Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

spatie/laravel-translatable

              main @ bf6b2d7
            

Fixes

CVEs

HIGH

Peak severity

Highlights

Auth Bypass: 1 prior fix. Scrutinize any change in this area.

(.github/workflows/dependabot-auto-merge.yml): most-fixed (1 issue). Treat as high-risk during review.

1 high-severity fix in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: The dependabot-auto-merge workflow historically relied on the spoofable 'github.actor' property to authorize automated merges, which could allow unauthorized pull requests to be merged automatically. This was mitigated by switching validation to immutable pull request metadata and explicit repository ownership checks.