compare Source

Miscellaneous Chores
  • puppeteer: Synchronize puppeteer versions
Dependencies
  • The following workspace dependencies were updated
    • dependencies
      • puppeteer-core bumped from 21.4.0 to 21.4.1
Bug Fixes

v21.3.8

Compare Source

Miscellaneous Chores
  • puppeteer: Synchronize puppeteer versions
Dependencies
  • The following workspace dependencies were updated
    • dependencies
      • puppeteer-core bumped from 21.3.7 to 21.3.8
Bug Fixes

v21.3.7

Compare Source

Miscellaneous Chores
  • puppeteer: Synchronize puppeteer versions
Dependencies
  • The following workspace dependencies were updated
    • dependencies
      • puppeteer-core bumped from 21.3.7 to 21.3.8
Bug Fixes

v21.3.6

Compare Source

Miscellaneous Chores
  • puppeteer: Synchronize puppeteer versions
Dependencies
  • The following workspace dependencies were updated
    • dependencies
      • puppeteer-core bumped from 21.3.6 to 21.3.7
Bug Fixes

v21.3.5

Compare Source

Miscellaneous Chores
  • puppeteer: Synchronize puppeteer versions
Dependencies
  • The following workspace dependencies were updated
    • dependencies
      • puppeteer-core bumped from 21.3.5 to 21.3.6
Bug Fixes

v21.3.4

Compare Source

Miscellaneous Chores
  • puppeteer: Synchronize puppeteer versions
Dependencies
  • The following workspace dependencies were updated
    • dependencies
      • puppeteer-core bumped from 21.3.4 to 21.3.5
Bug Fixes

v21.3.3

Compare Source

Miscellaneous Chores
  • puppeteer: Synchronize puppeteer versions
Dependencies
  • The following workspace dependencies were updated
    • dependencies
      • puppeteer-core bumped from 21.3.3 to 21.3.4
Bug Fixes

v21.3.2

Compare Source

Miscellaneous Chores
  • puppeteer: Synchronize puppeteer versions
Dependencies
  • The following workspace dependencies were updated
    • dependencies
      • puppeteer-core bumped from 21.3.2 to 21.3.3
Bug Fixes

v21.3.1

Compare Source

Miscellaneous Chores
  • puppeteer: Synchronize puppeteer versions
Dependencies
  • The following workspace dependencies were updated
    • dependencies
      • puppeteer-core bumped from 21.3.1 to 21.3.2
Bug Fixes

v21.3.0

Compare Source

Miscellaneous Chores
  • puppeteer: Synchronize puppeteer versions
Dependencies
  • The following workspace dependencies were updated
    • dependencies
      • puppeteer-core bumped from 21.3.0 to 21.3.1
Bug Fixes

v21.2.1

Compare Source

Miscellaneous Chores
  • puppeteer: Synchronize puppeteer versions
Dependencies
  • The following workspace dependencies were updated
    • dependencies
      • puppeteer-core bumped from 21.2.1 to 21.3.0
Features

@mend-for-github-com mend-for-github-com bot added the security fix Security fix generated by Mend label Sep 9, 2025
@socket-security
Copy link

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updatedpuppeteer@​18.2.1 ⏵ 22.15.09310088 -1197100

View full report

@rafikmojr
Copy link

Logo
Checkmarx One – Scan Summary & Details – c59b74c7-5e5e-405a-97ce-d63718048c32

New Issues (275)

Checkmarx found the following issues in this Pull Request

Severity Issue Source File / Package Checkmarx Insight
CRITICAL Second_Order_SQL_Injection /room/room-runtime/src/main/java/androidx/room/util/DBUtil.kt: 74
detailsThe application's query method executes an SQL query with sqLiteQuery, at line 74 of /room/room-runtime/src/main/java/androidx/room/util/DBUtil.k...
ID: YFxHBKIaSabz2R5i8%2FLUQfbL%2FTY%3D
Attack Vector
CRITICAL Stored_Command_Injection /development/update_library_versions.py: 59
detailsThe application's does_exist_on_gmaven method calls an OS (shell) command with check_output, at line 128 of /development/update_library_ver...
ID: WT3xBniIPWLrRwIXql2u4j3VLFw%3D
Attack Vector
CRITICAL Stored_Command_Injection /privacysandbox/tools/tools-apigenerator/src/main/java/androidx/privacysandbox/tools/apigenerator/PrivacySandboxApiGenerator.kt: 122
detailsThe application's compile method calls an OS (shell) command with start, at line 53 of /privacysandbox/tools/tools-core/src/main/java/androidx/p...
ID: Tv3LnZ8UUHrVV%2FoCECrGdxJIL90%3D
Attack Vector
CRITICAL Stored_Command_Injection /appsearch/exportToFramework.py: 93
detailsThe application's _FormatWrittenFiles method calls an OS (shell) command with check_call, at line 335 of /appsearch/exportToFramework.py, usin...
ID: h2woJE%2FE2w%2Bif8DD1M5LUAlczmg%3D
Attack Vector
HIGH CVE-2024-4068 Npm-braces-3.0.2
detailsRecommended version: 3.0.3
Description: The NPM package "braces", versions prior to 3.0.3, fails to limit the number of characters it can handle, which could lead to Memory Exhaustion. In...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: %2FDKWq%2FE14H6JTY6euBffuRJ%2Fi%2Bd8XRMgTQLO0ZibZP4%3D
Vulnerable Package
HIGH CVE-2024-45296 Npm-path-to-regexp-0.1.7
detailsRecommended version: 0.1.12
Description: The path-to-regexp turns path strings into regular expressions. In certain cases, path-to-regexp will output a regular expression that can be explo...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: pSRMZB%2B0Z5SZUcsjfxtLIJmEwOXs7oAS0JnP3EFlgE8%3D
Vulnerable Package
HIGH CVE-2024-45590 Npm-body-parser-1.20.1
detailsRecommended version: 1.20.3
Description: The body-parser is Node.js body parsing middleware. The body-parser package versions prior to 1.20.3 and 2.0.x prior to 2.0.0 are vulnerable to Den...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: akxdm6pmk%2BPizizGrCIfpR7x2c%2BIItbbS2rjMwCciB8%3D
Vulnerable Package
HIGH CVE-2024-52798 Npm-path-to-regexp-0.1.7
detailsRecommended version: 0.1.12
Description: path-to-regexp turns path strings into a regular expressions. In certain cases, path-to-regexp will output a regular expression that can be exploit...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: k4WPagbSKFJAyaCnnz%2FBq%2B3VT41%2Fn80P3rZtGvkWXIk%3D
Vulnerable Package
MEDIUM CVE-2024-29041 Npm-express-4.18.2
detailsRecommended version: 4.20.0
Description: Express.js minimalist web framework for node. Express.js versions prior to 4.19.2, and 5.0.x prior to 5.0.0-beta.3 are affected by an open redirect...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: LHDf0DDF6DekvP19r%2FvBTLLiAHkx1fdDy0jKv1WLyQc%3D
Vulnerable Package
MEDIUM CVE-2024-31207 Npm-vite-4.4.7
detailsRecommended version: 4.5.14
Description: Vite (French word for "quick", pronounced "/vit/", like "veet") is a frontend build tooling to improve the frontend development experience. "server...
Attack Vector: NETWORK
Attack Complexity: HIGH

ID: %2FcZEsqD04MKoA0N%2BoJU3XFUVDAFM6vnXWXKJfYMcc%2Bo%3D
Vulnerable Package
MEDIUM CVE-2024-4067 Npm-micromatch-4.0.5
detailsRecommended version: 4.0.8
Description: The NPM package "micromatch" prior to 4.0.8 is vulnerable to Regular Expression Denial of Service (ReDoS). The vulnerability occurs in "micromatch....
Attack Vector: NETWORK
Attack Complexity: LOW

ID: 7QUg5BFGRNpdo3bqacfWNcCRXzhV2BHCB9gMkrwH%2FAM%3D
Vulnerable Package
MEDIUM CVE-2024-43796 Npm-express-4.18.2
detailsRecommended version: 4.20.0
Description: Express.js minimalist web framework for node. In express versions prior to 4.20.0 and 5.0.x prior to 5.0.0, passing untrusted user input even after...
Attack Vector: NETWORK
Attack Complexity: HIGH

ID: h0fMMk4XgUUUZsSUVty6Z30XbTu9SaQnbfnuJuBZoug%3D
Vulnerable Package
MEDIUM CVE-2024-43799 Npm-send-0.18.0
detailsRecommended version: 0.19.0
Description: Send is a library for streaming files from the file system as an HTTP response. Send passes untrusted user input to "SendStream.redirect()" which e...
Attack Vector: NETWORK
Attack Complexity: HIGH

ID: pCKZxRJoWogGzNOqwcT1aL169Y%2FOvbeCz2en%2FA4hYPw%3D
Vulnerable Package
MEDIUM CVE-2024-43800 Npm-serve-static-1.15.0
detailsRecommended version: 1.16.0
Description: serve-static serves static files. serve-static passes untrusted user input even after sanitizing it to "redirect()" and may execute untrusted code....
Attack Vector: NETWORK
Attack Complexity: HIGH

ID: MtF7JoaBtCIDfk90vrQ2oC92jIsQPKZN6ktvg54nzb8%3D
Vulnerable Package
MEDIUM CVE-2024-45047 Npm-svelte-4.1.1
detailsRecommended version: 4.2.19
Description: Svelte is a performance-oriented web framework. A potential mXSS vulnerability exists in Svelte for versions through 4.2.18, 5.0.0-next.1 through 5...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: PKE0ASVYWK2rrhe7JSCCnOdtekC2xBsrCzwOuliRrwk%3D
Vulnerable Package
MEDIUM CVE-2024-45811 Npm-vite-4.4.7
detailsRecommended version: 4.5.14
Description: Vite a frontend build tooling framework for JavaScript. In versions through 3.2.10, 4.0.0-alpha.0 through 4.5.3, 5.0.0-beta.0 through 5.1.7, 5.2.0-...
Attack Vector: ADJACENT NETWORK
Attack Complexity: HIGH

ID: 44UeWxizoShxq5ezZORDMOUbB0%2Bv3wUZNlNvqEn4CIE%3D
Vulnerable Package
MEDIUM CVE-2024-45812 Npm-vite-4.4.7
detailsRecommended version: 4.5.14
Description: Vite a frontend build tooling framework for javascript. In vite versions through 3.2.10, 4.0.0-alpha.0 through 4.5.3, 5.0.0-beta.0 through 5.1.7, 5...
Attack Vector: NETWORK
Attack Complexity: HIGH

ID: RvuVBJLe8HrNTBMOPV6FVK2JujWV5Dqg%2FJYftAMcsto%3D
Vulnerable Package
MEDIUM CVE-2024-47068 Npm-rollup-3.26.3
detailsRecommended version: 3.29.5
Description: Rollup is a module bundler for JavaScript. In rollup versions prior to 2.79.2, 3.x prior to 3.29.5, and 4.x prior to 4.22.4 are susceptible to a DO...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: 1LVFzlELOC071wei5sQMv6Znhq2O5sGoHgkVPmCXsEw%3D
Vulnerable Package
MEDIUM CVE-2024-47068 Npm-rollup-3.27.2
detailsRecommended version: 3.29.5
Description: Rollup is a module bundler for JavaScript. In rollup versions prior to 2.79.2, 3.x prior to 3.29.5, and 4.x prior to 4.22.4 are susceptible to a DO...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: ehgaC6PCNdC1UG4cpwrjnIeb7u6jGT%2BvFlV7cxawrO0%3D
Vulnerable Package
MEDIUM CVE-2024-47764 Npm-cookie-0.5.0
detailsRecommended version: 0.7.0
Description: The NPM package cookie is a basic HTTP cookie parser and serializer for HTTP servers. The cookie name could be used to set other fields of the cook...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: F04N1WA8k4mIoKeXp0%2FI%2FzjgbnZnSlzKSE9Gz7INGGc%3D
Vulnerable Package
MEDIUM CVE-2024-55565 Npm-nanoid-3.3.6
detailsRecommended version: 3.3.8
Description: The package nanoid versions through 3.3.7 and 4.0.0 through 5.0.8 mishandle non-integer values.
Attack Vector: NETWORK
Attack Complexity: LOW

ID: 4gpzGO7IaVdyraeUj9kz8FFRN4Q9j4bfSwBsKOv0IYE%3D
Vulnerable Package
MEDIUM CVE-2025-24010 Npm-vite-4.4.7
detailsRecommended version: 4.5.14
Description: Vite is a frontend tooling framework for JavaScript. Vite allowed any websites to send any requests to the development server and read the response...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: 0JJmTssmx2yrxBJ8yujFcYfMDbl4LHeVe6XzmGxE5DE%3D
Vulnerable Package
MEDIUM CVE-2025-30208 Npm-vite-4.4.7
detailsRecommended version: 4.5.14
Description: Vite, a provider of frontend development tooling, has a vulnerability in versions through 4.5.9, 5.0.0 through 5.4.14, 6.0.0 through 6.0.11, 6.1.0 ...
Attack Vector: NETWORK
Attack Complexity: HIGH

ID: YUnk8kgDsG%2BIunqp%2F4yDJTKNyfFNXPa1Dg%2BZDdT%2FO8w%3D
Vulnerable Package
MEDIUM CVE-2025-31125 Npm-vite-4.4.7
detailsRecommended version: 4.5.14
Description: Vite is a frontend tooling framework for javascript. Vite exposes the content of non-allowed files using `?inline&import` or `?raw?import`. Only ap...
Attack Vector: NETWORK
Attack Complexity: HIGH

ID: LYhsVQ2bpVETcROxzXqTVZgCv9kRhvUqZAbJmWndIdk%3D
Vulnerable Package
MEDIUM CVE-2025-31486 Npm-vite-4.4.7
detailsRecommended version: 4.5.14
Description: A vulnerability in Vite allows the contents of arbitrary files to be returned to the browser. By appending "?.svg" along with "?.wasm?init" or sett...
Attack Vector: NETWORK
Attack Complexity: HIGH

ID: OrXUmOiVmvsUt6Xkt7MWk9b%2FApSXbZlznZYva3QWlnM%3D
Vulnerable Package
MEDIUM CVE-2025-32395 Npm-vite-4.4.7
detailsRecommended version: 4.5.14
Description: Vite is a frontend tooling framework for JavaScript. The contents of arbitrary files can be returned to the browser if the dev server is running on...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: e4mradvjEMepH6YeJD%2B6o%2Bu5K9o7384g3Qdrxh1dq5Y%3D
Vulnerable Package
MEDIUM CVE-2025-46565 Npm-vite-4.4.7
detailsRecommended version: 4.5.14
Description: Vite is a frontend tooling framework for javascript. In vite package versions through 4.5.13, 5.0.0-beta.0 through 5.4.18, 6.0.0-alpha.0 through 6....
Attack Vector: NETWORK
Attack Complexity: LOW

ID: WhJC0u0u7FIL1Mi5nClul7cKqkjsykm2hy5f%2F%2BjLIxQ%3D
Vulnerable Package
MEDIUM Cxbb85e86c-2fac Npm-esbuild-0.18.16
detailsRecommended version: 0.25.0
Description: esbuild is an extremely fast bundler for the web, allowing any website to send any request to the development server and read the response due to d...
Attack Vector: NETWORK
Attack Complexity: HIGH

ID: hW646GzACneTFhzD2a2yl6r1hIdT9eqjdaIZ2G6jgng%3D
Vulnerable Package
MEDIUM Parameter_Tampering /camera/integration-tests/uiwidgetstestapp/src/main/java/androidx/camera/integration/uiwidgets/foldable/FoldableCameraActivity.kt: 402
detailsMethod showCamerasAndDisplayInfo at line 402 of /camera/integration-tests/uiwidgetstestapp/src/main/java/androidx/camera/integration/uiwidgets/fol...
ID: Ae9wHJfpnTsV0oP%2Fl5j4fp8%2F48k%3D
Attack Vector
MEDIUM Parameter_Tampering /camera/integration-tests/uiwidgetstestapp/src/main/java/androidx/camera/integration/uiwidgets/foldable/FoldableCameraActivity.kt: 402
detailsMethod showCamerasAndDisplayInfo at line 402 of /camera/integration-tests/uiwidgetstestapp/src/main/java/androidx/camera/integration/uiwidgets/fol...
ID: 3C%2BFO2fqH3cGkmaheOXEVRbIvcM%3D
Attack Vector
MEDIUM Parameter_Tampering /camera/integration-tests/uiwidgetstestapp/src/main/java/androidx/camera/integration/uiwidgets/foldable/FoldableCameraActivity.kt: 402
detailsMethod showCamerasAndDisplayInfo at line 402 of /camera/integration-tests/uiwidgetstestapp/src/main/java/androidx/camera/integration/uiwidgets/fol...
ID: GJ%2FpWxj3HsXan4tWY3Z32Zzz4wo%3D
Attack Vector
MEDIUM Privacy_Violation /compose/material3/material3/samples/src/main/java/androidx/compose/material3/samples/TextFieldSamples.kt: 198
detailsMethod PasswordTextField at line 198 of /compose/material3/material3/samples/src/main/java/androidx/compose/material3/samples/TextFieldSamples.kt ...
ID: yI4sbDRsOS3XKEG7wlAonNPIlVk%3D
Attack Vector
MEDIUM Privacy_Violation /compose/material/material/samples/src/main/java/androidx/compose/material/samples/TextFieldSamples.kt: 170
detailsMethod PasswordTextField at line 170 of /compose/material/material/samples/src/main/java/androidx/compose/material/samples/TextFieldSamples.kt sen...
ID: Dal6B4jp8zQf2MwsYHYB45tJh4w%3D
Attack Vector
MEDIUM Privacy_Violation /room/room-compiler/src/test/test-data/kotlinCodeGen/queryResultAdapter_array.kt: 47
detailsMethod queryOfArray at line 47 of /room/room-compiler/src/test/test-data/kotlinCodeGen/queryResultAdapter_array.kt sends user information outsi...
ID: ngxGvZ%2BrMK9NmJYqZFtjY1khlOQ%3D
Attack Vector
MEDIUM Privacy_Violation /room/room-compiler/src/test/test-data/kotlinCodeGen/pojoRowAdapter_enum.kt: 75
detailsMethod getEntity at line 75 of /room/room-compiler/src/test/test-data/kotlinCodeGen/pojoRowAdapter_enum.kt sends user information outside the a...
ID: 26%2F07yt9D%2FJRoL%2FRd7Ob5s4DNWI%3D
Attack Vector

More results are available on the CxOne platform

Fixed Issues (1766) Great job! The following issues were fixed in this Pull Request
Severity Issue Source File / Package
HIGH Buffer_Improper_Index_Access /graphics/graphics-core/src/main/cpp/sc_test_utils.cpp: 29
HIGH Buffer_Improper_Index_Access /camera/camera-core/src/main/cpp/image_processing_util_jni.cc: 643
HIGH Buffer_Improper_Index_Access /camera/camera-core/src/main/cpp/image_processing_util_jni.cc: 633
HIGH Buffer_Improper_Index_Access /camera/camera-core/src/main/cpp/image_processing_util_jni.cc: 623
HIGH Buffer_Improper_Index_Access /camera/camera-core/src/main/cpp/image_processing_util_jni.cc: 211
HIGH Buffer_Improper_Index_Access /camera/camera-core/src/main/cpp/image_processing_util_jni.cc: 201
HIGH Buffer_Improper_Index_Access /camera/camera-core/src/main/cpp/image_processing_util_jni.cc: 191
HIGH Buffer_Overflow_Unbounded_Format /benchmark/benchmark-common/src/main/cpp/androidx_benchmark_CpuCounter.cpp: 66
HIGH Buffer_Overflow_Unbounded_Format /benchmark/benchmark-common/src/main/cpp/androidx_benchmark_CpuCounter.cpp: 66
HIGH Code_Injection /wear/watchface/watchface-editor/src/main/java/androidx/wear/watchface/editor/WatchFaceEditorContract.kt: 168
HIGH Code_Injection /wear/watchface/watchface-editor/src/main/java/androidx/wear/watchface/editor/WatchFaceEditorContract.kt: 168
HIGH Code_Injection /wear/watchface/watchface-editor/src/main/java/androidx/wear/watchface/editor/WatchFaceEditorContract.kt: 168
HIGH Code_Injection /wear/watchface/watchface-editor/src/main/java/androidx/wear/watchface/editor/WatchFaceEditorContract.kt: 168
HIGH Code_Injection /wear/watchface/watchface-editor/src/main/java/androidx/wear/watchface/editor/WatchFaceEditorContract.kt: 148
HIGH Code_Injection /wear/watchface/watchface-editor/src/main/java/androidx/wear/watchface/editor/WatchFaceEditorContract.kt: 148
HIGH Code_Injection /wear/watchface/watchface-editor/src/androidTest/java/androidx/wear/watchface/editor/EditorSessionTest.kt: 336
HIGH Code_Injection /wear/watchface/watchface-editor/src/androidTest/java/androidx/wear/watchface/editor/EditorSessionTest.kt: 336
HIGH Code_Injection /wear/watchface/watchface-editor/src/main/java/androidx/wear/watchface/editor/WatchFaceEditorContract.kt: 149
HIGH Code_Injection /wear/watchface/watchface-editor/src/main/java/androidx/wear/watchface/editor/WatchFaceEditorContract.kt: 149
HIGH Code_Injection /wear/watchface/watchface-editor/src/main/java/androidx/wear/watchface/editor/WatchFaceEditorContract.kt: 149
HIGH Code_Injection /wear/watchface/watchface-editor/src/main/java/androidx/wear/watchface/editor/WatchFaceEditorContract.kt: 149
HIGH Code_Injection /wear/watchface/watchface-editor/src/main/java/androidx/wear/watchface/editor/WatchFaceEditorContract.kt: 149
HIGH Code_Injection /wear/watchface/watchface-editor/src/main/java/androidx/wear/watchface/editor/WatchFaceEditorContract.kt: 149
HIGH Code_Injection /wear/watchface/watchface-editor/src/main/java/androidx/wear/watchface/editor/WatchFaceEditorContract.kt: 149
HIGH Code_Injection /wear/watchface/watchface-editor/src/main/java/androidx/wear/watchface/editor/WatchFaceEditorContract.kt: 149
HIGH Code_Injection /wear/watchface/watchface-editor/src/main/java/androidx/wear/watchface/editor/WatchFaceEditorContract.kt: 164
HIGH Code_Injection /wear/watchface/watchface-editor/src/main/java/androidx/wear/watchface/editor/WatchFaceEditorContract.kt: 164
HIGH Code_Injection /wear/watchface/watchface-editor/src/main/java/androidx/wear/watchface/editor/WatchFaceEditorContract.kt: 164
HIGH Code_Injection /wear/watchface/watchface-editor/src/main/java/androidx/wear/watchface/editor/WatchFaceEditorContract.kt: 164
HIGH Code_Injection /wear/watchface/watchface-editor/src/main/java/androidx/wear/watchface/editor/WatchFaceEditorContract.kt: 151
HIGH Code_Injection /wear/watchface/watchface-editor/src/main/java/androidx/wear/watchface/editor/WatchFaceEditorContract.kt: 151
HIGH Code_Injection /wear/watchface/watchface-editor/src/main/java/androidx/wear/watchface/editor/WatchFaceEditorContract.kt: 151
HIGH Code_Injection /wear/watchface/watchface-editor/src/main/java/androidx/wear/watchface/editor/WatchFaceEditorContract.kt: 151
HIGH Command_Injection /development/update_tracing_perfetto.py: 188
HIGH Command_Injection /development/file-utils/diff-filterer.py: 970
HIGH Command_Injection /development/update_library_versions.py: 59
HIGH Command_Injection /appsearch/exportToFramework.py: 376
HIGH Command_Injection /appsearch/exportToFramework.py: 377
HIGH Command_Injection /development/update_tracing_perfetto.py: 188
HIGH Command_Injection /development/update_tracing_perfetto.py: 188
HIGH Command_Injection /development/project-creator/create_project.py: 663
HIGH Cx89601373-08db Npm-debug-2.6.9
HIGH Cx89601373-08db Npm-debug-3.2.7
HIGH Cxab55612e-3a56 Npm-braces-3.0.2
HIGH Cxca84a1c2-1f12 Npm-micromatch-4.0.5
HIGH Cxf6e7f2c1-dc59 Npm-yauzl-2.10.0
HIGH OS_Access_Violation /development/file-utils/diff-filterer.py: 970
HIGH OS_Access_Violation /development/copy_screenshots_to_golden_repo.py: 22
HIGH OS_Access_Violation /development/simplify-build-failure/impl/explode.py: 211
HIGH OS_Access_Violation /development/simplify-build-failure/impl/explode.py: 211
HIGH OS_Access_Violation /appsearch/exportToFramework.py: 377
HIGH OS_Access_Violation /development/project-creator/create_project.py: 663
HIGH OS_Access_Violation /development/project-creator/create_project.py: 663
HIGH OS_Access_Violation /development/offlinifyDocs/offlinify_dackka_docs.py: 31
HIGH OS_Access_Violation /development/offlinifyDocs/offlinify_dackka_docs.py: 72
HIGH OS_Access_Violation /development/project-creator/create_project.py: 663
HIGH OS_Access_Violation /development/project-creator/create_project.py: 663
HIGH OS_Access_Violation /development/simplify-build-failure/impl/explode.py: 211
HIGH OS_Access_Violation /development/simplify-build-failure/impl/explode.py: 211
HIGH Off_by_One_Error /graphics/graphics-core/src/main/cpp/sc_test_utils.cpp: 29
HIGH Off_by_One_Error /camera/camera-core/src/main/cpp/image_processing_util_jni.cc: 643
HIGH Off_by_One_Error /camera/camera-core/src/main/cpp/image_processing_util_jni.cc: 633
HIGH Off_by_One_Error /camera/camera-core/src/main/cpp/image_processing_util_jni.cc: 623
HIGH Off_by_One_Error /camera/camera-core/src/main/cpp/image_processing_util_jni.cc: 211
HIGH Off_by_One_Error /camera/camera-core/src/main/cpp/image_processing_util_jni.cc: 201
HIGH Off_by_One_Error /camera/camera-core/src/main/cpp/image_processing_util_jni.cc: 191
HIGH Reflected_XSS /compose/ui/ui-text/benchmark/src/androidTest/java/androidx/compose/ui/text/benchmark/input/EditProcessorBenchmark.kt: 96
HIGH Reflected_XSS /compose/foundation/foundation/src/commonMain/kotlin/androidx/compose/foundation/text/ValidatingOffsetMapping.kt: 33

More results are available on the CxOne platform

Use @Checkmarx to reach out to us for assistance.

Just send a PR comment with @Checkmarx followed by a natural language request.

Examples: @Checkmarx how are you able to help me? @Checkmarx rescan this PR

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

security fix Security fix generated by Mend

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@rafikmojr