{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-d73af77d86a64e46", "name": "Insecure pattern 'direct_innerhtml_assignment' in js/profiler.js:376", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/profiler.js:376"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.65}}, {"id": "scanner-066c0840d17aeac7", "name": "Insecure pattern 'direct_innerhtml_assignment' in js/uiController.js:478", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/uiController.js:478"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.65}}, {"id": "scanner-a6816b3533dbf528", "name": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/notices.js:70", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/notices.js:70"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.65}}, {"id": "scanner-91be7821d5743aca", "name": "Insecure pattern 'node_child_process' in scripts/parse-commit.js:17", "shortDescription": {"text": "Insecure pattern 'node_child_process' in scripts/parse-commit.js:17"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.9}}, {"id": "scanner-4957a8e87f3a7f18", "name": "Insecure pattern 'node_child_process' in scripts/generate-changelog.js:10", "shortDescription": {"text": "Insecure pattern 'node_child_process' in scripts/generate-changelog.js:10"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.9}}, {"id": "scanner-619ddb796db50de0", "name": "Insecure pattern 'node_child_process' in scripts/bump-version.js:11", "shortDescription": {"text": "Insecure pattern 'node_child_process' in scripts/bump-version.js:11"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.9}}, {"id": "scanner-224e243df62fb1bf", "name": "Insecure pattern 'direct_innerhtml_assignment' in libs/js/nouislider.min.js:2", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in libs/js/nouislider.min.js:2"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.65}}, {"id": "scanner-6372cebde0220094", "name": "No auth library detected", "shortDescription": {"text": "No auth library detected"}, "fullDescription": {"text": "The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). The repo has auth/admin/session surface indicators, so auth may live in custom code, in a separate service, or be missing."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a0879b4b30be2a87", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-46c644c6227e4d4a", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1838a141491ce38c", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6893a6c8b0861585", "name": "Very low test-to-source ratio", "shortDescription": {"text": "Very low test-to-source ratio"}, "fullDescription": {"text": "1 test file(s) for 36 source file(s) (ratio 0.03). Consider adding integration or unit tests for critical paths."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 45 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2a5d900f9374579a", "name": "Fire-and-forget `fetch()` has no rejection handler \u2014 js/main.js:212", "shortDescription": {"text": "Fire-and-forget `fetch()` has no rejection handler \u2014 js/main.js:212"}, "fullDescription": {"text": "This fetch result is neither awaited, returned, assigned, nor followed by `.catch(...)`. A network failure can therefore become an unhandled promise rejection. Await/return the promise or attach an explicit rejection handler."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-d81dcbdfe52fde98", "name": "Fire-and-forget `fetch()` has no rejection handler \u2014 js/uiController.js:558", "shortDescription": {"text": "Fire-and-forget `fetch()` has no rejection handler \u2014 js/uiController.js:558"}, "fullDescription": {"text": "This fetch result is neither awaited, returned, assigned, nor followed by `.catch(...)`. A network failure can therefore become an unhandled promise rejection. Await/return the promise or attach an explicit rejection handler."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-bee48d834fb380da", "name": "Fire-and-forget `fetch()` has no rejection handler \u2014 js/ui/notices.js:108", "shortDescription": {"text": "Fire-and-forget `fetch()` has no rejection handler \u2014 js/ui/notices.js:108"}, "fullDescription": {"text": "This fetch result is neither awaited, returned, assigned, nor followed by `.catch(...)`. A network failure can therefore become an unhandled promise rejection. Await/return the promise or attach an explicit rejection handler."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-ec6edb1e92a4c29d", "name": "Vulnerable dependency brace-expansion 2.1.2: GHSA-mh99-v99m-4gvg", "shortDescription": {"text": "Vulnerable dependency brace-expansion 2.1.2: GHSA-mh99-v99m-4gvg"}, "fullDescription": {"text": "OSV.dev reports `brace-expansion` at version `2.1.2` (resolved in `package-lock.json`) is affected by GHSA-mh99-v99m-4gvg (aka CVE-2026-14257).\nNote: `brace-expansion` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nbrace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash\n\nAliases: CVE-2026-14257\nAdvisory: https://osv.dev/vulnerability/GHSA-mh99-v99m-4gvg\nFix: upgrade `brace-expansion` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-0fd8c517a9b2c9df", "name": "Vulnerable dependency brace-expansion 2.1.2: GHSA-rgw5-rvv9-x895", "shortDescription": {"text": "Vulnerable dependency brace-expansion 2.1.2: GHSA-rgw5-rvv9-x895"}, "fullDescription": {"text": "OSV.dev reports `brace-expansion` at version `2.1.2` (resolved in `package-lock.json`) is affected by GHSA-rgw5-rvv9-x895 (aka CVE-2026-69152).\nNote: `brace-expansion` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nbrace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation\n\nAliases: CVE-2026-69152\nAdvisory: https://osv.dev/vulnerability/GHSA-rgw5-rvv9-x895\nFix: upgrade `brace-expansion` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-64d832dbe6c52379", "name": "Vulnerable dependency tar 6.2.1: GHSA-23hp-3jrh-7fpw", "shortDescription": {"text": "Vulnerable dependency tar 6.2.1: GHSA-23hp-3jrh-7fpw"}, "fullDescription": {"text": "OSV.dev reports `tar` at version `6.2.1` (resolved in `package-lock.json`) is affected by GHSA-23hp-3jrh-7fpw (aka CVE-2026-59873).\nNote: `tar` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nnode-tar: Decompression/parse DoS via unlimited input\n\nAliases: CVE-2026-59873\nAdvisory: https://osv.dev/vulnerability/GHSA-23hp-3jrh-7fpw\nFix: upgrade `tar` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-cef61d23a009a332", "name": "Vulnerable dependency tar 6.2.1: GHSA-34x7-hfp2-rc4v", "shortDescription": {"text": "Vulnerable dependency tar 6.2.1: GHSA-34x7-hfp2-rc4v"}, "fullDescription": {"text": "OSV.dev reports `tar` at version `6.2.1` (resolved in `package-lock.json`) is affected by GHSA-34x7-hfp2-rc4v (aka CVE-2026-24842).\nNote: `tar` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nnode-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal\n\nAliases: CVE-2026-24842\nAdvisory: https://osv.dev/vulnerability/GHSA-34x7-hfp2-rc4v\nFix: upgrade `tar` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-a7245c8d0ead0c03", "name": "Vulnerable dependency tar 6.2.1: GHSA-83g3-92jg-28cx", "shortDescription": {"text": "Vulnerable dependency tar 6.2.1: GHSA-83g3-92jg-28cx"}, "fullDescription": {"text": "OSV.dev reports `tar` at version `6.2.1` (resolved in `package-lock.json`) is affected by GHSA-83g3-92jg-28cx (aka CVE-2026-26960).\nNote: `tar` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nArbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in node-tar Extraction\n\nAliases: CVE-2026-26960\nAdvisory: https://osv.dev/vulnerability/GHSA-83g3-92jg-28cx\nFix: upgrade `tar` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-201b6fadcd39ce78", "name": "Vulnerable dependency tar 6.2.1: GHSA-8qq5-rm4j-mr97", "shortDescription": {"text": "Vulnerable dependency tar 6.2.1: GHSA-8qq5-rm4j-mr97"}, "fullDescription": {"text": "OSV.dev reports `tar` at version `6.2.1` (resolved in `package-lock.json`) is affected by GHSA-8qq5-rm4j-mr97 (aka CVE-2026-23745).\nNote: `tar` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nnode-tar is Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization\n\nAliases: CVE-2026-23745\nAdvisory: https://osv.dev/vulnerability/GHSA-8qq5-rm4j-mr97\nFix: upgrade `tar` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-762768600a92ece3", "name": "Vulnerable dependency tar 6.2.1: GHSA-8x88-c5mf-7j5w", "shortDescription": {"text": "Vulnerable dependency tar 6.2.1: GHSA-8x88-c5mf-7j5w"}, "fullDescription": {"text": "OSV.dev reports `tar` at version `6.2.1` (resolved in `package-lock.json`) is affected by GHSA-8x88-c5mf-7j5w (aka CVE-2026-59874).\nNote: `tar` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nnode-tar: Negative tar entry size causes infinite loop in archive replace\n\nAliases: CVE-2026-59874\nAdvisory: https://osv.dev/vulnerability/GHSA-8x88-c5mf-7j5w\nFix: upgrade `tar` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-197e923092629f72", "name": "Vulnerable dependency tar 6.2.1: GHSA-9ppj-qmqm-q256", "shortDescription": {"text": "Vulnerable dependency tar 6.2.1: GHSA-9ppj-qmqm-q256"}, "fullDescription": {"text": "OSV.dev reports `tar` at version `6.2.1` (resolved in `package-lock.json`) is affected by GHSA-9ppj-qmqm-q256 (aka CVE-2026-31802).\nNote: `tar` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nnode-tar Symlink Path Traversal via Drive-Relative Linkpath\n\nAliases: CVE-2026-31802\nAdvisory: https://osv.dev/vulnerability/GHSA-9ppj-qmqm-q256\nFix: upgrade `tar` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-3130881563beb8a7", "name": "Vulnerable dependency tar 6.2.1: GHSA-gvwx-54wh-qm9j", "shortDescription": {"text": "Vulnerable dependency tar 6.2.1: GHSA-gvwx-54wh-qm9j"}, "fullDescription": {"text": "OSV.dev reports `tar` at version `6.2.1` (resolved in `package-lock.json`) is affected by GHSA-gvwx-54wh-qm9j (aka CVE-2026-59875).\nNote: `tar` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nnode-tar: Uncaught Exception DoS via NUL byte in PAX path/linkpath records\n\nAliases: CVE-2026-59875\nAdvisory: https://osv.dev/vulnerability/GHSA-gvwx-54wh-qm9j\nFix: upgrade `tar` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-0989b1d8edbfcfa5", "name": "Vulnerable dependency tar 6.2.1: GHSA-qffp-2rhf-9h96", "shortDescription": {"text": "Vulnerable dependency tar 6.2.1: GHSA-qffp-2rhf-9h96"}, "fullDescription": {"text": "OSV.dev reports `tar` at version `6.2.1` (resolved in `package-lock.json`) is affected by GHSA-qffp-2rhf-9h96 (aka CVE-2026-29786).\nNote: `tar` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\ntar has Hardlink Path Traversal via Drive-Relative Linkpath\n\nAliases: CVE-2026-29786\nAdvisory: https://osv.dev/vulnerability/GHSA-qffp-2rhf-9h96\nFix: upgrade `tar` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-c55d53acfbfbf5e8", "name": "Vulnerable dependency tar 6.2.1: GHSA-r292-9mhp-454m", "shortDescription": {"text": "Vulnerable dependency tar 6.2.1: GHSA-r292-9mhp-454m"}, "fullDescription": {"text": "OSV.dev reports `tar` at version `6.2.1` (resolved in `package-lock.json`) is affected by GHSA-r292-9mhp-454m.\nNote: `tar` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nnode-tar: Uncontrolled recursion in mapHas/filesFilter allows uncatchable stack-overflow DoS via crafted long-path tar with member selection\n\nAdvisory: https://osv.dev/vulnerability/GHSA-r292-9mhp-454m\nFix: upgrade `tar` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-6ebf52dd3dd11027", "name": "Vulnerable dependency tar 6.2.1: GHSA-r6q2-hw4h-h46w", "shortDescription": {"text": "Vulnerable dependency tar 6.2.1: GHSA-r6q2-hw4h-h46w"}, "fullDescription": {"text": "OSV.dev reports `tar` at version `6.2.1` (resolved in `package-lock.json`) is affected by GHSA-r6q2-hw4h-h46w (aka CVE-2026-23950).\nNote: `tar` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nRace Condition in node-tar Path Reservations via Unicode Ligature Collisions on macOS APFS\n\nAliases: CVE-2026-23950\nAdvisory: https://osv.dev/vulnerability/GHSA-r6q2-hw4h-h46w\nFix: upgrade `tar` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-fe545e4531c37cbe", "name": "Vulnerable dependency tar 6.2.1: GHSA-vmf3-w455-68vh", "shortDescription": {"text": "Vulnerable dependency tar 6.2.1: GHSA-vmf3-w455-68vh"}, "fullDescription": {"text": "OSV.dev reports `tar` at version `6.2.1` (resolved in `package-lock.json`) is affected by GHSA-vmf3-w455-68vh.\nNote: `tar` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-vmf3-w455-68vh\nFix: upgrade `tar` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-ba2e6231b54837aa", "name": "Vulnerable dependency tar 6.2.1: GHSA-w8wr-v893-vjvp", "shortDescription": {"text": "Vulnerable dependency tar 6.2.1: GHSA-w8wr-v893-vjvp"}, "fullDescription": {"text": "OSV.dev reports `tar` at version `6.2.1` (resolved in `package-lock.json`) is affected by GHSA-w8wr-v893-vjvp.\nNote: `tar` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-w8wr-v893-vjvp\nFix: upgrade `tar` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-151ad96f394c4276", "name": "Vulnerable dependency brace-expansion 1.1.16: GHSA-mh99-v99m-4gvg", "shortDescription": {"text": "Vulnerable dependency brace-expansion 1.1.16: GHSA-mh99-v99m-4gvg"}, "fullDescription": {"text": "OSV.dev reports `brace-expansion` at version `1.1.16` (resolved in `package-lock.json`) is affected by GHSA-mh99-v99m-4gvg (aka CVE-2026-14257).\nNote: `brace-expansion` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nbrace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash\n\nAliases: CVE-2026-14257\nAdvisory: https://osv.dev/vulnerability/GHSA-mh99-v99m-4gvg\nFix: upgrade `brace-expansion` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-d1721fbcaad3bb97", "name": "Vulnerable dependency brace-expansion 1.1.16: GHSA-rgw5-rvv9-x895", "shortDescription": {"text": "Vulnerable dependency brace-expansion 1.1.16: GHSA-rgw5-rvv9-x895"}, "fullDescription": {"text": "OSV.dev reports `brace-expansion` at version `1.1.16` (resolved in `package-lock.json`) is affected by GHSA-rgw5-rvv9-x895 (aka CVE-2026-69152).\nNote: `brace-expansion` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nbrace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation\n\nAliases: CVE-2026-69152\nAdvisory: https://osv.dev/vulnerability/GHSA-rgw5-rvv9-x895\nFix: upgrade `brace-expansion` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-97e1ea846e6d5bf2", "name": "Vulnerable dependency js-yaml 4.3.0: GHSA-5p4m-2wfm-xmqj", "shortDescription": {"text": "Vulnerable dependency js-yaml 4.3.0: GHSA-5p4m-2wfm-xmqj"}, "fullDescription": {"text": "OSV.dev reports `js-yaml` at version `4.3.0` (resolved in `package-lock.json`) is affected by GHSA-5p4m-2wfm-xmqj.\nNote: `js-yaml` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nJS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) \u2014 CVE-2026-59870 fix not backported\n\nAdvisory: https://osv.dev/vulnerability/GHSA-5p4m-2wfm-xmqj\nFix: upgrade `js-yaml` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-0b37292bb287407b", "name": "Vulnerable dependency minimatch 3.0.5: GHSA-23c5-xmqv-rm74", "shortDescription": {"text": "Vulnerable dependency minimatch 3.0.5: GHSA-23c5-xmqv-rm74"}, "fullDescription": {"text": "OSV.dev reports `minimatch` at version `3.0.5` (resolved in `package-lock.json`) is affected by GHSA-23c5-xmqv-rm74 (aka CVE-2026-27904).\nNote: `minimatch` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nminimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions\n\nAliases: CVE-2026-27904\nAdvisory: https://osv.dev/vulnerability/GHSA-23c5-xmqv-rm74\nFix: upgrade `minimatch` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-e8f6b61fc1457109", "name": "Vulnerable dependency minimatch 3.0.5: GHSA-3ppc-4f35-3m26", "shortDescription": {"text": "Vulnerable dependency minimatch 3.0.5: GHSA-3ppc-4f35-3m26"}, "fullDescription": {"text": "OSV.dev reports `minimatch` at version `3.0.5` (resolved in `package-lock.json`) is affected by GHSA-3ppc-4f35-3m26 (aka CVE-2026-26996).\nNote: `minimatch` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nminimatch has a ReDoS via repeated wildcards with non-matching literal in pattern\n\nAliases: CVE-2026-26996\nAdvisory: https://osv.dev/vulnerability/GHSA-3ppc-4f35-3m26\nFix: upgrade `minimatch` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-58d5872504227104", "name": "Vulnerable dependency minimatch 3.0.5: GHSA-7r86-cg39-jmmj", "shortDescription": {"text": "Vulnerable dependency minimatch 3.0.5: GHSA-7r86-cg39-jmmj"}, "fullDescription": {"text": "OSV.dev reports `minimatch` at version `3.0.5` (resolved in `package-lock.json`) is affected by GHSA-7r86-cg39-jmmj (aka CVE-2026-27903).\nNote: `minimatch` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nminimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments\n\nAliases: CVE-2026-27903\nAdvisory: https://osv.dev/vulnerability/GHSA-7r86-cg39-jmmj\nFix: upgrade `minimatch` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-5d74ab6286d1e088", "name": "Vulnerable dependency brace-expansion 5.0.7: GHSA-mh99-v99m-4gvg", "shortDescription": {"text": "Vulnerable dependency brace-expansion 5.0.7: GHSA-mh99-v99m-4gvg"}, "fullDescription": {"text": "OSV.dev reports `brace-expansion` at version `5.0.7` (resolved in `package-lock.json`) is affected by GHSA-mh99-v99m-4gvg (aka CVE-2026-14257).\nNote: `brace-expansion` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nbrace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash\n\nAliases: CVE-2026-14257\nAdvisory: https://osv.dev/vulnerability/GHSA-mh99-v99m-4gvg\nFix: upgrade `brace-expansion` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-ac3cb977b9dec278", "name": "Vulnerable dependency brace-expansion 5.0.7: GHSA-rgw5-rvv9-x895", "shortDescription": {"text": "Vulnerable dependency brace-expansion 5.0.7: GHSA-rgw5-rvv9-x895"}, "fullDescription": {"text": "OSV.dev reports `brace-expansion` at version `5.0.7` (resolved in `package-lock.json`) is affected by GHSA-rgw5-rvv9-x895 (aka CVE-2026-69152).\nNote: `brace-expansion` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nbrace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation\n\nAliases: CVE-2026-69152\nAdvisory: https://osv.dev/vulnerability/GHSA-rgw5-rvv9-x895\nFix: upgrade `brace-expansion` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-53ae15ca57837468", "name": "Vulnerable dependency sharp 0.32.6: GHSA-f88m-g3jw-g9cj", "shortDescription": {"text": "Vulnerable dependency sharp 0.32.6: GHSA-f88m-g3jw-g9cj"}, "fullDescription": {"text": "OSV.dev reports `sharp` at version `0.32.6` (resolved in `package-lock.json`) is affected by GHSA-f88m-g3jw-g9cj.\nNote: `sharp` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nsharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591\n\nAdvisory: https://osv.dev/vulnerability/GHSA-f88m-g3jw-g9cj\nFix: upgrade `sharp` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-7969ee3bffefc78d", "name": "Vulnerable dependency tar 7.5.20: GHSA-r292-9mhp-454m", "shortDescription": {"text": "Vulnerable dependency tar 7.5.20: GHSA-r292-9mhp-454m"}, "fullDescription": {"text": "OSV.dev reports `tar` at version `7.5.20` (resolved in `package-lock.json`) is affected by GHSA-r292-9mhp-454m.\nNote: `tar` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nnode-tar: Uncontrolled recursion in mapHas/filesFilter allows uncatchable stack-overflow DoS via crafted long-path tar with member selection\n\nAdvisory: https://osv.dev/vulnerability/GHSA-r292-9mhp-454m\nFix: upgrade `tar` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}]}}, "automationDetails": {"id": "repobility/30810"}, "properties": {"repository": "InsertCleverNameHere/Drums-Trainer", "repoUrl": "https://github.com/InsertCleverNameHere/Drums-Trainer", "branch": "main"}, "results": [{"ruleId": "scanner-d73af77d86a64e46", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/profiler.js:376"}, "properties": {"repobilityId": "8a669920d2207b86", "scanner": "scanner-primary", "fingerprint": "d73af77d86a64e46", "layer": "security", "severity": "medium", "confidence": 0.65, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "js/profiler.js"}, "region": {"startLine": 376}}}]}, {"ruleId": "scanner-066c0840d17aeac7", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/uiController.js:478"}, "properties": {"repobilityId": "d751aff5cd403210", "scanner": "scanner-primary", "fingerprint": "066c0840d17aeac7", "layer": "security", "severity": "medium", "confidence": 0.65, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "js/uiController.js"}, "region": {"startLine": 478}}}]}, {"ruleId": "scanner-a6816b3533dbf528", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/notices.js:70"}, "properties": {"repobilityId": "c94738493f921aa6", "scanner": "scanner-primary", "fingerprint": "a6816b3533dbf528", "layer": "security", "severity": "medium", "confidence": 0.65, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "js/ui/notices.js"}, "region": {"startLine": 70}}}]}, {"ruleId": "scanner-91be7821d5743aca", "level": "error", "message": {"text": "Insecure pattern 'node_child_process' in scripts/parse-commit.js:17"}, "properties": {"repobilityId": "78fb944079dd7b4c", "scanner": "scanner-primary", "fingerprint": "91be7821d5743aca", "layer": "security", "severity": "high", "confidence": 0.9, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/parse-commit.js"}, "region": {"startLine": 17}}}]}, {"ruleId": "scanner-4957a8e87f3a7f18", "level": "error", "message": {"text": "Insecure pattern 'node_child_process' in scripts/generate-changelog.js:10"}, "properties": {"repobilityId": "aaf12f30d4a31aad", "scanner": "scanner-primary", "fingerprint": "4957a8e87f3a7f18", "layer": "security", "severity": "high", "confidence": 0.9, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/generate-changelog.js"}, "region": {"startLine": 10}}}]}, {"ruleId": "scanner-619ddb796db50de0", "level": "error", "message": {"text": "Insecure pattern 'node_child_process' in scripts/bump-version.js:11"}, "properties": {"repobilityId": "7c12f002b5e29798", "scanner": "scanner-primary", "fingerprint": "619ddb796db50de0", "layer": "security", "severity": "high", "confidence": 0.9, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/bump-version.js"}, "region": {"startLine": 11}}}]}, {"ruleId": "scanner-224e243df62fb1bf", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in libs/js/nouislider.min.js:2"}, "properties": {"repobilityId": "7777e37a40ee44e1", "scanner": "scanner-primary", "fingerprint": "224e243df62fb1bf", "layer": "security", "severity": "medium", "confidence": 0.65, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "libs/js/nouislider.min.js"}, "region": {"startLine": 2}}}]}, {"ruleId": "scanner-6372cebde0220094", "level": "warning", "message": {"text": "No auth library detected"}, "properties": {"repobilityId": "a5b6035a5bbf8054", "scanner": "scanner-primary", "fingerprint": "6372cebde0220094", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["coverage", "auth"]}}, {"ruleId": "scanner-a0879b4b30be2a87", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "6158a699f06705ec", "scanner": "scanner-primary", "fingerprint": "a0879b4b30be2a87", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pr-validate.yml"}, "region": {"startLine": 13}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "04f6c832d67a7838", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 27}}}]}, {"ruleId": "scanner-1838a141491ce38c", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "b8fd4f5048f96576", "scanner": "scanner-primary", "fingerprint": "1838a141491ce38c", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6893a6c8b0861585", "level": "warning", "message": {"text": "Very low test-to-source ratio"}, "properties": {"repobilityId": "54a7de3f06314bf0", "scanner": "scanner-primary", "fingerprint": "6893a6c8b0861585", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["tests", "coverage"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "87c1e64dff441063", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-2a5d900f9374579a", "level": "warning", "message": {"text": "Fire-and-forget `fetch()` has no rejection handler \u2014 js/main.js:212"}, "properties": {"repobilityId": "75770b22f837b624", "scanner": "scanner-primary", "fingerprint": "2a5d900f9374579a", "layer": "quality", "severity": "medium", "confidence": 0.9, "tags": ["integrity", "fragile-runtime", "robustness", "unhandled-promise"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "js/main.js"}, "region": {"startLine": 212}}}]}, {"ruleId": "scanner-d81dcbdfe52fde98", "level": "warning", "message": {"text": "Fire-and-forget `fetch()` has no rejection handler \u2014 js/uiController.js:558"}, "properties": {"repobilityId": "85ad6f7cad15ce8d", "scanner": "scanner-primary", "fingerprint": "d81dcbdfe52fde98", "layer": "quality", "severity": "medium", "confidence": 0.9, "tags": ["integrity", "fragile-runtime", "robustness", "unhandled-promise"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "js/uiController.js"}, "region": {"startLine": 558}}}]}, {"ruleId": "scanner-bee48d834fb380da", "level": "warning", "message": {"text": "Fire-and-forget `fetch()` has no rejection handler \u2014 js/ui/notices.js:108"}, "properties": {"repobilityId": "b88e9df81924a1da", "scanner": "scanner-primary", "fingerprint": "bee48d834fb380da", "layer": "quality", "severity": "medium", "confidence": 0.9, "tags": ["integrity", "fragile-runtime", "robustness", "unhandled-promise"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "js/ui/notices.js"}, "region": {"startLine": 108}}}]}, {"ruleId": "scanner-ec6edb1e92a4c29d", "level": "error", "message": {"text": "Vulnerable dependency brace-expansion 2.1.2: GHSA-mh99-v99m-4gvg"}, "properties": {"repobilityId": "48885af058b76e05", "scanner": "scanner-primary", "fingerprint": "ec6edb1e92a4c29d", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-mh99-v99m-4gvg", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0fd8c517a9b2c9df", "level": "error", "message": {"text": "Vulnerable dependency brace-expansion 2.1.2: GHSA-rgw5-rvv9-x895"}, "properties": {"repobilityId": "aa4f34e9eff3f16f", "scanner": "scanner-primary", "fingerprint": "0fd8c517a9b2c9df", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-rgw5-rvv9-x895", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-64d832dbe6c52379", "level": "error", "message": {"text": "Vulnerable dependency tar 6.2.1: GHSA-23hp-3jrh-7fpw"}, "properties": {"repobilityId": "2b31f5b015f63b19", "scanner": "scanner-primary", "fingerprint": "64d832dbe6c52379", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-23hp-3jrh-7fpw", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-cef61d23a009a332", "level": "error", "message": {"text": "Vulnerable dependency tar 6.2.1: GHSA-34x7-hfp2-rc4v"}, "properties": {"repobilityId": "6278a266c23d1504", "scanner": "scanner-primary", "fingerprint": "cef61d23a009a332", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-34x7-hfp2-rc4v", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a7245c8d0ead0c03", "level": "error", "message": {"text": "Vulnerable dependency tar 6.2.1: GHSA-83g3-92jg-28cx"}, "properties": {"repobilityId": "de5b704a7f8378d1", "scanner": "scanner-primary", "fingerprint": "a7245c8d0ead0c03", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-83g3-92jg-28cx", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-201b6fadcd39ce78", "level": "error", "message": {"text": "Vulnerable dependency tar 6.2.1: GHSA-8qq5-rm4j-mr97"}, "properties": {"repobilityId": "f87ce42440b8ea48", "scanner": "scanner-primary", "fingerprint": "201b6fadcd39ce78", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-8qq5-rm4j-mr97", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-762768600a92ece3", "level": "error", "message": {"text": "Vulnerable dependency tar 6.2.1: GHSA-8x88-c5mf-7j5w"}, "properties": {"repobilityId": "a97460913e322b17", "scanner": "scanner-primary", "fingerprint": "762768600a92ece3", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-8x88-c5mf-7j5w", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-197e923092629f72", "level": "error", "message": {"text": "Vulnerable dependency tar 6.2.1: GHSA-9ppj-qmqm-q256"}, "properties": {"repobilityId": "ba7848efc0447c3d", "scanner": "scanner-primary", "fingerprint": "197e923092629f72", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-9ppj-qmqm-q256", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3130881563beb8a7", "level": "warning", "message": {"text": "Vulnerable dependency tar 6.2.1: GHSA-gvwx-54wh-qm9j"}, "properties": {"repobilityId": "af4ef3e7bc207515", "scanner": "scanner-primary", "fingerprint": "3130881563beb8a7", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-gvwx-54wh-qm9j", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0989b1d8edbfcfa5", "level": "error", "message": {"text": "Vulnerable dependency tar 6.2.1: GHSA-qffp-2rhf-9h96"}, "properties": {"repobilityId": "2cc0d011c816508c", "scanner": "scanner-primary", "fingerprint": "0989b1d8edbfcfa5", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-qffp-2rhf-9h96", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c55d53acfbfbf5e8", "level": "warning", "message": {"text": "Vulnerable dependency tar 6.2.1: GHSA-r292-9mhp-454m"}, "properties": {"repobilityId": "4f27b729ab5c153f", "scanner": "scanner-primary", "fingerprint": "c55d53acfbfbf5e8", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-r292-9mhp-454m", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6ebf52dd3dd11027", "level": "error", "message": {"text": "Vulnerable dependency tar 6.2.1: GHSA-r6q2-hw4h-h46w"}, "properties": {"repobilityId": "9d2e042e0c9a08f0", "scanner": "scanner-primary", "fingerprint": "6ebf52dd3dd11027", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-r6q2-hw4h-h46w", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-fe545e4531c37cbe", "level": "warning", "message": {"text": "Vulnerable dependency tar 6.2.1: GHSA-vmf3-w455-68vh"}, "properties": {"repobilityId": "120517fd80ea2fcd", "scanner": "scanner-primary", "fingerprint": "fe545e4531c37cbe", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-vmf3-w455-68vh", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ba2e6231b54837aa", "level": "warning", "message": {"text": "Vulnerable dependency tar 6.2.1: GHSA-w8wr-v893-vjvp"}, "properties": {"repobilityId": "7b9b54b883d7996a", "scanner": "scanner-primary", "fingerprint": "ba2e6231b54837aa", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-w8wr-v893-vjvp", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-151ad96f394c4276", "level": "error", "message": {"text": "Vulnerable dependency brace-expansion 1.1.16: GHSA-mh99-v99m-4gvg"}, "properties": {"repobilityId": "2ccdc93a6cd7d3ef", "scanner": "scanner-primary", "fingerprint": "151ad96f394c4276", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-mh99-v99m-4gvg", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d1721fbcaad3bb97", "level": "error", "message": {"text": "Vulnerable dependency brace-expansion 1.1.16: GHSA-rgw5-rvv9-x895"}, "properties": {"repobilityId": "85fc9fa25b07cf9c", "scanner": "scanner-primary", "fingerprint": "d1721fbcaad3bb97", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-rgw5-rvv9-x895", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-97e1ea846e6d5bf2", "level": "error", "message": {"text": "Vulnerable dependency js-yaml 4.3.0: GHSA-5p4m-2wfm-xmqj"}, "properties": {"repobilityId": "89d1abb9a0b367a6", "scanner": "scanner-primary", "fingerprint": "97e1ea846e6d5bf2", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-5p4m-2wfm-xmqj", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0b37292bb287407b", "level": "error", "message": {"text": "Vulnerable dependency minimatch 3.0.5: GHSA-23c5-xmqv-rm74"}, "properties": {"repobilityId": "8cc88ea88b74790f", "scanner": "scanner-primary", "fingerprint": "0b37292bb287407b", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-23c5-xmqv-rm74", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e8f6b61fc1457109", "level": "error", "message": {"text": "Vulnerable dependency minimatch 3.0.5: GHSA-3ppc-4f35-3m26"}, "properties": {"repobilityId": "e7cd2d48743f8f40", "scanner": "scanner-primary", "fingerprint": "e8f6b61fc1457109", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-3ppc-4f35-3m26", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-58d5872504227104", "level": "error", "message": {"text": "Vulnerable dependency minimatch 3.0.5: GHSA-7r86-cg39-jmmj"}, "properties": {"repobilityId": "ac77f9f3e0f302b7", "scanner": "scanner-primary", "fingerprint": "58d5872504227104", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-7r86-cg39-jmmj", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5d74ab6286d1e088", "level": "error", "message": {"text": "Vulnerable dependency brace-expansion 5.0.7: GHSA-mh99-v99m-4gvg"}, "properties": {"repobilityId": "8ed819d24ba8d50f", "scanner": "scanner-primary", "fingerprint": "5d74ab6286d1e088", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-mh99-v99m-4gvg", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ac3cb977b9dec278", "level": "error", "message": {"text": "Vulnerable dependency brace-expansion 5.0.7: GHSA-rgw5-rvv9-x895"}, "properties": {"repobilityId": "de31443261a7f6eb", "scanner": "scanner-primary", "fingerprint": "ac3cb977b9dec278", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-rgw5-rvv9-x895", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-53ae15ca57837468", "level": "error", "message": {"text": "Vulnerable dependency sharp 0.32.6: GHSA-f88m-g3jw-g9cj"}, "properties": {"repobilityId": "9018657dc1610910", "scanner": "scanner-primary", "fingerprint": "53ae15ca57837468", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-f88m-g3jw-g9cj", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7969ee3bffefc78d", "level": "warning", "message": {"text": "Vulnerable dependency tar 7.5.20: GHSA-r292-9mhp-454m"}, "properties": {"repobilityId": "93c6fde101044e5e", "scanner": "scanner-primary", "fingerprint": "7969ee3bffefc78d", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-r292-9mhp-454m", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}]}]}