[joelkeener]

Proposed changes

Upgrades vulnerable dependencies to resolve the Semgrep Supply Chain findings (Semgrep_Supply_Chain_Findings_2026_11_12.csv). npm audit now reports 0 vulnerabilities.

Production dependencies

• axios ^1.15.2 → ^1.21.1 (lockfile 1.21.1). Addresses GHSA-m8m8-qj5v-23w3 (prototype pollution), GHSA-mghh-pgcx-3jjj (shouldBypassProxy ReDoS), and related NO_PROXY, config.proxy, redirect Proxy-Authorization leak and cookies ReDoS advisories.
• js-yaml ^4.1.1 → ^4.3.2 (lockfile 4.3.2). Addresses GHSA-2883-xcg3-v3hh (merge keys), GHSA-5p4m-2wfm-xmqj (!!omap) and the merge-chain advisory CVE-2026-59869. Stays on 4.x to avoid the 5.x major bump.
• adm-zip ^0.5.10 → ^0.6.1.
• deepmerge replaced with deepmerge-ts ^8.0.2 (GHSA-gcqx-w48m-w2h4; no patched deepmerge release exists). lib/template.js uses deepmergeCustom with a last-value-wins mergeArrays, so the two former arrayMerge: arrayMergeOverwrite call sites still overwrite arrays.
• Removed the unused direct dependencies brace-expansion, diff, flatted, follow-redirects, minimatch and picomatch, per review. None are imported by this repo. They resolve only as transitive dependencies at patched versions, and picomatch is no longer installed.
• overrides pins follow-redirects to ^1.16.3 (resolves 1.16.3 via axios) as a version floor.
• form-data is 4.0.6 in the lockfile.

Dev dependencies

• mocha ^11.7.5 → ^12.0.3, which clears the diff and serialize-javascript findings. Mocha 12 requires Node ^20.19.0 || >=22.12.0.
• Dev-only overrides pin glob to ^14.0.6 and minimatch to ^11.0.8, because mocha and nyc still depend on older majors that have no patched release.
• The dev-only transitive js-yaml (via nyc) is refreshed from 3.14.2 to 3.15.2.
• npm audit fix refreshed the lockfile for ajv, uuid, @babel/core, browserslist, baseline-browser-mapping and nested brace-expansion.

CHANGELOG.md has a new v0.26.2 entry. The version in package.json is not bumped.

Not covered:

• The axios paths are tested only with nock mocks, with no live-network or proxy test.
• deepmerge-ts also merges Map and Set values, which deepmerge did not. Templates only merge plain JSON and YAML data, so no change is expected.
• I did not run npm ci or npm run audit-production.
• Semgrep needs a re-scan after merge to close the findings.

Checklist

• I have read the contributing guidelines.
• I have signed the F5 Contributor License Agreement (CLA).
• If applicable, I have added tests that prove my fix is effective or that my feature works. (No new tests. This is a dependency change covered by the existing suite.)
• If applicable, I have checked that any relevant tests pass after adding my changes. (On Node 22.12.0: npm test 171 passing, npm run test.cli 24 passing, npm run lint clean.)
• I have updated any relevant documentation (README.md and/or CHANGELOG.md). (CHANGELOG only.)

Ref: AUTOTOOL-5480

[tpitkinf5]

brace-expansion, diff, flatted, follow-redirects, minimatch, and picomatch are not directly used by f5-fast-core. I think they can be safely removed.

If they were being used to override sub-dependency versions, we can use the overrides option instead.

[joelkeener]

Agreed, none of these are imported anywhere, so I removed brace-expansion, diff, flatted, follow-redirects, minimatch and picomatch from dependencies.

They still resolve as transitive dependencies at patched versions, so no overrides were needed, except:

follow-redirects (via axios) now has an override as a hard floor (^1.16.3).
minimatch is covered by the existing dev-only override, which stays because mocha and nyc pin older majors.
picomatch is no longer installed. npm audit reports 0 vulnerabilities, and tests and lint pass.

[tpitkinf5]

Thanks!

[tpitkinf5]

Can we change this override block to avoid overriding older, non-vulnerable packages?

"overrides": {
  "mocha": {
    "glob": "^14.0.6",
    "minimatch": "^11.0.8"
  },
  "nyc": {
    "glob": "^14.0.6"
  },
  "test-exclude": {
    "glob": "^14.0.6",
    "minimatch": "^11.0.8"
  }
}

We can also drop follow-redirects because the axios update already fixes this.

[tpitkinf5]

Suggest keeping deepmerge and allowlisting the advisory instead of swapping to deepmerge-ts

GHSA-gcqx-w48m-w2h4 looks like a false positive, and the replacement has its own problems.

The advisory has been rejected upstream

• CVE-2026-93753 was marked Rejected in NVD on 2026-11-02 ("does not describe a security vulnerability"). VulnCheck, the CNA, rejected it after a dispute: Object.prototype is never modified, and the null-target case only lets an attacker set values they could set as plain own keys anyway. See TehShrike/deepmerge#285 and #273.
• The GitHub advisory hasn't been withdrawn yet. github/advisory-database#10910 asks GitHub to withdraw it.
• The maintainer closed the report and no fix is coming. The latest release is still 4.3.1.

Problems with deepmerge-ts

• It fails to load in mystique's Node 8 build. Its main is ./dist/index.cjs with no root index.js. Mystique's Babel step with --copy-files writes dist/index.js instead, so on Node 8.17 I got Cannot find module 'deepmerge-ts'. lib/template.js requires it at load time, so the worker would fail at startup.
• Results are no longer cloned. Editing the return value of getCombinedParameters({}) changed template.defaultParameters, and a later call returned the edited default. On 0.26.1 defaults were unaffected.
• __proto__ is kept as an own key. With skipValidation: true, a {"__proto__":{"injected":"PWNED"}} parameter rendered PWNED into a {{injected}} placeholder. On 0.26.1 it rendered an empty string. The validated path rejected my payload.

I ran the six template sets in test/templatesets and all 44 in mystique's templates/ through both versions, and the output was identical. The differences above are outside what those cover.

Suggestion: keep deepmerge@^4.3.1 and allowlist GHSA-gcqx-w48m-w2h4 and 1243505, noting that the CVE was rejected. Drop the allowlist entry once GitHub withdraws the advisory.