{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-12b711846771dc3d", "name": "Truncated text has no discoverable full-value affordance \u2014 apps/vis/web/src/components/shared/JsonViewer.tsx:76", "shortDescription": {"text": "Truncated text has no discoverable full-value affordance \u2014 apps/vis/web/src/components/shared/JsonViewer.tsx:76"}, "fullDescription": {"text": "A visibly truncated value should expose its full text through an accessible tooltip, description, or equivalent interaction. Native `title=` is one option, but it is not the only valid implementation.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.65}}, {"id": "scanner-ea51ecaaec0c87ab", "name": "Truncated text has no discoverable full-value affordance \u2014 apps/vis/web/src/components/shared/SizePreview.tsx:36", "shortDescription": {"text": "Truncated text has no discoverable full-value affordance \u2014 apps/vis/web/src/components/shared/SizePreview.tsx:36"}, "fullDescription": {"text": "A visibly truncated value should expose its full text through an accessible tooltip, description, or equivalent interaction. Native `title=` is one option, but it is not the only valid implementation.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.65}}, {"id": "scanner-748e39cd41a12a3f", "name": "Truncated text has no discoverable full-value affordance \u2014 apps/vis/web/src/components/wire/renderers.tsx:78", "shortDescription": {"text": "Truncated text has no discoverable full-value affordance \u2014 apps/vis/web/src/components/wire/renderers.tsx:78"}, "fullDescription": {"text": "A visibly truncated value should expose its full text through an accessible tooltip, description, or equivalent interaction. Native `title=` is one option, but it is not the only valid implementation.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.65}}, {"id": "scanner-63e60c6a0fd86be3", "name": "Truncated text has no discoverable full-value affordance \u2014 apps/vis/web/src/components/context/MessageBubble.tsx:110", "shortDescription": {"text": "Truncated text has no discoverable full-value affordance \u2014 apps/vis/web/src/components/context/MessageBubble.tsx:110"}, "fullDescription": {"text": "A visibly truncated value should expose its full text through an accessible tooltip, description, or equivalent interaction. Native `title=` is one option, but it is not the only valid implementation.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.65}}, {"id": "scanner-26113418d131e6eb", "name": "Truncated text has no discoverable full-value affordance \u2014 apps/kimi-inspect/src/components/ServicePanels.tsx:419", "shortDescription": {"text": "Truncated text has no discoverable full-value affordance \u2014 apps/kimi-inspect/src/components/ServicePanels.tsx:419"}, "fullDescription": {"text": "A visibly truncated value should expose its full text through an accessible tooltip, description, or equivalent interaction. Native `title=` is one option, but it is not the only valid implementation.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.65}}, {"id": "scanner-2a7e154e9d4833ec", "name": "Truncated text has no discoverable full-value affordance \u2014 apps/kimi-inspect/src/components/Sidebar.tsx:189", "shortDescription": {"text": "Truncated text has no discoverable full-value affordance \u2014 apps/kimi-inspect/src/components/Sidebar.tsx:189"}, "fullDescription": {"text": "A visibly truncated value should expose its full text through an accessible tooltip, description, or equivalent interaction. Native `title=` is one option, but it is not the only valid implementation.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.65}}, {"id": "scanner-afe341633a7d8802", "name": "Truncated text has no discoverable full-value affordance \u2014 apps/kimi-inspect/src/components/ModelCatalogView.tsx:296", "shortDescription": {"text": "Truncated text has no discoverable full-value affordance \u2014 apps/kimi-inspect/src/components/ModelCatalogView.tsx:296"}, "fullDescription": {"text": "A visibly truncated value should expose its full text through an accessible tooltip, description, or equivalent interaction. Native `title=` is one option, but it is not the only valid implementation.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.65}}, {"id": "scanner-17594295ab40b89f", "name": "Debug `console.log` remains in browser-facing code \u2014 apps/vscode/webview-ui/src/App.tsx:26", "shortDescription": {"text": "Debug `console.log` remains in browser-facing code \u2014 apps/vscode/webview-ui/src/App.tsx:26"}, "fullDescription": {"text": "Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 0.85}}, {"id": "scanner-73b14455a17f12fe", "name": "Truncated text has no discoverable full-value affordance \u2014 apps/vscode/webview-ui/src/components/WorkDirModal.tsx:86", "shortDescription": {"text": "Truncated text has no discoverable full-value affordance \u2014 apps/vscode/webview-ui/src/components/WorkDirModal.tsx:86"}, "fullDescription": {"text": "A visibly truncated value should expose its full text through an accessible tooltip, description, or equivalent interaction. Native `title=` is one option, but it is not the only valid implementation.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.65}}, {"id": "scanner-16da0803b52f1f30", "name": "Truncated text has no discoverable full-value affordance \u2014 apps/vscode/webview-ui/src/components/SlashCommandMenu.tsx:68", "shortDescription": {"text": "Truncated text has no discoverable full-value affordance \u2014 apps/vscode/webview-ui/src/components/SlashCommandMenu.tsx:68"}, "fullDescription": {"text": "A visibly truncated value should expose its full text through an accessible tooltip, description, or equivalent interaction. Native `title=` is one option, but it is not the only valid implementation.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.65}}, {"id": "scanner-90fed9d88aeef6e4", "name": "Truncated text has no discoverable full-value affordance \u2014 apps/vscode/webview-ui/src/components/MCPServersModal.tsx:359", "shortDescription": {"text": "Truncated text has no discoverable full-value affordance \u2014 apps/vscode/webview-ui/src/components/MCPServersModal.tsx:359"}, "fullDescription": {"text": "A visibly truncated value should expose its full text through an accessible tooltip, description, or equivalent interaction. Native `title=` is one option, but it is not the only valid implementation.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.65}}, {"id": "scanner-99b9703631fadd3b", "name": "Truncated text has no discoverable full-value affordance \u2014 apps/vscode/webview-ui/src/components/ToolRenderers.tsx:440", "shortDescription": {"text": "Truncated text has no discoverable full-value affordance \u2014 apps/vscode/webview-ui/src/components/ToolRenderers.tsx:440"}, "fullDescription": {"text": "A visibly truncated value should expose its full text through an accessible tooltip, description, or equivalent interaction. Native `title=` is one option, but it is not the only valid implementation.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.65}}, {"id": "scanner-0a326dc33dcacd6a", "name": "Truncated text has no discoverable full-value affordance \u2014 apps/vscode/webview-ui/src/components/FilePickerMenu.tsx:127", "shortDescription": {"text": "Truncated text has no discoverable full-value affordance \u2014 apps/vscode/webview-ui/src/components/FilePickerMenu.tsx:127"}, "fullDescription": {"text": "A visibly truncated value should expose its full text through an accessible tooltip, description, or equivalent interaction. Native `title=` is one option, but it is not the only valid implementation.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.65}}, {"id": "scanner-2428d16a14494139", "name": "Truncated text has no discoverable full-value affordance \u2014 apps/vscode/webview-ui/src/components/DisplayBlocks.tsx:97", "shortDescription": {"text": "Truncated text has no discoverable full-value affordance \u2014 apps/vscode/webview-ui/src/components/DisplayBlocks.tsx:97"}, "fullDescription": {"text": "A visibly truncated value should expose its full text through an accessible tooltip, description, or equivalent interaction. Native `title=` is one option, but it is not the only valid implementation.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.65}}, {"id": "scanner-2436fe1d205af907", "name": "Debug `console.log` remains in browser-facing code \u2014 apps/vscode/webview-ui/src/components/DisplayBlocks.tsx:166", "shortDescription": {"text": "Debug `console.log` remains in browser-facing code \u2014 apps/vscode/webview-ui/src/components/DisplayBlocks.tsx:166"}, "fullDescription": {"text": "Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 0.85}}, {"id": "scanner-4a152600fd3a34c1", "name": "Debug `console.log` remains in browser-facing code \u2014 apps/vscode/webview-ui/src/components/SessionList.tsx:112", "shortDescription": {"text": "Debug `console.log` remains in browser-facing code \u2014 apps/vscode/webview-ui/src/components/SessionList.tsx:112"}, "fullDescription": {"text": "Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 0.85}}, {"id": "scanner-40d18665fa850621", "name": "Truncated text has no discoverable full-value affordance \u2014 apps/vscode/webview-ui/src/components/inputarea/InputArea.tsx", "shortDescription": {"text": "Truncated text has no discoverable full-value affordance \u2014 apps/vscode/webview-ui/src/components/inputarea/InputArea.tsx:427"}, "fullDescription": {"text": "A visibly truncated value should expose its full text through an accessible tooltip, description, or equivalent interaction. Native `title=` is one option, but it is not the only valid implementation.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.65}}, {"id": "scanner-d36fd231473630a7", "name": "Debug `console.log` remains in browser-facing code \u2014 apps/vscode/webview-ui/src/services/bridge.ts:53", "shortDescription": {"text": "Debug `console.log` remains in browser-facing code \u2014 apps/vscode/webview-ui/src/services/bridge.ts:53"}, "fullDescription": {"text": "Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 0.85}}, {"id": "scanner-41e7ec9be1bceb6c", "name": "TODO/FIXME marker in shipping code \u2014 apps/kimi-web/src/composables/useKimiWebClient.ts:1741", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 apps/kimi-web/src/composables/useKimiWebClient.ts:1741"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.7}}, {"id": "scanner-e0d75c08aeb79558", "name": "Icon-only button without accessible name \u2014 apps/kimi-web/src/components/chat/Composer.vue:872", "shortDescription": {"text": "Icon-only button without accessible name \u2014 apps/kimi-web/src/components/chat/Composer.vue:872"}, "fullDescription": {"text": "A `<button>` whose only child is a single glyph or symbol needs `title=` or `aria-label=` so screen readers (and tooltips on hover) work.\n\nWhy: P3 in CHECKLIST.md \u2014 icon-only buttons skipped a title.\nRule id: fq.button.no-label"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 0.85}}, {"id": "scanner-23f354843f00df80", "name": "Icon-only button without accessible name \u2014 apps/kimi-web/src/debug/KapDebugView.vue:163", "shortDescription": {"text": "Icon-only button without accessible name \u2014 apps/kimi-web/src/debug/KapDebugView.vue:163"}, "fullDescription": {"text": "A `<button>` whose only child is a single glyph or symbol needs `title=` or `aria-label=` so screen readers (and tooltips on hover) work.\n\nWhy: P3 in CHECKLIST.md \u2014 icon-only buttons skipped a title.\nRule id: fq.button.no-label"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 0.85}}, {"id": "scanner-11374155d89682a1", "name": "TODO/FIXME marker in shipping code \u2014 apps/kimi-code/src/tui/controllers/editor-keyboard.ts:242", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 apps/kimi-code/src/tui/controllers/editor-keyboard.ts:242"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.7}}, {"id": "scanner-c4b6e9b2d088fe50", "name": "React Flow <Controls> without dark theming \u2014 packages/agent-core-v2/scripts/dep-graph/web/src/GraphView.tsx:718", "shortDescription": {"text": "React Flow <Controls> without dark theming \u2014 packages/agent-core-v2/scripts/dep-graph/web/src/GraphView.tsx:718"}, "fullDescription": {"text": "`<Controls>` ships with white buttons. Override `.react-flow__controls` and `.react-flow__controls-button` in your stylesheet or pass a styled wrapper.\n\nWhy: P1 in CHECKLIST.md \u2014 vendor defaults bleed light through.\nRule id: fq.controls.no-bg"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 0.85}}, {"id": "scanner-c3e5eab5728a4d35", "name": "Icon-only button without accessible name \u2014 packages/agent-core-v2/scripts/dep-graph/web/src/GraphView.tsx:799", "shortDescription": {"text": "Icon-only button without accessible name \u2014 packages/agent-core-v2/scripts/dep-graph/web/src/GraphView.tsx:799"}, "fullDescription": {"text": "A `<button>` whose only child is a single glyph or symbol needs `title=` or `aria-label=` so screen readers (and tooltips on hover) work.\n\nWhy: P3 in CHECKLIST.md \u2014 icon-only buttons skipped a title.\nRule id: fq.button.no-label"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 0.85}}, {"id": "scanner-de6be7694616e69b", "name": "detect child process \u2014 packages/pi-tui/src/autocomplete.ts:164", "shortDescription": {"text": "detect child process \u2014 packages/pi-tui/src/autocomplete.ts:164"}, "fullDescription": {"text": "Detected calls to child_process from a function argument `fdPath`. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed.\n\nRule: javascript.lang.security.detect-child-process.detect-child-process\nSeverity: ERROR\nOWASP: A01:2017 - Injection, A03:2021 - Injection, A05:2025 - Injection\nCWE: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.55}}, {"id": "scanner-b17924e2e9a696ab", "name": "CVE-2026-49356: @babel/core 7.29.0 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-49356: @babel/core 7.29.0 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "@babel/core: @babel/core: Arbitrary file read via sourceMappingURL comment\n\nBabel is a compiler for writing next generation JavaScript. Prior to 8.0.0-rc.6 and 7.29.6, @babel/core affected by an arbitrary file read via a sourceMappingURL comment. Using @babel/core to compile maliciously crafted code can allow an attacker to read any source map from the system that is running Babel, if the attacker controls the input source code, can read the output source code, and knows the path of the source map file that they want to read. This vulnerability is fixed in 8.0.0-rc.6 an\n\nPackage: @babel/core\nInstalled: 7.29.0\nFixed in: 8.0.0-rc.6, 7.29.6\nSeverity: LOW\nFix: Upgrade @babel/core to 8.0.0-rc.6, 7.29.6"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-993552b71134bcb6", "name": "GHSA-frvp-7c67-39w9: @hono/node-server 1.19.14 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "GHSA-frvp-7c67-39w9: @hono/node-server 1.19.14 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "Node.js Adapter for Hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`)\n\nThe same as the `hono` core [Path traversal in `serve-static` on Windows via encoded backslash (`%5C`)](https://github.com/honojs/hono/security/advisories/GHSA-wwfh-h76j-fc44).\n\n### Summary\n\nOn Windows hosts, an encoded backslash (`%5C`) in the request path decodes to `\\`, which the Windows path resolver treats as a separator. `serve-static` then resolves a single URL segment such as `admin\\secret.txt` into a nested file under the root and serves it, letting an attacker read static files meant t\n\nPackage: @hono/node-server\nInstalled: 1.19.14\nFixed in: 2.0.5\nSeverity: MEDIUM\nFix: Upgrade @hono/node-server to 2.0.5"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6e6ffce0c3b9b047", "name": "CVE-2026-44288: @protobufjs/utf8 1.1.0 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-44288: @protobufjs/utf8 1.1.0 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "protobufjs: protobufjs: Security control bypass due to improper handling of overlong UTF-8 sequences\n\nprotobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs includes a minimal UTF-8 decoder that accepted overlong UTF-8 byte sequences and decoded them to their canonical characters instead of replacing them. An attacker who can provide protobuf binary data decoded through the affected UTF-8 path may be able to bypass application-level checks that inspect raw bytes before protobuf string decoding. For example, bytes that do not contain certain \n\nPackage: @protobufjs/utf8\nInstalled: 1.1.0\nFixed in: 1.1.1\nSeverity: MEDIUM\nFix: Upgrade @protobufjs/utf8 to 1.1.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c9dadc5f9682a312", "name": "CVE-2026-12590: body-parser 2.2.2 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-12590: body-parser 2.2.2 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "body-parser: body-parser: Denial of Service via invalid limit option\n\nImpact: In body-parser versions prior to 1.20.6 (1.x line) and 2.3.0 (2.x line), when the parser is configured with an invalid limit option value such as an unparseable string or NaN, bytes.parse returns null and the request body size check is silently skipped. Applications that rely on limit as their primary safeguard against oversized request bodies will accept arbitrarily large payloads, leading to excessive memory and CPU usage and denial of service. Patches: This issue is fixed in body-pars\n\nPackage: body-parser\nInstalled: 2.2.2\nFixed in: 1.20.6, 2.3.0\nSeverity: LOW\nFix: Upgrade body-parser to 1.20.6, 2.3.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2f153c0c5a7f83b8", "name": "CVE-2026-13149: brace-expansion 5.0.6 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-13149: brace-expansion 5.0.6 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity\n\nbrace-expansion through 5.0.6 is vulnerable to denial of service. The expand() function exhibits exponential-time complexity in the number of consecutive non-expanding '{}' brace groups. An attacker who passes a crafted string to expand(), directly or transitively, can cause significant CPU consumption and event-loop blocking. The max option does not mitigate this, as it bounds the output size rather than the recursion work.\n\nPackage: brace-expansion\nInstalled: 5.0.6\nFixed in: 5.0.7, 1.1.16, 2.1.2\nSeverity: HIGH\nFix: Upgrade brace-expansion to 5.0.7, 1.1.16, 2.1.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-f1392a6b367f85c0", "name": "GHSA-cmwh-pvxp-8882: dompurify 3.4.7 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "GHSA-cmwh-pvxp-8882: dompurify 3.4.7 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "DOMPurify: Permanent `ALLOWED_ATTR` pollution via `setConfig()` bypassing the hook clone-guard (incomplete fix of the 3.4.7 hook-pollution patch)\n\n## Summary\n\nDOMPurify 3.4.7 shipped a security fix (\"permanent hook pollution\") that makes a registered `uponSanitizeAttribute` hook's mutation of `data.allowedAttributes` **non-persistent** \u2014 so allowing an attribute for one element does not leak into later `sanitize()` calls. The fix clones `ALLOWED_ATTR` inside `_parseConfig`.\n\nThat guard is **silently bypassed whenever the application uses the persistent-config API `DOMPurify.setConfig()`.** `setConfig()` sets the module flag `SET_CONFIG = t\n\nPackage: dompurify\nInstalled: 3.4.7\nFixed in: 3.4.11\nSeverity: MEDIUM\nFix: Upgrade dompurify to 3.4.11"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-88d38df654249cbe", "name": "GHSA-c2j3-45gr-mqc4: dompurify 3.4.7 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "GHSA-c2j3-45gr-mqc4: dompurify 3.4.7 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "DOMPurify: `CUSTOM_ELEMENT_HANDLING` bypasses `afterSanitizeElements` for allowed custom elements.\n\n## Summary\n\nThere is a possible hook-policy inconsistency in DOMPurify 3.4.11 involving `CUSTOM_ELEMENT_HANDLING`.\n\nWhen a custom element is allowed via `CUSTOM_ELEMENT_HANDLING.tagNameCheck`, it appears that the element does not go through `afterSanitizeElements` in the same way as a normal element. As a result, an application that relies on `afterSanitizeElements` as a security policy layer to strip sensitive attributes from all elements may see those attributes removed from normal elements bu\n\nPackage: dompurify\nInstalled: 3.4.7\nFixed in: 3.4.12\nSeverity: LOW\nFix: Upgrade dompurify to 3.4.12"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-15192e2ee8bc2131", "name": "GHSA-gvmj-g25r-r7wr: dompurify 3.4.7 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "GHSA-gvmj-g25r-r7wr: dompurify 3.4.7 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "DOMPurify: SAFE_FOR_TEMPLATES bypass - template expressions survive sanitization inside <template> content when using DOM output modes\n\n## Summary\n\nWhen DOMPurify is configured with both `SAFE_FOR_TEMPLATES: true` and `RETURN_DOM: true` (or `IN_PLACE: true`), an attacker can inject template expressions, such as `${evil}`, `{{evil}}`, or `<%evil%>`, that survive the sanitization pass inside `<template>` element content. This bypasses the explicit purpose of `SAFE_FOR_TEMPLATES`, which is to prevent template engine evaluation of user-supplied content.\n\n> **Note:** The string output path is **not** affected. Only the DOM return pat\n\nPackage: dompurify\nInstalled: 3.4.7\nFixed in: 3.4.8\nSeverity: LOW\nFix: Upgrade dompurify to 3.4.8"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-13f865215427d009", "name": "GHSA-vxr8-fq34-vvx9: dompurify 3.4.7 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "GHSA-vxr8-fq34-vvx9: dompurify 3.4.7 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "DOMPurify: Trusted Types policy survives `clearConfig()` and can poison later `RETURN_TRUSTED_TYPE` output\n\n## Impact\n\nA DOMPurify instance that is reused across trust boundaries can stay bound to a previously supplied `TRUSTED_TYPES_POLICY` even after `clearConfig()` is called. A later caller that requests `RETURN_TRUSTED_TYPE` receives a `TrustedHTML` object created by the old policy, not by a clean default configuration.\n\nIf the old policy is unsafe or controlled by a less-trusted integration, this turns a later \"default\" sanitize call into script execution at a Trusted Types sink. `TRUSTED_TYPES_P\n\nPackage: dompurify\nInstalled: 3.4.7\nFixed in: 3.4.9\nSeverity: LOW\nFix: Upgrade dompurify to 3.4.9"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3be016b75b879dff", "name": "GHSA-67mh-4wv8-2f99: esbuild 0.21.5 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "GHSA-67mh-4wv8-2f99: esbuild 0.21.5 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "esbuild enables any website to send any requests to the development server and read the response\n\n### Summary\n\nesbuild allows any websites to send any request to the development server and read the response due to default CORS settings.\n\n### Details\n\nesbuild sets `Access-Control-Allow-Origin: *` header to all requests, including the SSE connection, which allows any websites to send any request to the development server and read the response.\n\nhttps://github.com/evanw/esbuild/blob/df815ac27b84f8b34374c9182a93c94718f8a630/pkg/api/serve_other.go#L121\nhttps://github.com/evanw/esbuild/blob/df815a\n\nPackage: esbuild\nInstalled: 0.21.5\nFixed in: 0.25.0\nSeverity: MEDIUM\nFix: Upgrade esbuild to 0.25.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9e925efd8793ae9b", "name": "CVE-2026-13676: fast-uri 3.1.0 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-13676: fast-uri 3.1.0 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "fast-uri: fast-uri: Security policy bypass due to improper Unicode hostname canonicalization\n\nfast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fail to canonicalize Unicode (IDN) hostnames for HTTP-family URLs. The IDN conversion path calls a helper that does not exist on the global URL constructor, silently leaving the host in its original Unicode form while normalize() and equal() still return values that differ from a WHATWG-compatible URL parser. Applications that use fast-uri to enforce host-based policy (denylists, loopback filtering, redirect validation, outbound proxy routing) befo\n\nPackage: fast-uri\nInstalled: 3.1.0\nFixed in: 4.0.1, 3.1.3, 2.4.2\nSeverity: HIGH\nFix: Upgrade fast-uri to 4.0.1, 3.1.3, 2.4.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-2281acd7795cdefe", "name": "CVE-2026-16221: fast-uri 3.1.0 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-16221: fast-uri 3.1.0 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "Impact: fast-uri versions from 2.3.1 through 4.1.0 (including the 3.x  ...\n\nImpact: fast-uri versions from 2.3.1 through 4.1.0 (including the 3.x line up to 3.1.3 and the 2.x line up to 2.4.2) do not treat a literal backslash character (U+005C) as an authority delimiter. Node's native WHATWG URL parser, used by fetch, undici, and Node's http and https clients, normalizes the backslash to a forward slash for special schemes such as http, https, ws, wss, ftp, and file. As a result, the two parsers extract different hosts from the same input string. Applications that use f\n\nPackage: fast-uri\nInstalled: 3.1.0\nFixed in: 2.4.3, 3.1.4, 4.1.1\nSeverity: HIGH\nFix: Upgrade fast-uri to 2.4.3, 3.1.4, 4.1.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-ee58b7134906e5d0", "name": "CVE-2026-6321: fast-uri 3.1.0 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-6321: fast-uri 3.1.0 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "fast-uri: fast-uri: Path traversal vulnerability allows bypass of security policies\n\nfast-uri decoded percent-encoded path separators and dot segments before applying dot-segment removal in its normalize() and equal() functions. Encoded path data was treated like real slashes and parent-directory references, so distinct URIs could collapse onto the same normalized path. Applications that normalize or compare attacker-controlled URLs to enforce path-based policy can be bypassed, with a path that appears confined under an allowed prefix normalizing to a different location. Version\n\nPackage: fast-uri\nInstalled: 3.1.0\nFixed in: 3.1.1\nSeverity: HIGH\nFix: Upgrade fast-uri to 3.1.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-fa67cc47d2cf8220", "name": "CVE-2026-6322: fast-uri 3.1.0 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-6322: fast-uri 3.1.0 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "fast-uri: fast-uri: URI authority bypass due to improper delimiter handling\n\nfast-uri normalize() decoded percent-encoded authority delimiters inside the host component and then re-emitted them as raw delimiters during serialization. A host that combined an allowed domain, an encoded at-sign, and a different domain was re-emitted with the at-sign as a raw userinfo separator, changing the URI's authority to the second domain. Applications that normalize untrusted URLs before host allowlist checks, redirect validation, or outbound request routing can be steered to a differ\n\nPackage: fast-uri\nInstalled: 3.1.0\nFixed in: 3.1.2\nSeverity: HIGH\nFix: Upgrade fast-uri to 3.1.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-e275c5067d690455", "name": "CVE-2026-54290: hono 4.12.14 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-54290: hono 4.12.14 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "hono: CORS Middleware reflects any Origin with credentials when `origin` defaults to the wildcard\n\nHono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, with credentials: true and no explicit origin (the default wildcard), the CORS Middleware reflects the request's Origin and sends Access-Control-Allow-Credentials: true. Any site can then make credentialed cross-origin requests and read the responses, exposing cookie-authenticated endpoints to arbitrary origins. This vulnerability is fixed in 4.12.25.\n\nPackage: hono\nInstalled: 4.12.14\nFixed in: 4.12.25\nSeverity: HIGH\nFix: Upgrade hono to 4.12.25"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-6612893e952a6be0", "name": "CVE-2026-44455: hono 4.12.14 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-44455: hono 4.12.14 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "hono/jsx has Unvalidated JSX Tag Names that May Allow HTML Injection\n\nHono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.16, Improper handling of JSX element tag names in hono/jsx allowed unvalidated tag names to be directly inserted into the generated HTML output. When untrusted input is used as a tag name via the programmatic jsx() or createElement() APIs during server-side rendering, specially crafted values may break out of the intended element context and inject unintended HTML. This vulnerability is fixed in 4\n\nPackage: hono\nInstalled: 4.12.14\nFixed in: 4.12.16\nSeverity: MEDIUM\nFix: Upgrade hono to 4.12.16"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4900e4b9628cbcc1", "name": "CVE-2026-44456: hono 4.12.14 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-44456: hono 4.12.14 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "Hono: bodyLimit() can be bypassed for chunked / unknown-length requests\n\nHono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.16, bodyLimit() does not reliably enforce maxSize for requests without a usable Content-Length (e.g. Transfer-Encoding: chunked). Oversized requests can reach handlers and return 200 instead of 413. This vulnerability is fixed in 4.12.16.\n\nPackage: hono\nInstalled: 4.12.14\nFixed in: 4.12.16\nSeverity: MEDIUM\nFix: Upgrade hono to 4.12.16"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7c289ac126e846ee", "name": "CVE-2026-44457: hono 4.12.14 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-44457: hono 4.12.14 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "Hono's Cache Middleware ignores Vary: Authorization / Vary: Cookie leading to cross-user cache leakage\n\nHono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.18, Cache Middleware does not skip caching for responses that declare per-user variance via Vary: Authorization or Vary: Cookie. As a result, a response cached for one authenticated user may be served to subsequent requests from different users. This vulnerability is fixed in 4.12.18.\n\nPackage: hono\nInstalled: 4.12.14\nFixed in: 4.12.18\nSeverity: MEDIUM\nFix: Upgrade hono to 4.12.18"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-756b4b0a4f74e27b", "name": "CVE-2026-44458: hono 4.12.14 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-44458: hono 4.12.14 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "Hono has CSS Declaration Injection via Style Object Values in JSX SSR\n\nHono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.18, the JSX renderer escapes style attribute object values for HTML but not for CSS. Untrusted input in a style object value or property name can therefore inject additional CSS declarations into the rendered style attribute. The impact is limited to CSS and does not allow JavaScript execution or HTML attribute breakout. This vulnerability is fixed in 4.12.18.\n\nPackage: hono\nInstalled: 4.12.14\nFixed in: 4.12.18\nSeverity: MEDIUM\nFix: Upgrade hono to 4.12.18"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0839a916e0e915fa", "name": "CVE-2026-47673: hono 4.12.14 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-47673: hono 4.12.14 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "Hono: JWT middleware accepts any Authorization scheme, not only Bearer\n\nHono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.21, the jwt and jwk middlewares do not verify that the Authorization header value uses theBearer scheme. Any two-part header value \u2014 regardless of the scheme name in the first position \u2014 proceeds to JWT verification. A request presenting a valid JWT under a non-Bearer scheme identifier (such as Basic or Token) is authenticated identically to a correctly formed Bearer request. This vulnerability is\n\nPackage: hono\nInstalled: 4.12.14\nFixed in: 4.12.21\nSeverity: MEDIUM\nFix: Upgrade hono to 4.12.21"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ab78742adfe67608", "name": "CVE-2026-47674: hono 4.12.14 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-47674: hono 4.12.14 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "Hono: IP Restriction bypasses static deny rules for non-canonical IPv6 \n\nHono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.21, the ip-restriction middleware (hono/ip-restriction) compares incoming IP addresses against configured deny and allow rules using string equality after partial normalization. Non-canonical IPv6 representations of an address already listed in a static rule \u2014 such as compressed forms, explicit-zero forms, or hex-notation IPv4-mapped addresses \u2014 do not match the normalized rule entry, causing the \n\nPackage: hono\nInstalled: 4.12.14\nFixed in: 4.12.21\nSeverity: MEDIUM\nFix: Upgrade hono to 4.12.21"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-884ae5e8f5421ae4", "name": "CVE-2026-47675: hono 4.12.14 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-47675: hono 4.12.14 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "Hono: Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie injection\n\nHono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.21, the serialize() function in hono/cookie validates domain and path options against characters that corrupt Set-Cookie header syntax (;, \\r, \\n), but does not apply the same validation to sameSite and priority. An application that passes user-controlled input into either option may produce a Set-Cookie response header containing attacker-chosen additional attributes. This vulnerability is fixed \n\nPackage: hono\nInstalled: 4.12.14\nFixed in: 4.12.21\nSeverity: MEDIUM\nFix: Upgrade hono to 4.12.21"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-858a0667bd370148", "name": "CVE-2026-47676: hono 4.12.14 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-47676: hono 4.12.14 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "Hono: app.mount() strips mount prefix using undecoded path, causing incorrect routing for percent-encoded paths\n\nHono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.21, app.mount() strips the mount prefix from the incoming request path using the raw URL pathname, while route matching is performed against the percent-decoded path. This inconsistency causes the prefix to be stripped at the wrong position when the path contains percent-encoded multi-byte characters, resulting in the mounted sub-application receiving an incorrect path. This vulnerability is fixed\n\nPackage: hono\nInstalled: 4.12.14\nFixed in: 4.12.21\nSeverity: MEDIUM\nFix: Upgrade hono to 4.12.21"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-35cc5223146ecee8", "name": "CVE-2026-54286: hono 4.12.14 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-54286: hono 4.12.14 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`)\n\nHono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, on Windows hosts, an encoded backslash (%5C) in the request path decodes to \\, which the Windows path resolver treats as a separator. serve-static then resolves a single URL segment such as admin\\secret.txt into a nested file under the root and serves it, letting an attacker read static files meant to be protected behind prefix-mounted middleware. This vulnerability is fixed in 4.12.25.\n\nPackage: hono\nInstalled: 4.12.14\nFixed in: 4.12.25\nSeverity: MEDIUM\nFix: Upgrade hono to 4.12.25"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ab933290a6651a81", "name": "CVE-2026-54287: hono 4.12.14 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-54287: hono 4.12.14 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "hono: AWS Lambda adapter merges multiple `Set-Cookie` headers into one value, dropping cookies on ALB single-header and Lattice\n\nHono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, on AWS Lambda, the ALB single-header response and the VPC Lattice v2 response join multiple Set-Cookie headers into one comma-separated value. Because commas also appear inside cookie attributes (for example Expires dates), clients cannot split the value back into individual cookies and silently drop or misparse them. This vulnerability is fixed in 4.12.25.\n\nPackage: hono\nInstalled: 4.12.14\nFixed in: 4.12.25\nSeverity: MEDIUM\nFix: Upgrade hono to 4.12.25"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5036c990a3c9683c", "name": "CVE-2026-54288: hono 4.12.14 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-54288: hono 4.12.14 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "hono: Body Limit Middleware can be bypassed on AWS Lambda by understating `Content-Length`\n\nHono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, the Body Limit Middleware trusts the request's Content-Length header to decide whether a body is within the limit. On AWS Lambda (API Gateway v1/v2, ALB, VPC Lattice, and Lambda@Edge) the body is delivered fully buffered and the adapter builds the request with the client-declared Content-Length, which need not match the actual payload. A client can declare a tiny Content-Length while sending a\n\nPackage: hono\nInstalled: 4.12.14\nFixed in: 4.12.25\nSeverity: MEDIUM\nFix: Upgrade hono to 4.12.25"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-70be346e651ac92d", "name": "CVE-2026-54289: hono 4.12.14 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-54289: hono 4.12.14 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "hono: Lambda@Edge adapter keeps only the last value of a repeated request header, dropping the rest\n\nHono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, on AWS Lambda@Edge, CloudFront delivers a request header that appears more than once as several separate entries. The adapter writes each value with Headers.set instead of Headers.append, so every value overwrites the previous one and only the last reaches the application. Repeated request headers such as X-Forwarded-For, Forwarded, and Via are silently truncated to a single value. Request mid\n\nPackage: hono\nInstalled: 4.12.14\nFixed in: 4.12.25\nSeverity: MEDIUM\nFix: Upgrade hono to 4.12.25"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-64a0bc2b59825bba", "name": "CVE-2026-59895: hono 4.12.14 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-59895: hono 4.12.14 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "Hono: Server-Side XSS via JSX Escaping Bypass in cx() Utility\n\nHono is a Web application framework that provides support for any JavaScript runtime. From 4.0.0 before 4.12.27, cx() in hono/css composes class names from plain strings but marks the result as already escaped without HTML-escaping the input, allowing untrusted className values used in a JSX class attribute during server-side rendering to break out of the attribute and inject arbitrary markup. This issue is fixed in version 4.12.27.\n\nPackage: hono\nInstalled: 4.12.14\nFixed in: 4.12.27\nSeverity: MEDIUM\nFix: Upgrade hono to 4.12.27"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-92d99fe486a24622", "name": "CVE-2026-59896: hono 4.12.14 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-59896: hono 4.12.14 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "hono/jsx does not isolate context per request, leading to cross-request data disclosure\n\nHono is a Web application framework that provides support for any JavaScript runtime. From 4.11.8 before 4.12.27, hono/jsx did not isolate context values per request during server-side rendering, allowing createContext, useContext, jsxRenderer, or useRequestContext data from a different in-flight request to be used after an await in an async component. This issue is fixed in version 4.12.27.\n\nPackage: hono\nInstalled: 4.12.14\nFixed in: 4.12.27\nSeverity: MEDIUM\nFix: Upgrade hono to 4.12.27"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-cca6922b2e09e0dd", "name": "CVE-2026-59897: hono 4.12.14 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-59897: hono 4.12.14 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "Hono: API Gateway v1 adapter can drop a distinct repeated request header value during de-duplication\n\nHono is a Web application framework that provides support for any JavaScript runtime. From 4.3.3 before 4.12.27, the AWS API Gateway v1 adapter can drop a distinct repeated request header value because it de-duplicates values using a substring comparison instead of an exact match, so middleware or application logic that depends on the complete X-Forwarded-For chain, rate limiting, audit logging, or proxy-chain validation can receive incomplete data. This issue is fixed in version 4.12.27.\n\nPackage: hono\nInstalled: 4.12.14\nFixed in: 4.12.27\nSeverity: MEDIUM\nFix: Upgrade hono to 4.12.27"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c7a25c67916ec1fc", "name": "CVE-2026-44459: hono 4.12.14 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-44459: hono 4.12.14 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "Hono has improper validation of NumericDate claims (exp, nbf, iat) in JWT verify()\n\nHono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.18, improper validation of the JWT NumericDate claims exp, nbf, and iat in hono/utils/jwt allows tokens with non-spec-compliant claim values to silently bypass time-based checks. This issue is not exploitable by an anonymous attacker; it only manifests when a malformed claim value reaches verify() \u2014 typically when the application itself issues such tokens, or when the signing key is otherwise unde\n\nPackage: hono\nInstalled: 4.12.14\nFixed in: 4.12.18\nSeverity: LOW\nFix: Upgrade hono to 4.12.18"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c39e60a99cd19f3b", "name": "CVE-2026-42338: ip-address 10.1.0 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-42338: ip-address 10.1.0 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input\n\nip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.1.1, Address6.group() and Address6.link() do not HTML-escape attacker-controlled content before embedding it in the HTML strings they return, and AddressError.parseMessage (emitted by the Address6 constructor for invalid input) can contain unescaped attacker-controlled content in one branch. An application that (1) passes untrusted input to Address6 and (2) renders the output of these methods,\n\nPackage: ip-address\nInstalled: 10.1.0\nFixed in: 10.1.1\nSeverity: MEDIUM\nFix: Upgrade ip-address to 10.1.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-77cb8d69eb72544b", "name": "CVE-2026-59869: js-yaml 3.14.2 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-59869: js-yaml 3.14.2 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "js-yaml: js-yaml: Denial of Service via crafted YAML documents\n\njs-yaml is a JavaScript YAML parser and dumper. From 3.0.0 before 3.15.0 and from 4.0.0 before 4.3.0, js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly when a chain of mappings uses merge keys where each mapping merges the previous one. This issue is fixed in versions 3.15.0 and 4.3.0.\n\nPackage: js-yaml\nInstalled: 3.14.2\nFixed in: 3.15.0, 4.3.0\nSeverity: HIGH\nFix: Upgrade js-yaml to 3.15.0, 4.3.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-46a4e3a6a531415d", "name": "CVE-2026-53550: js-yaml 3.14.2 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-53550: js-yaml 3.14.2 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "js-yaml: js-yaml: Denial of Service via crafted YAML merge keys\n\njs-yaml is a JavaScript YAML parser and dumper. Prior to 4.2.0 and 3.15.0, a crafted YAML document can trigger algorithmic CPU exhaustion in js-yaml merge-key processing (<<) by repeating the same alias many times in a merge sequence. This causes quadratic parse-time behavior relative to input size and can block a Node.js worker/event loop for seconds with a relatively small payload (tens of KB), resulting in denial of service. The issue is in merge handling inside lib/loader.js. This vulnerabil\n\nPackage: js-yaml\nInstalled: 3.14.2\nFixed in: 4.2.0, 3.15.0\nSeverity: MEDIUM\nFix: Upgrade js-yaml to 4.2.0, 3.15.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-39762d64c6242d65", "name": "CVE-2026-59869: js-yaml 4.1.1 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-59869: js-yaml 4.1.1 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "js-yaml: js-yaml: Denial of Service via crafted YAML documents\n\njs-yaml is a JavaScript YAML parser and dumper. From 3.0.0 before 3.15.0 and from 4.0.0 before 4.3.0, js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly when a chain of mappings uses merge keys where each mapping merges the previous one. This issue is fixed in versions 3.15.0 and 4.3.0.\n\nPackage: js-yaml\nInstalled: 4.1.1\nFixed in: 3.15.0, 4.3.0\nSeverity: HIGH\nFix: Upgrade js-yaml to 3.15.0, 4.3.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-23f76c83140b1dbe", "name": "CVE-2026-53550: js-yaml 4.1.1 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-53550: js-yaml 4.1.1 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "js-yaml: js-yaml: Denial of Service via crafted YAML merge keys\n\njs-yaml is a JavaScript YAML parser and dumper. Prior to 4.2.0 and 3.15.0, a crafted YAML document can trigger algorithmic CPU exhaustion in js-yaml merge-key processing (<<) by repeating the same alias many times in a merge sequence. This causes quadratic parse-time behavior relative to input size and can block a Node.js worker/event loop for seconds with a relatively small payload (tens of KB), resulting in denial of service. The issue is in merge handling inside lib/loader.js. This vulnerabil\n\nPackage: js-yaml\nInstalled: 4.1.1\nFixed in: 4.2.0, 3.15.0\nSeverity: MEDIUM\nFix: Upgrade js-yaml to 4.2.0, 3.15.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9c74bb3be696a874", "name": "CVE-2026-59887: linkify-it 5.0.1 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-59887: linkify-it 5.0.1 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "linkify-it: Quadratic-complexity DoS via the `mailto:` validator scan-loop on attacker text\n\nlinkify-it is a links recognition library with full Unicode support. Prior to 5.0.2, the mailto: schema validator used by .test() and .match() can be invoked at every mailto: occurrence and scan the remaining input through src_email_name in lib/re.mjs, causing O(n^2) CPU consumption on crafted user text. This issue is fixed in version 5.0.2.\n\nPackage: linkify-it\nInstalled: 5.0.1\nFixed in: 5.0.2\nSeverity: HIGH\nFix: Upgrade linkify-it to 5.0.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-349cb0f13509797c", "name": "CVE-2026-41305: postcss 8.5.9 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-41305: postcss 8.5.9 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "postcss: PostCSS: Cross-Site Scripting (XSS) via improper escaping of style closing tags\n\nPostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Versions prior to 8.5.10 do not escape `</style>` sequences when stringifying CSS ASTs. When user-submitted CSS is parsed and re-stringified for embedding in HTML `<style>` tags, `</style>` in CSS values breaks out of the style context, enabling XSS. Version 8.5.10 fixes the issue.\n\nPackage: postcss\nInstalled: 8.5.9\nFixed in: 8.5.10\nSeverity: MEDIUM\nFix: Upgrade postcss to 8.5.10"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-642f1c98e00981bd", "name": "CVE-2026-41242: protobufjs 7.5.4 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-41242: protobufjs 7.5.4 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "protobufjs: protobufjs: Arbitrary code execution via injected protobuf definition type fields\n\nprotobufjs compiles protobuf definitions into JavaScript (JS) functions. In versions prior to 8.0.1 and 7.5.5, attackers can inject arbitrary code in the \"type\" fields of protobuf definitions, which will then execute during object decoding using that definition. Versions 8.0.1 and 7.5.5 patch the issue.\n\nPackage: protobufjs\nInstalled: 7.5.4\nFixed in: 8.0.1, 7.5.5\nSeverity: CRITICAL\nFix: Upgrade protobufjs to 8.0.1, 7.5.5"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-6c2c63528f37be6d", "name": "CVE-2026-44289: protobufjs 7.5.4 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-44289: protobufjs 7.5.4 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "protobufjs: protobufjs: Denial of Service via uncontrolled recursion in protobuf decoding\n\nprotobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs could recurse without a depth limit while decoding nested protobuf data. This affected both skipping unknown group fields and generated decoding of nested message fields. A crafted protobuf binary payload could cause the JavaScript call stack to be exhausted during decoding. This vulnerability is fixed in 7.5.6 and 8.0.2.\n\nPackage: protobufjs\nInstalled: 7.5.4\nFixed in: 7.5.6, 8.0.2\nSeverity: HIGH\nFix: Upgrade protobufjs to 7.5.6, 8.0.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-ef133bfb33bfe2d1", "name": "CVE-2026-44290: protobufjs 7.5.4 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-44290: protobufjs 7.5.4 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "protobufjs: protobufjs: Denial of Service via crafted schema\n\nprotobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs allowed certain schema option paths to traverse through inherited object properties while applying options. A crafted protobuf schema or JSON descriptor could cause option handling to write to properties on global JavaScript constructors, corrupting process-wide built-in functionality. This vulnerability is fixed in 7.5.6 and 8.0.2.\n\nPackage: protobufjs\nInstalled: 7.5.4\nFixed in: 7.5.6, 8.0.2\nSeverity: HIGH\nFix: Upgrade protobufjs to 7.5.6, 8.0.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-4bf34c643a208348", "name": "CVE-2026-44291: protobufjs 7.5.4 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-44291: protobufjs 7.5.4 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "protobufjs: protobufjs: Arbitrary Code Execution via prototype pollution\n\nprotobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs used plain objects with inherited prototypes for internal type lookup tables used by generated encode and decode functions. If Object.prototype had already been polluted, those lookup tables could resolve attacker-controlled inherited properties as valid protobuf type information. This could cause attacker-controlled strings to be emitted into generated JavaScript code. This vulnerabilit\n\nPackage: protobufjs\nInstalled: 7.5.4\nFixed in: 7.5.6, 8.0.2\nSeverity: HIGH\nFix: Upgrade protobufjs to 7.5.6, 8.0.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-7ef1cd109789f8f1", "name": "CVE-2026-44293: protobufjs 7.5.4 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-44293: protobufjs 7.5.4 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "protobufjs: protobufjs: Arbitrary code execution due to unsafe expression generation from crafted protobuf descriptors\n\nprotobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs generated JavaScript for toObject conversion could include an unsafe expression derived from a schema-controlled bytes field default value. A crafted descriptor with a non-string default value for a bytes field could cause attacker-controlled code to be emitted into the generated conversion function. This vulnerability is fixed in 7.5.6 and 8.0.2.\n\nPackage: protobufjs\nInstalled: 7.5.4\nFixed in: 7.5.6, 8.0.2\nSeverity: HIGH\nFix: Upgrade protobufjs to 7.5.6, 8.0.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-f2fc6a601f149747", "name": "CVE-2026-48712: protobufjs 7.5.4 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-48712: protobufjs 7.5.4 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "protobufjs: protobufjs: Denial of Service via uncontrolled recursion with crafted protobuf payload\n\nprotobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.6.1 and 8.4.1, protobufjs could recurse without a depth limit while converting decoded messages to plain objects or JSON. This affected generated toObject() conversion and the custom google.protobuf.Any JSON conversion path. A crafted protobuf binary payload containing deeply nested Any values could cause the JavaScript call stack to be exhausted during conversion to JSON. This vulnerability is fixed in 7.6.1 and\n\nPackage: protobufjs\nInstalled: 7.5.4\nFixed in: 7.6.1, 8.4.1\nSeverity: HIGH\nFix: Upgrade protobufjs to 7.6.1, 8.4.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-709fb68bc432f757", "name": "CVE-2026-44288: protobufjs 7.5.4 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-44288: protobufjs 7.5.4 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "protobufjs: protobufjs: Security control bypass due to improper handling of overlong UTF-8 sequences\n\nprotobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs includes a minimal UTF-8 decoder that accepted overlong UTF-8 byte sequences and decoded them to their canonical characters instead of replacing them. An attacker who can provide protobuf binary data decoded through the affected UTF-8 path may be able to bypass application-level checks that inspect raw bytes before protobuf string decoding. For example, bytes that do not contain certain \n\nPackage: protobufjs\nInstalled: 7.5.4\nFixed in: 7.5.6, 8.0.2\nSeverity: MEDIUM\nFix: Upgrade protobufjs to 7.5.6, 8.0.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a417f5de75bde6aa", "name": "CVE-2026-44292: protobufjs 7.5.4 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-44292: protobufjs 7.5.4 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "protobufjs: protobufjs: Data integrity impact due to prototype pollution\n\nprotobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs generated message constructors copied enumerable properties from a provided properties object without filtering the __proto__ key. If an application constructed a message from an attacker-controlled plain object, an own enumerable __proto__ property could alter the prototype of that individual message instance. This vulnerability is fixed in 7.5.6 and 8.0.2.\n\nPackage: protobufjs\nInstalled: 7.5.4\nFixed in: 7.5.6, 8.0.2\nSeverity: MEDIUM\nFix: Upgrade protobufjs to 7.5.6, 8.0.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9c6445899e9d9a0e", "name": "CVE-2026-44294: protobufjs 7.5.4 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-44294: protobufjs 7.5.4 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "protobufjs: protobufjs: Denial of Service due to unescaped control characters in field names\n\nprotobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs generated JavaScript property accessors from schema-controlled field and oneof names. Certain control characters in field names were not escaped before being embedded into generated function bodies. A crafted schema or JSON descriptor could therefore cause generated encode, decode, verify, or conversion functions to fail during compilation. This vulnerability is fixed in 7.5.6 and 8.0.2.\n\nPackage: protobufjs\nInstalled: 7.5.4\nFixed in: 7.5.6, 8.0.2\nSeverity: MEDIUM\nFix: Upgrade protobufjs to 7.5.6, 8.0.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4260332644dce412", "name": "CVE-2026-45740: protobufjs 7.5.4 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-45740: protobufjs 7.5.4 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "protobufjs: protobufjs: Denial of Service via crafted JSON descriptors\n\nprotobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.8 and 8.2.0, protobufjs could recurse without a depth limit while expanding nested JSON descriptors through Root.fromJSON() and Namespace.addJSON(). A crafted JSON descriptor with deeply nested namespace definitions could cause the JavaScript call stack to be exhausted during descriptor loading. This vulnerability is fixed in 7.5.8 and 8.2.0.\n\nPackage: protobufjs\nInstalled: 7.5.4\nFixed in: 7.5.8, 8.2.0\nSeverity: MEDIUM\nFix: Upgrade protobufjs to 7.5.8, 8.2.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7ce74348686c1be7", "name": "CVE-2026-54269: protobufjs 7.5.4 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-54269: protobufjs 7.5.4 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "protobufjs: protobufjs-cli: protobufjs: Denial of Service due to name collision with runtime helpers\n\nprotobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 8.6.0 and 7.6.3, protobufjs accepted certain schema-derived names that could collide with properties used by protobufjs runtime helpers. The known affected names are fields named hasOwnProperty, field or oneof names such as $type when loaded through protobufjs JSON/reflection descriptors, and service methods whose generated helper name is rpcCall. When affected message or service types were used, protobufjs could r\n\nPackage: protobufjs\nInstalled: 7.5.4\nFixed in: 7.6.3, 8.6.0\nSeverity: MEDIUM\nFix: Upgrade protobufjs to 7.6.3, 8.6.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-64d9bf8627368b8b", "name": "CVE-2026-59877: protobufjs 7.5.4 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-59877: protobufjs 7.5.4 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "protobufjs: protobufjs: Denial of Service via crafted .proto schema\n\nprotobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.6.5 and 8.6.6, protobufjs parsed option names by advancing through schema tokens until reaching an = token without checking for end of input, so a crafted .proto schema that opens an option declaration and ends prematurely can cause parse, Root.load, or Root.loadSync to loop indefinitely. This issue is fixed in versions 7.6.5 and 8.6.6.\n\nPackage: protobufjs\nInstalled: 7.5.4\nFixed in: 7.6.5, 8.6.6\nSeverity: MEDIUM\nFix: Upgrade protobufjs to 7.6.5, 8.6.6"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-618f3c6532aa65ef", "name": "CVE-2026-8723: qs 6.15.1 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-8723: qs 6.15.1 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "### Summary    `qs.stringify` throws `TypeError` when called with `arr ...\n\n### Summary\n\n\n\n`qs.stringify` throws `TypeError` when called with `arrayFormat: 'comma'` and `encodeValuesOnly: true` on an array containing `null` or `undefined`. The throw is synchronous and not handled by any of qs's null-related options (`skipNulls`, `strictNullHandling`).\n\n\n\n### Details\n\n\n\nIn the comma + `encodeValuesOnly` branch, `lib/stringify.js:145` mapped the array through the raw encoder before joining:\n\n\n\n```js\n\n\n\nobj = utils.maybeMap(obj, encoder);\n\n\n\n```\n\n\n\n`utils.encode` (`lib/uti\n\nPackage: qs\nInstalled: 6.15.1\nFixed in: 6.15.2\nSeverity: MEDIUM\nFix: Upgrade qs to 6.15.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b0247a0a98209007", "name": "CVE-2026-42211: react-router 7.14.1 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-42211: react-router 7.14.1 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "react-router: React Router: Remote Code Execution via prototype pollution in Framework Mode\n\nReact Router is a router for React. In versions 7.0.0 through 7.14.1, when using Framework Mode, a combination of steps could potentially allow unauthorized remote code execution (RCE) through external requests. This attack requires the application code to have an existing prototype pollution vulnerability, which can then be leveraged in a 2-step attack where the second step triggers unauthorized RCE on the remote server. This does not impact applications using Declarative Mode (`<BrowserRouter>\n\nPackage: react-router\nInstalled: 7.14.1\nFixed in: 7.14.2\nSeverity: HIGH\nFix: Upgrade react-router to 7.14.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-cac339bb98c3794e", "name": "CVE-2026-42342: react-router 7.14.1 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-42342: react-router 7.14.1 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "react-router: @remix-run/server-runtime: React Router / Remix: Denial of Service via unbounded path expansion in __manifest endpoint\n\nReact Router is a router for React. In versions 7.0.0 through 7.14.x of react-router and versions 2.10.0 through 2.17.4 of @remix-run/server-runtime, certain crafted requests can consume disproportionate server resources via unbounded path expansion in the __manifest endpoint, resulting in response time degradation and/or service unavailability for end users. This affects React Router Framework Mode applications as well as Remix applications. This does not impact applications using Declarative M\n\nPackage: react-router\nInstalled: 7.14.1\nFixed in: 7.15.0\nSeverity: HIGH\nFix: Upgrade react-router to 7.15.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-55ed0f80b10a9a7d", "name": "CVE-2026-53663: react-router 7.14.1 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-53663: react-router 7.14.1 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "react-router: @remix-run/server-runtime: React Router: Insufficient CSRF protection allows integrity impact\n\nReact Router is a router for React. From 7.12.0 until 7.15.1, certain CSRF checks in React Router v7 Framework Mode were insufficient and run on POST requests, but were bypassed on PUT/PATCH/DELETE requests. This is a low severity vulnerability because modern browser protections (CORS preflight, SameSite cookies) already block the cross-origin attack vectors that this missing CSRF check would otherwise gate. This vulnerability is fixed in 7.15.1.\n\nPackage: react-router\nInstalled: 7.14.1\nFixed in: 7.15.1\nSeverity: LOW\nFix: Upgrade react-router to 7.15.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-98c7012c93dea3f0", "name": "CVE-2026-59873: tar 7.5.13 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-59873: tar 7.5.13 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "tar: node-tar: Denial of Service via crafted gzip bomb\n\nnode-tar is a tar archive manipulation library for Node.js. Prior to 7.5.19, node-tar does not enforce hard upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths such as src/extract.ts, allowing a small crafted gzip bomb to exhaust disk space and CPU. This issue is fixed in version 7.5.19.\n\nPackage: tar\nInstalled: 7.5.13\nFixed in: 7.5.19\nSeverity: CRITICAL\nFix: Upgrade tar to 7.5.19"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-555b88d3f76a4a7e", "name": "CVE-2026-59874: tar 7.5.13 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-59874: tar 7.5.13 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "tar: Node-tar: Denial of Service via malformed tar archive header\n\nnode-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, tar.replace accepts a checksum-valid tar header with a negative base-256 encoded entry size, causing the archive scanner to make no progress while repeatedly parsing the same header. This issue is fixed in version 7.5.18.\n\nPackage: tar\nInstalled: 7.5.13\nFixed in: 7.5.18\nSeverity: HIGH\nFix: Upgrade tar to 7.5.18"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-e36cdd44cd18f779", "name": "CVE-2026-53655: tar 7.5.13 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-53655: tar 7.5.13 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "node-tar: node-tar: File smuggling due to inconsistent tar archive parsing\n\nnode-tar is a full-featured Tar for Node.js. Prior to 7.5.16, tar (node-tar) applies a PAX extended header's size= record (and other PAX overrides) to the next header entry of any type, including intermediary metadata headers such as a GNU long-name (L) or long-link (K) entry. Per POSIX pax, a PAX extended header (x) describes the next file entry, not the intermediary extension headers that may sit between the x header and the file it annotates. Because node-tar lets the PAX size override the by\n\nPackage: tar\nInstalled: 7.5.13\nFixed in: 7.5.16\nSeverity: MEDIUM\nFix: Upgrade tar to 7.5.16"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ae3d866c0730d9e0", "name": "CVE-2026-59871: tar 7.5.13 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-59871: tar 7.5.13 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "node-tar: node-tar: Denial of Service due to incorrect PAX path handling\n\nnode-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, node-tar coerces all-digit PAX path and linkpath values in src/pax.ts to JavaScript numbers, causing downstream path handling such as normalizeWindowsPath(entry.path).split('/') to throw an uncaught TypeError. This issue is fixed in version 7.5.18.\n\nPackage: tar\nInstalled: 7.5.13\nFixed in: 7.5.18\nSeverity: MEDIUM\nFix: Upgrade tar to 7.5.18"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-993c5ff4088aa324", "name": "CVE-2026-59875: tar 7.5.13 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-59875: tar 7.5.13 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "node-tar: node-tar: Denial of Service via crafted archive with NUL bytes in metadata\n\nnode-tar is a tar archive manipulation library for Node.js. Prior to 7.5.17, node-tar does not strip NUL bytes from PAX path and linkpath records in src/pax.ts, allowing a crafted archive with values to reach fs.lstat or fs.open and terminate the process with an uncaught exception. This issue is fixed in version 7.5.17.\n\nPackage: tar\nInstalled: 7.5.13\nFixed in: 7.5.17\nSeverity: MEDIUM\nFix: Upgrade tar to 7.5.17"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e30e547b6d4e083c", "name": "CVE-2026-12151: undici 7.27.1 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-12151: undici 7.27.1 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames\n\nImpact:\nThe undici WebSocket client enforces maxPayloadSize on the cumulative byte count of fragments in a message but does not enforce a limit on the number of fragments. A malicious WebSocket server can stream many small or empty continuation frames that each pass per-frame and cumulative-size validation, collectively causing unbounded memory growth in the client process. The result is memory exhaustion and a denial of service.\n\nAffected applications are those using the undici WebSocket client\n\nPackage: undici\nInstalled: 7.27.1\nFixed in: 6.27.0, 7.28.0, 8.5.0\nSeverity: HIGH\nFix: Upgrade undici to 6.27.0, 7.28.0, 8.5.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-049909921e22854a", "name": "CVE-2026-6734: undici 7.27.1 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-6734: undici 7.27.1 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "undici: undici: Information disclosure and data integrity issues due to incorrect Socks5ProxyAgent connection routing\n\nImpact:\nWhen using Socks5ProxyAgent, undici reuses a single connection pool across different origins without verifying that the pool's origin matches the requested origin. All requests are dispatched through the pool connected to the first origin, regardless of the intended destination.\n\nThis causes cross-origin request routing: credentials and request data intended for origin B are sent to origin A, responses from the wrong origin are trusted, and HTTPS requests may be silently downgraded to HT\n\nPackage: undici\nInstalled: 7.27.1\nFixed in: 7.28.0, 8.2.0\nSeverity: HIGH\nFix: Upgrade undici to 7.28.0, 8.2.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-b3c3660810e97dab", "name": "CVE-2026-9697: undici 7.27.1 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-9697: undici 7.27.1 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "undici: undici: Man-in-the-Middle attack via ignored TLS options with SOCKS5 proxy\n\nImpact:\nundici's ProxyAgent silently drops the requestTls option when configured with a SOCKS5 proxy URI (socks5:// or socks://). The target HTTPS connection through the SOCKS5 tunnel falls back to Node's default trust store, ignoring user-configured ca, cert, key, rejectUnauthorized, and servername settings.\n\nApplications that pin to an internal or corporate CA via requestTls.ca will, when their proxy URI is SOCKS5, get the default Mozilla CA bundle as the trust anchor instead. Any cert signed \n\nPackage: undici\nInstalled: 7.27.1\nFixed in: 7.28.0, 8.5.0\nSeverity: HIGH\nFix: Upgrade undici to 7.28.0, 8.5.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-9bc3853831dd1050", "name": "CVE-2026-9678: undici 7.27.1 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-9678: undici 7.27.1 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "undici: Undici: Information disclosure due to improper cache-control header parsing\n\nImpact:\nUndici's cache interceptor incorrectly classifies some responses as cacheable when the upstream Cache-Control header uses whitespace-padded qualified private or no-cache field names such as private=\" authorization\" or no-cache=\"\\tauthorization\". The parser preserves the surrounding whitespace, so later comparisons against the literal authorization field name fail and the response is stored.\n\nIn shared-cache mode, this allows a response containing one user's authenticated data to be serve\n\nPackage: undici\nInstalled: 7.27.1\nFixed in: 7.28.0, 8.5.0\nSeverity: MEDIUM\nFix: Upgrade undici to 7.28.0, 8.5.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-264eb698240f3370", "name": "CVE-2026-9679: undici 7.27.1 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-9679: undici 7.27.1 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "undici: undici vulnerable to HTTP header injection via Set-Cookie percent-decoding\n\nImpact:\nundici's cookie parser in parseSetCookie percent-decodes cookie values via qsUnescape, turning encoded sequences like %0D%0A, %00, %3B, and %3D into their literal byte equivalents. RFC 6265 \u00a75.4 does not specify any decoding and browsers do not decode either.\n\nApplications that parse a Set-Cookie header and then forward the parsed value into a response header (proxies, middleware, SSR frameworks) become vulnerable to HTTP response header injection: an attacker-controlled upstream can inj\n\nPackage: undici\nInstalled: 7.27.1\nFixed in: 6.27.0, 7.28.0, 8.5.0\nSeverity: MEDIUM\nFix: Upgrade undici to 6.27.0, 7.28.0, 8.5.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c26b783f96a71f9b", "name": "CVE-2026-11525: undici 7.27.1 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-11525: undici 7.27.1 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header\n\nImpact:\nWhen undici parses a Set-Cookie header, it accepts any SameSite attribute value that contains Strict, Lax, or None as a substring, rather than the case-insensitive exact match specified by RFC 6265. Non-spec values are silently mapped to one of the three standard tokens. For example, SameSite=NoneOfYourBusiness is parsed as None (the most permissive setting), and SameSite=StrictLax is parsed as Lax (a downgrade from Strict).\n\nAffected applications are those that consume Set-Cookie header\n\nPackage: undici\nInstalled: 7.27.1\nFixed in: 6.27.0, 7.28.0, 8.5.0\nSeverity: LOW\nFix: Upgrade undici to 6.27.0, 7.28.0, 8.5.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-00d5db35ea37ffb8", "name": "CVE-2026-6733: undici 7.27.1 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-6733: undici 7.27.1 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery.\n\nImpact:\nUndici's HTTP/1.1 client is vulnerable to response queue poisoning on reused keep-alive sockets. An attacker-controlled upstream server can inject an unsolicited HTTP/1.1 response onto an idle socket after a request completes. When the client dispatches the next request on that socket, it associates the injected response with the new request, causing responses to be delivered to the wrong requests.\n\nThis requires an attacker-controlled or compromised upstream HTTP/1.1 server and keep-ali\n\nPackage: undici\nInstalled: 7.27.1\nFixed in: 6.27.0, 7.28.0, 8.5.0\nSeverity: LOW\nFix: Upgrade undici to 6.27.0, 7.28.0, 8.5.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5a451309f41c67ac", "name": "CVE-2026-53571: vite 5.4.21 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-53571: vite 5.4.21 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "vite: `server.fs.deny` bypass on Windows alternate paths\n\nVite is a frontend tooling framework for JavaScript. Prior to 8.0.16, 7.3.5, and 6.4.3, the contents of files that are specified by server.fs.deny can be returned to the browser on Windows. Vite\u2019s dev server denies direct access to sensitive files through server.fs.deny, including entries such as .env, .env.*, and *.{crt,pem}. However, on Windows, the deny logic does not correctly normalize NTFS ADS path forms before access checks are applied. Because of this, requests such as /.env::$DATA?raw a\n\nPackage: vite\nInstalled: 5.4.21\nFixed in: 8.0.16, 7.3.5, 6.4.3\nSeverity: HIGH\nFix: Upgrade vite to 8.0.16, 7.3.5, 6.4.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-4abeff9aec06fec2", "name": "CVE-2026-39365: vite 5.4.21 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-39365: vite 5.4.21 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "vite: Vite: Information disclosure via path traversal in dev server's .map request handling\n\nVite is a frontend tooling framework for JavaScript. From 6.0.0 to before 6.4.2, 7.3.2, and 8.0.5, the dev server\u2019s handling of .map requests for optimized dependencies resolves file paths and calls readFile without restricting ../ segments in the URL. As a result, it is possible to bypass the server.fs.strict allow list and retrieve .map files located outside the project root, provided they can be parsed as valid source map JSON. This vulnerability is fixed in 6.4.2, 7.3.2, and 8.0.5.\n\nPackage: vite\nInstalled: 5.4.21\nFixed in: 8.0.5, 7.3.2, 6.4.2\nSeverity: MEDIUM\nFix: Upgrade vite to 8.0.5, 7.3.2, 6.4.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-08d6443effa48eea", "name": "CVE-2026-53632: vite 5.4.21 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-53632: vite 5.4.21 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "launch-editor: launch-editor: Credential compromise via NTLMv2 password hash leak through UNC path access\n\nlaunch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.1, the launch-editor NPM package accesses arbitrary paths including Windows UNC paths. When a UNC path is opened, Windows automatically attempts NTLM authentication to the remote host, causing the user\u2019s NTLMv2 password hash to be leaked to an attacker-controlled SMB server. This can result in credential compromise through offline hash cracking. This vulnerability is fixed in 2.14.1.\n\nPackage: vite\nInstalled: 5.4.21\nFixed in: 8.0.16, 7.3.5, 6.4.3\nSeverity: MEDIUM\nFix: Upgrade vite to 8.0.16, 7.3.5, 6.4.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-90ebb6126bfc7765", "name": "CVE-2026-48779: ws 8.20.0 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-48779: ws 8.20.0 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "ws: ws: Denial of Service via memory exhaustion from small WebSocket fragments\n\nws is an open source WebSocket client and server for Node.js. All versions from 1.1.0 up to (but not including) 5.2.5, from 6.0.0 up to 6.2.4, from 7.0.0 up to 7.5.11, and from 8.0.0 up to 8.21.0 are affected by a memory exhaustion DoS vulnerability. A peer can send a high volume of exceptionally small fragments and data chunks, with modest network traffic, to force the remote peer into allocating and holding structural wrappers that consume far more memory than the default documented message-si\n\nPackage: ws\nInstalled: 8.20.0\nFixed in: 5.2.5, 6.2.4, 7.5.11, 8.21.0\nSeverity: HIGH\nFix: Upgrade ws to 5.2.5, 6.2.4, 7.5.11, 8.21.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-5a491364b191b329", "name": "CVE-2026-45736: ws 8.20.0 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-45736: ws 8.20.0 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "ws: ws: Uninitialized memory disclosure via `websocket.close()` with `TypedArray`\n\nws is an open source WebSocket client and server for Node.js. Prior to 8.20.1, the websocket.close() implementation is vulnerable to uninitialized memory disclosure when a TypedArray is passed as the reason argument. This vulnerability is fixed in 8.20.1.\n\nPackage: ws\nInstalled: 8.20.0\nFixed in: 8.20.1\nSeverity: MEDIUM\nFix: Upgrade ws to 8.20.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6bd16922ed884b60", "name": "DS-0002: Image user should not be 'root' \u2014 packages/klient/Dockerfile", "shortDescription": {"text": "DS-0002: Image user should not be 'root' \u2014 packages/klient/Dockerfile"}, "fullDescription": {"text": "Image user should not be 'root'\n\nSpecify at least 1 USER command in Dockerfile with non-root user as argument\n\nRule: DS-0002\nSeverity: HIGH\nTarget: packages/klient/Dockerfile"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-aae76674b0a2f27c", "name": "DS-0026: No HEALTHCHECK defined \u2014 packages/klient/Dockerfile", "shortDescription": {"text": "DS-0026: No HEALTHCHECK defined \u2014 packages/klient/Dockerfile"}, "fullDescription": {"text": "No HEALTHCHECK defined\n\nAdd HEALTHCHECK instruction in your Dockerfile\n\nRule: DS-0026\nSeverity: LOW\nTarget: packages/klient/Dockerfile"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2679282aa1c484b5", "name": "Agent authority lacks a verifier contract: AGENTS.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: AGENTS.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f42cb21e1ca4e3b3", "name": "Agent authority lacks a verifier contract: apps/kimi-web/AGENTS.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: apps/kimi-web/AGENTS.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-79b21bd939f88b58", "name": "Agent authority lacks a verifier contract: docs/zh/customization/agents.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: docs/zh/customization/agents.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6b7a382a7c934afb", "name": "Agent authority lacks a verifier contract: docs/en/customization/agents.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: docs/en/customization/agents.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6597c1993ca0e25f", "name": "Agent authority lacks a verifier contract: packages/agent-core-v2/AGENTS.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: packages/agent-core-v2/AGENTS.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b6fce3c96387599c", "name": "Agent authority lacks a verifier contract: packages/agent-core-v2/src/app/skillCatalog/builtin/sub-skill/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: packages/agent-core-v2/src/app/skillCatalog/builtin/sub-skill/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f5085ddc8c449463", "name": "Agent authority lacks a verifier contract: packages/agent-core-v2/src/app/skillCatalog/builtin/sub-skill/review/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: packages/agent-core-v2/src/app/skillCatalog/builtin/sub-skill/review/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-cf8a799c08ffd0e3", "name": "Agent authority lacks a verifier contract: packages/agent-core/src/skill/builtin/sub-skill/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: packages/agent-core/src/skill/builtin/sub-skill/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-85beac3cd5b2ef51", "name": "Agent authority lacks a verifier contract: packages/agent-core/src/skill/builtin/sub-skill/review/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: packages/agent-core/src/skill/builtin/sub-skill/review/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e73a9132365207d8", "name": "Agent authority lacks a verifier contract: packages/pi-tui/AGENTS.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: packages/pi-tui/AGENTS.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e88f921528313f54", "name": "Agent authority lacks a verifier contract: plugins/official/kimi-datasource/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: plugins/official/kimi-datasource/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5754588a75f75bee", "name": "SkillSpector E1 (data-exfil) in plugins/official/kimi-datasource/bin/kimi-datasource.mjs", "shortDescription": {"text": "SkillSpector E1 (data-exfil) in plugins/official/kimi-datasource/bin/kimi-datasource.mjs"}, "fullDescription": {"text": "https://api.kimi.com/\n\nData is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.\n\nSkill: kimi-datasource\nRule: E1  Category: data-exfil\nSeverity: MEDIUM  Confidence: 0.50\n\nRemediation: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.5}}, {"id": "scanner-e637c415447867e4", "name": "Run SkillSpector's LLM-backed analysis in your own pipeline", "shortDescription": {"text": "Run SkillSpector's LLM-backed analysis in your own pipeline"}, "fullDescription": {"text": "Repobility ran SkillSpector's static rules server-side. The deeper LLM-backed analyzers \u2014 tool-poisoning (TP*), semantic security discovery (SSD*), developer-intent mismatch (SDI*) \u2014 are meant to run on YOUR machine with YOUR model; repobility never sends your code to an LLM. Recipe:\n\n# 1. Install SkillSpector in your own isolated env\npipx install \"skillspector @ git+https://github.com/NVIDIA/SkillSpector.git\"\n\n# 2. Point it at YOUR LLM pipeline (pick one) - your code stays on your machine\nexport SKILLSPECTOR_PROVIDER=anthropic && export ANTHROPIC_API_KEY=sk-ant-...\n# export SKILLSPECTOR_PROVIDER=openai   && export OPENAI_API_KEY=sk-...\n# export SKILLSPECTOR_PROVIDER=openai OPENAI_API_KEY=ollama OPENAI_BASE_URL=http://localhost:11434/v1 SKILLSPECTOR_MODEL=llama3.1:8b\n# export SKILLSPECTOR_PROVIDER=nv_build && export NVIDIA_INFERENCE_KEY=nvapi-...\n\n# 3. Run the LLM-backed scan per skill (omit --no-llm to enable the LLM analyzers)\nskillspector scan plugins/official/kimi-datasource --form"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "info", "confidence": 1.0}}, {"id": "scanner-0b69fa8bea96fae3", "name": "Dockerfile runs as root: packages/klient/Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: packages/klient/Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f1385cdae20e8bf0", "name": "Insecure pattern 'vue_v_html' in apps/kimi-web/src/components/FilePreview.vue:553", "shortDescription": {"text": "Insecure pattern 'vue_v_html' in apps/kimi-web/src/components/FilePreview.vue:553"}, "fullDescription": {"text": "Found a known-risky pattern (vue_v_html). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.65}}, {"id": "scanner-e39e9277a3e98644", "name": "Insecure pattern 'vue_v_html' in apps/kimi-web/src/components/chat/MentionMenu.vue:83", "shortDescription": {"text": "Insecure pattern 'vue_v_html' in apps/kimi-web/src/components/chat/MentionMenu.vue:83"}, "fullDescription": {"text": "Found a known-risky pattern (vue_v_html). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.65}}, {"id": "scanner-9d6532b5341565da", "name": "Insecure pattern 'vue_v_html' in apps/kimi-web/src/components/chat/ToolRow.vue:57", "shortDescription": {"text": "Insecure pattern 'vue_v_html' in apps/kimi-web/src/components/chat/ToolRow.vue:57"}, "fullDescription": {"text": "Found a known-risky pattern (vue_v_html). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.65}}, {"id": "scanner-ade6f69fa13f8099", "name": "Insecure pattern 'vue_v_html' in apps/kimi-web/src/components/dialogs/SearchSessionsDialog.vue:161", "shortDescription": {"text": "Insecure pattern 'vue_v_html' in apps/kimi-web/src/components/dialogs/SearchSessionsDialog.vue:161"}, "fullDescription": {"text": "Found a known-risky pattern (vue_v_html). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.65}}, {"id": "scanner-a95e6f2e13feee84", "name": "Insecure pattern 'node_child_process' in apps/kimi-code/scripts/build-vis-asset.mjs:5", "shortDescription": {"text": "Insecure pattern 'node_child_process' in apps/kimi-code/scripts/build-vis-asset.mjs:5"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.9}}, {"id": "scanner-3c3354f733faacdc", "name": "Insecure pattern 'node_child_process' in apps/kimi-code/src/cli/run-shell.ts:1", "shortDescription": {"text": "Insecure pattern 'node_child_process' in apps/kimi-code/src/cli/run-shell.ts:1"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.9}}, {"id": "scanner-3ba1aeb51f7f8c62", "name": "Insecure pattern 'node_child_process' in apps/kimi-code/src/cli/update/preflight.ts:1", "shortDescription": {"text": "Insecure pattern 'node_child_process' in apps/kimi-code/src/cli/update/preflight.ts:1"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.9}}, {"id": "scanner-da6ae27c12868040", "name": "Insecure pattern 'node_child_process' in apps/kimi-code/src/utils/process/external-editor.ts:11", "shortDescription": {"text": "Insecure pattern 'node_child_process' in apps/kimi-code/src/utils/process/external-editor.ts:11"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.9}}, {"id": "scanner-647f17be76d1f181", "name": "Insecure pattern 'exec_used' in packages/kaos/src/local.ts:727", "shortDescription": {"text": "Insecure pattern 'exec_used' in packages/kaos/src/local.ts:727"}, "fullDescription": {"text": "Found a known-risky pattern (exec_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-54019cb0c8e6c4e0", "name": "Insecure pattern 'exec_used' in packages/kaos/src/kaos.ts:94", "shortDescription": {"text": "Insecure pattern 'exec_used' in packages/kaos/src/kaos.ts:94"}, "fullDescription": {"text": "Found a known-risky pattern (exec_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-0048d76fb9f0a71f", "name": "Insecure pattern 'node_child_process' in packages/kap-server/src/lib/fileLaunch.ts:2", "shortDescription": {"text": "Insecure pattern 'node_child_process' in packages/kap-server/src/lib/fileLaunch.ts:2"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.9}}, {"id": "scanner-62b3bbb0486d4d12", "name": "Insecure pattern 'exec_used' in packages/acp-adapter/src/kaos-acp.ts:244", "shortDescription": {"text": "Insecure pattern 'exec_used' in packages/acp-adapter/src/kaos-acp.ts:244"}, "fullDescription": {"text": "Found a known-risky pattern (exec_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-67f2b1b4f15ebad4", "name": "Insecure pattern 'exec_used' in packages/agent-core-v2/src/os/backends/node-local/tools/rgLocator.ts:54", "shortDescription": {"text": "Insecure pattern 'exec_used' in packages/agent-core-v2/src/os/backends/node-local/tools/rgLocator.ts:54"}, "fullDescription": {"text": "Found a known-risky pattern (exec_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-28a274ae86000b3b", "name": "Insecure pattern 'exec_used' in packages/agent-core-v2/src/session/process/processRunner.ts:34", "shortDescription": {"text": "Insecure pattern 'exec_used' in packages/agent-core-v2/src/session/process/processRunner.ts:34"}, "fullDescription": {"text": "Found a known-risky pattern (exec_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-1d49bf72e117b302", "name": "Insecure pattern 'exec_used' in packages/agent-core-v2/src/session/process/processRunnerService.ts:28", "shortDescription": {"text": "Insecure pattern 'exec_used' in packages/agent-core-v2/src/session/process/processRunnerService.ts:28"}, "fullDescription": {"text": "Found a known-risky pattern (exec_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-26a1e5ce7a50d767", "name": "Insecure pattern 'exec_used' in packages/agent-core-v2/src/session/sessionFs/rgLocator.ts:34", "shortDescription": {"text": "Insecure pattern 'exec_used' in packages/agent-core-v2/src/session/sessionFs/rgLocator.ts:34"}, "fullDescription": {"text": "Found a known-risky pattern (exec_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-894b88778ceec8d2", "name": "Insecure pattern 'node_child_process' in packages/pi-tui/src/terminal-image.ts:1", "shortDescription": {"text": "Insecure pattern 'node_child_process' in packages/pi-tui/src/terminal-image.ts:1"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.9}}, {"id": "scanner-6cddaff1ec9d2c59", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-76d1307a801f7446", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-09216238c870ae6a", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/upload-pages-artifact@v5 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c4fb3f824e437796", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-479a251a829cea7d", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-46c644c6227e4d4a", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1838a141491ce38c", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-cb639d9a10a47b23", "name": "package.json defines install-time lifecycle scripts", "shortDescription": {"text": "package.json defines install-time lifecycle scripts"}, "fullDescription": {"text": "preinstall/install/postinstall/prepare scripts execute during dependency installation. Review them carefully for network calls, obfuscation, shell execution, or credential access."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-56a11826fd99c4aa", "name": "package.json defines install-time lifecycle scripts", "shortDescription": {"text": "package.json defines install-time lifecycle scripts"}, "fullDescription": {"text": "preinstall/install/postinstall/prepare scripts execute during dependency installation. Review them carefully for network calls, obfuscation, shell execution, or credential access."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bd4b7757b949ab8a", "name": "Very large file: apps/vis/server/test/lib/context-projector.test.ts (942 lines)", "shortDescription": {"text": "Very large file: apps/vis/server/test/lib/context-projector.test.ts (942 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4bd20a13e1d1b83b", "name": "Very large file: apps/kimi-web/test/workspace-state.test.ts (2107 lines)", "shortDescription": {"text": "Very large file: apps/kimi-web/test/workspace-state.test.ts (2107 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6cd2b04da24cf7ce", "name": "Very large file: apps/kimi-web/src/api/daemon/client.ts (1562 lines)", "shortDescription": {"text": "Very large file: apps/kimi-web/src/api/daemon/client.ts (1562 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-69c13e7443abf91f", "name": "Very large file: apps/kimi-web/src/api/daemon/agentEventProjector.ts (1582 lines)", "shortDescription": {"text": "Very large file: apps/kimi-web/src/api/daemon/agentEventProjector.ts (1582 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a4ccc7c79c97c5bd", "name": "Very large file: apps/kimi-web/src/composables/useKimiWebClient.ts (2968 lines)", "shortDescription": {"text": "Very large file: apps/kimi-web/src/composables/useKimiWebClient.ts (2968 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-54a09c1adf06d73a", "name": "Very large file: apps/kimi-web/src/composables/client/useWorkspaceState.ts (2842 lines)", "shortDescription": {"text": "Very large file: apps/kimi-web/src/composables/client/useWorkspaceState.ts (2842 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3d8542924d68e9f9", "name": "Very large file: apps/kimi-code/test/tui/kimi-tui-message-flow.test.ts (5697 lines)", "shortDescription": {"text": "Very large file: apps/kimi-code/test/tui/kimi-tui-message-flow.test.ts (5697 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f48676a52c0ffe20", "name": "Very large file: apps/kimi-code/test/tui/kimi-tui-startup.test.ts (1776 lines)", "shortDescription": {"text": "Very large file: apps/kimi-code/test/tui/kimi-tui-startup.test.ts (1776 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9f4f1dae92df4ec4", "name": "Very large file: apps/kimi-code/test/tui/components/messages/tool-call.test.ts (1908 lines)", "shortDescription": {"text": "Very large file: apps/kimi-code/test/tui/components/messages/tool-call.test.ts (1908 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-88a973408f2277b0", "name": "Very large file: apps/kimi-code/test/cli/run-prompt.test.ts (1403 lines)", "shortDescription": {"text": "Very large file: apps/kimi-code/test/cli/run-prompt.test.ts (1403 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-27bc909cb0748462", "name": "Very large file: apps/kimi-code/src/tui/kimi-tui.ts (3069 lines)", "shortDescription": {"text": "Very large file: apps/kimi-code/src/tui/kimi-tui.ts (3069 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6085d202b93681f4", "name": "Very large file: apps/kimi-code/src/tui/components/messages/tool-call.ts (2331 lines)", "shortDescription": {"text": "Very large file: apps/kimi-code/src/tui/components/messages/tool-call.ts (2331 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f897bc93df708283", "name": "Very large file: apps/kimi-code/src/tui/components/messages/agent-swarm-progress.ts (1727 lines)", "shortDescription": {"text": "Very large file: apps/kimi-code/src/tui/components/messages/agent-swarm-progress.ts (1727 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-26cfa8faf9383fbb", "name": "Very large file: packages/kaos/test/ssh.test.ts (1472 lines)", "shortDescription": {"text": "Very large file: packages/kaos/test/ssh.test.ts (1472 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fe171ac06c120ee9", "name": "Very large file: packages/kap-server/test/sessionEventBroadcaster.test.ts (2453 lines)", "shortDescription": {"text": "Very large file: packages/kap-server/test/sessionEventBroadcaster.test.ts (2453 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-de2a6d937ccc869c", "name": "Very large file: packages/kap-server/test/transcript.test.ts (1395 lines)", "shortDescription": {"text": "Very large file: packages/kap-server/test/transcript.test.ts (1395 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-eef4bf3f515fa1a0", "name": "Very large file: packages/kap-server/test/services/transcript.test.ts (2302 lines)", "shortDescription": {"text": "Very large file: packages/kap-server/test/services/transcript.test.ts (2302 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-458fe48e285a4ddf", "name": "Very large file: packages/kap-server/src/transport/ws/v1/sessionEventBroadcaster.ts (1577 lines)", "shortDescription": {"text": "Very large file: packages/kap-server/src/transport/ws/v1/sessionEventBroadcaster.ts (1577 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-11611f61de040832", "name": "Very large file: packages/kap-server/src/services/transcript/coreEventMap.ts (1507 lines)", "shortDescription": {"text": "Very large file: packages/kap-server/src/services/transcript/coreEventMap.ts (1507 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e8dac13e13bdd9d5", "name": "Very large file: packages/acp-adapter/src/session.ts (1715 lines)", "shortDescription": {"text": "Very large file: packages/acp-adapter/src/session.ts (1715 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0359f7b6d2ca1020", "name": "Very large file: packages/acp-adapter/src/server.ts (1209 lines)", "shortDescription": {"text": "Very large file: packages/acp-adapter/src/server.ts (1209 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d883d97368e68cb4", "name": "Very large file: packages/minidb/src/index.ts (1668 lines)", "shortDescription": {"text": "Very large file: packages/minidb/src/index.ts (1668 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-14a413e9c1bbb3ee", "name": "Very large file: packages/kosong/test/kimi.test.ts (2170 lines)", "shortDescription": {"text": "Very large file: packages/kosong/test/kimi.test.ts (2170 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-310b61e28b71a472", "name": "Very large file: packages/kosong/test/openai-legacy.test.ts (2166 lines)", "shortDescription": {"text": "Very large file: packages/kosong/test/openai-legacy.test.ts (2166 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a9dce8c58f5e3191", "name": "Very large file: packages/kosong/test/anthropic.test.ts (3571 lines)", "shortDescription": {"text": "Very large file: packages/kosong/test/anthropic.test.ts (3571 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d42d50965bb5d31e", "name": "Very large file: packages/kosong/test/google-genai.test.ts (1972 lines)", "shortDescription": {"text": "Very large file: packages/kosong/test/google-genai.test.ts (1972 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-87a7e1896b2eff40", "name": "Very large file: packages/kosong/test/openai-responses.test.ts (2158 lines)", "shortDescription": {"text": "Very large file: packages/kosong/test/openai-responses.test.ts (2158 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-48f3bcfc1ddd2162", "name": "Very large file: packages/agent-core-v2/test/agent/media/image-compress.test.ts (1537 lines)", "shortDescription": {"text": "Very large file: packages/agent-core-v2/test/agent/media/image-compress.test.ts (1537 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7abbad59a8417466", "name": "Very large file: packages/agent-core-v2/test/agent/goal/goal.test.ts (2298 lines)", "shortDescription": {"text": "Very large file: packages/agent-core-v2/test/agent/goal/goal.test.ts (2298 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2c5e70a98414f117", "name": "Very large file: packages/agent-core-v2/test/agent/loop/loop.test.ts (1106 lines)", "shortDescription": {"text": "Very large file: packages/agent-core-v2/test/agent/loop/loop.test.ts (1106 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-50d0d3891ca931cd", "name": "Very large file: packages/agent-core-v2/test/agent/fullCompaction/fullCompaction.test.ts (3331 lines)", "shortDescription": {"text": "Very large file: packages/agent-core-v2/test/agent/fullCompaction/fullCompaction.test.ts (3331 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-decb1a17807d165e", "name": "Very large file: packages/agent-core-v2/test/agent/plan/plan.test.ts (999 lines)", "shortDescription": {"text": "Very large file: packages/agent-core-v2/test/agent/plan/plan.test.ts (999 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-eeab450f3b82401e", "name": "Very large file: packages/agent-core-v2/test/app/config/config.test.ts (1673 lines)", "shortDescription": {"text": "Very large file: packages/agent-core-v2/test/app/config/config.test.ts (1673 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-79fbf514a39f8af8", "name": "Very large file: packages/agent-core-v2/test/app/auth/auth.test.ts (1383 lines)", "shortDescription": {"text": "Very large file: packages/agent-core-v2/test/app/auth/auth.test.ts (1383 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-63d10aee57102d42", "name": "Very large file: packages/agent-core-v2/test/os/backends/node-local/tools/grep.test.ts (2133 lines)", "shortDescription": {"text": "Very large file: packages/agent-core-v2/test/os/backends/node-local/tools/grep.test.ts (2133 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d42821a95089b486", "name": "Very large file: packages/agent-core-v2/test/os/backends/node-local/tools/bash.test.ts (1828 lines)", "shortDescription": {"text": "Very large file: packages/agent-core-v2/test/os/backends/node-local/tools/bash.test.ts (1828 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3eaa755a0c797518", "name": "Very large file: packages/agent-core-v2/test/tool/tool.test.ts (2777 lines)", "shortDescription": {"text": "Very large file: packages/agent-core-v2/test/tool/tool.test.ts (2777 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1b24a189f747992d", "name": "Very large file: packages/agent-core-v2/test/harness/agent.ts (2803 lines)", "shortDescription": {"text": "Very large file: packages/agent-core-v2/test/harness/agent.ts (2803 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5f74b95769faef9d", "name": "Very large file: packages/protocol/src/events.ts (1865 lines)", "shortDescription": {"text": "Very large file: packages/protocol/src/events.ts (1865 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a02417e68ba2ca57", "name": "Very large file: packages/agent-core/test/agent/turn.test.ts (2996 lines)", "shortDescription": {"text": "Very large file: packages/agent-core/test/agent/turn.test.ts (2996 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-345bb6214892bdc9", "name": "Very large file: packages/agent-core/test/agent/permission.test.ts (4199 lines)", "shortDescription": {"text": "Very large file: packages/agent-core/test/agent/permission.test.ts (4199 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-dc14d706ca8c4b92", "name": "Very large file: packages/agent-core/test/agent/resume.test.ts (1767 lines)", "shortDescription": {"text": "Very large file: packages/agent-core/test/agent/resume.test.ts (1767 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2119281c83ea22f8", "name": "Very large file: packages/agent-core/test/agent/context.test.ts (1544 lines)", "shortDescription": {"text": "Very large file: packages/agent-core/test/agent/context.test.ts (1544 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cec1204e010579f4", "name": "Very large file: packages/agent-core/test/agent/compaction/full.test.ts (2727 lines)", "shortDescription": {"text": "Very large file: packages/agent-core/test/agent/compaction/full.test.ts (2727 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-964a3c0fa6dc5090", "name": "Very large file: packages/agent-core/test/services/prompt-service.test.ts (1709 lines)", "shortDescription": {"text": "Very large file: packages/agent-core/test/services/prompt-service.test.ts (1709 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-af103d236cebd697", "name": "Very large file: packages/agent-core/test/tools/grep.test.ts (1952 lines)", "shortDescription": {"text": "Very large file: packages/agent-core/test/tools/grep.test.ts (1952 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-22762d3d85a8164c", "name": "Very large file: packages/agent-core/test/tools/read-media.test.ts (1522 lines)", "shortDescription": {"text": "Very large file: packages/agent-core/test/tools/read-media.test.ts (1522 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-68802565ebd63c11", "name": "Very large file: packages/agent-core/test/tools/image-compress.test.ts (1859 lines)", "shortDescription": {"text": "Very large file: packages/agent-core/test/tools/image-compress.test.ts (1859 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-efd873e39b82ecbf", "name": "Very large file: packages/agent-core/test/tools/bash.test.ts (1483 lines)", "shortDescription": {"text": "Very large file: packages/agent-core/test/tools/bash.test.ts (1483 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-dc3fe3a5a4caa6ea", "name": "Very large file: packages/agent-core/test/session/subagent-host.test.ts (1785 lines)", "shortDescription": {"text": "Very large file: packages/agent-core/test/session/subagent-host.test.ts (1785 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-335d1cd43dff4109", "name": "Very large file: packages/agent-core/test/harness/runtime.test.ts (1428 lines)", "shortDescription": {"text": "Very large file: packages/agent-core/test/harness/runtime.test.ts (1428 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0a8c16c72916b27d", "name": "Very large file: packages/agent-core/src/agent/turn/index.ts (1586 lines)", "shortDescription": {"text": "Very large file: packages/agent-core/src/agent/turn/index.ts (1586 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c7f8a5ee4516b7b3", "name": "Very large file: packages/agent-core/src/rpc/core-impl.ts (1605 lines)", "shortDescription": {"text": "Very large file: packages/agent-core/src/rpc/core-impl.ts (1605 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-efe4c7d5cc5c8bee", "name": "Very large file: packages/pi-tui/test/editor.test.ts (4452 lines)", "shortDescription": {"text": "Very large file: packages/pi-tui/test/editor.test.ts (4452 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-987562e03ebacf94", "name": "Very large file: packages/pi-tui/test/markdown.test.ts (1450 lines)", "shortDescription": {"text": "Very large file: packages/pi-tui/test/markdown.test.ts (1450 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-04c277e84cf16fcb", "name": "Very large file: packages/pi-tui/src/tui.ts (1752 lines)", "shortDescription": {"text": "Very large file: packages/pi-tui/src/tui.ts (1752 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-841158d5b2a88d71", "name": "Very large file: packages/pi-tui/src/components/editor.ts (2415 lines)", "shortDescription": {"text": "Very large file: packages/pi-tui/src/components/editor.ts (2415 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-03d6fd0be4bb59af", "name": "158 TODO/FIXME markers", "shortDescription": {"text": "158 TODO/FIXME markers"}, "fullDescription": {"text": "High count of TODO/FIXME/HACK markers \u2014 track them as issues so they're not forgotten."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6f92ae605fc08caf", "name": "Node manifest has dependencies but no lockfile: apps/vis/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: apps/vis/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d426e50524a3ef5c", "name": "Node manifest has dependencies but no lockfile: apps/vis/web/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: apps/vis/web/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b905af02a8c0631d", "name": "Node manifest has dependencies but no lockfile: apps/vis/server/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: apps/vis/server/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 1.0}}, {"id": "scanner-378043821ea30c8c", "name": "Node manifest has dependencies but no lockfile: apps/kimi-inspect/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: apps/kimi-inspect/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bc6a4aa204b162f8", "name": "Node manifest has dependencies but no lockfile: apps/vscode/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: apps/vscode/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2e1a3064b0dbb8f0", "name": "Node manifest has dependencies but no lockfile: apps/kimi-web/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: apps/kimi-web/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d2506772cee93623", "name": "Node manifest has dependencies but no lockfile: apps/kimi-code/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: apps/kimi-code/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 1.0}}, {"id": "scanner-662ebc4a2945a151", "name": "Node manifest has dependencies but no lockfile: docs/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: docs/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 1.0}}, {"id": "scanner-499ab2782891535e", "name": "Node manifest has dependencies but no lockfile: packages/kaos/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/kaos/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a1d1ac4fe9c71b53", "name": "Node manifest has dependencies but no lockfile: packages/kap-server/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/kap-server/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 1.0}}, {"id": "scanner-33ce4a7be061366f", "name": "Node manifest has dependencies but no lockfile: packages/migration-legacy/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/migration-legacy/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7d131bd6ae27ec20", "name": "Node manifest has dependencies but no lockfile: packages/acp-adapter/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/acp-adapter/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0196704c35ed40d0", "name": "Node manifest has dependencies but no lockfile: packages/oauth/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/oauth/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 1.0}}, {"id": "scanner-94fddf2b7223b8c2", "name": "Node manifest has dependencies but no lockfile: packages/klient/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/klient/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 1.0}}, {"id": "scanner-29627e92fac6ed07", "name": "Node manifest has dependencies but no lockfile: packages/kosong/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/kosong/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c3131d4f4fb66bfd", "name": "Node manifest has dependencies but no lockfile: packages/agent-core-v2/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/agent-core-v2/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ef09ae4a1a894193", "name": "Node manifest has dependencies but no lockfile: packages/protocol/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/protocol/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0badbe94f5c1fcc1", "name": "Node manifest has dependencies but no lockfile: packages/transcript/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/transcript/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f18584cfbdecfa6a", "name": "Node manifest has dependencies but no lockfile: packages/node-sdk/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/node-sdk/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 1.0}}, {"id": "scanner-da1e30fd30dc2ca6", "name": "Node manifest has dependencies but no lockfile: packages/agent-core/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/agent-core/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 1.0}}, {"id": "scanner-07cd8dd720006196", "name": "Node manifest has dependencies but no lockfile: packages/pi-tui/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/pi-tui/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 304 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 179 placeholder/mock markers across 92 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-749d4bc1bd66df5f", "name": "Agent instructions exist but release-hardening basics are missing", "shortDescription": {"text": "Agent instructions exist but release-hardening basics are missing"}, "fullDescription": {"text": "AI-coder instruction files were found, but the repo is missing lockfile. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-70579808cacc02a6", "name": "Legacy-named symbol `subscribe_v2` in apps/kimi-inspect/src/transcript/ws.ts:10", "shortDescription": {"text": "Legacy-named symbol `subscribe_v2` in apps/kimi-inspect/src/transcript/ws.ts:10"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-830c18a80e839825", "name": "Legacy-named symbol `hasOld` in apps/vscode/webview-ui/src/components/DisplayBlocks.tsx:90", "shortDescription": {"text": "Legacy-named symbol `hasOld` in apps/vscode/webview-ui/src/components/DisplayBlocks.tsx:90"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cb167855b81c282a", "name": "Legacy-named symbol `hasLegacy` in apps/vscode/src/managers/baseline.manager.ts:219", "shortDescription": {"text": "Legacy-named symbol `hasLegacy` in apps/vscode/src/managers/baseline.manager.ts:219"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-093d9f428d9e5f54", "name": "Legacy-named symbol `authLegacy` in packages/kap-server/src/routes/auth.ts:16", "shortDescription": {"text": "Legacy-named symbol `authLegacy` in packages/kap-server/src/routes/auth.ts:16"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-551e746161f25acb", "name": "Legacy-named symbol `messageLegacy` in packages/kap-server/src/routes/messages.ts:5", "shortDescription": {"text": "Legacy-named symbol `messageLegacy` in packages/kap-server/src/routes/messages.ts:5"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8581603d1815a2c2", "name": "Legacy-named symbol `subscribe_v2` in packages/kap-server/src/transport/ws/v1/wsConnectionV1.ts:3", "shortDescription": {"text": "Legacy-named symbol `subscribe_v2` in packages/kap-server/src/transport/ws/v1/wsConnectionV1.ts:3"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0f16fb2dadbdb4b1", "name": "Legacy-named symbol `sessionLegacy` in packages/kap-server/src/protocol/rest-session.ts:27", "shortDescription": {"text": "Legacy-named symbol `sessionLegacy` in packages/kap-server/src/protocol/rest-session.ts:27"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0d35bf394f0e2ce7", "name": "Legacy-named symbol `sessionLegacy` in packages/kap-server/src/protocol/session.ts:9", "shortDescription": {"text": "Legacy-named symbol `sessionLegacy` in packages/kap-server/src/protocol/session.ts:9"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e7c087b582e6e9e7", "name": "Legacy-named symbol `sessionLegacy` in packages/kap-server/src/protocol/rest-prompt.ts:27", "shortDescription": {"text": "Legacy-named symbol `sessionLegacy` in packages/kap-server/src/protocol/rest-prompt.ts:27"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d6a13c0ac0879ce9", "name": "Legacy-named symbol `subscribe_v2` in packages/kap-server/src/protocol/ws-control.ts:169", "shortDescription": {"text": "Legacy-named symbol `subscribe_v2` in packages/kap-server/src/protocol/ws-control.ts:169"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-38a4cac555ee845f", "name": "Legacy-named symbol `wireProtocolFromOld` in packages/migration-legacy/src/sessions/state-writer.ts:10", "shortDescription": {"text": "Legacy-named symbol `wireProtocolFromOld` in packages/migration-legacy/src/sessions/state-writer.ts:10"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-73a07fc52ecff2f6", "name": "Legacy-named symbol `wireProtocolFromOld` in packages/migration-legacy/src/sessions/migrate-one.ts:118", "shortDescription": {"text": "Legacy-named symbol `wireProtocolFromOld` in packages/migration-legacy/src/sessions/migrate-one.ts:118"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0c5404121c4da0f8", "name": "Legacy-named symbol `sessionLegacy` in packages/agent-core-v2/scripts/check-domain-layers.mjs:243", "shortDescription": {"text": "Legacy-named symbol `sessionLegacy` in packages/agent-core-v2/scripts/check-domain-layers.mjs:243"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ad3b8f996f0dde88", "name": "Legacy-named symbol `sessionLegacy` in packages/agent-core-v2/src/index.ts:291", "shortDescription": {"text": "Legacy-named symbol `sessionLegacy` in packages/agent-core-v2/src/index.ts:291"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6a7c663abeb538e9", "name": "Legacy-named symbol `messageLegacy` in packages/agent-core-v2/src/errors.ts:22", "shortDescription": {"text": "Legacy-named symbol `messageLegacy` in packages/agent-core-v2/src/errors.ts:22"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-27b11f32b9295521", "name": "Legacy-named symbol `sessionLegacy` in packages/agent-core-v2/src/agent/contextMemory/messageProjection.ts:8", "shortDescription": {"text": "Legacy-named symbol `sessionLegacy` in packages/agent-core-v2/src/agent/contextMemory/messageProjection.ts:8"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3d2228226f25518e", "name": "Legacy-named symbol `messageLegacy` in packages/agent-core-v2/src/agent/contextMemory/protocolMessage.ts:5", "shortDescription": {"text": "Legacy-named symbol `messageLegacy` in packages/agent-core-v2/src/agent/contextMemory/protocolMessage.ts:5"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-95865a89bad1961e", "name": "Legacy-named symbol `sessionLegacy` in packages/agent-core-v2/src/agent/rpc/core-api.ts:32", "shortDescription": {"text": "Legacy-named symbol `sessionLegacy` in packages/agent-core-v2/src/agent/rpc/core-api.ts:32"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b00d695a18c13eee", "name": "Legacy-named symbol `sessionLegacy` in packages/agent-core-v2/src/app/sessionLegacy/sessionLegacyService.ts:2", "shortDescription": {"text": "Legacy-named symbol `sessionLegacy` in packages/agent-core-v2/src/app/sessionLegacy/sessionLegacyService.ts:2"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9dbf2f2ee6be6878", "name": "Legacy-named symbol `sessionLegacy` in packages/agent-core-v2/src/app/sessionLegacy/sessionLegacy.ts:2", "shortDescription": {"text": "Legacy-named symbol `sessionLegacy` in packages/agent-core-v2/src/app/sessionLegacy/sessionLegacy.ts:2"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c348a65bb1296f03", "name": "Legacy-named symbol `sessionLegacy` in packages/agent-core-v2/src/app/sessionLegacy/sessionProtocol.ts:2", "shortDescription": {"text": "Legacy-named symbol `sessionLegacy` in packages/agent-core-v2/src/app/sessionLegacy/sessionProtocol.ts:2"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-dae41dae708ebc57", "name": "Legacy-named symbol `messageLegacy` in packages/agent-core-v2/src/app/messageLegacy/messageLegacyService.ts:2", "shortDescription": {"text": "Legacy-named symbol `messageLegacy` in packages/agent-core-v2/src/app/messageLegacy/messageLegacyService.ts:2"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-907b5d8d36f57a75", "name": "Legacy-named symbol `messageLegacy` in packages/agent-core-v2/src/app/messageLegacy/messageLegacy.ts:2", "shortDescription": {"text": "Legacy-named symbol `messageLegacy` in packages/agent-core-v2/src/app/messageLegacy/messageLegacy.ts:2"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4200872242492f13", "name": "Legacy-named symbol `messageLegacy` in packages/agent-core-v2/src/app/messageLegacy/errors.ts:2", "shortDescription": {"text": "Legacy-named symbol `messageLegacy` in packages/agent-core-v2/src/app/messageLegacy/errors.ts:2"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-76b1d3bf156d3e1e", "name": "Legacy-named symbol `authLegacy` in packages/agent-core-v2/src/app/authLegacy/authLegacyService.ts:2", "shortDescription": {"text": "Legacy-named symbol `authLegacy` in packages/agent-core-v2/src/app/authLegacy/authLegacyService.ts:2"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-63221a8fca2675f0", "name": "Legacy-named symbol `authLegacy` in packages/agent-core-v2/src/app/authLegacy/authLegacy.ts:2", "shortDescription": {"text": "Legacy-named symbol `authLegacy` in packages/agent-core-v2/src/app/authLegacy/authLegacy.ts:2"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fe47761d82b97fd7", "name": "Fire-and-forget `fetch()` has no rejection handler \u2014 packages/agent-core-v2/src/app/web/tools/fetch-url-types.ts:21", "shortDescription": {"text": "Fire-and-forget `fetch()` has no rejection handler \u2014 packages/agent-core-v2/src/app/web/tools/fetch-url-types.ts:21"}, "fullDescription": {"text": "This fetch result is neither awaited, returned, assigned, nor followed by `.catch(...)`. A network failure can therefore become an unhandled promise rejection. Await/return the promise or attach an explicit rejection handler."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-135f71e00c2b3b39", "name": "Legacy-named symbol `listLegacy` in packages/agent-core-v2/src/app/sessionIndex/sessionIndexService.ts:113", "shortDescription": {"text": "Legacy-named symbol `listLegacy` in packages/agent-core-v2/src/app/sessionIndex/sessionIndexService.ts:113"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fe3dad4dccfd7ef9", "name": "Legacy-named symbol `sessionLegacy` in packages/agent-core-v2/src/session/errors.ts:3", "shortDescription": {"text": "Legacy-named symbol `sessionLegacy` in packages/agent-core-v2/src/session/errors.ts:3"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-684e599558868bc5", "name": "Legacy-named symbol `subscribe_v2` in packages/transcript/src/contract/schema.ts:477", "shortDescription": {"text": "Legacy-named symbol `subscribe_v2` in packages/transcript/src/contract/schema.ts:477"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-35cbcc0e685e2825", "name": "Commented-code block (5 lines) in packages/agent-core/src/agent/compaction/micro.ts:58", "shortDescription": {"text": "Commented-code block (5 lines) in packages/agent-core/src/agent/compaction/micro.ts:58"}, "fullDescription": {"text": "5 of 5 consecutive comment lines look like executable statements. Confirm the block is obsolete, then delete it or recover it from git history when needed."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 0.72}}, {"id": "scanner-edb568a5edd1a6fd", "name": "Legacy-named symbol `fromLegacy` in packages/agent-core/src/utils/completion-budget.ts:28", "shortDescription": {"text": "Legacy-named symbol `fromLegacy` in packages/agent-core/src/utils/completion-budget.ts:28"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f485e269cc03d983", "name": "Fire-and-forget `fetch()` has no rejection handler \u2014 packages/agent-core/src/tools/builtin/web/fetch-url.ts:39", "shortDescription": {"text": "Fire-and-forget `fetch()` has no rejection handler \u2014 packages/agent-core/src/tools/builtin/web/fetch-url.ts:39"}, "fullDescription": {"text": "This fetch result is neither awaited, returned, assigned, nor followed by `.catch(...)`. A network failure can therefore become an unhandled promise rejection. Await/return the promise or attach an explicit rejection handler."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-e7fae9c4975a20b6", "name": "Frontend route `/sessions/:sessionId` has no Link/navigate to it \u2014 apps/vis/web/src/App.tsx", "shortDescription": {"text": "Frontend route `/sessions/:sessionId` has no Link/navigate to it \u2014 apps/vis/web/src/App.tsx"}, "fullDescription": {"text": "The route is registered but no `<Link to=\u2026>` or `navigate(\u2026)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-cf77ae0ecbf73d93", "name": "Frontend route `/sessions/:sessionId/agents/:agentId` has no Link/navigate to it \u2014 apps/vis/web/src/App.tsx", "shortDescription": {"text": "Frontend route `/sessions/:sessionId/agents/:agentId` has no Link/navigate to it \u2014 apps/vis/web/src/App.tsx"}, "fullDescription": {"text": "The route is registered but no `<Link to=\u2026>` or `navigate(\u2026)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-66fab1b17ecc430f", "name": "Vulnerable dependency @hono/node-server 1.19.14: GHSA-frvp-7c67-39w9", "shortDescription": {"text": "Vulnerable dependency @hono/node-server 1.19.14: GHSA-frvp-7c67-39w9"}, "fullDescription": {"text": "OSV.dev reports `@hono/node-server` at version `1.19.14` (resolved in `pnpm-lock.yaml`) is affected by GHSA-frvp-7c67-39w9.\n\nNode.js Adapter for Hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`)\n\nAdvisory: https://osv.dev/vulnerability/GHSA-frvp-7c67-39w9\nFix: upgrade `@hono/node-server` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0509418362dca3c3", "name": "Vulnerable dependency diff 7.0.0: GHSA-73rr-hh4g-fpgx", "shortDescription": {"text": "Vulnerable dependency diff 7.0.0: GHSA-73rr-hh4g-fpgx"}, "fullDescription": {"text": "OSV.dev reports `diff` at version `7.0.0` (resolved in `pnpm-lock.yaml`) is affected by GHSA-73rr-hh4g-fpgx (aka CVE-2026-24001).\n\njsdiff has a Denial of Service vulnerability in parsePatch and applyPatch\n\nAliases: CVE-2026-24001\nAdvisory: https://osv.dev/vulnerability/GHSA-73rr-hh4g-fpgx\nFix: upgrade `diff` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2ba6dadd28cc3195", "name": "Vulnerable dependency hono 4.12.14: GHSA-2gcr-mfcq-wcc3", "shortDescription": {"text": "Vulnerable dependency hono 4.12.14: GHSA-2gcr-mfcq-wcc3"}, "fullDescription": {"text": "OSV.dev reports `hono` at version `4.12.14` (resolved in `pnpm-lock.yaml`) is affected by GHSA-2gcr-mfcq-wcc3 (aka CVE-2026-47676).\n\nHono: app.mount() strips mount prefix using undecoded path, causing incorrect routing for percent-encoded paths\n\nAliases: CVE-2026-47676\nAdvisory: https://osv.dev/vulnerability/GHSA-2gcr-mfcq-wcc3\nFix: upgrade `hono` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-569c66ccff7e2bf4", "name": "Vulnerable dependency hono 4.12.14: GHSA-3hrh-pfw6-9m5x", "shortDescription": {"text": "Vulnerable dependency hono 4.12.14: GHSA-3hrh-pfw6-9m5x"}, "fullDescription": {"text": "OSV.dev reports `hono` at version `4.12.14` (resolved in `pnpm-lock.yaml`) is affected by GHSA-3hrh-pfw6-9m5x (aka CVE-2026-47675).\n\nHono: Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie injection\n\nAliases: CVE-2026-47675\nAdvisory: https://osv.dev/vulnerability/GHSA-3hrh-pfw6-9m5x\nFix: upgrade `hono` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-dd47aa7207c392a2", "name": "Vulnerable dependency hono 4.12.14: GHSA-69xw-7hcm-h432", "shortDescription": {"text": "Vulnerable dependency hono 4.12.14: GHSA-69xw-7hcm-h432"}, "fullDescription": {"text": "OSV.dev reports `hono` at version `4.12.14` (resolved in `pnpm-lock.yaml`) is affected by GHSA-69xw-7hcm-h432 (aka CVE-2026-44455).\n\nhono/jsx has Unvalidated JSX Tag Names that May Allow HTML Injection\n\nAliases: CVE-2026-44455\nAdvisory: https://osv.dev/vulnerability/GHSA-69xw-7hcm-h432\nFix: upgrade `hono` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-54bbbc11db021073", "name": "Vulnerable dependency hono 4.12.14: GHSA-88fw-hqm2-52qc", "shortDescription": {"text": "Vulnerable dependency hono 4.12.14: GHSA-88fw-hqm2-52qc"}, "fullDescription": {"text": "OSV.dev reports `hono` at version `4.12.14` (resolved in `pnpm-lock.yaml`) is affected by GHSA-88fw-hqm2-52qc (aka CVE-2026-54290).\n\nhono: CORS Middleware reflects any Origin with credentials when `origin` defaults to the wildcard\n\nAliases: CVE-2026-54290\nAdvisory: https://osv.dev/vulnerability/GHSA-88fw-hqm2-52qc\nFix: upgrade `hono` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 1.0}}, {"id": "scanner-68a297fbe050c63e", "name": "Vulnerable dependency hono 4.12.14: GHSA-9vqf-7f2p-gf9v", "shortDescription": {"text": "Vulnerable dependency hono 4.12.14: GHSA-9vqf-7f2p-gf9v"}, "fullDescription": {"text": "OSV.dev reports `hono` at version `4.12.14` (resolved in `pnpm-lock.yaml`) is affected by GHSA-9vqf-7f2p-gf9v (aka CVE-2026-44456).\n\nHono: bodyLimit() can be bypassed for chunked / unknown-length requests\n\nAliases: CVE-2026-44456\nAdvisory: https://osv.dev/vulnerability/GHSA-9vqf-7f2p-gf9v\nFix: upgrade `hono` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b3d6f782a2fbafda", "name": "Vulnerable dependency hono 4.12.14: GHSA-f577-qrjj-4474", "shortDescription": {"text": "Vulnerable dependency hono 4.12.14: GHSA-f577-qrjj-4474"}, "fullDescription": {"text": "OSV.dev reports `hono` at version `4.12.14` (resolved in `pnpm-lock.yaml`) is affected by GHSA-f577-qrjj-4474 (aka CVE-2026-47673).\n\nHono: JWT middleware accepts any Authorization scheme, not only Bearer\n\nAliases: CVE-2026-47673\nAdvisory: https://osv.dev/vulnerability/GHSA-f577-qrjj-4474\nFix: upgrade `hono` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-42996ab15f11975e", "name": "Vulnerable dependency hono 4.12.14: GHSA-hm8q-7f3q-5f36", "shortDescription": {"text": "Vulnerable dependency hono 4.12.14: GHSA-hm8q-7f3q-5f36"}, "fullDescription": {"text": "OSV.dev reports `hono` at version `4.12.14` (resolved in `pnpm-lock.yaml`) is affected by GHSA-hm8q-7f3q-5f36.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-hm8q-7f3q-5f36\nFix: upgrade `hono` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f822ca50f425b19f", "name": "Vulnerable dependency hono 4.12.14: GHSA-hvrm-45r6-mjfj", "shortDescription": {"text": "Vulnerable dependency hono 4.12.14: GHSA-hvrm-45r6-mjfj"}, "fullDescription": {"text": "OSV.dev reports `hono` at version `4.12.14` (resolved in `pnpm-lock.yaml`) is affected by GHSA-hvrm-45r6-mjfj.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-hvrm-45r6-mjfj\nFix: upgrade `hono` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8ea6939dbeb4d0e5", "name": "Vulnerable dependency hono 4.12.14: GHSA-j6c9-x7qj-28xf", "shortDescription": {"text": "Vulnerable dependency hono 4.12.14: GHSA-j6c9-x7qj-28xf"}, "fullDescription": {"text": "OSV.dev reports `hono` at version `4.12.14` (resolved in `pnpm-lock.yaml`) is affected by GHSA-j6c9-x7qj-28xf.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-j6c9-x7qj-28xf\nFix: upgrade `hono` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8e650efa0210eb18", "name": "Vulnerable dependency hono 4.12.14: GHSA-p77w-8qqv-26rm", "shortDescription": {"text": "Vulnerable dependency hono 4.12.14: GHSA-p77w-8qqv-26rm"}, "fullDescription": {"text": "OSV.dev reports `hono` at version `4.12.14` (resolved in `pnpm-lock.yaml`) is affected by GHSA-p77w-8qqv-26rm.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-p77w-8qqv-26rm\nFix: upgrade `hono` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ca16796b9e31a09a", "name": "Vulnerable dependency hono 4.12.14: GHSA-qp7p-654g-cw7p", "shortDescription": {"text": "Vulnerable dependency hono 4.12.14: GHSA-qp7p-654g-cw7p"}, "fullDescription": {"text": "OSV.dev reports `hono` at version `4.12.14` (resolved in `pnpm-lock.yaml`) is affected by GHSA-qp7p-654g-cw7p.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-qp7p-654g-cw7p\nFix: upgrade `hono` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3fc9b86111460ef6", "name": "Vulnerable dependency hono 4.12.14: GHSA-rv63-4mwf-qqc2", "shortDescription": {"text": "Vulnerable dependency hono 4.12.14: GHSA-rv63-4mwf-qqc2"}, "fullDescription": {"text": "OSV.dev reports `hono` at version `4.12.14` (resolved in `pnpm-lock.yaml`) is affected by GHSA-rv63-4mwf-qqc2.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-rv63-4mwf-qqc2\nFix: upgrade `hono` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ed79c2edec8500d1", "name": "Vulnerable dependency hono 4.12.14: GHSA-w62v-xxxg-mg59", "shortDescription": {"text": "Vulnerable dependency hono 4.12.14: GHSA-w62v-xxxg-mg59"}, "fullDescription": {"text": "OSV.dev reports `hono` at version `4.12.14` (resolved in `pnpm-lock.yaml`) is affected by GHSA-w62v-xxxg-mg59.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-w62v-xxxg-mg59\nFix: upgrade `hono` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d870b34bdb9d936c", "name": "Vulnerable dependency hono 4.12.14: GHSA-wgpf-jwqj-8h8p", "shortDescription": {"text": "Vulnerable dependency hono 4.12.14: GHSA-wgpf-jwqj-8h8p"}, "fullDescription": {"text": "OSV.dev reports `hono` at version `4.12.14` (resolved in `pnpm-lock.yaml`) is affected by GHSA-wgpf-jwqj-8h8p.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-wgpf-jwqj-8h8p\nFix: upgrade `hono` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-12550a01e0d68c43", "name": "Vulnerable dependency hono 4.12.14: GHSA-wwfh-h76j-fc44", "shortDescription": {"text": "Vulnerable dependency hono 4.12.14: GHSA-wwfh-h76j-fc44"}, "fullDescription": {"text": "OSV.dev reports `hono` at version `4.12.14` (resolved in `pnpm-lock.yaml`) is affected by GHSA-wwfh-h76j-fc44.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-wwfh-h76j-fc44\nFix: upgrade `hono` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-657d258d4d6c182f", "name": "Vulnerable dependency hono 4.12.14: GHSA-xgm2-5f3f-mvvc", "shortDescription": {"text": "Vulnerable dependency hono 4.12.14: GHSA-xgm2-5f3f-mvvc"}, "fullDescription": {"text": "OSV.dev reports `hono` at version `4.12.14` (resolved in `pnpm-lock.yaml`) is affected by GHSA-xgm2-5f3f-mvvc.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-xgm2-5f3f-mvvc\nFix: upgrade `hono` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f175fbe0d7bbb40f", "name": "Vulnerable dependency hono 4.12.14: GHSA-xrhx-7g5j-rcj5", "shortDescription": {"text": "Vulnerable dependency hono 4.12.14: GHSA-xrhx-7g5j-rcj5"}, "fullDescription": {"text": "OSV.dev reports `hono` at version `4.12.14` (resolved in `pnpm-lock.yaml`) is affected by GHSA-xrhx-7g5j-rcj5.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-xrhx-7g5j-rcj5\nFix: upgrade `hono` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1294062cd83bfa5d", "name": "Vulnerable dependency js-yaml 3.14.2: GHSA-52cp-r559-cp3m", "shortDescription": {"text": "Vulnerable dependency js-yaml 3.14.2: GHSA-52cp-r559-cp3m"}, "fullDescription": {"text": "OSV.dev reports `js-yaml` at version `3.14.2` (resolved in `pnpm-lock.yaml`) is affected by GHSA-52cp-r559-cp3m (aka CVE-2026-59869).\n\njs-yaml: YAML merge-key chains can force quadratic CPU consumption\n\nAliases: CVE-2026-59869\nAdvisory: https://osv.dev/vulnerability/GHSA-52cp-r559-cp3m\nFix: upgrade `js-yaml` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 1.0}}, {"id": "scanner-9135f7aafb79faab", "name": "Vulnerable dependency js-yaml 3.14.2: GHSA-h67p-54hq-rp68", "shortDescription": {"text": "Vulnerable dependency js-yaml 3.14.2: GHSA-h67p-54hq-rp68"}, "fullDescription": {"text": "OSV.dev reports `js-yaml` at version `3.14.2` (resolved in `pnpm-lock.yaml`) is affected by GHSA-h67p-54hq-rp68 (aka CVE-2026-53550).\n\nJS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases\n\nAliases: CVE-2026-53550\nAdvisory: https://osv.dev/vulnerability/GHSA-h67p-54hq-rp68\nFix: upgrade `js-yaml` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-24aa5b155a8f2b03", "name": "Vulnerable dependency js-yaml 4.1.1: GHSA-52cp-r559-cp3m", "shortDescription": {"text": "Vulnerable dependency js-yaml 4.1.1: GHSA-52cp-r559-cp3m"}, "fullDescription": {"text": "OSV.dev reports `js-yaml` at version `4.1.1` (resolved in `pnpm-lock.yaml`) is affected by GHSA-52cp-r559-cp3m (aka CVE-2026-59869).\n\njs-yaml: YAML merge-key chains can force quadratic CPU consumption\n\nAliases: CVE-2026-59869\nAdvisory: https://osv.dev/vulnerability/GHSA-52cp-r559-cp3m\nFix: upgrade `js-yaml` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 1.0}}, {"id": "scanner-56eee3d193968fe9", "name": "Vulnerable dependency js-yaml 4.1.1: GHSA-h67p-54hq-rp68", "shortDescription": {"text": "Vulnerable dependency js-yaml 4.1.1: GHSA-h67p-54hq-rp68"}, "fullDescription": {"text": "OSV.dev reports `js-yaml` at version `4.1.1` (resolved in `pnpm-lock.yaml`) is affected by GHSA-h67p-54hq-rp68 (aka CVE-2026-53550).\n\nJS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases\n\nAliases: CVE-2026-53550\nAdvisory: https://osv.dev/vulnerability/GHSA-h67p-54hq-rp68\nFix: upgrade `js-yaml` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d98c879120110d78", "name": "Vulnerable dependency tar 7.5.13: GHSA-23hp-3jrh-7fpw", "shortDescription": {"text": "Vulnerable dependency tar 7.5.13: GHSA-23hp-3jrh-7fpw"}, "fullDescription": {"text": "OSV.dev reports `tar` at version `7.5.13` (resolved in `pnpm-lock.yaml`) is affected by GHSA-23hp-3jrh-7fpw (aka CVE-2026-59873).\n\nnode-tar: Decompression/parse DoS via unlimited input\n\nAliases: CVE-2026-59873\nAdvisory: https://osv.dev/vulnerability/GHSA-23hp-3jrh-7fpw\nFix: upgrade `tar` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-50db1b96c52eeb3e", "name": "Vulnerable dependency tar 7.5.13: GHSA-8x88-c5mf-7j5w", "shortDescription": {"text": "Vulnerable dependency tar 7.5.13: GHSA-8x88-c5mf-7j5w"}, "fullDescription": {"text": "OSV.dev reports `tar` at version `7.5.13` (resolved in `pnpm-lock.yaml`) is affected by GHSA-8x88-c5mf-7j5w (aka CVE-2026-59874).\n\nnode-tar: Negative tar entry size causes infinite loop in archive replace\n\nAliases: CVE-2026-59874\nAdvisory: https://osv.dev/vulnerability/GHSA-8x88-c5mf-7j5w\nFix: upgrade `tar` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 1.0}}, {"id": "scanner-4bc346e189a16b04", "name": "Vulnerable dependency tar 7.5.13: GHSA-gvwx-54wh-qm9j", "shortDescription": {"text": "Vulnerable dependency tar 7.5.13: GHSA-gvwx-54wh-qm9j"}, "fullDescription": {"text": "OSV.dev reports `tar` at version `7.5.13` (resolved in `pnpm-lock.yaml`) is affected by GHSA-gvwx-54wh-qm9j (aka CVE-2026-59875).\n\nnode-tar: Uncaught Exception DoS via NUL byte in PAX path/linkpath records\n\nAliases: CVE-2026-59875\nAdvisory: https://osv.dev/vulnerability/GHSA-gvwx-54wh-qm9j\nFix: upgrade `tar` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d0b5c643ff887292", "name": "Vulnerable dependency tar 7.5.13: GHSA-vmf3-w455-68vh", "shortDescription": {"text": "Vulnerable dependency tar 7.5.13: GHSA-vmf3-w455-68vh"}, "fullDescription": {"text": "OSV.dev reports `tar` at version `7.5.13` (resolved in `pnpm-lock.yaml`) is affected by GHSA-vmf3-w455-68vh.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-vmf3-w455-68vh\nFix: upgrade `tar` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-142beda4e2b923a4", "name": "Vulnerable dependency tar 7.5.13: GHSA-w8wr-v893-vjvp", "shortDescription": {"text": "Vulnerable dependency tar 7.5.13: GHSA-w8wr-v893-vjvp"}, "fullDescription": {"text": "OSV.dev reports `tar` at version `7.5.13` (resolved in `pnpm-lock.yaml`) is affected by GHSA-w8wr-v893-vjvp.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-w8wr-v893-vjvp\nFix: upgrade `tar` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ad393e420d45a08c", "name": "Vulnerable dependency undici 7.27.1: GHSA-35p6-xmwp-9g52", "shortDescription": {"text": "Vulnerable dependency undici 7.27.1: GHSA-35p6-xmwp-9g52"}, "fullDescription": {"text": "OSV.dev reports `undici` at version `7.27.1` (resolved in `pnpm-lock.yaml`) is affected by GHSA-35p6-xmwp-9g52 (aka CVE-2026-6733).\n\nundici vulnerable to HTTP response queue poisoning via keep-alive socket reuse\n\nAliases: CVE-2026-6733\nAdvisory: https://osv.dev/vulnerability/GHSA-35p6-xmwp-9g52\nFix: upgrade `undici` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0e13ccd2e31e1ca5", "name": "Vulnerable dependency undici 7.27.1: GHSA-g8m3-5g58-fq7m", "shortDescription": {"text": "Vulnerable dependency undici 7.27.1: GHSA-g8m3-5g58-fq7m"}, "fullDescription": {"text": "OSV.dev reports `undici` at version `7.27.1` (resolved in `pnpm-lock.yaml`) is affected by GHSA-g8m3-5g58-fq7m (aka CVE-2026-11525).\n\nundici vulnerable to Set-Cookie SameSite attribute downgrade via permissive substring matching\n\nAliases: CVE-2026-11525\nAdvisory: https://osv.dev/vulnerability/GHSA-g8m3-5g58-fq7m\nFix: upgrade `undici` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bd079ab51d04219a", "name": "Vulnerable dependency undici 7.27.1: GHSA-hm92-r4w5-c3mj", "shortDescription": {"text": "Vulnerable dependency undici 7.27.1: GHSA-hm92-r4w5-c3mj"}, "fullDescription": {"text": "OSV.dev reports `undici` at version `7.27.1` (resolved in `pnpm-lock.yaml`) is affected by GHSA-hm92-r4w5-c3mj.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-hm92-r4w5-c3mj\nFix: upgrade `undici` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2f13e0e0de441509", "name": "Vulnerable dependency undici 7.27.1: GHSA-p88m-4jfj-68fv", "shortDescription": {"text": "Vulnerable dependency undici 7.27.1: GHSA-p88m-4jfj-68fv"}, "fullDescription": {"text": "OSV.dev reports `undici` at version `7.27.1` (resolved in `pnpm-lock.yaml`) is affected by GHSA-p88m-4jfj-68fv.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-p88m-4jfj-68fv\nFix: upgrade `undici` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ad979d068e9307e4", "name": "Vulnerable dependency undici 7.27.1: GHSA-pr7r-676h-xcf6", "shortDescription": {"text": "Vulnerable dependency undici 7.27.1: GHSA-pr7r-676h-xcf6"}, "fullDescription": {"text": "OSV.dev reports `undici` at version `7.27.1` (resolved in `pnpm-lock.yaml`) is affected by GHSA-pr7r-676h-xcf6.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-pr7r-676h-xcf6\nFix: upgrade `undici` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ec319663ed847dad", "name": "Vulnerable dependency undici 7.27.1: GHSA-vmh5-mc38-953g", "shortDescription": {"text": "Vulnerable dependency undici 7.27.1: GHSA-vmh5-mc38-953g"}, "fullDescription": {"text": "OSV.dev reports `undici` at version `7.27.1` (resolved in `pnpm-lock.yaml`) is affected by GHSA-vmh5-mc38-953g.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-vmh5-mc38-953g\nFix: upgrade `undici` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-59ac195b7a255a7e", "name": "Vulnerable dependency undici 7.27.1: GHSA-vxpw-j846-p89q", "shortDescription": {"text": "Vulnerable dependency undici 7.27.1: GHSA-vxpw-j846-p89q"}, "fullDescription": {"text": "OSV.dev reports `undici` at version `7.27.1` (resolved in `pnpm-lock.yaml`) is affected by GHSA-vxpw-j846-p89q.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-vxpw-j846-p89q\nFix: upgrade `undici` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5d4271c7452ee68b", "name": "Vulnerable dependency vite 5.4.21: GHSA-4w7w-66w2-5vf9", "shortDescription": {"text": "Vulnerable dependency vite 5.4.21: GHSA-4w7w-66w2-5vf9"}, "fullDescription": {"text": "OSV.dev reports `vite` at version `5.4.21` (resolved in `pnpm-lock.yaml`) is affected by GHSA-4w7w-66w2-5vf9 (aka CVE-2026-39365).\n\nVite Vulnerable to Path Traversal in Optimized Deps `.map` Handling\n\nAliases: CVE-2026-39365\nAdvisory: https://osv.dev/vulnerability/GHSA-4w7w-66w2-5vf9\nFix: upgrade `vite` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-08e77ee84bd401b2", "name": "Vulnerable dependency vite 5.4.21: GHSA-fx2h-pf6j-xcff", "shortDescription": {"text": "Vulnerable dependency vite 5.4.21: GHSA-fx2h-pf6j-xcff"}, "fullDescription": {"text": "OSV.dev reports `vite` at version `5.4.21` (resolved in `pnpm-lock.yaml`) is affected by GHSA-fx2h-pf6j-xcff (aka CVE-2026-53571).\n\nvite: `server.fs.deny` bypass on Windows alternate paths\n\nAliases: CVE-2026-53571\nAdvisory: https://osv.dev/vulnerability/GHSA-fx2h-pf6j-xcff\nFix: upgrade `vite` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 1.0}}, {"id": "scanner-e997dd1aba95f6ef", "name": "Vulnerable dependency vite 5.4.21: GHSA-v6wh-96g9-6wx3", "shortDescription": {"text": "Vulnerable dependency vite 5.4.21: GHSA-v6wh-96g9-6wx3"}, "fullDescription": {"text": "OSV.dev reports `vite` at version `5.4.21` (resolved in `pnpm-lock.yaml`) is affected by GHSA-v6wh-96g9-6wx3 (aka CVE-2026-53632).\n\nlaunch-editor: NTLMv2 hash disclosure via UNC path handling on Windows\n\nAliases: CVE-2026-53632\nAdvisory: https://osv.dev/vulnerability/GHSA-v6wh-96g9-6wx3\nFix: upgrade `vite` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4e5a53e0089001be", "name": "Vulnerable dependency vite 6.4.2: GHSA-fx2h-pf6j-xcff", "shortDescription": {"text": "Vulnerable dependency vite 6.4.2: GHSA-fx2h-pf6j-xcff"}, "fullDescription": {"text": "OSV.dev reports `vite` at version `6.4.2` (resolved in `pnpm-lock.yaml`) is affected by GHSA-fx2h-pf6j-xcff (aka CVE-2026-53571).\n\nvite: `server.fs.deny` bypass on Windows alternate paths\n\nAliases: CVE-2026-53571\nAdvisory: https://osv.dev/vulnerability/GHSA-fx2h-pf6j-xcff\nFix: upgrade `vite` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-189aadabbcade1b0", "name": "Vulnerable dependency vite 6.4.2: GHSA-v6wh-96g9-6wx3", "shortDescription": {"text": "Vulnerable dependency vite 6.4.2: GHSA-v6wh-96g9-6wx3"}, "fullDescription": {"text": "OSV.dev reports `vite` at version `6.4.2` (resolved in `pnpm-lock.yaml`) is affected by GHSA-v6wh-96g9-6wx3 (aka CVE-2026-53632).\n\nlaunch-editor: NTLMv2 hash disclosure via UNC path handling on Windows\n\nAliases: CVE-2026-53632\nAdvisory: https://osv.dev/vulnerability/GHSA-v6wh-96g9-6wx3\nFix: upgrade `vite` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-80f71fcb3a207da8", "name": "Vulnerable dependency vite 8.0.8: GHSA-fx2h-pf6j-xcff", "shortDescription": {"text": "Vulnerable dependency vite 8.0.8: GHSA-fx2h-pf6j-xcff"}, "fullDescription": {"text": "OSV.dev reports `vite` at version `8.0.8` (resolved in `pnpm-lock.yaml`) is affected by GHSA-fx2h-pf6j-xcff (aka CVE-2026-53571).\n\nvite: `server.fs.deny` bypass on Windows alternate paths\n\nAliases: CVE-2026-53571\nAdvisory: https://osv.dev/vulnerability/GHSA-fx2h-pf6j-xcff\nFix: upgrade `vite` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 1.0}}, {"id": "scanner-631b177afa72cc8c", "name": "Vulnerable dependency vite 8.0.8: GHSA-v6wh-96g9-6wx3", "shortDescription": {"text": "Vulnerable dependency vite 8.0.8: GHSA-v6wh-96g9-6wx3"}, "fullDescription": {"text": "OSV.dev reports `vite` at version `8.0.8` (resolved in `pnpm-lock.yaml`) is affected by GHSA-v6wh-96g9-6wx3 (aka CVE-2026-53632).\n\nlaunch-editor: NTLMv2 hash disclosure via UNC path handling on Windows\n\nAliases: CVE-2026-53632\nAdvisory: https://osv.dev/vulnerability/GHSA-v6wh-96g9-6wx3\nFix: upgrade `vite` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b8acf95aa32e6574", "name": "Vulnerable dependency ws 8.20.0: GHSA-58qx-3vcg-4xpx", "shortDescription": {"text": "Vulnerable dependency ws 8.20.0: GHSA-58qx-3vcg-4xpx"}, "fullDescription": {"text": "OSV.dev reports `ws` at version `8.20.0` (resolved in `pnpm-lock.yaml`) is affected by GHSA-58qx-3vcg-4xpx (aka CVE-2026-45736).\n\nws: Uninitialized memory disclosure\n\nAliases: CVE-2026-45736\nAdvisory: https://osv.dev/vulnerability/GHSA-58qx-3vcg-4xpx\nFix: upgrade `ws` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-257714305f06797c", "name": "Vulnerable dependency ws 8.20.0: GHSA-96hv-2xvq-fx4p", "shortDescription": {"text": "Vulnerable dependency ws 8.20.0: GHSA-96hv-2xvq-fx4p"}, "fullDescription": {"text": "OSV.dev reports `ws` at version `8.20.0` (resolved in `pnpm-lock.yaml`) is affected by GHSA-96hv-2xvq-fx4p (aka CVE-2026-48779).\n\nws: Memory exhaustion DoS from tiny fragments and data chunks\n\nAliases: CVE-2026-48779\nAdvisory: https://osv.dev/vulnerability/GHSA-96hv-2xvq-fx4p\nFix: upgrade `ws` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 1.0}}, {"id": "scanner-1e89a3a89db0b7ea", "name": "Vulnerable dependency @babel/core 7.29.0: GHSA-4x5r-pxfx-6jf8", "shortDescription": {"text": "Vulnerable dependency @babel/core 7.29.0: GHSA-4x5r-pxfx-6jf8"}, "fullDescription": {"text": "OSV.dev reports `@babel/core` at version `7.29.0` (resolved in `pnpm-lock.yaml`) is affected by GHSA-4x5r-pxfx-6jf8 (aka CVE-2026-49356).\nNote: `@babel/core` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\n@babel/core: Arbitrary File Read via sourceMappingURL Comment\n\nAliases: CVE-2026-49356\nAdvisory: https://osv.dev/vulnerability/GHSA-4x5r-pxfx-6jf8\nFix: upgrade `@babel/core` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 0.9}}, {"id": "scanner-63717db2042f18fc", "name": "Dependency @agentclientprotocol/sdk is a major version behind", "shortDescription": {"text": "Dependency @agentclientprotocol/sdk is a major version behind"}, "fullDescription": {"text": "`@agentclientprotocol/sdk` is pinned at `0.23.0` in `packages/acp-adapter/package.json` while the latest release on the npm registry is `1.3.0` \u2014 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `@agentclientprotocol/sdk` to `1.3.0`."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 0.9}}, {"id": "scanner-dbc439fe314ef318", "name": "Dependency @google/genai is a major version behind", "shortDescription": {"text": "Dependency @google/genai is a major version behind"}, "fullDescription": {"text": "`@google/genai` is pinned at `1.49.0` in `packages/agent-core-v2/package.json` while the latest release on the npm registry is `2.13.0` \u2014 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `@google/genai` to `2.13.0`."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 0.9}}, {"id": "scanner-e66d1607ec5dc56f", "name": "Dependency @hono/node-server is a major version behind", "shortDescription": {"text": "Dependency @hono/node-server is a major version behind"}, "fullDescription": {"text": "`@hono/node-server` is pinned at `1.13.7` in `apps/vis/server/package.json` while the latest release on the npm registry is `2.0.11` \u2014 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `@hono/node-server` to `2.0.11`."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 0.9}}, {"id": "scanner-b522119a9d05b89c", "name": "Dependency bcryptjs is a major version behind", "shortDescription": {"text": "Dependency bcryptjs is a major version behind"}, "fullDescription": {"text": "`bcryptjs` is pinned at `2.4.3` in `packages/kap-server/package.json` while the latest release on the npm registry is `3.0.3` \u2014 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `bcryptjs` to `3.0.3`."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 0.9}}, {"id": "scanner-cdf67416f254a7ac", "name": "Dependency chokidar is a major version behind", "shortDescription": {"text": "Dependency chokidar is a major version behind"}, "fullDescription": {"text": "`chokidar` is pinned at `4.0.3` in `packages/agent-core-v2/package.json` while the latest release on the npm registry is `5.0.0` \u2014 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `chokidar` to `5.0.0`."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 0.9}}, {"id": "scanner-06946a4e2590d577", "name": "Dependency diff is a major version behind", "shortDescription": {"text": "Dependency diff is a major version behind"}, "fullDescription": {"text": "`diff` is pinned at `8.0.2` in `apps/vscode/package.json` while the latest release on the npm registry is `9.0.0` \u2014 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `diff` to `9.0.0`."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 0.9}}, {"id": "scanner-81cde0c93076ed7f", "name": "Dependency ignore is two or more major versions behind", "shortDescription": {"text": "Dependency ignore is two or more major versions behind"}, "fullDescription": {"text": "`ignore` is pinned at `5.3.2` in `packages/agent-core-v2/package.json` while the latest release on the npm registry is `7.0.6` \u2014 2 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `ignore` to `7.0.6`."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-a76448d9160d0ec2", "name": "Dependency js-yaml is a major version behind", "shortDescription": {"text": "Dependency js-yaml is a major version behind"}, "fullDescription": {"text": "`js-yaml` is pinned at `4.1.1` in `packages/agent-core-v2/package.json` while the latest release on the npm registry is `5.2.1` \u2014 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `js-yaml` to `5.2.1`."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 0.9}}, {"id": "scanner-04f8c647645992c7", "name": "Dangling fetch: GET /__inspect/servers (apps/kimi-inspect/src/servers.ts:32)", "shortDescription": {"text": "Dangling fetch: GET /__inspect/servers (apps/kimi-inspect/src/servers.ts:32)"}, "fullDescription": {"text": "`apps/kimi-inspect/src/servers.ts:32` calls `GET /__inspect/servers` but no backend route in the scanned graph matches that path. The path appears development/example-only, so verify its custom dev server or proxy registration.\n\nTool: fetch\nNormalized path used for matching: `/__inspect/servers`"}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "medium", "confidence": 0.55}}, {"id": "scanner-3cf44469fddc5cf7", "name": "Dangling fetch: GET /__kimi-dev/backend (apps/kimi-web/src/api/devBackend.ts:36)", "shortDescription": {"text": "Dangling fetch: GET /__kimi-dev/backend (apps/kimi-web/src/api/devBackend.ts:36)"}, "fullDescription": {"text": "`apps/kimi-web/src/api/devBackend.ts:36` calls `GET /__kimi-dev/backend` but no backend route in the scanned graph matches that path. The path appears development/example-only, so verify its custom dev server or proxy registration.\n\nTool: fetch\nNormalized path used for matching: `/__kimi-dev/backend`"}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "medium", "confidence": 0.55}}, {"id": "scanner-a2062e3b4d0c79ce", "name": "Dangling fetch: POST /__kimi-dev/backend (apps/kimi-web/src/api/devBackend.ts:50)", "shortDescription": {"text": "Dangling fetch: POST /__kimi-dev/backend (apps/kimi-web/src/api/devBackend.ts:50)"}, "fullDescription": {"text": "`apps/kimi-web/src/api/devBackend.ts:50` calls `POST /__kimi-dev/backend` but no backend route in the scanned graph matches that path. The path appears development/example-only, so verify its custom dev server or proxy registration.\n\nTool: fetch\nNormalized path used for matching: `/__kimi-dev/backend`"}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "medium", "confidence": 0.55}}, {"id": "scanner-e300971b7e019b20", "name": "3 backend endpoints not called by scanned frontend", "shortDescription": {"text": "3 backend endpoints not called by scanned frontend"}, "fullDescription": {"text": "No scanned frontend call matched these backend routes. Sample: GET /asyncapi.json, GET /openapi.json, GET /*. This is fine when endpoints serve external clients (mobile apps, SDKs, third-party integrations, server-side webhooks). Otherwise document consumers or remove dead routes."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/30765"}, "properties": {"repository": "MoonshotAI/kimi-code", "repoUrl": "https://github.com/MoonshotAI/kimi-code", "branch": "main"}, "results": [{"ruleId": "scanner-12b711846771dc3d", "level": "none", "message": {"text": "Truncated text has no discoverable full-value affordance \u2014 apps/vis/web/src/components/shared/JsonViewer.tsx:76"}, "properties": {"repobilityId": "d8fa81a3cffd9d4f", "scanner": "scanner-primary", "fingerprint": "12b711846771dc3d", "layer": "frontend", "severity": "info", "confidence": 0.65, "tags": ["frontend-quality", "fq.truncate.no-title"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/vis/web/src/components/shared/JsonViewer.tsx"}, "region": {"startLine": 76}}}]}, {"ruleId": "scanner-ea51ecaaec0c87ab", "level": "none", "message": {"text": "Truncated text has no discoverable full-value affordance \u2014 apps/vis/web/src/components/shared/SizePreview.tsx:36"}, "properties": {"repobilityId": "fb0a09b801c6c4e2", "scanner": "scanner-primary", "fingerprint": "ea51ecaaec0c87ab", "layer": "frontend", "severity": "info", "confidence": 0.65, "tags": ["frontend-quality", "fq.truncate.no-title"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/vis/web/src/components/shared/SizePreview.tsx"}, "region": {"startLine": 36}}}]}, {"ruleId": "scanner-748e39cd41a12a3f", "level": "none", "message": {"text": "Truncated text has no discoverable full-value affordance \u2014 apps/vis/web/src/components/wire/renderers.tsx:78"}, "properties": {"repobilityId": "15e8a34fac5bf196", "scanner": "scanner-primary", "fingerprint": "748e39cd41a12a3f", "layer": "frontend", "severity": "info", "confidence": 0.65, "tags": ["frontend-quality", "fq.truncate.no-title"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/vis/web/src/components/wire/renderers.tsx"}, "region": {"startLine": 78}}}]}, {"ruleId": "scanner-63e60c6a0fd86be3", "level": "none", "message": {"text": "Truncated text has no discoverable full-value affordance \u2014 apps/vis/web/src/components/context/MessageBubble.tsx:110"}, "properties": {"repobilityId": "805d8c8a2c78bebe", "scanner": "scanner-primary", "fingerprint": "63e60c6a0fd86be3", "layer": "frontend", "severity": "info", "confidence": 0.65, "tags": ["frontend-quality", "fq.truncate.no-title"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/vis/web/src/components/context/MessageBubble.tsx"}, "region": {"startLine": 110}}}]}, {"ruleId": "scanner-26113418d131e6eb", "level": "none", "message": {"text": "Truncated text has no discoverable full-value affordance \u2014 apps/kimi-inspect/src/components/ServicePanels.tsx:419"}, "properties": {"repobilityId": "19cde538d4eb9ea0", "scanner": "scanner-primary", "fingerprint": "26113418d131e6eb", "layer": "frontend", "severity": "info", "confidence": 0.65, "tags": ["frontend-quality", "fq.truncate.no-title"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/kimi-inspect/src/components/ServicePanels.tsx"}, "region": {"startLine": 419}}}]}, {"ruleId": "scanner-2a7e154e9d4833ec", "level": "none", "message": {"text": "Truncated text has no discoverable full-value affordance \u2014 apps/kimi-inspect/src/components/Sidebar.tsx:189"}, "properties": {"repobilityId": "911829cd0bd87d02", "scanner": "scanner-primary", "fingerprint": "2a7e154e9d4833ec", "layer": "frontend", "severity": "info", "confidence": 0.65, "tags": ["frontend-quality", "fq.truncate.no-title"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/kimi-inspect/src/components/Sidebar.tsx"}, "region": {"startLine": 189}}}]}, {"ruleId": "scanner-afe341633a7d8802", "level": "none", "message": {"text": "Truncated text has no discoverable full-value affordance \u2014 apps/kimi-inspect/src/components/ModelCatalogView.tsx:296"}, "properties": {"repobilityId": "0a4693d2d6605a37", "scanner": "scanner-primary", "fingerprint": "afe341633a7d8802", "layer": "frontend", "severity": "info", "confidence": 0.65, "tags": ["frontend-quality", "fq.truncate.no-title"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/kimi-inspect/src/components/ModelCatalogView.tsx"}, "region": {"startLine": 296}}}]}, {"ruleId": "scanner-17594295ab40b89f", "level": "note", "message": {"text": "Debug `console.log` remains in browser-facing code \u2014 apps/vscode/webview-ui/src/App.tsx:26"}, "properties": {"repobilityId": "33d1f6415df4e214", "scanner": "scanner-primary", "fingerprint": "17594295ab40b89f", "layer": "frontend", "severity": "low", "confidence": 0.85, "tags": ["frontend-quality", "fq.console-leak"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/vscode/webview-ui/src/App.tsx"}, "region": {"startLine": 26}}}]}, {"ruleId": "scanner-73b14455a17f12fe", "level": "none", "message": {"text": "Truncated text has no discoverable full-value affordance \u2014 apps/vscode/webview-ui/src/components/WorkDirModal.tsx:86"}, "properties": {"repobilityId": "4efdb0fd10888fbc", "scanner": "scanner-primary", "fingerprint": "73b14455a17f12fe", "layer": "frontend", "severity": "info", "confidence": 0.65, "tags": ["frontend-quality", "fq.truncate.no-title"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/vscode/webview-ui/src/components/WorkDirModal.tsx"}, "region": {"startLine": 86}}}]}, {"ruleId": "scanner-16da0803b52f1f30", "level": "none", "message": {"text": "Truncated text has no discoverable full-value affordance \u2014 apps/vscode/webview-ui/src/components/SlashCommandMenu.tsx:68"}, "properties": {"repobilityId": "406d65e773e032f1", "scanner": "scanner-primary", "fingerprint": "16da0803b52f1f30", "layer": "frontend", "severity": "info", "confidence": 0.65, "tags": ["frontend-quality", "fq.truncate.no-title"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/vscode/webview-ui/src/components/SlashCommandMenu.tsx"}, "region": {"startLine": 68}}}]}, {"ruleId": "scanner-90fed9d88aeef6e4", "level": "none", "message": {"text": "Truncated text has no discoverable full-value affordance \u2014 apps/vscode/webview-ui/src/components/MCPServersModal.tsx:359"}, "properties": {"repobilityId": "38a2bfa37ce65edf", "scanner": "scanner-primary", "fingerprint": "90fed9d88aeef6e4", "layer": "frontend", "severity": "info", "confidence": 0.65, "tags": ["frontend-quality", "fq.truncate.no-title"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/vscode/webview-ui/src/components/MCPServersModal.tsx"}, "region": {"startLine": 359}}}]}, {"ruleId": "scanner-99b9703631fadd3b", "level": "none", "message": {"text": "Truncated text has no discoverable full-value affordance \u2014 apps/vscode/webview-ui/src/components/ToolRenderers.tsx:440"}, "properties": {"repobilityId": "af3edc848b37deef", "scanner": "scanner-primary", "fingerprint": "99b9703631fadd3b", "layer": "frontend", "severity": "info", "confidence": 0.65, "tags": ["frontend-quality", "fq.truncate.no-title"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/vscode/webview-ui/src/components/ToolRenderers.tsx"}, "region": {"startLine": 440}}}]}, {"ruleId": "scanner-0a326dc33dcacd6a", "level": "none", "message": {"text": "Truncated text has no discoverable full-value affordance \u2014 apps/vscode/webview-ui/src/components/FilePickerMenu.tsx:127"}, "properties": {"repobilityId": "cdc43772f1fc910d", "scanner": "scanner-primary", "fingerprint": "0a326dc33dcacd6a", "layer": "frontend", "severity": "info", "confidence": 0.65, "tags": ["frontend-quality", "fq.truncate.no-title"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/vscode/webview-ui/src/components/FilePickerMenu.tsx"}, "region": {"startLine": 127}}}]}, {"ruleId": "scanner-2428d16a14494139", "level": "none", "message": {"text": "Truncated text has no discoverable full-value affordance \u2014 apps/vscode/webview-ui/src/components/DisplayBlocks.tsx:97"}, "properties": {"repobilityId": "08d0c4cbed654854", "scanner": "scanner-primary", "fingerprint": "2428d16a14494139", "layer": "frontend", "severity": "info", "confidence": 0.65, "tags": ["frontend-quality", "fq.truncate.no-title"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/vscode/webview-ui/src/components/DisplayBlocks.tsx"}, "region": {"startLine": 97}}}]}, {"ruleId": "scanner-2436fe1d205af907", "level": "note", "message": {"text": "Debug `console.log` remains in browser-facing code \u2014 apps/vscode/webview-ui/src/components/DisplayBlocks.tsx:166"}, "properties": {"repobilityId": "1dc67f49c1ccb5dc", "scanner": "scanner-primary", "fingerprint": "2436fe1d205af907", "layer": "frontend", "severity": "low", "confidence": 0.85, "tags": ["frontend-quality", "fq.console-leak"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/vscode/webview-ui/src/components/DisplayBlocks.tsx"}, "region": {"startLine": 166}}}]}, {"ruleId": "scanner-4a152600fd3a34c1", "level": "note", "message": {"text": "Debug `console.log` remains in browser-facing code \u2014 apps/vscode/webview-ui/src/components/SessionList.tsx:112"}, "properties": {"repobilityId": "791b2a7c9cbb81ba", "scanner": "scanner-primary", "fingerprint": "4a152600fd3a34c1", "layer": "frontend", "severity": "low", "confidence": 0.85, "tags": ["frontend-quality", "fq.console-leak"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/vscode/webview-ui/src/components/SessionList.tsx"}, "region": {"startLine": 112}}}]}, {"ruleId": "scanner-40d18665fa850621", "level": "none", "message": {"text": "Truncated text has no discoverable full-value affordance \u2014 apps/vscode/webview-ui/src/components/inputarea/InputArea.tsx:427"}, "properties": {"repobilityId": "12213417919845db", "scanner": "scanner-primary", "fingerprint": "40d18665fa850621", "layer": "frontend", "severity": "info", "confidence": 0.65, "tags": ["frontend-quality", "fq.truncate.no-title"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/vscode/webview-ui/src/components/inputarea/InputArea.tsx"}, "region": {"startLine": 427}}}]}, {"ruleId": "scanner-d36fd231473630a7", "level": "note", "message": {"text": "Debug `console.log` remains in browser-facing code \u2014 apps/vscode/webview-ui/src/services/bridge.ts:53"}, "properties": {"repobilityId": "da3f2c08d64e08ae", "scanner": "scanner-primary", "fingerprint": "d36fd231473630a7", "layer": "frontend", "severity": "low", "confidence": 0.85, "tags": ["frontend-quality", "fq.console-leak"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/vscode/webview-ui/src/services/bridge.ts"}, "region": {"startLine": 53}}}]}, {"ruleId": "scanner-41e7ec9be1bceb6c", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 apps/kimi-web/src/composables/useKimiWebClient.ts:1741"}, "properties": {"repobilityId": "467ec1185ce727c6", "scanner": "scanner-primary", "fingerprint": "41e7ec9be1bceb6c", "layer": "frontend", "severity": "info", "confidence": 0.7, "tags": ["frontend-quality", "fq.todo-marker"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/kimi-web/src/composables/useKimiWebClient.ts"}, "region": {"startLine": 1741}}}]}, {"ruleId": "scanner-e0d75c08aeb79558", "level": "note", "message": {"text": "Icon-only button without accessible name \u2014 apps/kimi-web/src/components/chat/Composer.vue:872"}, "properties": {"repobilityId": "5fa8a36603454da8", "scanner": "scanner-primary", "fingerprint": "e0d75c08aeb79558", "layer": "frontend", "severity": "low", "confidence": 0.85, "tags": ["frontend-quality", "fq.button.no-label"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/kimi-web/src/components/chat/Composer.vue"}, "region": {"startLine": 872}}}]}, {"ruleId": "scanner-23f354843f00df80", "level": "note", "message": {"text": "Icon-only button without accessible name \u2014 apps/kimi-web/src/debug/KapDebugView.vue:163"}, "properties": {"repobilityId": "13441862c3c488ee", "scanner": "scanner-primary", "fingerprint": "23f354843f00df80", "layer": "frontend", "severity": "low", "confidence": 0.85, "tags": ["frontend-quality", "fq.button.no-label"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/kimi-web/src/debug/KapDebugView.vue"}, "region": {"startLine": 163}}}]}, {"ruleId": "scanner-11374155d89682a1", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 apps/kimi-code/src/tui/controllers/editor-keyboard.ts:242"}, "properties": {"repobilityId": "0e4be8e266e492d1", "scanner": "scanner-primary", "fingerprint": "11374155d89682a1", "layer": "frontend", "severity": "info", "confidence": 0.7, "tags": ["frontend-quality", "fq.todo-marker"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/kimi-code/src/tui/controllers/editor-keyboard.ts"}, "region": {"startLine": 242}}}]}, {"ruleId": "scanner-c4b6e9b2d088fe50", "level": "note", "message": {"text": "React Flow <Controls> without dark theming \u2014 packages/agent-core-v2/scripts/dep-graph/web/src/GraphView.tsx:718"}, "properties": {"repobilityId": "99c751a6af4018ca", "scanner": "scanner-primary", "fingerprint": "c4b6e9b2d088fe50", "layer": "frontend", "severity": "low", "confidence": 0.85, "tags": ["frontend-quality", "fq.controls.no-bg"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/agent-core-v2/scripts/dep-graph/web/src/GraphView.tsx"}, "region": {"startLine": 718}}}]}, {"ruleId": "scanner-c3e5eab5728a4d35", "level": "note", "message": {"text": "Icon-only button without accessible name \u2014 packages/agent-core-v2/scripts/dep-graph/web/src/GraphView.tsx:799"}, "properties": {"repobilityId": "1e9be026833518bb", "scanner": "scanner-primary", "fingerprint": "c3e5eab5728a4d35", "layer": "frontend", "severity": "low", "confidence": 0.85, "tags": ["frontend-quality", "fq.button.no-label"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/agent-core-v2/scripts/dep-graph/web/src/GraphView.tsx"}, "region": {"startLine": 799}}}]}, {"ruleId": "scanner-de6be7694616e69b", "level": "warning", "message": {"text": "detect child process \u2014 packages/pi-tui/src/autocomplete.ts:164"}, "properties": {"repobilityId": "93d70b3893570626", "scanner": "scanner-primary", "fingerprint": "de6be7694616e69b", "layer": "security", "severity": "medium", "confidence": 0.55, "tags": ["semgrep", "security", "javascript"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/pi-tui/src/autocomplete.ts"}, "region": {"startLine": 164}}}]}, {"ruleId": "scanner-b17924e2e9a696ab", "level": "note", "message": {"text": "CVE-2026-49356: @babel/core 7.29.0 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "5ed9b7327a0bdc8f", "scanner": "scanner-primary", "fingerprint": "b17924e2e9a696ab", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-49356"]}}, {"ruleId": "scanner-993552b71134bcb6", "level": "warning", "message": {"text": "GHSA-frvp-7c67-39w9: @hono/node-server 1.19.14 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "7a7c2342b3c17e8c", "scanner": "scanner-primary", "fingerprint": "993552b71134bcb6", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-frvp-7c67-39w9"]}}, {"ruleId": "scanner-6e6ffce0c3b9b047", "level": "warning", "message": {"text": "CVE-2026-44288: @protobufjs/utf8 1.1.0 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "cfd33caebea574b7", "scanner": "scanner-primary", "fingerprint": "6e6ffce0c3b9b047", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44288"]}}, {"ruleId": "scanner-c9dadc5f9682a312", "level": "note", "message": {"text": "CVE-2026-12590: body-parser 2.2.2 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "c52a5d8da171f050", "scanner": "scanner-primary", "fingerprint": "c9dadc5f9682a312", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-12590"]}}, {"ruleId": "scanner-2f153c0c5a7f83b8", "level": "error", "message": {"text": "CVE-2026-13149: brace-expansion 5.0.6 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "eedf4eae95361bb4", "scanner": "scanner-primary", "fingerprint": "2f153c0c5a7f83b8", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-13149"]}}, {"ruleId": "scanner-f1392a6b367f85c0", "level": "warning", "message": {"text": "GHSA-cmwh-pvxp-8882: dompurify 3.4.7 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "0a7a56c060679217", "scanner": "scanner-primary", "fingerprint": "f1392a6b367f85c0", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-cmwh-pvxp-8882"]}}, {"ruleId": "scanner-88d38df654249cbe", "level": "note", "message": {"text": "GHSA-c2j3-45gr-mqc4: dompurify 3.4.7 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "9ea21f414d0c7f1b", "scanner": "scanner-primary", "fingerprint": "88d38df654249cbe", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-c2j3-45gr-mqc4"]}}, {"ruleId": "scanner-15192e2ee8bc2131", "level": "note", "message": {"text": "GHSA-gvmj-g25r-r7wr: dompurify 3.4.7 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "6f06089dd330c942", "scanner": "scanner-primary", "fingerprint": "15192e2ee8bc2131", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-gvmj-g25r-r7wr"]}}, {"ruleId": "scanner-13f865215427d009", "level": "note", "message": {"text": "GHSA-vxr8-fq34-vvx9: dompurify 3.4.7 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "a15f69de251ce07b", "scanner": "scanner-primary", "fingerprint": "13f865215427d009", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-vxr8-fq34-vvx9"]}}, {"ruleId": "scanner-3be016b75b879dff", "level": "warning", "message": {"text": "GHSA-67mh-4wv8-2f99: esbuild 0.21.5 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "13032fffba065b44", "scanner": "scanner-primary", "fingerprint": "3be016b75b879dff", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-67mh-4wv8-2f99"]}}, {"ruleId": "scanner-9e925efd8793ae9b", "level": "error", "message": {"text": "CVE-2026-13676: fast-uri 3.1.0 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "22f3458cd6c077d8", "scanner": "scanner-primary", "fingerprint": "9e925efd8793ae9b", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-13676"]}}, {"ruleId": "scanner-2281acd7795cdefe", "level": "error", "message": {"text": "CVE-2026-16221: fast-uri 3.1.0 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "d0a482fb1283ccc4", "scanner": "scanner-primary", "fingerprint": "2281acd7795cdefe", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-16221"]}}, {"ruleId": "scanner-ee58b7134906e5d0", "level": "error", "message": {"text": "CVE-2026-6321: fast-uri 3.1.0 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "235bcfe30a3ee7f4", "scanner": "scanner-primary", "fingerprint": "ee58b7134906e5d0", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-6321"]}}, {"ruleId": "scanner-fa67cc47d2cf8220", "level": "error", "message": {"text": "CVE-2026-6322: fast-uri 3.1.0 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "45d19c683e75019e", "scanner": "scanner-primary", "fingerprint": "fa67cc47d2cf8220", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-6322"]}}, {"ruleId": "scanner-e275c5067d690455", "level": "error", "message": {"text": "CVE-2026-54290: hono 4.12.14 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "7578782077515776", "scanner": "scanner-primary", "fingerprint": "e275c5067d690455", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-54290"]}}, {"ruleId": "scanner-6612893e952a6be0", "level": "warning", "message": {"text": "CVE-2026-44455: hono 4.12.14 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "0c0920a76efdc72f", "scanner": "scanner-primary", "fingerprint": "6612893e952a6be0", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44455"]}}, {"ruleId": "scanner-4900e4b9628cbcc1", "level": "warning", "message": {"text": "CVE-2026-44456: hono 4.12.14 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "e52f6e55d2a2c74f", "scanner": "scanner-primary", "fingerprint": "4900e4b9628cbcc1", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44456"]}}, {"ruleId": "scanner-7c289ac126e846ee", "level": "warning", "message": {"text": "CVE-2026-44457: hono 4.12.14 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "a5b0879809ef9115", "scanner": "scanner-primary", "fingerprint": "7c289ac126e846ee", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44457"]}}, {"ruleId": "scanner-756b4b0a4f74e27b", "level": "warning", "message": {"text": "CVE-2026-44458: hono 4.12.14 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "e3f022987442d0fb", "scanner": "scanner-primary", "fingerprint": "756b4b0a4f74e27b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44458"]}}, {"ruleId": "scanner-0839a916e0e915fa", "level": "warning", "message": {"text": "CVE-2026-47673: hono 4.12.14 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "9913753757a984c4", "scanner": "scanner-primary", "fingerprint": "0839a916e0e915fa", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-47673"]}}, {"ruleId": "scanner-ab78742adfe67608", "level": "warning", "message": {"text": "CVE-2026-47674: hono 4.12.14 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "68c19dd1cc3e83ec", "scanner": "scanner-primary", "fingerprint": "ab78742adfe67608", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-47674"]}}, {"ruleId": "scanner-884ae5e8f5421ae4", "level": "warning", "message": {"text": "CVE-2026-47675: hono 4.12.14 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "44971e609d9b8d76", "scanner": "scanner-primary", "fingerprint": "884ae5e8f5421ae4", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-47675"]}}, {"ruleId": "scanner-858a0667bd370148", "level": "warning", "message": {"text": "CVE-2026-47676: hono 4.12.14 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "bdd62b07de9685c3", "scanner": "scanner-primary", "fingerprint": "858a0667bd370148", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-47676"]}}, {"ruleId": "scanner-35cc5223146ecee8", "level": "warning", "message": {"text": "CVE-2026-54286: hono 4.12.14 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "1133ce53f13cc99c", "scanner": "scanner-primary", "fingerprint": "35cc5223146ecee8", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-54286"]}}, {"ruleId": "scanner-ab933290a6651a81", "level": "warning", "message": {"text": "CVE-2026-54287: hono 4.12.14 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "ba9c12b5f6f4e34b", "scanner": "scanner-primary", "fingerprint": "ab933290a6651a81", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-54287"]}}, {"ruleId": "scanner-5036c990a3c9683c", "level": "warning", "message": {"text": "CVE-2026-54288: hono 4.12.14 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "e022311b9ffe3b9c", "scanner": "scanner-primary", "fingerprint": "5036c990a3c9683c", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-54288"]}}, {"ruleId": "scanner-70be346e651ac92d", "level": "warning", "message": {"text": "CVE-2026-54289: hono 4.12.14 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "6b9bf4fee1281934", "scanner": "scanner-primary", "fingerprint": "70be346e651ac92d", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-54289"]}}, {"ruleId": "scanner-64a0bc2b59825bba", "level": "warning", "message": {"text": "CVE-2026-59895: hono 4.12.14 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "63a78c9ca28d905e", "scanner": "scanner-primary", "fingerprint": "64a0bc2b59825bba", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59895"]}}, {"ruleId": "scanner-92d99fe486a24622", "level": "warning", "message": {"text": "CVE-2026-59896: hono 4.12.14 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "d2dc122ba4f9f3d0", "scanner": "scanner-primary", "fingerprint": "92d99fe486a24622", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59896"]}}, {"ruleId": "scanner-cca6922b2e09e0dd", "level": "warning", "message": {"text": "CVE-2026-59897: hono 4.12.14 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "269c964777b9f202", "scanner": "scanner-primary", "fingerprint": "cca6922b2e09e0dd", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59897"]}}, {"ruleId": "scanner-c7a25c67916ec1fc", "level": "note", "message": {"text": "CVE-2026-44459: hono 4.12.14 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "6e09c25b5f78accf", "scanner": "scanner-primary", "fingerprint": "c7a25c67916ec1fc", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44459"]}}, {"ruleId": "scanner-c39e60a99cd19f3b", "level": "warning", "message": {"text": "CVE-2026-42338: ip-address 10.1.0 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "51ecbe5de5837549", "scanner": "scanner-primary", "fingerprint": "c39e60a99cd19f3b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-42338"]}}, {"ruleId": "scanner-77cb8d69eb72544b", "level": "error", "message": {"text": "CVE-2026-59869: js-yaml 3.14.2 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "eb0c76d47422406a", "scanner": "scanner-primary", "fingerprint": "77cb8d69eb72544b", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59869"]}}, {"ruleId": "scanner-46a4e3a6a531415d", "level": "warning", "message": {"text": "CVE-2026-53550: js-yaml 3.14.2 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "4698948255093732", "scanner": "scanner-primary", "fingerprint": "46a4e3a6a531415d", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-53550"]}}, {"ruleId": "scanner-39762d64c6242d65", "level": "error", "message": {"text": "CVE-2026-59869: js-yaml 4.1.1 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "eb0c76d47422406a", "scanner": "scanner-primary", "fingerprint": "39762d64c6242d65", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59869"]}}, {"ruleId": "scanner-23f76c83140b1dbe", "level": "warning", "message": {"text": "CVE-2026-53550: js-yaml 4.1.1 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "4698948255093732", "scanner": "scanner-primary", "fingerprint": "23f76c83140b1dbe", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-53550"]}}, {"ruleId": "scanner-9c74bb3be696a874", "level": "error", "message": {"text": "CVE-2026-59887: linkify-it 5.0.1 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "abdf70e8bb36b1c6", "scanner": "scanner-primary", "fingerprint": "9c74bb3be696a874", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59887"]}}, {"ruleId": "scanner-349cb0f13509797c", "level": "warning", "message": {"text": "CVE-2026-41305: postcss 8.5.9 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "9177cf1e6ab13411", "scanner": "scanner-primary", "fingerprint": "349cb0f13509797c", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-41305"]}}, {"ruleId": "scanner-642f1c98e00981bd", "level": "error", "message": {"text": "CVE-2026-41242: protobufjs 7.5.4 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "55b86d0a60b2c979", "scanner": "scanner-primary", "fingerprint": "642f1c98e00981bd", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-41242"]}}, {"ruleId": "scanner-6c2c63528f37be6d", "level": "error", "message": {"text": "CVE-2026-44289: protobufjs 7.5.4 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "99cb4dbfb205f581", "scanner": "scanner-primary", "fingerprint": "6c2c63528f37be6d", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44289"]}}, {"ruleId": "scanner-ef133bfb33bfe2d1", "level": "error", "message": {"text": "CVE-2026-44290: protobufjs 7.5.4 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "3d3ec5cdd5823368", "scanner": "scanner-primary", "fingerprint": "ef133bfb33bfe2d1", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44290"]}}, {"ruleId": "scanner-4bf34c643a208348", "level": "error", "message": {"text": "CVE-2026-44291: protobufjs 7.5.4 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "862d50e9e0dfd52a", "scanner": "scanner-primary", "fingerprint": "4bf34c643a208348", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44291"]}}, {"ruleId": "scanner-7ef1cd109789f8f1", "level": "error", "message": {"text": "CVE-2026-44293: protobufjs 7.5.4 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "9643905be67658b1", "scanner": "scanner-primary", "fingerprint": "7ef1cd109789f8f1", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44293"]}}, {"ruleId": "scanner-f2fc6a601f149747", "level": "error", "message": {"text": "CVE-2026-48712: protobufjs 7.5.4 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "5294751aa71cebd5", "scanner": "scanner-primary", "fingerprint": "f2fc6a601f149747", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-48712"]}}, {"ruleId": "scanner-709fb68bc432f757", "level": "warning", "message": {"text": "CVE-2026-44288: protobufjs 7.5.4 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "2768d04b2d8bd5b9", "scanner": "scanner-primary", "fingerprint": "709fb68bc432f757", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44288"]}}, {"ruleId": "scanner-a417f5de75bde6aa", "level": "warning", "message": {"text": "CVE-2026-44292: protobufjs 7.5.4 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "839b8385654a2247", "scanner": "scanner-primary", "fingerprint": "a417f5de75bde6aa", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44292"]}}, {"ruleId": "scanner-9c6445899e9d9a0e", "level": "warning", "message": {"text": "CVE-2026-44294: protobufjs 7.5.4 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "4d66158e968e1d47", "scanner": "scanner-primary", "fingerprint": "9c6445899e9d9a0e", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44294"]}}, {"ruleId": "scanner-4260332644dce412", "level": "warning", "message": {"text": "CVE-2026-45740: protobufjs 7.5.4 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "dd1d2f6635ab2ab3", "scanner": "scanner-primary", "fingerprint": "4260332644dce412", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-45740"]}}, {"ruleId": "scanner-7ce74348686c1be7", "level": "warning", "message": {"text": "CVE-2026-54269: protobufjs 7.5.4 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "bc7be1a11f0831e7", "scanner": "scanner-primary", "fingerprint": "7ce74348686c1be7", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-54269"]}}, {"ruleId": "scanner-64d9bf8627368b8b", "level": "warning", "message": {"text": "CVE-2026-59877: protobufjs 7.5.4 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "e476f049a4a11e8e", "scanner": "scanner-primary", "fingerprint": "64d9bf8627368b8b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59877"]}}, {"ruleId": "scanner-618f3c6532aa65ef", "level": "warning", "message": {"text": "CVE-2026-8723: qs 6.15.1 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "a7adafc808d1b7c4", "scanner": "scanner-primary", "fingerprint": "618f3c6532aa65ef", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-8723"]}}, {"ruleId": "scanner-b0247a0a98209007", "level": "error", "message": {"text": "CVE-2026-42211: react-router 7.14.1 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "6f8db621d1826376", "scanner": "scanner-primary", "fingerprint": "b0247a0a98209007", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-42211"]}}, {"ruleId": "scanner-cac339bb98c3794e", "level": "error", "message": {"text": "CVE-2026-42342: react-router 7.14.1 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "81eb114acd5f004e", "scanner": "scanner-primary", "fingerprint": "cac339bb98c3794e", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-42342"]}}, {"ruleId": "scanner-55ed0f80b10a9a7d", "level": "note", "message": {"text": "CVE-2026-53663: react-router 7.14.1 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "07195528662bd2a8", "scanner": "scanner-primary", "fingerprint": "55ed0f80b10a9a7d", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-53663"]}}, {"ruleId": "scanner-98c7012c93dea3f0", "level": "error", "message": {"text": "CVE-2026-59873: tar 7.5.13 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "ade3dd7702afeddb", "scanner": "scanner-primary", "fingerprint": "98c7012c93dea3f0", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59873"]}}, {"ruleId": "scanner-555b88d3f76a4a7e", "level": "error", "message": {"text": "CVE-2026-59874: tar 7.5.13 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "e0989e892a69f25f", "scanner": "scanner-primary", "fingerprint": "555b88d3f76a4a7e", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59874"]}}, {"ruleId": "scanner-e36cdd44cd18f779", "level": "warning", "message": {"text": "CVE-2026-53655: tar 7.5.13 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "342f71d62c45bd21", "scanner": "scanner-primary", "fingerprint": "e36cdd44cd18f779", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-53655"]}}, {"ruleId": "scanner-ae3d866c0730d9e0", "level": "warning", "message": {"text": "CVE-2026-59871: tar 7.5.13 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "5361ae4b8cfca563", "scanner": "scanner-primary", "fingerprint": "ae3d866c0730d9e0", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59871"]}}, {"ruleId": "scanner-993c5ff4088aa324", "level": "warning", "message": {"text": "CVE-2026-59875: tar 7.5.13 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "30fb643d911d7fd6", "scanner": "scanner-primary", "fingerprint": "993c5ff4088aa324", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59875"]}}, {"ruleId": "scanner-e30e547b6d4e083c", "level": "error", "message": {"text": "CVE-2026-12151: undici 7.27.1 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "43b892875fa9caa6", "scanner": "scanner-primary", "fingerprint": "e30e547b6d4e083c", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-12151"]}}, {"ruleId": "scanner-049909921e22854a", "level": "error", "message": {"text": "CVE-2026-6734: undici 7.27.1 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "114c7f56ef224afc", "scanner": "scanner-primary", "fingerprint": "049909921e22854a", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-6734"]}}, {"ruleId": "scanner-b3c3660810e97dab", "level": "error", "message": {"text": "CVE-2026-9697: undici 7.27.1 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "1bc1c9bbf7812467", "scanner": "scanner-primary", "fingerprint": "b3c3660810e97dab", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-9697"]}}, {"ruleId": "scanner-9bc3853831dd1050", "level": "warning", "message": {"text": "CVE-2026-9678: undici 7.27.1 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "8b7bc5ed1f65bf6e", "scanner": "scanner-primary", "fingerprint": "9bc3853831dd1050", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-9678"]}}, {"ruleId": "scanner-264eb698240f3370", "level": "warning", "message": {"text": "CVE-2026-9679: undici 7.27.1 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "7181992331f10edf", "scanner": "scanner-primary", "fingerprint": "264eb698240f3370", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-9679"]}}, {"ruleId": "scanner-c26b783f96a71f9b", "level": "note", "message": {"text": "CVE-2026-11525: undici 7.27.1 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "68c1d778b48fb6bc", "scanner": "scanner-primary", "fingerprint": "c26b783f96a71f9b", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-11525"]}}, {"ruleId": "scanner-00d5db35ea37ffb8", "level": "note", "message": {"text": "CVE-2026-6733: undici 7.27.1 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "f5a068a85a035106", "scanner": "scanner-primary", "fingerprint": "00d5db35ea37ffb8", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-6733"]}}, {"ruleId": "scanner-5a451309f41c67ac", "level": "error", "message": {"text": "CVE-2026-53571: vite 5.4.21 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "d7a98de180351e0a", "scanner": "scanner-primary", "fingerprint": "5a451309f41c67ac", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-53571"]}}, {"ruleId": "scanner-4abeff9aec06fec2", "level": "warning", "message": {"text": "CVE-2026-39365: vite 5.4.21 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "a29de5381b3c4eae", "scanner": "scanner-primary", "fingerprint": "4abeff9aec06fec2", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-39365"]}}, {"ruleId": "scanner-08d6443effa48eea", "level": "warning", "message": {"text": "CVE-2026-53632: vite 5.4.21 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "2298f85d16a68c92", "scanner": "scanner-primary", "fingerprint": "08d6443effa48eea", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-53632"]}}, {"ruleId": "scanner-90ebb6126bfc7765", "level": "error", "message": {"text": "CVE-2026-48779: ws 8.20.0 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "3e3e7c29f5745cfa", "scanner": "scanner-primary", "fingerprint": "90ebb6126bfc7765", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-48779"]}}, {"ruleId": "scanner-5a491364b191b329", "level": "warning", "message": {"text": "CVE-2026-45736: ws 8.20.0 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "641d2b16c8bb5383", "scanner": "scanner-primary", "fingerprint": "5a491364b191b329", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-45736"]}}, {"ruleId": "scanner-6bd16922ed884b60", "level": "error", "message": {"text": "DS-0002: Image user should not be 'root' \u2014 packages/klient/Dockerfile"}, "properties": {"repobilityId": "fe9a89f61b847d19", "scanner": "scanner-primary", "fingerprint": "6bd16922ed884b60", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-aae76674b0a2f27c", "level": "note", "message": {"text": "DS-0026: No HEALTHCHECK defined \u2014 packages/klient/Dockerfile"}, "properties": {"repobilityId": "7353916126637660", "scanner": "scanner-primary", "fingerprint": "aae76674b0a2f27c", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-2679282aa1c484b5", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: AGENTS.md"}, "properties": {"repobilityId": "27d579812e6be614", "scanner": "scanner-primary", "fingerprint": "2679282aa1c484b5", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "agents_md"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "AGENTS.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f42cb21e1ca4e3b3", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: apps/kimi-web/AGENTS.md"}, "properties": {"repobilityId": "436c1e02234dc5a7", "scanner": "scanner-primary", "fingerprint": "f42cb21e1ca4e3b3", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "agents_md"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/kimi-web/AGENTS.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-79b21bd939f88b58", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: docs/zh/customization/agents.md"}, "properties": {"repobilityId": "3ab3b0e8988b2ceb", "scanner": "scanner-primary", "fingerprint": "79b21bd939f88b58", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "agents_md"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/zh/customization/agents.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6b7a382a7c934afb", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: docs/en/customization/agents.md"}, "properties": {"repobilityId": "ef875c602455ea7d", "scanner": "scanner-primary", "fingerprint": "6b7a382a7c934afb", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "agents_md"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/en/customization/agents.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6597c1993ca0e25f", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: packages/agent-core-v2/AGENTS.md"}, "properties": {"repobilityId": "3be9ba94e0dff292", "scanner": "scanner-primary", "fingerprint": "6597c1993ca0e25f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "agents_md"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/agent-core-v2/AGENTS.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b6fce3c96387599c", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: packages/agent-core-v2/src/app/skillCatalog/builtin/sub-skill/SKILL.md"}, "properties": {"repobilityId": "ea634d7dd6fbe40d", "scanner": "scanner-primary", "fingerprint": "b6fce3c96387599c", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/agent-core-v2/src/app/skillCatalog/builtin/sub-skill/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f5085ddc8c449463", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: packages/agent-core-v2/src/app/skillCatalog/builtin/sub-skill/review/SKILL.md"}, "properties": {"repobilityId": "627a82e15053c1f7", "scanner": "scanner-primary", "fingerprint": "f5085ddc8c449463", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/agent-core-v2/src/app/skillCatalog/builtin/sub-skill/review/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-cf8a799c08ffd0e3", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: packages/agent-core/src/skill/builtin/sub-skill/SKILL.md"}, "properties": {"repobilityId": "834fa7e354db7ff7", "scanner": "scanner-primary", "fingerprint": "cf8a799c08ffd0e3", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/agent-core/src/skill/builtin/sub-skill/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-85beac3cd5b2ef51", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: packages/agent-core/src/skill/builtin/sub-skill/review/SKILL.md"}, "properties": {"repobilityId": "9fc7df9d9847a062", "scanner": "scanner-primary", "fingerprint": "85beac3cd5b2ef51", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/agent-core/src/skill/builtin/sub-skill/review/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e73a9132365207d8", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: packages/pi-tui/AGENTS.md"}, "properties": {"repobilityId": "84de0e65d3c10cff", "scanner": "scanner-primary", "fingerprint": "e73a9132365207d8", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "agents_md"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/pi-tui/AGENTS.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e88f921528313f54", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: plugins/official/kimi-datasource/SKILL.md"}, "properties": {"repobilityId": "365cfd8cc3125a33", "scanner": "scanner-primary", "fingerprint": "e88f921528313f54", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "plugins/official/kimi-datasource/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5754588a75f75bee", "level": "warning", "message": {"text": "SkillSpector E1 (data-exfil) in plugins/official/kimi-datasource/bin/kimi-datasource.mjs"}, "properties": {"repobilityId": "845de09328925fba", "scanner": "scanner-primary", "fingerprint": "5754588a75f75bee", "layer": "security", "severity": "medium", "confidence": 0.5, "tags": ["skillspector", "mcp-skill", "data-exfil", "E1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "plugins/official/kimi-datasource/bin/kimi-datasource.mjs"}, "region": {"startLine": 23}}}]}, {"ruleId": "scanner-e637c415447867e4", "level": "none", "message": {"text": "Run SkillSpector's LLM-backed analysis in your own pipeline"}, "properties": {"repobilityId": "1936f198ff5212bf", "scanner": "scanner-primary", "fingerprint": "e637c415447867e4", "layer": "security", "severity": "info", "confidence": 1.0, "tags": ["skillspector", "mcp-skill", "llm-advisory", "ai-coder"]}}, {"ruleId": "scanner-0b69fa8bea96fae3", "level": "warning", "message": {"text": "Dockerfile runs as root: packages/klient/Dockerfile"}, "properties": {"repobilityId": "274f4a2963ba015b", "scanner": "scanner-primary", "fingerprint": "0b69fa8bea96fae3", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-f1385cdae20e8bf0", "level": "warning", "message": {"text": "Insecure pattern 'vue_v_html' in apps/kimi-web/src/components/FilePreview.vue:553"}, "properties": {"repobilityId": "1d7be5e7e1ffdafc", "scanner": "scanner-primary", "fingerprint": "f1385cdae20e8bf0", "layer": "security", "severity": "medium", "confidence": 0.65, "tags": ["owasp", "vue_v_html"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/kimi-web/src/components/FilePreview.vue"}, "region": {"startLine": 553}}}]}, {"ruleId": "scanner-e39e9277a3e98644", "level": "warning", "message": {"text": "Insecure pattern 'vue_v_html' in apps/kimi-web/src/components/chat/MentionMenu.vue:83"}, "properties": {"repobilityId": "0e02aacb69f64dc7", "scanner": "scanner-primary", "fingerprint": "e39e9277a3e98644", "layer": "security", "severity": "medium", "confidence": 0.65, "tags": ["owasp", "vue_v_html"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/kimi-web/src/components/chat/MentionMenu.vue"}, "region": {"startLine": 83}}}]}, {"ruleId": "scanner-9d6532b5341565da", "level": "warning", "message": {"text": "Insecure pattern 'vue_v_html' in apps/kimi-web/src/components/chat/ToolRow.vue:57"}, "properties": {"repobilityId": "22dd57cee21267f0", "scanner": "scanner-primary", "fingerprint": "9d6532b5341565da", "layer": "security", "severity": "medium", "confidence": 0.65, "tags": ["owasp", "vue_v_html"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/kimi-web/src/components/chat/ToolRow.vue"}, "region": {"startLine": 57}}}]}, {"ruleId": "scanner-ade6f69fa13f8099", "level": "warning", "message": {"text": "Insecure pattern 'vue_v_html' in apps/kimi-web/src/components/dialogs/SearchSessionsDialog.vue:161"}, "properties": {"repobilityId": "a361798a07be9ef6", "scanner": "scanner-primary", "fingerprint": "ade6f69fa13f8099", "layer": "security", "severity": "medium", "confidence": 0.65, "tags": ["owasp", "vue_v_html"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/kimi-web/src/components/dialogs/SearchSessionsDialog.vue"}, "region": {"startLine": 161}}}]}, {"ruleId": "scanner-a95e6f2e13feee84", "level": "error", "message": {"text": "Insecure pattern 'node_child_process' in apps/kimi-code/scripts/build-vis-asset.mjs:5"}, "properties": {"repobilityId": "2c92c44e615d8794", "scanner": "scanner-primary", "fingerprint": "a95e6f2e13feee84", "layer": "security", "severity": "high", "confidence": 0.9, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/kimi-code/scripts/build-vis-asset.mjs"}, "region": {"startLine": 5}}}]}, {"ruleId": "scanner-3c3354f733faacdc", "level": "error", "message": {"text": "Insecure pattern 'node_child_process' in apps/kimi-code/src/cli/run-shell.ts:1"}, "properties": {"repobilityId": "a8a3ab00a3c84abf", "scanner": "scanner-primary", "fingerprint": "3c3354f733faacdc", "layer": "security", "severity": "high", "confidence": 0.9, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/kimi-code/src/cli/run-shell.ts"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3ba1aeb51f7f8c62", "level": "error", "message": {"text": "Insecure pattern 'node_child_process' in apps/kimi-code/src/cli/update/preflight.ts:1"}, "properties": {"repobilityId": "96de83ce35bdfe57", "scanner": "scanner-primary", "fingerprint": "3ba1aeb51f7f8c62", "layer": "security", "severity": "high", "confidence": 0.9, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/kimi-code/src/cli/update/preflight.ts"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-da6ae27c12868040", "level": "error", "message": {"text": "Insecure pattern 'node_child_process' in apps/kimi-code/src/utils/process/external-editor.ts:11"}, "properties": {"repobilityId": "83b7dba72455fbfd", "scanner": "scanner-primary", "fingerprint": "da6ae27c12868040", "layer": "security", "severity": "high", "confidence": 0.9, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/kimi-code/src/utils/process/external-editor.ts"}, "region": {"startLine": 11}}}]}, {"ruleId": "scanner-647f17be76d1f181", "level": "error", "message": {"text": "Insecure pattern 'exec_used' in packages/kaos/src/local.ts:727"}, "properties": {"repobilityId": "69ad06cb18ada7b9", "scanner": "scanner-primary", "fingerprint": "647f17be76d1f181", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "exec_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/kaos/src/local.ts"}, "region": {"startLine": 727}}}]}, {"ruleId": "scanner-54019cb0c8e6c4e0", "level": "error", "message": {"text": "Insecure pattern 'exec_used' in packages/kaos/src/kaos.ts:94"}, "properties": {"repobilityId": "a1678ac873dee718", "scanner": "scanner-primary", "fingerprint": "54019cb0c8e6c4e0", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "exec_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/kaos/src/kaos.ts"}, "region": {"startLine": 94}}}]}, {"ruleId": "scanner-0048d76fb9f0a71f", "level": "error", "message": {"text": "Insecure pattern 'node_child_process' in packages/kap-server/src/lib/fileLaunch.ts:2"}, "properties": {"repobilityId": "a5509de87113ae91", "scanner": "scanner-primary", "fingerprint": "0048d76fb9f0a71f", "layer": "security", "severity": "high", "confidence": 0.9, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/kap-server/src/lib/fileLaunch.ts"}, "region": {"startLine": 2}}}]}, {"ruleId": "scanner-62b3bbb0486d4d12", "level": "error", "message": {"text": "Insecure pattern 'exec_used' in packages/acp-adapter/src/kaos-acp.ts:244"}, "properties": {"repobilityId": "ef64002b64d771df", "scanner": "scanner-primary", "fingerprint": "62b3bbb0486d4d12", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "exec_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/acp-adapter/src/kaos-acp.ts"}, "region": {"startLine": 244}}}]}, {"ruleId": "scanner-67f2b1b4f15ebad4", "level": "error", "message": {"text": "Insecure pattern 'exec_used' in packages/agent-core-v2/src/os/backends/node-local/tools/rgLocator.ts:54"}, "properties": {"repobilityId": "63c59fbb67918f9f", "scanner": "scanner-primary", "fingerprint": "67f2b1b4f15ebad4", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "exec_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/agent-core-v2/src/os/backends/node-local/tools/rgLocator.ts"}, "region": {"startLine": 54}}}]}, {"ruleId": "scanner-28a274ae86000b3b", "level": "error", "message": {"text": "Insecure pattern 'exec_used' in packages/agent-core-v2/src/session/process/processRunner.ts:34"}, "properties": {"repobilityId": "90f1bdac123076ce", "scanner": "scanner-primary", "fingerprint": "28a274ae86000b3b", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "exec_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/agent-core-v2/src/session/process/processRunner.ts"}, "region": {"startLine": 34}}}]}, {"ruleId": "scanner-1d49bf72e117b302", "level": "error", "message": {"text": "Insecure pattern 'exec_used' in packages/agent-core-v2/src/session/process/processRunnerService.ts:28"}, "properties": {"repobilityId": "10741663d7c7544d", "scanner": "scanner-primary", "fingerprint": "1d49bf72e117b302", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "exec_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/agent-core-v2/src/session/process/processRunnerService.ts"}, "region": {"startLine": 28}}}]}, {"ruleId": "scanner-26a1e5ce7a50d767", "level": "error", "message": {"text": "Insecure pattern 'exec_used' in packages/agent-core-v2/src/session/sessionFs/rgLocator.ts:34"}, "properties": {"repobilityId": "846035d18e208e62", "scanner": "scanner-primary", "fingerprint": "26a1e5ce7a50d767", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "exec_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/agent-core-v2/src/session/sessionFs/rgLocator.ts"}, "region": {"startLine": 34}}}]}, {"ruleId": "scanner-894b88778ceec8d2", "level": "error", "message": {"text": "Insecure pattern 'node_child_process' in packages/pi-tui/src/terminal-image.ts:1"}, "properties": {"repobilityId": "54fffb5109a95e47", "scanner": "scanner-primary", "fingerprint": "894b88778ceec8d2", "layer": "security", "severity": "high", "confidence": 0.9, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/pi-tui/src/terminal-image.ts"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6cddaff1ec9d2c59", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "b57c3d3c649ce2aa", "scanner": "scanner-primary", "fingerprint": "6cddaff1ec9d2c59", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pkg-pr-new.yml"}, "region": {"startLine": 22}}}]}, {"ruleId": "scanner-76d1307a801f7446", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "831fe17820ad75b2", "scanner": "scanner-primary", "fingerprint": "76d1307a801f7446", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/nix-build.yml"}, "region": {"startLine": 22}}}]}, {"ruleId": "scanner-09216238c870ae6a", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "10a0e86d8af9bea9", "scanner": "scanner-primary", "fingerprint": "09216238c870ae6a", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/docs-deploy.yml"}, "region": {"startLine": 37}}}]}, {"ruleId": "scanner-c4fb3f824e437796", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "9b4e76482b201243", "scanner": "scanner-primary", "fingerprint": "c4fb3f824e437796", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/docs-deploy.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-479a251a829cea7d", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "2abdbc50ef73ad1e", "scanner": "scanner-primary", "fingerprint": "479a251a829cea7d", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/_native-build.yml"}, "region": {"startLine": 59}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "04f6c832d67a7838", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 25}}}]}, {"ruleId": "scanner-1838a141491ce38c", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "b8fd4f5048f96576", "scanner": "scanner-primary", "fingerprint": "1838a141491ce38c", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-cb639d9a10a47b23", "level": "note", "message": {"text": "package.json defines install-time lifecycle scripts"}, "properties": {"repobilityId": "714673743ff59cef", "scanner": "scanner-primary", "fingerprint": "cb639d9a10a47b23", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "npm", "install-scripts"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-56a11826fd99c4aa", "level": "note", "message": {"text": "package.json defines install-time lifecycle scripts"}, "properties": {"repobilityId": "d77672a35f73a816", "scanner": "scanner-primary", "fingerprint": "56a11826fd99c4aa", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "npm", "install-scripts"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/kimi-code/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-bd4b7757b949ab8a", "level": "note", "message": {"text": "Very large file: apps/vis/server/test/lib/context-projector.test.ts (942 lines)"}, "properties": {"repobilityId": "5ca948812740968d", "scanner": "scanner-primary", "fingerprint": "bd4b7757b949ab8a", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-4bd20a13e1d1b83b", "level": "note", "message": {"text": "Very large file: apps/kimi-web/test/workspace-state.test.ts (2107 lines)"}, "properties": {"repobilityId": "867d758091283233", "scanner": "scanner-primary", "fingerprint": "4bd20a13e1d1b83b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-6cd2b04da24cf7ce", "level": "note", "message": {"text": "Very large file: apps/kimi-web/src/api/daemon/client.ts (1562 lines)"}, "properties": {"repobilityId": "88e8c2cf30239333", "scanner": "scanner-primary", "fingerprint": "6cd2b04da24cf7ce", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-69c13e7443abf91f", "level": "note", "message": {"text": "Very large file: apps/kimi-web/src/api/daemon/agentEventProjector.ts (1582 lines)"}, "properties": {"repobilityId": "e2d564bab61f4751", "scanner": "scanner-primary", "fingerprint": "69c13e7443abf91f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-a4ccc7c79c97c5bd", "level": "note", "message": {"text": "Very large file: apps/kimi-web/src/composables/useKimiWebClient.ts (2968 lines)"}, "properties": {"repobilityId": "1b7f532330a37f3a", "scanner": "scanner-primary", "fingerprint": "a4ccc7c79c97c5bd", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-54a09c1adf06d73a", "level": "note", "message": {"text": "Very large file: apps/kimi-web/src/composables/client/useWorkspaceState.ts (2842 lines)"}, "properties": {"repobilityId": "df5e46e0ca17b4fa", "scanner": "scanner-primary", "fingerprint": "54a09c1adf06d73a", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-3d8542924d68e9f9", "level": "note", "message": {"text": "Very large file: apps/kimi-code/test/tui/kimi-tui-message-flow.test.ts (5697 lines)"}, "properties": {"repobilityId": "96558b3135a4a537", "scanner": "scanner-primary", "fingerprint": "3d8542924d68e9f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-f48676a52c0ffe20", "level": "note", "message": {"text": "Very large file: apps/kimi-code/test/tui/kimi-tui-startup.test.ts (1776 lines)"}, "properties": {"repobilityId": "5ed7dc49ac970afa", "scanner": "scanner-primary", "fingerprint": "f48676a52c0ffe20", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-9f4f1dae92df4ec4", "level": "note", "message": {"text": "Very large file: apps/kimi-code/test/tui/components/messages/tool-call.test.ts (1908 lines)"}, "properties": {"repobilityId": "7ac251f279b2ec0f", "scanner": "scanner-primary", "fingerprint": "9f4f1dae92df4ec4", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-88a973408f2277b0", "level": "note", "message": {"text": "Very large file: apps/kimi-code/test/cli/run-prompt.test.ts (1403 lines)"}, "properties": {"repobilityId": "979d7fdfed418b53", "scanner": "scanner-primary", "fingerprint": "88a973408f2277b0", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-27bc909cb0748462", "level": "note", "message": {"text": "Very large file: apps/kimi-code/src/tui/kimi-tui.ts (3069 lines)"}, "properties": {"repobilityId": "aea3ac00daa620e6", "scanner": "scanner-primary", "fingerprint": "27bc909cb0748462", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-6085d202b93681f4", "level": "note", "message": {"text": "Very large file: apps/kimi-code/src/tui/components/messages/tool-call.ts (2331 lines)"}, "properties": {"repobilityId": "e06ecb0d51c79a82", "scanner": "scanner-primary", "fingerprint": "6085d202b93681f4", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-f897bc93df708283", "level": "note", "message": {"text": "Very large file: apps/kimi-code/src/tui/components/messages/agent-swarm-progress.ts (1727 lines)"}, "properties": {"repobilityId": "73652e8cc6fc6ac2", "scanner": "scanner-primary", "fingerprint": "f897bc93df708283", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-26cfa8faf9383fbb", "level": "note", "message": {"text": "Very large file: packages/kaos/test/ssh.test.ts (1472 lines)"}, "properties": {"repobilityId": "d96e74dd45670c4e", "scanner": "scanner-primary", "fingerprint": "26cfa8faf9383fbb", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-fe171ac06c120ee9", "level": "note", "message": {"text": "Very large file: packages/kap-server/test/sessionEventBroadcaster.test.ts (2453 lines)"}, "properties": {"repobilityId": "f8cf2cee81032635", "scanner": "scanner-primary", "fingerprint": "fe171ac06c120ee9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-de2a6d937ccc869c", "level": "note", "message": {"text": "Very large file: packages/kap-server/test/transcript.test.ts (1395 lines)"}, "properties": {"repobilityId": "8488a64fb39b45e9", "scanner": "scanner-primary", "fingerprint": "de2a6d937ccc869c", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-eef4bf3f515fa1a0", "level": "note", "message": {"text": "Very large file: packages/kap-server/test/services/transcript.test.ts (2302 lines)"}, "properties": {"repobilityId": "6c80cd63c18aad2f", "scanner": "scanner-primary", "fingerprint": "eef4bf3f515fa1a0", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-458fe48e285a4ddf", "level": "note", "message": {"text": "Very large file: packages/kap-server/src/transport/ws/v1/sessionEventBroadcaster.ts (1577 lines)"}, "properties": {"repobilityId": "fbc1d7d825601a61", "scanner": "scanner-primary", "fingerprint": "458fe48e285a4ddf", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-11611f61de040832", "level": "note", "message": {"text": "Very large file: packages/kap-server/src/services/transcript/coreEventMap.ts (1507 lines)"}, "properties": {"repobilityId": "b084c4f72a0b8839", "scanner": "scanner-primary", "fingerprint": "11611f61de040832", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-e8dac13e13bdd9d5", "level": "note", "message": {"text": "Very large file: packages/acp-adapter/src/session.ts (1715 lines)"}, "properties": {"repobilityId": "6e9af60bc96c6714", "scanner": "scanner-primary", "fingerprint": "e8dac13e13bdd9d5", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-0359f7b6d2ca1020", "level": "note", "message": {"text": "Very large file: packages/acp-adapter/src/server.ts (1209 lines)"}, "properties": {"repobilityId": "2e90ef0d3c1555b0", "scanner": "scanner-primary", "fingerprint": "0359f7b6d2ca1020", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-d883d97368e68cb4", "level": "note", "message": {"text": "Very large file: packages/minidb/src/index.ts (1668 lines)"}, "properties": {"repobilityId": "4f65586d1cc0d7b4", "scanner": "scanner-primary", "fingerprint": "d883d97368e68cb4", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-14a413e9c1bbb3ee", "level": "note", "message": {"text": "Very large file: packages/kosong/test/kimi.test.ts (2170 lines)"}, "properties": {"repobilityId": "3d62ca75eec5179e", "scanner": "scanner-primary", "fingerprint": "14a413e9c1bbb3ee", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-310b61e28b71a472", "level": "note", "message": {"text": "Very large file: packages/kosong/test/openai-legacy.test.ts (2166 lines)"}, "properties": {"repobilityId": "ad595d416c363185", "scanner": "scanner-primary", "fingerprint": "310b61e28b71a472", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-a9dce8c58f5e3191", "level": "note", "message": {"text": "Very large file: packages/kosong/test/anthropic.test.ts (3571 lines)"}, "properties": {"repobilityId": "f51127dfbd681211", "scanner": "scanner-primary", "fingerprint": "a9dce8c58f5e3191", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-d42d50965bb5d31e", "level": "note", "message": {"text": "Very large file: packages/kosong/test/google-genai.test.ts (1972 lines)"}, "properties": {"repobilityId": "e332323493f9e578", "scanner": "scanner-primary", "fingerprint": "d42d50965bb5d31e", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-87a7e1896b2eff40", "level": "note", "message": {"text": "Very large file: packages/kosong/test/openai-responses.test.ts (2158 lines)"}, "properties": {"repobilityId": "385e5c0e20ad0c03", "scanner": "scanner-primary", "fingerprint": "87a7e1896b2eff40", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-48f3bcfc1ddd2162", "level": "note", "message": {"text": "Very large file: packages/agent-core-v2/test/agent/media/image-compress.test.ts (1537 lines)"}, "properties": {"repobilityId": "1fa0ae9e496a29f9", "scanner": "scanner-primary", "fingerprint": "48f3bcfc1ddd2162", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-7abbad59a8417466", "level": "note", "message": {"text": "Very large file: packages/agent-core-v2/test/agent/goal/goal.test.ts (2298 lines)"}, "properties": {"repobilityId": "c126bd4fe4d0c442", "scanner": "scanner-primary", "fingerprint": "7abbad59a8417466", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-2c5e70a98414f117", "level": "note", "message": {"text": "Very large file: packages/agent-core-v2/test/agent/loop/loop.test.ts (1106 lines)"}, "properties": {"repobilityId": "b31610edda7bc176", "scanner": "scanner-primary", "fingerprint": "2c5e70a98414f117", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-50d0d3891ca931cd", "level": "note", "message": {"text": "Very large file: packages/agent-core-v2/test/agent/fullCompaction/fullCompaction.test.ts (3331 lines)"}, "properties": {"repobilityId": "e96274dfd2f48922", "scanner": "scanner-primary", "fingerprint": "50d0d3891ca931cd", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-decb1a17807d165e", "level": "note", "message": {"text": "Very large file: packages/agent-core-v2/test/agent/plan/plan.test.ts (999 lines)"}, "properties": {"repobilityId": "5ba3805314b34452", "scanner": "scanner-primary", "fingerprint": "decb1a17807d165e", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-eeab450f3b82401e", "level": "note", "message": {"text": "Very large file: packages/agent-core-v2/test/app/config/config.test.ts (1673 lines)"}, "properties": {"repobilityId": "e02790756e177f0a", "scanner": "scanner-primary", "fingerprint": "eeab450f3b82401e", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-79fbf514a39f8af8", "level": "note", "message": {"text": "Very large file: packages/agent-core-v2/test/app/auth/auth.test.ts (1383 lines)"}, "properties": {"repobilityId": "ed3dc02966b540d7", "scanner": "scanner-primary", "fingerprint": "79fbf514a39f8af8", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-63d10aee57102d42", "level": "note", "message": {"text": "Very large file: packages/agent-core-v2/test/os/backends/node-local/tools/grep.test.ts (2133 lines)"}, "properties": {"repobilityId": "4afc32a49ef172c3", "scanner": "scanner-primary", "fingerprint": "63d10aee57102d42", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-d42821a95089b486", "level": "note", "message": {"text": "Very large file: packages/agent-core-v2/test/os/backends/node-local/tools/bash.test.ts (1828 lines)"}, "properties": {"repobilityId": "955f2a4ac1aa7bf8", "scanner": "scanner-primary", "fingerprint": "d42821a95089b486", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-3eaa755a0c797518", "level": "note", "message": {"text": "Very large file: packages/agent-core-v2/test/tool/tool.test.ts (2777 lines)"}, "properties": {"repobilityId": "c4691e969a810e52", "scanner": "scanner-primary", "fingerprint": "3eaa755a0c797518", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-1b24a189f747992d", "level": "note", "message": {"text": "Very large file: packages/agent-core-v2/test/harness/agent.ts (2803 lines)"}, "properties": {"repobilityId": "5e7183acc4760450", "scanner": "scanner-primary", "fingerprint": "1b24a189f747992d", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-5f74b95769faef9d", "level": "note", "message": {"text": "Very large file: packages/protocol/src/events.ts (1865 lines)"}, "properties": {"repobilityId": "644f6412455de06d", "scanner": "scanner-primary", "fingerprint": "5f74b95769faef9d", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-a02417e68ba2ca57", "level": "note", "message": {"text": "Very large file: packages/agent-core/test/agent/turn.test.ts (2996 lines)"}, "properties": {"repobilityId": "b53884e33d27bb19", "scanner": "scanner-primary", "fingerprint": "a02417e68ba2ca57", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-345bb6214892bdc9", "level": "note", "message": {"text": "Very large file: packages/agent-core/test/agent/permission.test.ts (4199 lines)"}, "properties": {"repobilityId": "8c4e2cb1c85665c0", "scanner": "scanner-primary", "fingerprint": "345bb6214892bdc9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-dc14d706ca8c4b92", "level": "note", "message": {"text": "Very large file: packages/agent-core/test/agent/resume.test.ts (1767 lines)"}, "properties": {"repobilityId": "23fdf9af36c8d322", "scanner": "scanner-primary", "fingerprint": "dc14d706ca8c4b92", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-2119281c83ea22f8", "level": "note", "message": {"text": "Very large file: packages/agent-core/test/agent/context.test.ts (1544 lines)"}, "properties": {"repobilityId": "f1d7aed870139a75", "scanner": "scanner-primary", "fingerprint": "2119281c83ea22f8", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-cec1204e010579f4", "level": "note", "message": {"text": "Very large file: packages/agent-core/test/agent/compaction/full.test.ts (2727 lines)"}, "properties": {"repobilityId": "aec12460dda9666d", "scanner": "scanner-primary", "fingerprint": "cec1204e010579f4", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-964a3c0fa6dc5090", "level": "note", "message": {"text": "Very large file: packages/agent-core/test/services/prompt-service.test.ts (1709 lines)"}, "properties": {"repobilityId": "ef1702434890e627", "scanner": "scanner-primary", "fingerprint": "964a3c0fa6dc5090", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-af103d236cebd697", "level": "note", "message": {"text": "Very large file: packages/agent-core/test/tools/grep.test.ts (1952 lines)"}, "properties": {"repobilityId": "2b8a8646bcd78568", "scanner": "scanner-primary", "fingerprint": "af103d236cebd697", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-22762d3d85a8164c", "level": "note", "message": {"text": "Very large file: packages/agent-core/test/tools/read-media.test.ts (1522 lines)"}, "properties": {"repobilityId": "c76d3528fa353fbc", "scanner": "scanner-primary", "fingerprint": "22762d3d85a8164c", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-68802565ebd63c11", "level": "note", "message": {"text": "Very large file: packages/agent-core/test/tools/image-compress.test.ts (1859 lines)"}, "properties": {"repobilityId": "9ca56bc6ea961ed4", "scanner": "scanner-primary", "fingerprint": "68802565ebd63c11", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-efd873e39b82ecbf", "level": "note", "message": {"text": "Very large file: packages/agent-core/test/tools/bash.test.ts (1483 lines)"}, "properties": {"repobilityId": "8698a3dad66b6caa", "scanner": "scanner-primary", "fingerprint": "efd873e39b82ecbf", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-dc3fe3a5a4caa6ea", "level": "note", "message": {"text": "Very large file: packages/agent-core/test/session/subagent-host.test.ts (1785 lines)"}, "properties": {"repobilityId": "30c812b34f3d120a", "scanner": "scanner-primary", "fingerprint": "dc3fe3a5a4caa6ea", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-335d1cd43dff4109", "level": "note", "message": {"text": "Very large file: packages/agent-core/test/harness/runtime.test.ts (1428 lines)"}, "properties": {"repobilityId": "f49ac210e50f3aeb", "scanner": "scanner-primary", "fingerprint": "335d1cd43dff4109", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-0a8c16c72916b27d", "level": "note", "message": {"text": "Very large file: packages/agent-core/src/agent/turn/index.ts (1586 lines)"}, "properties": {"repobilityId": "62102019a384461f", "scanner": "scanner-primary", "fingerprint": "0a8c16c72916b27d", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-c7f8a5ee4516b7b3", "level": "note", "message": {"text": "Very large file: packages/agent-core/src/rpc/core-impl.ts (1605 lines)"}, "properties": {"repobilityId": "a9efa0b2eb4b9c35", "scanner": "scanner-primary", "fingerprint": "c7f8a5ee4516b7b3", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-efe4c7d5cc5c8bee", "level": "note", "message": {"text": "Very large file: packages/pi-tui/test/editor.test.ts (4452 lines)"}, "properties": {"repobilityId": "d9d28112d1b6128b", "scanner": "scanner-primary", "fingerprint": "efe4c7d5cc5c8bee", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-987562e03ebacf94", "level": "note", "message": {"text": "Very large file: packages/pi-tui/test/markdown.test.ts (1450 lines)"}, "properties": {"repobilityId": "05f96e7ba20fecec", "scanner": "scanner-primary", "fingerprint": "987562e03ebacf94", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-04c277e84cf16fcb", "level": "note", "message": {"text": "Very large file: packages/pi-tui/src/tui.ts (1752 lines)"}, "properties": {"repobilityId": "74463e2d1d16a71b", "scanner": "scanner-primary", "fingerprint": "04c277e84cf16fcb", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-841158d5b2a88d71", "level": "note", "message": {"text": "Very large file: packages/pi-tui/src/components/editor.ts (2415 lines)"}, "properties": {"repobilityId": "9d115de40c678631", "scanner": "scanner-primary", "fingerprint": "841158d5b2a88d71", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-03d6fd0be4bb59af", "level": "note", "message": {"text": "158 TODO/FIXME markers"}, "properties": {"repobilityId": "4b38c118003e07d2", "scanner": "scanner-primary", "fingerprint": "03d6fd0be4bb59af", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["maintenance"]}}, {"ruleId": "scanner-6f92ae605fc08caf", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: apps/vis/package.json"}, "properties": {"repobilityId": "5727deab49c799a7", "scanner": "scanner-primary", "fingerprint": "6f92ae605fc08caf", "layer": "dependencies", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/vis/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d426e50524a3ef5c", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: apps/vis/web/package.json"}, "properties": {"repobilityId": "5fdc9f3e69ccc79d", "scanner": "scanner-primary", "fingerprint": "d426e50524a3ef5c", "layer": "dependencies", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/vis/web/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b905af02a8c0631d", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: apps/vis/server/package.json"}, "properties": {"repobilityId": "a41930438c9bcb01", "scanner": "scanner-primary", "fingerprint": "b905af02a8c0631d", "layer": "dependencies", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/vis/server/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-378043821ea30c8c", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: apps/kimi-inspect/package.json"}, "properties": {"repobilityId": "33ed22c4a2a8efe0", "scanner": "scanner-primary", "fingerprint": "378043821ea30c8c", "layer": "dependencies", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/kimi-inspect/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-bc6a4aa204b162f8", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: apps/vscode/package.json"}, "properties": {"repobilityId": "571068671c764ebe", "scanner": "scanner-primary", "fingerprint": "bc6a4aa204b162f8", "layer": "dependencies", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/vscode/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2e1a3064b0dbb8f0", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: apps/kimi-web/package.json"}, "properties": {"repobilityId": "cfa6f2737c1497fe", "scanner": "scanner-primary", "fingerprint": "2e1a3064b0dbb8f0", "layer": "dependencies", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/kimi-web/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d2506772cee93623", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: apps/kimi-code/package.json"}, "properties": {"repobilityId": "fb5eba88ce7395ef", "scanner": "scanner-primary", "fingerprint": "d2506772cee93623", "layer": "dependencies", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/kimi-code/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-662ebc4a2945a151", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: docs/package.json"}, "properties": {"repobilityId": "e77ce50b08d152bb", "scanner": "scanner-primary", "fingerprint": "662ebc4a2945a151", "layer": "dependencies", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-499ab2782891535e", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/kaos/package.json"}, "properties": {"repobilityId": "fcdc86d8c5c68d79", "scanner": "scanner-primary", "fingerprint": "499ab2782891535e", "layer": "dependencies", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/kaos/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a1d1ac4fe9c71b53", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/kap-server/package.json"}, "properties": {"repobilityId": "8c2a30989e39bca9", "scanner": "scanner-primary", "fingerprint": "a1d1ac4fe9c71b53", "layer": "dependencies", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/kap-server/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-33ce4a7be061366f", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/migration-legacy/package.json"}, "properties": {"repobilityId": "499bf150a3c489d6", "scanner": "scanner-primary", "fingerprint": "33ce4a7be061366f", "layer": "dependencies", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/migration-legacy/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7d131bd6ae27ec20", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/acp-adapter/package.json"}, "properties": {"repobilityId": "b300357b0f0171cb", "scanner": "scanner-primary", "fingerprint": "7d131bd6ae27ec20", "layer": "dependencies", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/acp-adapter/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0196704c35ed40d0", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/oauth/package.json"}, "properties": {"repobilityId": "8624f284c9f63185", "scanner": "scanner-primary", "fingerprint": "0196704c35ed40d0", "layer": "dependencies", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/oauth/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-94fddf2b7223b8c2", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/klient/package.json"}, "properties": {"repobilityId": "be1740b9b655a273", "scanner": "scanner-primary", "fingerprint": "94fddf2b7223b8c2", "layer": "dependencies", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/klient/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-29627e92fac6ed07", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/kosong/package.json"}, "properties": {"repobilityId": "5a784482209a3361", "scanner": "scanner-primary", "fingerprint": "29627e92fac6ed07", "layer": "dependencies", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/kosong/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c3131d4f4fb66bfd", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/agent-core-v2/package.json"}, "properties": {"repobilityId": "5364dc4891fef4c8", "scanner": "scanner-primary", "fingerprint": "c3131d4f4fb66bfd", "layer": "dependencies", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/agent-core-v2/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ef09ae4a1a894193", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/protocol/package.json"}, "properties": {"repobilityId": "0939d10aef433444", "scanner": "scanner-primary", "fingerprint": "ef09ae4a1a894193", "layer": "dependencies", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/protocol/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0badbe94f5c1fcc1", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/transcript/package.json"}, "properties": {"repobilityId": "c503276f1a90b79d", "scanner": "scanner-primary", "fingerprint": "0badbe94f5c1fcc1", "layer": "dependencies", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/transcript/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f18584cfbdecfa6a", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/node-sdk/package.json"}, "properties": {"repobilityId": "2a810075612c0f44", "scanner": "scanner-primary", "fingerprint": "f18584cfbdecfa6a", "layer": "dependencies", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/node-sdk/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-da1e30fd30dc2ca6", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/agent-core/package.json"}, "properties": {"repobilityId": "f175b4cb509f02e2", "scanner": "scanner-primary", "fingerprint": "da1e30fd30dc2ca6", "layer": "dependencies", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/agent-core/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-07cd8dd720006196", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/pi-tui/package.json"}, "properties": {"repobilityId": "2cc64b439a3fd764", "scanner": "scanner-primary", "fingerprint": "07cd8dd720006196", "layer": "dependencies", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/pi-tui/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "7bb636fb16fd6f46", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "e9fc5dcfa1fdbd30", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "63b6e46839b26e92", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-749d4bc1bd66df5f", "level": "warning", "message": {"text": "Agent instructions exist but release-hardening basics are missing"}, "properties": {"repobilityId": "4c18a7d2212809ff", "scanner": "scanner-primary", "fingerprint": "749d4bc1bd66df5f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-70579808cacc02a6", "level": "note", "message": {"text": "Legacy-named symbol `subscribe_v2` in apps/kimi-inspect/src/transcript/ws.ts:10"}, "properties": {"repobilityId": "f4291bcf61c55227", "scanner": "scanner-primary", "fingerprint": "70579808cacc02a6", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-830c18a80e839825", "level": "note", "message": {"text": "Legacy-named symbol `hasOld` in apps/vscode/webview-ui/src/components/DisplayBlocks.tsx:90"}, "properties": {"repobilityId": "b80b1c283029114b", "scanner": "scanner-primary", "fingerprint": "830c18a80e839825", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-cb167855b81c282a", "level": "note", "message": {"text": "Legacy-named symbol `hasLegacy` in apps/vscode/src/managers/baseline.manager.ts:219"}, "properties": {"repobilityId": "523ad57635c4ee94", "scanner": "scanner-primary", "fingerprint": "cb167855b81c282a", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-093d9f428d9e5f54", "level": "note", "message": {"text": "Legacy-named symbol `authLegacy` in packages/kap-server/src/routes/auth.ts:16"}, "properties": {"repobilityId": "498f7d7c4f3706bd", "scanner": "scanner-primary", "fingerprint": "093d9f428d9e5f54", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-551e746161f25acb", "level": "note", "message": {"text": "Legacy-named symbol `messageLegacy` in packages/kap-server/src/routes/messages.ts:5"}, "properties": {"repobilityId": "1e6577402d3e70ad", "scanner": "scanner-primary", "fingerprint": "551e746161f25acb", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-8581603d1815a2c2", "level": "note", "message": {"text": "Legacy-named symbol `subscribe_v2` in packages/kap-server/src/transport/ws/v1/wsConnectionV1.ts:3"}, "properties": {"repobilityId": "3a85a0b8edf5e2b1", "scanner": "scanner-primary", "fingerprint": "8581603d1815a2c2", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-0f16fb2dadbdb4b1", "level": "note", "message": {"text": "Legacy-named symbol `sessionLegacy` in packages/kap-server/src/protocol/rest-session.ts:27"}, "properties": {"repobilityId": "6304b4fcb31e1fe1", "scanner": "scanner-primary", "fingerprint": "0f16fb2dadbdb4b1", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-0d35bf394f0e2ce7", "level": "note", "message": {"text": "Legacy-named symbol `sessionLegacy` in packages/kap-server/src/protocol/session.ts:9"}, "properties": {"repobilityId": "a8d5e7140f5046c9", "scanner": "scanner-primary", "fingerprint": "0d35bf394f0e2ce7", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-e7c087b582e6e9e7", "level": "note", "message": {"text": "Legacy-named symbol `sessionLegacy` in packages/kap-server/src/protocol/rest-prompt.ts:27"}, "properties": {"repobilityId": "dd2c3344e1060f13", "scanner": "scanner-primary", "fingerprint": "e7c087b582e6e9e7", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-d6a13c0ac0879ce9", "level": "note", "message": {"text": "Legacy-named symbol `subscribe_v2` in packages/kap-server/src/protocol/ws-control.ts:169"}, "properties": {"repobilityId": "723b596ef608120c", "scanner": "scanner-primary", "fingerprint": "d6a13c0ac0879ce9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-38a4cac555ee845f", "level": "note", "message": {"text": "Legacy-named symbol `wireProtocolFromOld` in packages/migration-legacy/src/sessions/state-writer.ts:10"}, "properties": {"repobilityId": "c2175f02a134f8d9", "scanner": "scanner-primary", "fingerprint": "38a4cac555ee845f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-73a07fc52ecff2f6", "level": "note", "message": {"text": "Legacy-named symbol `wireProtocolFromOld` in packages/migration-legacy/src/sessions/migrate-one.ts:118"}, "properties": {"repobilityId": "80f5630bcf6a75d7", "scanner": "scanner-primary", "fingerprint": "73a07fc52ecff2f6", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-0c5404121c4da0f8", "level": "note", "message": {"text": "Legacy-named symbol `sessionLegacy` in packages/agent-core-v2/scripts/check-domain-layers.mjs:243"}, "properties": {"repobilityId": "a02785066d98cf75", "scanner": "scanner-primary", "fingerprint": "0c5404121c4da0f8", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-ad3b8f996f0dde88", "level": "note", "message": {"text": "Legacy-named symbol `sessionLegacy` in packages/agent-core-v2/src/index.ts:291"}, "properties": {"repobilityId": "700d5a4a59dd005c", "scanner": "scanner-primary", "fingerprint": "ad3b8f996f0dde88", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-6a7c663abeb538e9", "level": "note", "message": {"text": "Legacy-named symbol `messageLegacy` in packages/agent-core-v2/src/errors.ts:22"}, "properties": {"repobilityId": "916aca53214a97a2", "scanner": "scanner-primary", "fingerprint": "6a7c663abeb538e9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-27b11f32b9295521", "level": "note", "message": {"text": "Legacy-named symbol `sessionLegacy` in packages/agent-core-v2/src/agent/contextMemory/messageProjection.ts:8"}, "properties": {"repobilityId": "0ac6b877795f5b97", "scanner": "scanner-primary", "fingerprint": "27b11f32b9295521", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-3d2228226f25518e", "level": "note", "message": {"text": "Legacy-named symbol `messageLegacy` in packages/agent-core-v2/src/agent/contextMemory/protocolMessage.ts:5"}, "properties": {"repobilityId": "db9811c540a9c2ac", "scanner": "scanner-primary", "fingerprint": "3d2228226f25518e", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-95865a89bad1961e", "level": "note", "message": {"text": "Legacy-named symbol `sessionLegacy` in packages/agent-core-v2/src/agent/rpc/core-api.ts:32"}, "properties": {"repobilityId": "367ced40f51ea7e9", "scanner": "scanner-primary", "fingerprint": "95865a89bad1961e", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-b00d695a18c13eee", "level": "note", "message": {"text": "Legacy-named symbol `sessionLegacy` in packages/agent-core-v2/src/app/sessionLegacy/sessionLegacyService.ts:2"}, "properties": {"repobilityId": "15b725c990ab2472", "scanner": "scanner-primary", "fingerprint": "b00d695a18c13eee", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-9dbf2f2ee6be6878", "level": "note", "message": {"text": "Legacy-named symbol `sessionLegacy` in packages/agent-core-v2/src/app/sessionLegacy/sessionLegacy.ts:2"}, "properties": {"repobilityId": "8187cb315f35e736", "scanner": "scanner-primary", "fingerprint": "9dbf2f2ee6be6878", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-c348a65bb1296f03", "level": "note", "message": {"text": "Legacy-named symbol `sessionLegacy` in packages/agent-core-v2/src/app/sessionLegacy/sessionProtocol.ts:2"}, "properties": {"repobilityId": "4c5a7d965bc54e48", "scanner": "scanner-primary", "fingerprint": "c348a65bb1296f03", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-dae41dae708ebc57", "level": "note", "message": {"text": "Legacy-named symbol `messageLegacy` in packages/agent-core-v2/src/app/messageLegacy/messageLegacyService.ts:2"}, "properties": {"repobilityId": "71da19cde4964ac2", "scanner": "scanner-primary", "fingerprint": "dae41dae708ebc57", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-907b5d8d36f57a75", "level": "note", "message": {"text": "Legacy-named symbol `messageLegacy` in packages/agent-core-v2/src/app/messageLegacy/messageLegacy.ts:2"}, "properties": {"repobilityId": "92cefe89cbd90c2d", "scanner": "scanner-primary", "fingerprint": "907b5d8d36f57a75", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-4200872242492f13", "level": "note", "message": {"text": "Legacy-named symbol `messageLegacy` in packages/agent-core-v2/src/app/messageLegacy/errors.ts:2"}, "properties": {"repobilityId": "2398075f35e7fa28", "scanner": "scanner-primary", "fingerprint": "4200872242492f13", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-76b1d3bf156d3e1e", "level": "note", "message": {"text": "Legacy-named symbol `authLegacy` in packages/agent-core-v2/src/app/authLegacy/authLegacyService.ts:2"}, "properties": {"repobilityId": "a6d95bb96171bc57", "scanner": "scanner-primary", "fingerprint": "76b1d3bf156d3e1e", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-63221a8fca2675f0", "level": "note", "message": {"text": "Legacy-named symbol `authLegacy` in packages/agent-core-v2/src/app/authLegacy/authLegacy.ts:2"}, "properties": {"repobilityId": "50f86511f7183c2d", "scanner": "scanner-primary", "fingerprint": "63221a8fca2675f0", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-fe47761d82b97fd7", "level": "warning", "message": {"text": "Fire-and-forget `fetch()` has no rejection handler \u2014 packages/agent-core-v2/src/app/web/tools/fetch-url-types.ts:21"}, "properties": {"repobilityId": "aa5ba4122d1ecfc9", "scanner": "scanner-primary", "fingerprint": "fe47761d82b97fd7", "layer": "quality", "severity": "medium", "confidence": 0.9, "tags": ["integrity", "fragile-runtime", "robustness", "unhandled-promise"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/agent-core-v2/src/app/web/tools/fetch-url-types.ts"}, "region": {"startLine": 21}}}]}, {"ruleId": "scanner-135f71e00c2b3b39", "level": "note", "message": {"text": "Legacy-named symbol `listLegacy` in packages/agent-core-v2/src/app/sessionIndex/sessionIndexService.ts:113"}, "properties": {"repobilityId": "c72e63ca6609726c", "scanner": "scanner-primary", "fingerprint": "135f71e00c2b3b39", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-fe3dad4dccfd7ef9", "level": "note", "message": {"text": "Legacy-named symbol `sessionLegacy` in packages/agent-core-v2/src/session/errors.ts:3"}, "properties": {"repobilityId": "a5f871a6018401bd", "scanner": "scanner-primary", "fingerprint": "fe3dad4dccfd7ef9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-684e599558868bc5", "level": "note", "message": {"text": "Legacy-named symbol `subscribe_v2` in packages/transcript/src/contract/schema.ts:477"}, "properties": {"repobilityId": "c5bb98a8a5ee90d5", "scanner": "scanner-primary", "fingerprint": "684e599558868bc5", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-35cbcc0e685e2825", "level": "none", "message": {"text": "Commented-code block (5 lines) in packages/agent-core/src/agent/compaction/micro.ts:58"}, "properties": {"repobilityId": "38aacbc2d72092a4", "scanner": "scanner-primary", "fingerprint": "35cbcc0e685e2825", "layer": "quality", "severity": "info", "confidence": 0.72, "tags": ["integrity", "commented-code", "dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/agent-core/src/agent/compaction/micro.ts"}, "region": {"startLine": 58}}}]}, {"ruleId": "scanner-edb568a5edd1a6fd", "level": "note", "message": {"text": "Legacy-named symbol `fromLegacy` in packages/agent-core/src/utils/completion-budget.ts:28"}, "properties": {"repobilityId": "b662c002dddcfa96", "scanner": "scanner-primary", "fingerprint": "edb568a5edd1a6fd", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-f485e269cc03d983", "level": "warning", "message": {"text": "Fire-and-forget `fetch()` has no rejection handler \u2014 packages/agent-core/src/tools/builtin/web/fetch-url.ts:39"}, "properties": {"repobilityId": "81ab2f81b85e2294", "scanner": "scanner-primary", "fingerprint": "f485e269cc03d983", "layer": "quality", "severity": "medium", "confidence": 0.9, "tags": ["integrity", "fragile-runtime", "robustness", "unhandled-promise"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/agent-core/src/tools/builtin/web/fetch-url.ts"}, "region": {"startLine": 39}}}]}, {"ruleId": "scanner-e7fae9c4975a20b6", "level": "warning", "message": {"text": "Frontend route `/sessions/:sessionId` has no Link/navigate to it \u2014 apps/vis/web/src/App.tsx"}, "properties": {"repobilityId": "8fe9a2979af14a42", "scanner": "scanner-primary", "fingerprint": "e7fae9c4975a20b6", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "orphan-page", "wiring"]}}, {"ruleId": "scanner-cf77ae0ecbf73d93", "level": "warning", "message": {"text": "Frontend route `/sessions/:sessionId/agents/:agentId` has no Link/navigate to it \u2014 apps/vis/web/src/App.tsx"}, "properties": {"repobilityId": "e17b22fda74938ed", "scanner": "scanner-primary", "fingerprint": "cf77ae0ecbf73d93", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "orphan-page", "wiring"]}}, {"ruleId": "scanner-66fab1b17ecc430f", "level": "warning", "message": {"text": "Vulnerable dependency @hono/node-server 1.19.14: GHSA-frvp-7c67-39w9"}, "properties": {"repobilityId": "e20a828d2748b708", "scanner": "scanner-primary", "fingerprint": "66fab1b17ecc430f", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-frvp-7c67-39w9"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/vis/server/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0509418362dca3c3", "level": "note", "message": {"text": "Vulnerable dependency diff 7.0.0: GHSA-73rr-hh4g-fpgx"}, "properties": {"repobilityId": "e3bbea3c8c4d9b9c", "scanner": "scanner-primary", "fingerprint": "0509418362dca3c3", "layer": "dependencies", "severity": "low", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-73rr-hh4g-fpgx"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pnpm-lock.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2ba6dadd28cc3195", "level": "warning", "message": {"text": "Vulnerable dependency hono 4.12.14: GHSA-2gcr-mfcq-wcc3"}, "properties": {"repobilityId": "e5061af65d4bba32", "scanner": "scanner-primary", "fingerprint": "2ba6dadd28cc3195", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-2gcr-mfcq-wcc3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/vis/server/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-569c66ccff7e2bf4", "level": "warning", "message": {"text": "Vulnerable dependency hono 4.12.14: GHSA-3hrh-pfw6-9m5x"}, "properties": {"repobilityId": "9199145c0a75a85d", "scanner": "scanner-primary", "fingerprint": "569c66ccff7e2bf4", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-3hrh-pfw6-9m5x"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/vis/server/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-dd47aa7207c392a2", "level": "warning", "message": {"text": "Vulnerable dependency hono 4.12.14: GHSA-69xw-7hcm-h432"}, "properties": {"repobilityId": "06fa54f59365f157", "scanner": "scanner-primary", "fingerprint": "dd47aa7207c392a2", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-69xw-7hcm-h432"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/vis/server/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-54bbbc11db021073", "level": "error", "message": {"text": "Vulnerable dependency hono 4.12.14: GHSA-88fw-hqm2-52qc"}, "properties": {"repobilityId": "dd07b7b47b7a410f", "scanner": "scanner-primary", "fingerprint": "54bbbc11db021073", "layer": "dependencies", "severity": "high", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-88fw-hqm2-52qc"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/vis/server/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-68a297fbe050c63e", "level": "warning", "message": {"text": "Vulnerable dependency hono 4.12.14: GHSA-9vqf-7f2p-gf9v"}, "properties": {"repobilityId": "fa46c1c74db48ea9", "scanner": "scanner-primary", "fingerprint": "68a297fbe050c63e", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-9vqf-7f2p-gf9v"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/vis/server/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b3d6f782a2fbafda", "level": "warning", "message": {"text": "Vulnerable dependency hono 4.12.14: GHSA-f577-qrjj-4474"}, "properties": {"repobilityId": "5fb7b098d4c85a82", "scanner": "scanner-primary", "fingerprint": "b3d6f782a2fbafda", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-f577-qrjj-4474"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/vis/server/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-42996ab15f11975e", "level": "warning", "message": {"text": "Vulnerable dependency hono 4.12.14: GHSA-hm8q-7f3q-5f36"}, "properties": {"repobilityId": "3b07250050aeaf8a", "scanner": "scanner-primary", "fingerprint": "42996ab15f11975e", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-hm8q-7f3q-5f36"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/vis/server/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f822ca50f425b19f", "level": "warning", "message": {"text": "Vulnerable dependency hono 4.12.14: GHSA-hvrm-45r6-mjfj"}, "properties": {"repobilityId": "97e873cf15a6e1b2", "scanner": "scanner-primary", "fingerprint": "f822ca50f425b19f", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-hvrm-45r6-mjfj"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/vis/server/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8ea6939dbeb4d0e5", "level": "warning", "message": {"text": "Vulnerable dependency hono 4.12.14: GHSA-j6c9-x7qj-28xf"}, "properties": {"repobilityId": "3fe2161b26ab57d4", "scanner": "scanner-primary", "fingerprint": "8ea6939dbeb4d0e5", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-j6c9-x7qj-28xf"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/vis/server/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8e650efa0210eb18", "level": "warning", "message": {"text": "Vulnerable dependency hono 4.12.14: GHSA-p77w-8qqv-26rm"}, "properties": {"repobilityId": "6551b75f1aa9e779", "scanner": "scanner-primary", "fingerprint": "8e650efa0210eb18", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-p77w-8qqv-26rm"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/vis/server/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ca16796b9e31a09a", "level": "warning", "message": {"text": "Vulnerable dependency hono 4.12.14: GHSA-qp7p-654g-cw7p"}, "properties": {"repobilityId": "e49521c2bea4875e", "scanner": "scanner-primary", "fingerprint": "ca16796b9e31a09a", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-qp7p-654g-cw7p"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/vis/server/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3fc9b86111460ef6", "level": "warning", "message": {"text": "Vulnerable dependency hono 4.12.14: GHSA-rv63-4mwf-qqc2"}, "properties": {"repobilityId": "f2177d708c52a0b7", "scanner": "scanner-primary", "fingerprint": "3fc9b86111460ef6", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-rv63-4mwf-qqc2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/vis/server/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ed79c2edec8500d1", "level": "warning", "message": {"text": "Vulnerable dependency hono 4.12.14: GHSA-w62v-xxxg-mg59"}, "properties": {"repobilityId": "cb945bacbe689dab", "scanner": "scanner-primary", "fingerprint": "ed79c2edec8500d1", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-w62v-xxxg-mg59"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/vis/server/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d870b34bdb9d936c", "level": "warning", "message": {"text": "Vulnerable dependency hono 4.12.14: GHSA-wgpf-jwqj-8h8p"}, "properties": {"repobilityId": "2783478ad6745ed5", "scanner": "scanner-primary", "fingerprint": "d870b34bdb9d936c", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-wgpf-jwqj-8h8p"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/vis/server/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-12550a01e0d68c43", "level": "warning", "message": {"text": "Vulnerable dependency hono 4.12.14: GHSA-wwfh-h76j-fc44"}, "properties": {"repobilityId": "3b8b01a3bed6bbf0", "scanner": "scanner-primary", "fingerprint": "12550a01e0d68c43", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-wwfh-h76j-fc44"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/vis/server/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-657d258d4d6c182f", "level": "warning", "message": {"text": "Vulnerable dependency hono 4.12.14: GHSA-xgm2-5f3f-mvvc"}, "properties": {"repobilityId": "ff4163ee9547f7d9", "scanner": "scanner-primary", "fingerprint": "657d258d4d6c182f", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-xgm2-5f3f-mvvc"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/vis/server/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f175fbe0d7bbb40f", "level": "warning", "message": {"text": "Vulnerable dependency hono 4.12.14: GHSA-xrhx-7g5j-rcj5"}, "properties": {"repobilityId": "2b7ae7391ddd703b", "scanner": "scanner-primary", "fingerprint": "f175fbe0d7bbb40f", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-xrhx-7g5j-rcj5"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/vis/server/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1294062cd83bfa5d", "level": "error", "message": {"text": "Vulnerable dependency js-yaml 3.14.2: GHSA-52cp-r559-cp3m"}, "properties": {"repobilityId": "55522dc7c85b667a", "scanner": "scanner-primary", "fingerprint": "1294062cd83bfa5d", "layer": "dependencies", "severity": "high", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-52cp-r559-cp3m"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pnpm-lock.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9135f7aafb79faab", "level": "warning", "message": {"text": "Vulnerable dependency js-yaml 3.14.2: GHSA-h67p-54hq-rp68"}, "properties": {"repobilityId": "7fd8c6f05bbc0277", "scanner": "scanner-primary", "fingerprint": "9135f7aafb79faab", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-h67p-54hq-rp68"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pnpm-lock.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-24aa5b155a8f2b03", "level": "error", "message": {"text": "Vulnerable dependency js-yaml 4.1.1: GHSA-52cp-r559-cp3m"}, "properties": {"repobilityId": "bb9354b1169e66e2", "scanner": "scanner-primary", "fingerprint": "24aa5b155a8f2b03", "layer": "dependencies", "severity": "high", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-52cp-r559-cp3m"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/agent-core-v2/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-56eee3d193968fe9", "level": "warning", "message": {"text": "Vulnerable dependency js-yaml 4.1.1: GHSA-h67p-54hq-rp68"}, "properties": {"repobilityId": "2e7af66f705e9148", "scanner": "scanner-primary", "fingerprint": "56eee3d193968fe9", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-h67p-54hq-rp68"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/agent-core-v2/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d98c879120110d78", "level": "error", "message": {"text": "Vulnerable dependency tar 7.5.13: GHSA-23hp-3jrh-7fpw"}, "properties": {"repobilityId": "5c9c167ab493aa7a", "scanner": "scanner-primary", "fingerprint": "d98c879120110d78", "layer": "dependencies", "severity": "critical", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-23hp-3jrh-7fpw"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/agent-core-v2/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-50db1b96c52eeb3e", "level": "error", "message": {"text": "Vulnerable dependency tar 7.5.13: GHSA-8x88-c5mf-7j5w"}, "properties": {"repobilityId": "cb21b85a204d571b", "scanner": "scanner-primary", "fingerprint": "50db1b96c52eeb3e", "layer": "dependencies", "severity": "high", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-8x88-c5mf-7j5w"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/agent-core-v2/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4bc346e189a16b04", "level": "warning", "message": {"text": "Vulnerable dependency tar 7.5.13: GHSA-gvwx-54wh-qm9j"}, "properties": {"repobilityId": "62e99564d6cb9359", "scanner": "scanner-primary", "fingerprint": "4bc346e189a16b04", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-gvwx-54wh-qm9j"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/agent-core-v2/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d0b5c643ff887292", "level": "warning", "message": {"text": "Vulnerable dependency tar 7.5.13: GHSA-vmf3-w455-68vh"}, "properties": {"repobilityId": "5113ab34429f8dc2", "scanner": "scanner-primary", "fingerprint": "d0b5c643ff887292", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-vmf3-w455-68vh"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/agent-core-v2/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-142beda4e2b923a4", "level": "warning", "message": {"text": "Vulnerable dependency tar 7.5.13: GHSA-w8wr-v893-vjvp"}, "properties": {"repobilityId": "4debe9b4f384d56c", "scanner": "scanner-primary", "fingerprint": "142beda4e2b923a4", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-w8wr-v893-vjvp"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/agent-core-v2/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ad393e420d45a08c", "level": "note", "message": {"text": "Vulnerable dependency undici 7.27.1: GHSA-35p6-xmwp-9g52"}, "properties": {"repobilityId": "7f858bcf03d85f7e", "scanner": "scanner-primary", "fingerprint": "ad393e420d45a08c", "layer": "dependencies", "severity": "low", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-35p6-xmwp-9g52"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/agent-core-v2/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0e13ccd2e31e1ca5", "level": "note", "message": {"text": "Vulnerable dependency undici 7.27.1: GHSA-g8m3-5g58-fq7m"}, "properties": {"repobilityId": "255e96ea6daad9af", "scanner": "scanner-primary", "fingerprint": "0e13ccd2e31e1ca5", "layer": "dependencies", "severity": "low", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-g8m3-5g58-fq7m"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/agent-core-v2/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-bd079ab51d04219a", "level": "warning", "message": {"text": "Vulnerable dependency undici 7.27.1: GHSA-hm92-r4w5-c3mj"}, "properties": {"repobilityId": "546d1fbe947ef38b", "scanner": "scanner-primary", "fingerprint": "bd079ab51d04219a", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-hm92-r4w5-c3mj"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/agent-core-v2/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2f13e0e0de441509", "level": "warning", "message": {"text": "Vulnerable dependency undici 7.27.1: GHSA-p88m-4jfj-68fv"}, "properties": {"repobilityId": "002e854c3f4108aa", "scanner": "scanner-primary", "fingerprint": "2f13e0e0de441509", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-p88m-4jfj-68fv"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/agent-core-v2/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ad979d068e9307e4", "level": "warning", "message": {"text": "Vulnerable dependency undici 7.27.1: GHSA-pr7r-676h-xcf6"}, "properties": {"repobilityId": "45e4fbc3ab245743", "scanner": "scanner-primary", "fingerprint": "ad979d068e9307e4", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-pr7r-676h-xcf6"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/agent-core-v2/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ec319663ed847dad", "level": "warning", "message": {"text": "Vulnerable dependency undici 7.27.1: GHSA-vmh5-mc38-953g"}, "properties": {"repobilityId": "1d3a8e41eeb55c54", "scanner": "scanner-primary", "fingerprint": "ec319663ed847dad", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-vmh5-mc38-953g"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/agent-core-v2/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-59ac195b7a255a7e", "level": "warning", "message": {"text": "Vulnerable dependency undici 7.27.1: GHSA-vxpw-j846-p89q"}, "properties": {"repobilityId": "9e3e03726234a13d", "scanner": "scanner-primary", "fingerprint": "59ac195b7a255a7e", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-vxpw-j846-p89q"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/agent-core-v2/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5d4271c7452ee68b", "level": "warning", "message": {"text": "Vulnerable dependency vite 5.4.21: GHSA-4w7w-66w2-5vf9"}, "properties": {"repobilityId": "90685dbb72b15019", "scanner": "scanner-primary", "fingerprint": "5d4271c7452ee68b", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-4w7w-66w2-5vf9"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pnpm-lock.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-08e77ee84bd401b2", "level": "error", "message": {"text": "Vulnerable dependency vite 5.4.21: GHSA-fx2h-pf6j-xcff"}, "properties": {"repobilityId": "d9b9604813f5ec55", "scanner": "scanner-primary", "fingerprint": "08e77ee84bd401b2", "layer": "dependencies", "severity": "high", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-fx2h-pf6j-xcff"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pnpm-lock.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e997dd1aba95f6ef", "level": "warning", "message": {"text": "Vulnerable dependency vite 5.4.21: GHSA-v6wh-96g9-6wx3"}, "properties": {"repobilityId": "6d8cd9b06e1669ff", "scanner": "scanner-primary", "fingerprint": "e997dd1aba95f6ef", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-v6wh-96g9-6wx3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pnpm-lock.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4e5a53e0089001be", "level": "error", "message": {"text": "Vulnerable dependency vite 6.4.2: GHSA-fx2h-pf6j-xcff"}, "properties": {"repobilityId": "eab07cdb6033978e", "scanner": "scanner-primary", "fingerprint": "4e5a53e0089001be", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-fx2h-pf6j-xcff", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/kimi-inspect/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-189aadabbcade1b0", "level": "warning", "message": {"text": "Vulnerable dependency vite 6.4.2: GHSA-v6wh-96g9-6wx3"}, "properties": {"repobilityId": "cc4b5000fe61f491", "scanner": "scanner-primary", "fingerprint": "189aadabbcade1b0", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-v6wh-96g9-6wx3", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/kimi-inspect/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-80f71fcb3a207da8", "level": "error", "message": {"text": "Vulnerable dependency vite 8.0.8: GHSA-fx2h-pf6j-xcff"}, "properties": {"repobilityId": "f7d823719865739b", "scanner": "scanner-primary", "fingerprint": "80f71fcb3a207da8", "layer": "dependencies", "severity": "high", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-fx2h-pf6j-xcff"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pnpm-lock.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-631b177afa72cc8c", "level": "warning", "message": {"text": "Vulnerable dependency vite 8.0.8: GHSA-v6wh-96g9-6wx3"}, "properties": {"repobilityId": "08a12d1e77d6ed9b", "scanner": "scanner-primary", "fingerprint": "631b177afa72cc8c", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-v6wh-96g9-6wx3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pnpm-lock.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b8acf95aa32e6574", "level": "warning", "message": {"text": "Vulnerable dependency ws 8.20.0: GHSA-58qx-3vcg-4xpx"}, "properties": {"repobilityId": "1d8931ed96d4a424", "scanner": "scanner-primary", "fingerprint": "b8acf95aa32e6574", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-58qx-3vcg-4xpx"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/kimi-web/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-257714305f06797c", "level": "error", "message": {"text": "Vulnerable dependency ws 8.20.0: GHSA-96hv-2xvq-fx4p"}, "properties": {"repobilityId": "58982c4a1e291e03", "scanner": "scanner-primary", "fingerprint": "257714305f06797c", "layer": "dependencies", "severity": "high", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-96hv-2xvq-fx4p"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/kimi-web/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1e89a3a89db0b7ea", "level": "note", "message": {"text": "Vulnerable dependency @babel/core 7.29.0: GHSA-4x5r-pxfx-6jf8"}, "properties": {"repobilityId": "048ec5a9afac1732", "scanner": "scanner-primary", "fingerprint": "1e89a3a89db0b7ea", "layer": "dependencies", "severity": "low", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-4x5r-pxfx-6jf8", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pnpm-lock.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-63717db2042f18fc", "level": "note", "message": {"text": "Dependency @agentclientprotocol/sdk is a major version behind"}, "properties": {"repobilityId": "df2959519dd8c8ef", "scanner": "scanner-primary", "fingerprint": "63717db2042f18fc", "layer": "dependencies", "severity": "low", "confidence": 0.9, "tags": ["dependency", "freshness", "outdated"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/acp-adapter/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-dbc439fe314ef318", "level": "note", "message": {"text": "Dependency @google/genai is a major version behind"}, "properties": {"repobilityId": "d887dd1fddcc802f", "scanner": "scanner-primary", "fingerprint": "dbc439fe314ef318", "layer": "dependencies", "severity": "low", "confidence": 0.9, "tags": ["dependency", "freshness", "outdated"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/agent-core-v2/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e66d1607ec5dc56f", "level": "note", "message": {"text": "Dependency @hono/node-server is a major version behind"}, "properties": {"repobilityId": "a4bd409d5fe14875", "scanner": "scanner-primary", "fingerprint": "e66d1607ec5dc56f", "layer": "dependencies", "severity": "low", "confidence": 0.9, "tags": ["dependency", "freshness", "outdated"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/vis/server/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b522119a9d05b89c", "level": "note", "message": {"text": "Dependency bcryptjs is a major version behind"}, "properties": {"repobilityId": "d628e4d33d679649", "scanner": "scanner-primary", "fingerprint": "b522119a9d05b89c", "layer": "dependencies", "severity": "low", "confidence": 0.9, "tags": ["dependency", "freshness", "outdated"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/kap-server/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-cdf67416f254a7ac", "level": "note", "message": {"text": "Dependency chokidar is a major version behind"}, "properties": {"repobilityId": "8baff3969c60eb76", "scanner": "scanner-primary", "fingerprint": "cdf67416f254a7ac", "layer": "dependencies", "severity": "low", "confidence": 0.9, "tags": ["dependency", "freshness", "outdated"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/agent-core-v2/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-06946a4e2590d577", "level": "note", "message": {"text": "Dependency diff is a major version behind"}, "properties": {"repobilityId": "4089fb59e41a6e2a", "scanner": "scanner-primary", "fingerprint": "06946a4e2590d577", "layer": "dependencies", "severity": "low", "confidence": 0.9, "tags": ["dependency", "freshness", "outdated"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/vscode/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-81cde0c93076ed7f", "level": "warning", "message": {"text": "Dependency ignore is two or more major versions behind"}, "properties": {"repobilityId": "7039e0c77b0e423e", "scanner": "scanner-primary", "fingerprint": "81cde0c93076ed7f", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "freshness", "outdated"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/agent-core-v2/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a76448d9160d0ec2", "level": "note", "message": {"text": "Dependency js-yaml is a major version behind"}, "properties": {"repobilityId": "36a2bf1b5b0aadbd", "scanner": "scanner-primary", "fingerprint": "a76448d9160d0ec2", "layer": "dependencies", "severity": "low", "confidence": 0.9, "tags": ["dependency", "freshness", "outdated"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/agent-core-v2/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-04f8c647645992c7", "level": "warning", "message": {"text": "Dangling fetch: GET /__inspect/servers (apps/kimi-inspect/src/servers.ts:32)"}, "properties": {"repobilityId": "d00f412010a8f776", "scanner": "scanner-primary", "fingerprint": "04f8c647645992c7", "layer": "api", "severity": "medium", "confidence": 0.55, "tags": ["wiring", "dangling-fetch", "fetch", "non-production-context", "development-endpoint"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/kimi-inspect/src/servers.ts"}, "region": {"startLine": 32}}}]}, {"ruleId": "scanner-3cf44469fddc5cf7", "level": "warning", "message": {"text": "Dangling fetch: GET /__kimi-dev/backend (apps/kimi-web/src/api/devBackend.ts:36)"}, "properties": {"repobilityId": "d787b5cd701a0999", "scanner": "scanner-primary", "fingerprint": "3cf44469fddc5cf7", "layer": "api", "severity": "medium", "confidence": 0.55, "tags": ["wiring", "dangling-fetch", "fetch", "non-production-context", "development-endpoint"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/kimi-web/src/api/devBackend.ts"}, "region": {"startLine": 36}}}]}, {"ruleId": "scanner-a2062e3b4d0c79ce", "level": "warning", "message": {"text": "Dangling fetch: POST /__kimi-dev/backend (apps/kimi-web/src/api/devBackend.ts:50)"}, "properties": {"repobilityId": "0b54e25521d67770", "scanner": "scanner-primary", "fingerprint": "a2062e3b4d0c79ce", "layer": "api", "severity": "medium", "confidence": 0.55, "tags": ["wiring", "dangling-fetch", "fetch", "non-production-context", "development-endpoint"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/kimi-web/src/api/devBackend.ts"}, "region": {"startLine": 50}}}]}, {"ruleId": "scanner-e300971b7e019b20", "level": "note", "message": {"text": "3 backend endpoints not called by scanned frontend"}, "properties": {"repobilityId": "3c8e96670c5e1f9f", "scanner": "scanner-primary", "fingerprint": "e300971b7e019b20", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}]}]}