fix(deps): update dependency danger to v13 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
danger	^11.0.2 → ^13.0.0

---

danger allows local OS command injection through crafted file paths

CVE-2026-16629 / GHSA-3x93-p86w-5jvh

More information

Details

A vulnerability was identified in danger danger-js up to 13.0.7. Impacted is the function danger.git.diffForFile of the file source/platforms/git/localGetFileAtSHA.ts of the component CLI. Such manipulation of the argument File leads to os command injection. The attack needs to be performed locally. Upgrading to version 13.0.8 is recommended to address this issue. The name of the patch is 087a7290264cc6fb7154ea8c2552a7b2cb8b33a3. It is advisable to upgrade the affected component.

Severity

• CVSS Score: 4.8 / 10 (Medium)
• Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-16629
• https://github.com/danger/danger-js/pull/1513
• https://github.com/danger/danger-js/commit/087a7290264cc6fb7154ea8c2552a7b2cb8b33a3
• https://github.com/danger/danger-js
• https://github.com/danger/danger-js/releases/tag/13.0.8
• https://vuldb.com/cve/CVE-2026-16629
• https://vuldb.com/submit/860211
• https://vuldb.com/vuln/382377
• https://vuldb.com/vuln/382377/cti
• https://github.com/advisories/GHSA-3x93-p86w-5jvh

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

danger/danger-js (danger)

v13.0.8

Compare Source

v13.0.7

Compare Source

v13.0.5

Compare Source

• Dropped p-limit as a dep
• Force no-color in git for the local command - cyberowl
• Use stdout/err in local command - cyberowl

v13.0.4

Compare Source

• Removed some dependencies! [@​yoshi-taka]
• Fixed dockerfile syntax [@​SimenB]

v13.0.3

Compare Source

• Lots of deploy faff, as we are forced to update node in all the build processing [@​orta]

v13.0.2

Compare Source

v13.0.1

Compare Source

v13.0.0

Compare Source

• Breaking Update @octokit/rest from 18 to 20 to prevent transitive CVEs - Fixes #​1479 [@​fbartho]
• Clean up dead discussion link - Fixes #​1467 [@​fbartho]
• Adds infra for pythons pre-commit hooks
• Replace parse-git-config with ini + fs as it has a CVE out - #​1486
• Disabled Windows CI as it was failing for successful builds

v12.3.4

Compare Source

• Ensure that babel ignores do not cause the transpiler to fall over, by supporting the
  null return from loadOptions which occurs when a file is ignored.
• Allow absolute paths for a Dangerfile

v12.3.3

Compare Source

• [#​1180] Set module properly when tsconfig does not contain compilerOptions.module [@​matthewh]

v12.3.2

Compare Source

• [#​1180] Adds support for ESM Dangerfiles (by using dangerfile.mts/dangerfile.mjs) [@​matthewh]

v12.3.1

Compare Source

• Fixes for created, modified and deleted files in GitHub - [@​szweier]
• Dont log about github.pr not being available in pull_request_target - [@​sayali10]

v12.3.0

Compare Source

• Dockerfile changes - [@​glensc]
• Use node 18 for pre-built versions of danger (used by Danger Swift / Kotlin et al) - [@​heltoft]

v12.2.1

Compare Source

v12.2.0

Compare Source

• Adds a log when you run on GitHub Actions without being a pull_request - [@​orta]
• GitHub: Move to 'List pull request files' API with pagination support [@​fabianehlert]

v12.1.0

Compare Source

It's been 7 years since I looked at danger init and err, the world of CI has changed quite a bit since then. So, Danger JS's
init command now knows that GitHub Actions exists and will correctly offer some advice on how to set up a Dangerfile for it. - [@​orta]

v12.0.1

Compare Source

Bumping to 12.x because we've raised the minimum to node version from 14 to 18. This is due to some of our dependencies
requiring a newer version of node. This is a breaking change for some folk! Also, 14 has been out of support for quite a while
now and Node 18 gives us a full year. - [@​orta]

• Remove the user checks in GitHub comment/inline comment lookups, to allow using app tokens [#​1433] - [@​orta]
• Upgrade node engine from >=14.13.1 to >=18 [@​heltoft]
• Upgrade @types/node from ^10.11.3 to 18.19.18 [@​heltoft]
• GitLab: [#​1386] Move from @gitbeaker/node to @gitbeaker/rest [@​heltoft]
• GitLab: [#​1412] Danger fails to create inline comments on Gitlab [@​heltoft]
• GitLab: [#​1405] Can't post multiple inline comments [@​heltoft]
• GitLab: Do not delete system resolved danger inline comments [@​heltoft]
• Fix for ESM imports in Dangerfiles [@​mgol]

v12.0.0

Compare Source

Bumping to 12.x because we've raised the minimum to node version from 14 to 18. This is due to some of our dependencies
requiring a newer version of node. This is a breaking change for some folk! Also, 14 has been out of support for quite a while
now and Node 18 gives us a full year. - [@​orta]

• Remove the user checks in GitHub comment/inline comment lookups, to allow using app tokens [#​1433] - [@​orta]
• Upgrade node engine from >=14.13.1 to >=18 [@​heltoft]
• Upgrade @types/node from ^10.11.3 to 18.19.18 [@​heltoft]
• GitLab: [#​1386] Move from @gitbeaker/node to @gitbeaker/rest [@​heltoft]
• GitLab: [#​1412] Danger fails to create inline comments on Gitlab [@​heltoft]
• GitLab: [#​1405] Can't post multiple inline comments [@​heltyarnoft]
• GitLab: Do not delete system resolved danger inline comments [@​heltoft]
• Fix for ESM imports in Dangerfiles [@​mgol]

v11.3.1

Compare Source

• Adds pull_number into thisPR in the GitHub SDL [@​radimsv]
• Clear missing DSL timeout when DSL is found so danger runner can exit faster when done [@​normano64]
• Customise GHE actions bot user ID via DANGER_GHE_ACTIONS_BOT_USER_ID #​1404 [@​dimitar-hristov]

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Never, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[bolt-new-by-stackblitz]

Run & review this pull request in StackBlitz Codeflow.

[changeset-bot]

⚠️ No Changeset found

Latest commit: cbd9759

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[codesandbox-ci]

This pull request is automatically built and testable in CodeSandbox.

To see build info of the built libraries, click here or the icon next to each commit SHA.

Latest deployment of this branch, based on commit cbd9759:

Sandbox	Source
@twilio-paste/nextjs-template	Configuration
@twilio-paste/token-contrast-checker	Configuration