[Aikido] Fix 2 critical issues in tough-cookie, json-schema and 16 other issues

[aikido-autofix]

Upgrade dependencies to fix critical prototype pollution vulnerabilities in tough-cookie and json-schema, plus HTTP Parameter Pollution in form-data.

⚠️ Incomplete breaking changes analysis (6/10 analyzed)

⚠️ Breaking changes analysis not available for: json-schema, hoek, hawk, xml2js

✅ No breaking changes from the upgraded packages affect this codebase. All packages with breaking changes (tough-cookie, qs, uuid, ajv, and lodash) are transitive dependencies that are not directly imported or used in the code. The codebase only directly uses request-promise-native, xml2js-es6-promise, and cli-table, along with built-in Node.js modules. The transitive dependency upgrades are managed by the direct dependencies (request and request-promise-native), which will handle any compatibility requirements internally.

All breaking changes by upgrading tough-cookie from version 2.3.4 to 4.1.4 (CHANGELOG)

Version	Description
4.0.0	Re-ordered parameters for findCookies() - callback function has to be last to comply with universalify
4.0.0	Changed from function prototypes to Classes for defining classes, which might break code using .call() for inheritance with function prototypes

All breaking changes by upgrading qs from version 6.4.0 to 6.16.0 (CHANGELOG)

Version	Description
6.10.0	stringify: throw on cycles, instead of an infinite loop (#395, #394, #393)

All breaking changes by upgrading uuid from version 3.1.0 to 11.1.1 (CHANGELOG)

Version	Description
7.0.0	The default export (which was the v4() method) has been removed
7.0.0	Deep imports of uuid version functions are deprecated and emit deprecation warnings; ECMAScript module named imports should be used instead
7.0.0	Builtin support for insecure random number generators in the browser has been removed
7.0.0	Support for generating v3 and v5 UUIDs in Node.js<4.x has been removed
7.0.0	Code base converted to ECMAScript Modules (ESM) with CommonJS build for node and ESM build for browser bundlers
8.0.0	For native ECMAScript Module (ESM) usage in Node.js only named exports are exposed, there is no more default export
8.0.0	Deep requiring specific algorithms like require('uuid/v4') is no longer supported
8.2.0	Deprecated v4 string parameter has been removed
9.0.0	Node.js 10.x support dropped (minimum version is now 12.x)
9.0.0	Minified UMD build removed from the package
9.0.0	IE 11 and Safari 10 support dropped; browsers must correctly implement const/let and default arguments
9.0.0	Fallback on msCrypto removed
10.0.0	Node.js 12 and 14 support dropped (only node 16-20 supported)
11.0.0	v1 internal state and options logic refactored
11.0.0	v7 internal state and options logic refactored
11.0.0	Ported to TypeScript
11.0.0	Node support matrix updated (only support node 16-20)

All breaking changes by upgrading ajv from version 4.11.8 to 6.15.0 (CHANGELOG)

Version	Description
5.0.0	$id keyword is now used as schema URI instead of id
5.0.0	exclusiveMaximum and exclusiveMinimum keywords must be numbers instead of booleans
5.0.0	Keywords switch, patternRequired, formatMinimum, and formatMaximum moved to ajv-keywords package (^2.0.0)
5.0.0	Format "regex" changed to prohibit \Z anchor
5.0.0	Format "uri" changed to only allow absolute URIs; relative URIs require "uri-reference"
5.0.0	Methods are no longer bound to Ajv instances
5.0.0	compileAsync method now returns Promise instead of previous behavior
5.0.0	Option beautify: true is no longer supported
5.0.0	Option v5 is no longer used
5.0.0	Option extendRefs default changed from true to "ignore" - when $ref is used other keywords are now ignored
5.0.0	Option sourceCode default changed from true to false - source code of validation functions no longer stored by default
5.0.0	Option unknownFormats default changed from "ignore" to true - now fails schema compilation by default
5.0.0	Auto-detection of async mode and transpile option now require ajv-async package
5.0.0	Default async mode changed to "co*" (co-wrapped generator functions)
5.0.0	Async validation Promise now resolves with validated data instead of true
5.0.0	Typescript 2.0 is now required
6.0.0	Only $id keyword is used as schema ID by default; schemaId option must be set to "id" or "auto" for id keyword to be used
6.0.0	Default meta-schema changed to draft-07
6.0.0	Removed deprecated patternGroups keyword
6.0.0	Async schemas can only be compiled to async functions; compilation to generator functions no longer supported
6.0.0	Removed v5 meta-schema
6.0.0	Removed nodent bundle

All breaking changes by upgrading lodash from version 4.17.21 to 4.18.1 (CHANGELOG)

Version	Description
4.18.0	_.unset / _.omit now block constructor and prototype as non-terminal path keys unconditionally. Calls that previously returned true and deleted the property now return false and leave the target untouched.
4.18.0	_.template now throws "Invalid imports option passed into _.template" when imports keys contain forbidden identifier characters, which were previously allowed.

✅ 18 CVEs resolved by this upgrade, including 3 critical 🚨 CVEs

This PR will resolve the following CVEs:

Issue	Severity	Description
CVE-2023-26136	🚨 CRITICAL	[tough-cookie] Versions of the package tough-cookie before 4.1.3 are vulnerable to Prototype Pollution due to improper handling of Cookies when using CookieJar in rejectPublicSuffixes=false mode. This issue arises from the manner in which the objects are initialized.
CVE-2021-3918	🚨 CRITICAL	[json-schema] is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
CVE-2025-7783	🚨 CRITICAL	[form-data] Use of Insufficiently Random Values vulnerability in form-data allows HTTP Parameter Pollution (HPP). This vulnerability is associated with program files lib/form_data.Js. This issue affects form-data: < 2.5.4, 3.0.0 - 3.0.3, 4.0.0 - 4.0.3.
CVE-2026-12143	HIGH	[form-data] A CRLF injection vulnerability in field names and filenames allows attackers to inject headers or additional multipart parts into requests, potentially enabling form field manipulation or smuggling attacks when untrusted input is used.
CVE-2020-36604	HIGH	[hoek] before 8.5.1 and 9.x before 9.0.3 allows prototype poisoning in the clone function.
CVE-2022-24999	HIGH	[qs] A prototype pollution vulnerability allows attackers to manipulate object prototypes via __proto__ keys in query strings, causing Node process hangs and denial of service in Express applications without authentication.
AIKIDO-2026-81971	MEDIUM	[qs] A vulnerability in buffer type checking allows attackers to crash the application by providing malicious input that causes a non-function to be invoked during serialization, resulting in an uncaught TypeError that can crash the request handler or worker process.
CVE-2026-82417	MEDIUM	[qs] A vulnerability in the buffer detection logic causes qs.stringify to throw a TypeError when serializing objects with a non-callable isBuffer property in their constructor, allowing attackers to trigger denial of service by crafting malicious input that gets re-serialized.
CVE-2025-15284	LOW	[qs] Improper input validation in the arrayLimit option fails to enforce limits on bracket notation arrays (a[]=1&a[]=2), only enforcing limits on indexed notation, potentially enabling HTTP DoS when parameterLimit is set to high values. The default parameterLimit of 1000 mitigates practical DoS risk.
CVE-2022-29167	HIGH	[hawk] A regular expression DoS vulnerability in the Host header parser allows attackers to cause exponential computation delays through crafted input. The vulnerability can be exploited via the Hawk.authenticate() function when processing HTTP requests.
CVE-2026-41907	HIGH	[uuid] A buffer overflow vulnerability allows v3, v5, and v6 UUID functions to write beyond caller-provided buffer boundaries when given small buffers or large offsets, causing silent data corruption. This can lead to memory corruption and potential code execution or information disclosure.
AIKIDO-2026-10892	MEDIUM	[uuid] UUID functions v3(), v5(), and v6() can write past the end of a caller-provided buffer due to missing offset validation, enabling buffer overflow attacks. The fix adds bounds checks to prevent out-of-range writes.
CVE-2020-15366	MEDIUM	[ajv] A prototype pollution vulnerability in the validate() function allows arbitrary code execution through a maliciously crafted JSON schema. This enables remote code execution when processing untrusted schemas, exceeding the expected denial of service impact.
CVE-2025-69873	LOW	[ajv] A ReDoS vulnerability in the pattern keyword allows attackers to inject malicious regex patterns via $data references, causing catastrophic backtracking and CPU exhaustion. A 31-character payload can block execution for ~44 seconds, enabling complete denial of service with minimal input.
AIKIDO-2026-273849	LOW	[ajv] A prototype pollution vulnerability allows attackers to bypass format validation when the $data option is enabled by using inherited property names like constructor or toString as format values, causing unexpected validation behavior or errors.
CVE-2025-13465	MEDIUM	[lodash] A prototype pollution vulnerability in _.unset and _.omit functions allows attackers to delete methods from global prototypes via crafted paths. While this prevents property overwriting, it can cause denial of service by removing critical prototype methods.
CVE-2026-2950	MEDIUM	[lodash] Prototype pollution vulnerability in _.unset and _.omit functions allows attackers to bypass previous fixes by using array-wrapped path segments to delete properties from built-in prototypes, potentially causing application malfunction or denial of service.
CVE-2023-0842	MEDIUM	[xml2js] version 0.4.23 allows an external attacker to edit or add new properties to an object. This is possible because the application does not properly validate incoming JSON keys, thus allowing the proto property to be edited.

🤖 Remediation details

Fix transitive security vulnerabilities in issue_checker dependencies

Short summary

This PR remediates security vulnerabilities in ten transitive packages — tough-cookie, json-schema, form-data, hoek, qs, hawk, uuid, ajv, lodash, and xml2js — all pulled in through the request, request-promise-native, and xml2js-es6-promise direct dependencies declared in issue_checker/package.json. Fixes are applied via a direct dependency bump (request), lockfile-only selector refreshes (jsprim, lodash), and resolutions entries for packages whose parent chains had no viable upgrade path. Only issue_checker/package.json and issue_checker/yarn.lock are modified.

---

tough-cookie

Resolved from 2.3.4 to 4.1.4 via a resolutions entry (^4.1.3). Both request (all published versions cap at ~2.5.0) and request-promise-native (permissive >=2.3.0 range but stale in the lockfile) could not deliver a patched version through a parent bump alone, so a resolution was required to force the lockfile past the 2.x ceiling.

json-schema

Resolved from 0.2.3 to 0.4.0 by refreshing the jsprim lockfile entry. jsprim@1.4.1 pinned json-schema exactly at 0.2.3; bumping jsprim to 1.4.2 (within the existing ^1.2.2 range already declared by http-signature) caused it to declare json-schema@0.4.0, which is the minimum patched version. No manifest change was needed beyond the lockfile refresh.

form-data

Resolved from 2.1.4 to 2.5.6 via a resolutions entry (^2.5.6). Even after bumping request to 2.88.2, that version pins form-data at ~2.3.2, which caps at 2.3.x — well below the 2.5.4 / 2.5.6 patch floor. A resolution was the only way to reach a patched 2.x release without replacing request entirely.

hoek

Removed from the lockfile entirely. hoek@2.16.3 was pulled in exclusively by hawk, boom, and sntp — all of which are themselves dependencies of hawk. Bumping request to ^2.88.0 caused Yarn to resolve request@2.88.2, which dropped hawk as a dependency, transitively eliminating hoek, boom, sntp, and cryptiles from the tree. The unscoped hoek package's highest published version (6.1.3) does not satisfy the >=8.5.1 patch requirement, so removal via the parent bump was the correct path.

qs

Resolved from 6.4.0 to 6.16.0 via a resolutions entry (^6.16.0). request@2.88.2 pins qs at ~6.5.2, which caps at 6.5.x — far below the 6.16.0 floor required to address all advisories in scope. No published version of request declares a qs range that admits 6.16.0, making a resolution necessary.

hawk

Removed from the lockfile entirely as a side effect of bumping request to ^2.88.0. request@2.87.0 was the first version to drop hawk as a dependency; resolving request@2.88.2 therefore eliminates hawk@3.1.3 from the tree. No published version of hawk itself satisfies the >=9.0.1 patch requirement under the unscoped package name, so removal via the parent bump was the correct and only viable path.

uuid

Resolved from 3.1.0 to 11.1.1 via a resolutions entry (^11.1.1). request@2.88.2 pins uuid at ^3.3.2, which is bounded to 3.x. No published version of request widens that range to admit uuid@11.x, so a resolution was required to cross the major version boundary to the patched release.

ajv

Resolved from 4.11.8 to 6.15.0 by bumping request to ^2.88.0. request@2.88.0 was the first version to declare har-validator@~5.1.0; har-validator@5.1.5 in turn declares ajv@^6.12.3, which resolves to 6.15.0 — satisfying the >=6.15.0 patch floor. The prior request@2.81.0 used har-validator@~4.2.1, which only admitted ajv@^4.9.1.

lodash

Resolved from 4.17.21 to 4.18.1 via a lockfile-only selector refresh (yarn upgrade 'lodash@^4.13.1'). The parent request-promise-core@1.1.1 already declares lodash@^4.13.1, a range that admits 4.18.x; the lockfile entry was simply stale and needed refreshing to pick up the patched release.

xml2js

Resolved from 0.4.19 to 0.5.0 via a resolutions entry (^0.5.0). The sole parent xml2js-es6-promise@1.1.1 (the only published version of that package) pins xml2js at ^0.4.16, which caps at 0.4.x. Since no newer version of xml2js-es6-promise exists to widen that range, a resolution was the only path to the patched 0.5.0 release.

---

Version changes

Package	From	To	Why updated
request	^2.81.0	^2.88.0	Direct dep bump — required to drop hawk, upgrade har-validator → ajv, and enable other transitive fixes
tough-cookie	2.3.4	4.1.4	Vulnerable package — resolutions override (parent request caps at ~2.5.0)
json-schema	0.2.3	0.4.0	Vulnerable package — lockfile refresh of jsprim to 1.4.2
jsprim	1.4.1	1.4.2	Lockfile refresh — needed to carry json-schema@0.4.0
form-data	2.1.4	2.5.6	Vulnerable package — resolutions override (parent request@2.88.2 caps at ~2.3.2)
hoek	2.16.3	removed	Vulnerable package — eliminated by dropping hawk via request bump
qs	6.4.0	6.16.0	Vulnerable package — resolutions override (parent request@2.88.2 caps at ~6.5.2)
hawk	3.1.3	removed	Vulnerable package — dropped by request@2.88.0+
uuid	3.1.0	11.1.1	Vulnerable package — resolutions override (parent request@2.88.2 caps at ^3.3.2)
ajv	4.11.8	6.15.0	Vulnerable package — transitive after request bump (via har-validator@5.1.5)
lodash	4.17.21	4.18.1	Vulnerable package — lockfile refresh of existing ^4.13.1 range
xml2js	0.4.19	0.5.0	Vulnerable package — resolutions override (parent xml2js-es6-promise@1.1.1 caps at ^0.4.16)
har-validator	4.2.1	5.1.5	Transitive after request bump — carries patched ajv@^6.12.3
boom	2.10.1	removed	Transitive — eliminated by dropping hawk via request bump
sntp	1.0.9	removed	Transitive — eliminated by dropping hawk via request bump
cryptiles	2.0.5	removed	Transitive — eliminated by dropping hawk via request bump