Minimus-Junior-Backend-Exercise

Junior Backend Exercise — dasel v3.3.1 Package dasel v3.3.1 with Melange, build a container image with apko, and fix CVE-2026-33320. Prerequisites: Docker. All build steps run inside containers — no local melange/apko install needed. Run all commands from the repo root on linux/amd64 or Docker...

CLEANSTART-2026-SF33903 js-yaml is a JavaScript YAML parser and dumper

Security vulnerability affects the argo-workflows package. js-yaml is a JavaScript YAML parser and dumper...

GHSA-WHR6-FGPQ-FPV9 compose-lint: A committed symlink makes compose-lint quote a file from outside the project into its output

Impact Like Docker Compose, compose-lint follows symlinks when it reads a project's files. Unlike Compose, compose-lint up to 0.24.0 could then put the contents of a file from outside the project into its output, where the author of a pull request can read it. A pull request can commit a symlink,...

compose-lint: A committed symlink makes compose-lint quote a file from outside the project into its output

Impact Like Docker Compose, compose-lint follows symlinks when it reads a project's files. Unlike Compose, compose-lint up to 0.24.0 could then put the contents of a file from outside the project into its output, where the author of a pull request can read it. A pull request can commit a symlink,...

compose-lint: `fix --apply` can delete a line the user did not select, including a security setting

Impact compose-lint fix --apply converts the line numbers its fixers work with into positions in the file. The YAML parser treats a lone carriage return, U+0085, U+2028 and U+2029 as line breaks, but the conversion counted only \n. One of those characters inside a quoted value, which most editors...

EUVD-2026-120127

compose-lint: fix --apply can delete a line the user did not select, including a security setting...

GHSA-65V8-Q222-64XX compose-lint: `fix --apply` can delete a line the user did not select, including a security setting

Impact compose-lint fix --apply converts the line numbers its fixers work with into positions in the file. The YAML parser treats a lone carriage return, U+0085, U+2028 and U+2029 as line breaks, but the conversion counted only \n. One of those characters inside a quoted value, which most editors...

CVE-2026-123370

compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. From 0.9.0 until 0.18.0, compose-lint's YAML parser recognizes lone carriage returns and Unicode line separators U+0085, U+2028, and U+2029 as line breaks while fix position conversion...

CVE-2026-123370 compose-lint: `fix --apply` can delete a line the user did not select, including a security setting

compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. From 0.9.0 until 0.18.0, compose-lint's YAML parser recognizes lone carriage returns and Unicode line separators U+0085, U+2028, and U+2029 as line breaks while fix position conversion...

CVE-2026-123370 compose-lint: `fix --apply` can delete a line the user did not select, including a security setting

compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. From 0.9.0 until 0.18.0, compose-lint's YAML parser recognizes lone carriage returns and Unicode line separators U+0085, U+2028, and U+2029 as line breaks while fix position conversion...

CVE-2026-123370

The compose-lint Docker Compose security linter (versions 0.9.0 through 0.18.0 ) is vulnerable to an issue where the YAML parser recognizes lone carriage returns and various Unicode line separators (e.g., U+0085 , U+2028 , U+2029 ) as line breaks, while position conversion only counts standard ne...

CVE-2026-123370

compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. From 0.9.0 until 0.18.0, compose-lint's YAML parser recognizes lone carriage returns and Unicode line separators U+0085, U+2028, and U+2029 as line breaks while fix position conversion...

CVE-2026-123370: tmatens compose-lint: compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment

compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. From 0.9.0 until 0.18.0, compose-lint's YAML parser recognizes lone carriage returns and Unicode line separators U+0085, U+2028, and U+2029 as line breaks while fix position conversion...

PT-2026-140931

Name of the Vulnerable Software and Affected Versions compose-lint versions 0.9.0 through 0.17.0 Description The YAML parser in compose-lint incorrectly handles lone carriage returns and Unicode line separators U+0085, U+2028, and U+2029 by recognizing them as line breaks, whereas the fix positio...

CLEANSTART-2026-NU63132 js-yaml is a JavaScript YAML parser and dumper

Security vulnerability affects the argo-workflows package. js-yaml is a JavaScript YAML parser and dumper...

CLEANSTART-2026-XC07817 js-yaml is a JavaScript YAML parser and dumper

CVE-2026-59869 affects multiple packages. js-yaml is a JavaScript YAML parser and dumper. See references for individual vulnerability details...

CLEANSTART-2026-PU16771 js-yaml is a JavaScript YAML parser and dumper

CVE-2026-53550 affects multiple packages. js-yaml is a JavaScript YAML parser and dumper. See references for individual vulnerability details...

CLEANSTART-2026-EJ12081 js-yaml is a JavaScript YAML parser and dumper

CVE-2026-59869 affects multiple packages. js-yaml is a JavaScript YAML parser and dumper. See references for individual vulnerability details...

CLEANSTART-2026-BJ01560 js-yaml is a JavaScript YAML parser and dumper

Security vulnerability affects the argo-workflows package. js-yaml is a JavaScript YAML parser and dumper...

Symfony and Symfony YAML Component 2.0.x < 5.4.54 / 6.0.x < 6.4.45 / 7.0.x < 7.4.18 / 8.0.x < 8.1.6 DoS

The version of Symfony and/or the Symfony YAML Component installed on the remote host is 2.0.x prior to 5.4.54, or 6.0.x prior to 6.4.45, or 7.0.x prior to 7.4.18, or 8.0.x prior to 8.1.6. It is, therefore, affected by a denial of service vulnerability. - Yaml\Parser::lexInlineStructure recursed...