Description of the patch:
This update for agama-web-ui fixes the following issues:
- CVE-2025-7783: form-data: unsafe
Math.random() function is used to select a boundary value for multipart
form-encoded data (bsc#1246822).
- CVE-2026-12143: form-data: CRLF injection via unescaped multipart field names and filenames (bsc#1272310).
- CVE-2026-13149: brace-expansion:
expand() function exhibits exponential-time complexity when processing
non-expanding {} brace groups (bsc#1269927).
- CVE-2026-13311: shell-quote: quadratic complexity in
parse() function when processing specially crafted strings
(bsc#1269359).
- CVE-2026-13676: fast-uri: host-based policy bypass due to failure to canonicalize Unicode/IDN hostnames for
HTTP-family URLs (bsc#1269595).
- CVE-2026-27601: underscore: DoS via stack overflow due to missing depth limits in
_.flatten and _.isEqual
functions (bsc#1259169).
- CVE-2026-40181: react-router: open redirect to an external domain due to path values starting with
// being
reinterpreted as protocol-relative URLs (bsc#1272311).
- CVE-2026-49356: @babel/core: arbitrary file read via
sourceMappingURL comment (bsc#1272317).
- CVE-2026-53550: js-yaml: quadratic complexity in merge-key processing when processing a crafted YAML document
(bsc#1268851).
- CVE-2026-53632: launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows (bsc#1272319).
- CVE-2026-54466: websocket-driver: message corruption via abuse of protocol length headers (bsc#1272312).
- CVE-2026-54490: websocket-driver: resource limit bypass via message compression (bsc#1272313).
- CVE-2026-55602: http-proxy-middleware: Host-header-driven backend routing bypass via
router host+path substring
matching (bsc#1272318).