[enyineer]

Automated by the daily Security Maintenance workflow.

Direct dependency range bumps

• CRITICAL better-auth 1.7.1 → ^1.7.7 (CVE-2026-114607, GHSA-r4xp-prcw-77qf)

Needs manual attention (major-version fix only)

• MEDIUM glob 10.5.0: only a major-version fix is available — bump manually
• HIGH happy-dom 20.14.6: only a major-version fix is available — bump manually
• MEDIUM minimatch 10.2.6: only a major-version fix is available — bump manually
• MEDIUM zlib 1.3.2-r1: only a major-version fix is available — bump manually

[changeset-bot]

🦋 Changeset detected

Latest commit: a8f787a

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 59 packages

Name	Type
@checkstack/auth-backend	Patch
@checkstack/auth-frontend	Patch
@checkstack/auth-ldap-backend	Patch
@checkstack/auth-saml-backend	Patch
@checkstack/backend	Patch
@checkstack/frontend	Patch
@checkstack/announcement-backend	Patch
@checkstack/catalog-backend	Patch
@checkstack/notification-backend	Patch
@checkstack/theme-backend	Patch
@checkstack/tips-backend	Patch
@checkstack/auth-credential-backend	Patch
@checkstack/auth-github-backend	Patch
@checkstack/announcement-frontend	Patch
@checkstack/automation-frontend	Patch
@checkstack/catalog-frontend	Patch
@checkstack/healthcheck-frontend	Patch
@checkstack/incident-frontend	Patch
@checkstack/logstream-frontend	Patch
@checkstack/maintenance-frontend	Patch
@checkstack/metricstream-frontend	Patch
@checkstack/notification-frontend	Patch
@checkstack/slo-frontend	Patch
@checkstack/status-page-frontend	Patch
@checkstack/telemetry-frontend	Patch
@checkstack/theme-frontend	Patch
@checkstack/tips-frontend	Patch
@checkstack/tracestream-frontend	Patch
@checkstack/logstream-backend	Patch
@checkstack/metricstream-backend	Patch
@checkstack/telemetry-backend	Patch
@checkstack/tracestream-backend	Patch
@checkstack/anomaly-backend	Patch
@checkstack/dependency-backend	Patch
@checkstack/healthcheck-backend	Patch
@checkstack/incident-backend	Patch
@checkstack/maintenance-backend	Patch
@checkstack/slo-backend	Patch
@checkstack/screenshots	Patch
@checkstack/status-page-backend	Patch
@checkstack/notification-backstage-backend	Patch
@checkstack/notification-discord-backend	Patch
@checkstack/notification-gotify-backend	Patch
@checkstack/notification-pushover-backend	Patch
@checkstack/notification-slack-backend	Patch
@checkstack/notification-smtp-backend	Patch
@checkstack/notification-teams-backend	Patch
@checkstack/notification-telegram-backend	Patch
@checkstack/notification-webex-backend	Patch
@checkstack/notification-webhook-backend	Patch
@checkstack/dashboard-frontend	Patch
@checkstack/anomaly-frontend	Patch
@checkstack/gitops-frontend	Patch
@checkstack/integration-frontend	Patch
@checkstack/pluginmanager-frontend	Patch
@checkstack/satellite-frontend	Patch
@checkstack/satellite-backend	Patch
@checkstack/dependency-frontend	Patch
@checkstack/k8s-events-backend	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[github-actions]

❌ PR Checks Failed

Check	Status
Typecheck	✅ Passed
Lint	✅ Passed
Deps	✅ Passed
Test	✅ Passed
Integration	✅ Passed
Security (deps)	❌ Failed
Security (container)	✅ Passed
E2E	✅ Passed

❌ Security Audit Failures (dependency graph)

🔎 Security Audit (dependency graph, incl. devDependencies)

❌ Fixable vulnerabilities (1) — an upgrade path exists, so these fail the build:
  [HIGH] happy-dom 20.14.6 -> fixed in 21.0.4  (CVE-2026-115895)

⚠️  Known unfixed vulnerabilities (0) — surfaced, not gated:
  (none)

How to fix: This gate scans the whole dependency graph (incl. devDependencies) and fails only on findings with an upgrade path (a fixed version exists); unfixed findings are warnings, not gated. Run bun run audit:security locally to reproduce. Bump the affected direct dependency, or for a transitive package add a documented entry to security/managed-overrides.json plus matching overrides/resolutions in package.json (then bun install). Re-run bun run audit:overrides:check to confirm the override is consistent.

@enyineer The above code quality issues were found in this PR. Please fix them before merging.

[github-actions]

❌ PR Checks Failed

Check	Status
Typecheck	✅ Passed
Lint	✅ Passed
Deps	✅ Passed
Test	✅ Passed
Integration	✅ Passed
Security (deps)	❌ Failed
Security (container)	✅ Passed
E2E	✅ Passed

❌ Security Audit Failures (dependency graph)

🔎 Security Audit (dependency graph, incl. devDependencies)

❌ Fixable vulnerabilities (2) — an upgrade path exists, so these fail the build:
  [HIGH] happy-dom 20.14.6 -> fixed in 21.0.0  (CVE-2026-118660)
  [HIGH] happy-dom 20.14.6 -> fixed in 21.0.4  (CVE-2026-115895)

⚠️  Known unfixed vulnerabilities (0) — surfaced, not gated:
  (none)

How to fix: This gate scans the whole dependency graph (incl. devDependencies) and fails only on findings with an upgrade path (a fixed version exists); unfixed findings are warnings, not gated. Run bun run audit:security locally to reproduce. Bump the affected direct dependency, or for a transitive package add a documented entry to security/managed-overrides.json plus matching overrides/resolutions in package.json (then bun install). Re-run bun run audit:overrides:check to confirm the override is consistent.

@enyineer The above code quality issues were found in this PR. Please fix them before merging.

[github-actions]

❌ PR Checks Failed

Check	Status
Typecheck	✅ Passed
Lint	✅ Passed
Deps	✅ Passed
Test	✅ Passed
Integration	✅ Passed
Security (deps)	❌ Failed
Security (container)	✅ Passed
E2E	✅ Passed

❌ Security Audit Failures (dependency graph)

🔎 Security Audit (dependency graph, incl. devDependencies)

❌ Fixable vulnerabilities (4) — an upgrade path exists, so these fail the build:
  [MEDIUM] glob 13.0.6 -> fixed in 14.0.2  (CVE-2026-118773)
  [MEDIUM] minimatch 10.2.6 -> fixed in 11.0.1  (CVE-2026-118764)
  [HIGH] happy-dom 20.14.6 -> fixed in 21.0.0  (CVE-2026-118660)
  [HIGH] happy-dom 20.14.6 -> fixed in 21.0.4  (CVE-2026-115895)

⚠️  Known unfixed vulnerabilities (0) — surfaced, not gated:
  (none)

How to fix: This gate scans the whole dependency graph (incl. devDependencies) and fails only on findings with an upgrade path (a fixed version exists); unfixed findings are warnings, not gated. Run bun run audit:security locally to reproduce. Bump the affected direct dependency, or for a transitive package add a documented entry to security/managed-overrides.json plus matching overrides/resolutions in package.json (then bun install). Re-run bun run audit:overrides:check to confirm the override is consistent.

@enyineer The above code quality issues were found in this PR. Please fix them before merging.

[github-actions]

❌ PR Checks Failed

⚠️ Escalation: Automated fixes have not resolved the issues after 3 attempts. Manual intervention is required.

Check	Status
Typecheck	✅ Passed
Lint	✅ Passed
Deps	✅ Passed
Test	✅ Passed
Integration	✅ Passed
Security (deps)	❌ Failed
Security (container)	✅ Passed
E2E	✅ Passed

❌ Security Audit Failures (dependency graph)

🔎 Security Audit (dependency graph, incl. devDependencies)

❌ Fixable vulnerabilities (4) — an upgrade path exists, so these fail the build:
  [MEDIUM] glob 13.0.6 -> fixed in 14.0.2  (CVE-2026-118773)
  [MEDIUM] minimatch 10.2.6 -> fixed in 11.0.1  (CVE-2026-118764)
  [HIGH] happy-dom 20.14.6 -> fixed in 21.0.0  (CVE-2026-118660)
  [HIGH] happy-dom 20.14.6 -> fixed in 21.0.4  (CVE-2026-115895)

⚠️  Known unfixed vulnerabilities (0) — surfaced, not gated:
  (none)

How to fix: This gate scans the whole dependency graph (incl. devDependencies) and fails only on findings with an upgrade path (a fixed version exists); unfixed findings are warnings, not gated. Run bun run audit:security locally to reproduce. Bump the affected direct dependency, or for a transitive package add a documented entry to security/managed-overrides.json plus matching overrides/resolutions in package.json (then bun install). Re-run bun run audit:overrides:check to confirm the override is consistent.

@enyineer The above code quality issues were found in this PR. Automated fixes have not resolved them after 3 attempts. Manual intervention is required.

[github-actions]

❌ PR Checks Failed

⚠️ Escalation: Automated fixes have not resolved the issues after 3 attempts. Manual intervention is required.

Check	Status
Typecheck	✅ Passed
Lint	✅ Passed
Deps	✅ Passed
Test	✅ Passed
Integration	✅ Passed
Security (deps)	❌ Failed
Security (container)	❌ Failed
E2E	✅ Passed

❌ Security Audit Failures (dependency graph)

🔎 Security Audit (dependency graph, incl. devDependencies)

❌ Fixable vulnerabilities (4) — an upgrade path exists, so these fail the build:
  [MEDIUM] glob 13.0.6 -> fixed in 14.0.2  (CVE-2026-118773)
  [MEDIUM] minimatch 10.2.6 -> fixed in 11.0.1  (CVE-2026-118764)
  [HIGH] happy-dom 20.14.6 -> fixed in 21.0.0  (CVE-2026-118660)
  [HIGH] happy-dom 20.14.6 -> fixed in 21.0.4  (CVE-2026-115895)

⚠️  Known unfixed vulnerabilities (0) — surfaced, not gated:
  (none)

How to fix: This gate scans the whole dependency graph (incl. devDependencies) and fails only on findings with an upgrade path (a fixed version exists); unfixed findings are warnings, not gated. Run bun run audit:security locally to reproduce. Bump the affected direct dependency, or for a transitive package add a documented entry to security/managed-overrides.json plus matching overrides/resolutions in package.json (then bun install). Re-run bun run audit:overrides:check to confirm the override is consistent.

❌ Security Audit Failures (container / OS)

🔎 Security Audit (container / OS packages)

❌ Fixable vulnerabilities (1) — these fail the build:
  [MEDIUM] zlib 1.3.2-r1 -> fixed in 1.4-r0  (CVE-2026-4738)

⚠️  Known unfixed vulnerabilities (0) — surfaced, not gated:
  (none)

How to fix: Only fixable findings (a patched version exists) fail the build; unfixed findings are surfaced as warnings, not gated. Run bun run audit:image to reproduce the production-image scan locally. These are OS/container packages (alpine, openssl, ...) - bump the base image or the apk add set in the Dockerfile. npm dependency findings are handled by the Security (deps) gate above, not here.

@enyineer The above code quality issues were found in this PR. Automated fixes have not resolved them after 3 attempts. Manual intervention is required.

[github-actions]

❌ PR Checks Failed

⚠️ Escalation: Automated fixes have not resolved the issues after 3 attempts. Manual intervention is required.

Check	Status
Typecheck	✅ Passed
Lint	✅ Passed
Deps	✅ Passed
Test	✅ Passed
Integration	✅ Passed
Security (deps)	❌ Failed
Security (container)	❌ Failed
E2E	✅ Passed

❌ Security Audit Failures (dependency graph)

🔎 Security Audit (dependency graph, incl. devDependencies)

❌ Fixable vulnerabilities (4) — an upgrade path exists, so these fail the build:
  [MEDIUM] glob 13.0.6 -> fixed in 14.0.2  (CVE-2026-118773)
  [MEDIUM] minimatch 10.2.6 -> fixed in 11.0.1  (CVE-2026-118764)
  [HIGH] happy-dom 20.14.6 -> fixed in 21.0.0  (CVE-2026-118660)
  [HIGH] happy-dom 20.14.6 -> fixed in 21.0.4  (CVE-2026-115895)

⚠️  Known unfixed vulnerabilities (0) — surfaced, not gated:
  (none)

How to fix: This gate scans the whole dependency graph (incl. devDependencies) and fails only on findings with an upgrade path (a fixed version exists); unfixed findings are warnings, not gated. Run bun run audit:security locally to reproduce. Bump the affected direct dependency, or for a transitive package add a documented entry to security/managed-overrides.json plus matching overrides/resolutions in package.json (then bun install). Re-run bun run audit:overrides:check to confirm the override is consistent.

❌ Security Audit Failures (container / OS)

🔎 Security Audit (container / OS packages)

❌ Fixable vulnerabilities (1) — these fail the build:
  [MEDIUM] zlib 1.3.2-r1 -> fixed in 1.4-r0  (CVE-2026-4738)

⚠️  Known unfixed vulnerabilities (0) — surfaced, not gated:
  (none)

How to fix: Only fixable findings (a patched version exists) fail the build; unfixed findings are surfaced as warnings, not gated. Run bun run audit:image to reproduce the production-image scan locally. These are OS/container packages (alpine, openssl, ...) - bump the base image or the apk add set in the Dockerfile. npm dependency findings are handled by the Security (deps) gate above, not here.

@enyineer The above code quality issues were found in this PR. Automated fixes have not resolved them after 3 attempts. Manual intervention is required.