{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-195b68c2e71f903b", "name": "TODO/FIXME marker in shipping code \u2014 types/api/address.ts:24", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 types/api/address.ts:24"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.7}}, {"id": "scanner-56db74f7b31d8b13", "name": "TODO/FIXME marker in shipping code \u2014 ui/address/AddressTokenTransfers.pw.tsx:17", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 ui/address/AddressTokenTransfers.pw.tsx:17"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.7}}, {"id": "scanner-796168dc0dc7cb9d", "name": "TODO/FIXME marker in shipping code \u2014 ui/address/AddressTxs.pw.tsx:101", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 ui/address/AddressTxs.pw.tsx:101"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.7}}, {"id": "scanner-ab79a8af4f5afa6e", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 ui/address/details/AddressQrCode.tsx:93", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 ui/address/details/AddressQrCode.tsx:93"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 0.8}}, {"id": "scanner-be2b47b60b9b86b9", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 ui/address/details/AddressAlerts.tsx:46", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 ui/address/details/AddressAlerts.tsx:46"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 0.8}}, {"id": "scanner-fc160d1c421a4110", "name": "TODO/FIXME marker in shipping code \u2014 ui/address/contract/ContractDetails.pw.tsx:17", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 ui/address/contract/ContractDetails.pw.tsx:17"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.7}}, {"id": "scanner-7c8a3fa0394ec64c", "name": "TODO/FIXME marker in shipping code \u2014 ui/address/contract/alerts/ContractDetailsAlerts.pw.tsx:10", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 ui/address/contract/alerts/ContractDetailsAlerts.pw.tsx:10"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.7}}, {"id": "scanner-bec6a319688be409", "name": "TODO/FIXME marker in shipping code \u2014 ui/marketplace/Rating/PopoverContent.tsx:74", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 ui/marketplace/Rating/PopoverContent.tsx:74"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.7}}, {"id": "scanner-0dc213868a125553", "name": "TODO/FIXME marker in shipping code \u2014 ui/optimismSuperchain/home/ChainIndicators.tsx:53", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 ui/optimismSuperchain/home/ChainIndicators.tsx:53"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.7}}, {"id": "scanner-a853cbde25b601cd", "name": "TODO/FIXME marker in shipping code \u2014 ui/shared/layout/Layout.pw.tsx:9", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 ui/shared/layout/Layout.pw.tsx:9"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.7}}, {"id": "scanner-efa39f1173bf6e50", "name": "TODO/FIXME marker in shipping code \u2014 ui/shared/layout/LayoutError.pw.tsx:9", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 ui/shared/layout/LayoutError.pw.tsx:9"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.7}}, {"id": "scanner-641b02f7f8857ed9", "name": "TODO/FIXME marker in shipping code \u2014 ui/shared/layout/LayoutHome.pw.tsx:8", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 ui/shared/layout/LayoutHome.pw.tsx:8"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.7}}, {"id": "scanner-219805c308147e35", "name": "TODO/FIXME marker in shipping code \u2014 ui/shared/monaco/CodeEditor.tsx:232", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 ui/shared/monaco/CodeEditor.tsx:232"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.7}}, {"id": "scanner-42fa69046b0adaf6", "name": "TODO/FIXME marker in shipping code \u2014 ui/shared/monaco/utils/addFileImportDecorations.ts:31", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 ui/shared/monaco/utils/addFileImportDecorations.ts:31"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.7}}, {"id": "scanner-b0d72727c28dc80f", "name": "TODO/FIXME marker in shipping code \u2014 ui/shared/monaco/utils/getFullPathOfImportedFile.ts:3", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 ui/shared/monaco/utils/getFullPathOfImportedFile.ts:3"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.7}}, {"id": "scanner-5b25a205a5c8973c", "name": "TODO/FIXME marker in shipping code \u2014 ui/shared/AccountActionsMenu/items/PrivateTagMenuItem.tsx:61", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 ui/shared/AccountActionsMenu/items/PrivateTagMenuItem.tsx:61"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.7}}, {"id": "scanner-4d60cc7e770b1c20", "name": "TODO/FIXME marker in shipping code \u2014 ui/shared/AccountActionsMenu/items/PublicTagMenuItem.tsx:20", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 ui/shared/AccountActionsMenu/items/PublicTagMenuItem.tsx:20"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.7}}, {"id": "scanner-566c275faf5abd9c", "name": "TODO/FIXME marker in shipping code \u2014 ui/shared/nft/NftMediaFullscreenModal.tsx:35", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 ui/shared/nft/NftMediaFullscreenModal.tsx:35"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.7}}, {"id": "scanner-664356af7e075fb1", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 ui/shared/entities/address/AddressIdenticon.tsx:56", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 ui/shared/entities/address/AddressIdenticon.tsx:56"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 0.8}}, {"id": "scanner-dffdec9341c90238", "name": "TODO/FIXME marker in shipping code \u2014 ui/shared/pagination/useQueryWithPages.ts:194", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 ui/shared/pagination/useQueryWithPages.ts:194"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.7}}, {"id": "scanner-40f52740bb090f1b", "name": "TODO/FIXME marker in shipping code \u2014 ui/home/indicators/ChainIndicators.tsx:67", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 ui/home/indicators/ChainIndicators.tsx:67"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.7}}, {"id": "scanner-3398e5fd54455608", "name": "TODO/FIXME marker in shipping code \u2014 ui/pages/Home.pw.tsx:35", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 ui/pages/Home.pw.tsx:35"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.7}}, {"id": "scanner-52963fa9e6d979f9", "name": "TODO/FIXME marker in shipping code \u2014 ui/pages/Tokens.pw.tsx:29", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 ui/pages/Tokens.pw.tsx:29"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.7}}, {"id": "scanner-f1d259cebf829669", "name": "TODO/FIXME marker in shipping code \u2014 ui/pages/TokenTransfers.pw.tsx:9", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 ui/pages/TokenTransfers.pw.tsx:9"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.7}}, {"id": "scanner-e6efeeb6b4cf5fac", "name": "TODO/FIXME marker in shipping code \u2014 ui/pages/Blocks.pw.tsx:18", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 ui/pages/Blocks.pw.tsx:18"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.7}}, {"id": "scanner-40a0969c81d5f255", "name": "TODO/FIXME marker in shipping code \u2014 ui/pages/Token.pw.tsx:24", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 ui/pages/Token.pw.tsx:24"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.7}}, {"id": "scanner-119c50d3bc309481", "name": "TODO/FIXME marker in shipping code \u2014 ui/snippets/navigation/vertical/NavigationDesktop.pw.tsx:54", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 ui/snippets/navigation/vertical/NavigationDesktop.pw.tsx:54"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.7}}, {"id": "scanner-e0c37cbaf8d5865c", "name": "TODO/FIXME marker in shipping code \u2014 ui/snippets/auth/AuthModal.tsx:187", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 ui/snippets/auth/AuthModal.tsx:187"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.7}}, {"id": "scanner-3610ca6170fc7b0b", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 ui/snippets/searchBar/SearchBarSuggest/SearchBarSuggestDomain.tsx:", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 ui/snippets/searchBar/SearchBarSuggest/SearchBarSuggestDomain.tsx:31"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 0.8}}, {"id": "scanner-a50c8a41c5543e69", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 ui/snippets/searchBar/SearchBarSuggest/SearchBarSuggestCluster.tsx", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 ui/snippets/searchBar/SearchBarSuggest/SearchBarSuggestCluster.tsx:34"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 0.8}}, {"id": "scanner-0806f5bceda570b7", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 ui/snippets/searchBar/SearchBarSuggest/SearchBarSuggestApp.tsx:46", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 ui/snippets/searchBar/SearchBarSuggest/SearchBarSuggestApp.tsx:46"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 0.8}}, {"id": "scanner-03ca2537cc9b0bf6", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 ui/snippets/searchBar/SearchBarSuggest/SearchBarSuggestAddress.tsx", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 ui/snippets/searchBar/SearchBarSuggest/SearchBarSuggestAddress.tsx:67"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 0.8}}, {"id": "scanner-bee09a060aa801e8", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 ui/snippets/searchBar/SearchBarSuggest/SearchBarSuggestBlock.tsx:4", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 ui/snippets/searchBar/SearchBarSuggest/SearchBarSuggestBlock.tsx:46"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 0.8}}, {"id": "scanner-c3f413e50b5dcb26", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 ui/snippets/searchBar/SearchBarSuggest/SearchBarSuggestToken.tsx:4", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 ui/snippets/searchBar/SearchBarSuggest/SearchBarSuggestToken.tsx:42"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 0.8}}, {"id": "scanner-631cf38ba0311c1c", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 ui/snippets/header/alerts/MaintenanceAlert.tsx:15", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 ui/snippets/header/alerts/MaintenanceAlert.tsx:15"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 0.8}}, {"id": "scanner-e5e707fb5d5f26aa", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 ui/searchResults/SearchResultTableItem.tsx:85", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 ui/searchResults/SearchResultTableItem.tsx:85"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 0.8}}, {"id": "scanner-f8227d0b835ee484", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 ui/searchResults/SearchResultListItem.tsx:79", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 ui/searchResults/SearchResultListItem.tsx:79"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 0.8}}, {"id": "scanner-fc21b4d5a3b47e95", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 ui/searchResults/SearchResultEntityTag.tsx:25", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 ui/searchResults/SearchResultEntityTag.tsx:25"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 0.8}}, {"id": "scanner-fe03435f8ab7e26e", "name": "TODO/FIXME marker in shipping code \u2014 toolkit/chakra/icon-button.tsx:13", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 toolkit/chakra/icon-button.tsx:13"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.7}}, {"id": "scanner-efa3a988eedc7ad8", "name": "TODO/FIXME marker in shipping code \u2014 toolkit/chakra/select.tsx:176", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 toolkit/chakra/select.tsx:176"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.7}}, {"id": "scanner-a6b3b8650cd37630", "name": "TODO/FIXME marker in shipping code \u2014 toolkit/chakra/tooltip.tsx:117", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 toolkit/chakra/tooltip.tsx:117"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.7}}, {"id": "scanner-9cdce2eeb40de40b", "name": "TODO/FIXME marker in shipping code \u2014 toolkit/package/src/index.ts:40", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 toolkit/package/src/index.ts:40"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.7}}, {"id": "scanner-0d782c15f08fdd8f", "name": "TODO/FIXME marker in shipping code \u2014 toolkit/components/charts/ChartFullscreenDialog.tsx:40", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 toolkit/components/charts/ChartFullscreenDialog.tsx:40"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.7}}, {"id": "scanner-95da9948de762b6d", "name": "TODO/FIXME marker in shipping code \u2014 toolkit/components/truncation/TruncatedTextTooltip.tsx:39", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 toolkit/components/truncation/TruncatedTextTooltip.tsx:39"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.7}}, {"id": "scanner-44372368e06ccdd3", "name": "TODO/FIXME marker in shipping code \u2014 toolkit/theme/globals/scrollbar.ts:22", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 toolkit/theme/globals/scrollbar.ts:22"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.7}}, {"id": "scanner-a6f1b6f7d0edbc46", "name": "TODO/FIXME marker in shipping code \u2014 lib/networks/getNetworkTitle.ts:3", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 lib/networks/getNetworkTitle.ts:3"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.7}}, {"id": "scanner-95f3f80ccd7fd9b1", "name": "TODO/FIXME marker in shipping code \u2014 lib/metadata/templates/description.ts:7", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 lib/metadata/templates/description.ts:7"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.7}}, {"id": "scanner-01ac87c3a284ce62", "name": "TODO/FIXME marker in shipping code \u2014 nextjs/utils/fetchProxy.ts:14", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 nextjs/utils/fetchProxy.ts:14"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.7}}, {"id": "scanner-af3c80604da283e4", "name": "TODO/FIXME marker in shipping code \u2014 playwright/lib.tsx:48", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 playwright/lib.tsx:48"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.7}}, {"id": "scanner-1d99ba53793c8935", "name": "Debug `console.log` remains in browser-facing code \u2014 playwright/lib.tsx:61", "shortDescription": {"text": "Debug `console.log` remains in browser-facing code \u2014 playwright/lib.tsx:61"}, "fullDescription": {"text": "Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 0.85}}, {"id": "scanner-f9576c11a4239c3f", "name": "detect child process \u2014 deploy/tools/affected-tests/index.js:98", "shortDescription": {"text": "detect child process \u2014 deploy/tools/affected-tests/index.js:98"}, "fullDescription": {"text": "Detected calls to child_process from a function argument `packageJsonFile`. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed.\n\nRule: javascript.lang.security.detect-child-process.detect-child-process\nSeverity: ERROR\nOWASP: A01:2017 - Injection, A03:2021 - Injection, A05:2025 - Injection\nCWE: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.55}}, {"id": "scanner-ddf9c384923c8a99", "name": "react dangerouslysetinnerhtml \u2014 ui/searchResults/SearchResultEntityTag.tsx:25", "shortDescription": {"text": "react dangerouslysetinnerhtml \u2014 ui/searchResults/SearchResultEntityTag.tsx:25"}, "fullDescription": {"text": "Detection of dangerouslySetInnerHTML from non-constant definition. This can inadvertently expose users to cross-site scripting (XSS) attacks if this comes from user-provided input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize your HTML.\n\nRule: typescript.react.security.audit.react-dangerouslysetinnerhtml.react-dangerouslysetinnerhtml\nSeverity: WARNING\nOWASP: A07:2017 - Cross-Site Scripting (XSS), A03:2021 - Injection, A05:2025 - Injection\nCWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-db6d9a5e9f1f8cab", "name": "react dangerouslysetinnerhtml \u2014 ui/searchResults/SearchResultListItem.tsx:79", "shortDescription": {"text": "react dangerouslysetinnerhtml \u2014 ui/searchResults/SearchResultListItem.tsx:79"}, "fullDescription": {"text": "Detection of dangerouslySetInnerHTML from non-constant definition. This can inadvertently expose users to cross-site scripting (XSS) attacks if this comes from user-provided input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize your HTML.\n\nRule: typescript.react.security.audit.react-dangerouslysetinnerhtml.react-dangerouslysetinnerhtml\nSeverity: WARNING\nOWASP: A07:2017 - Cross-Site Scripting (XSS), A03:2021 - Injection, A05:2025 - Injection\nCWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-3690cac81d4cb48d", "name": "react dangerouslysetinnerhtml \u2014 ui/searchResults/SearchResultTableItem.tsx:85", "shortDescription": {"text": "react dangerouslysetinnerhtml \u2014 ui/searchResults/SearchResultTableItem.tsx:85"}, "fullDescription": {"text": "Detection of dangerouslySetInnerHTML from non-constant definition. This can inadvertently expose users to cross-site scripting (XSS) attacks if this comes from user-provided input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize your HTML.\n\nRule: typescript.react.security.audit.react-dangerouslysetinnerhtml.react-dangerouslysetinnerhtml\nSeverity: WARNING\nOWASP: A07:2017 - Cross-Site Scripting (XSS), A03:2021 - Injection, A05:2025 - Injection\nCWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-fe511ed23de0f42b", "name": "react dangerouslysetinnerhtml \u2014 ui/shared/entities/address/AddressIdenticon.tsx:56", "shortDescription": {"text": "react dangerouslysetinnerhtml \u2014 ui/shared/entities/address/AddressIdenticon.tsx:56"}, "fullDescription": {"text": "Detection of dangerouslySetInnerHTML from non-constant definition. This can inadvertently expose users to cross-site scripting (XSS) attacks if this comes from user-provided input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize your HTML.\n\nRule: typescript.react.security.audit.react-dangerouslysetinnerhtml.react-dangerouslysetinnerhtml\nSeverity: WARNING\nOWASP: A07:2017 - Cross-Site Scripting (XSS), A03:2021 - Injection, A05:2025 - Injection\nCWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-23d47e8e17b92560", "name": "react dangerouslysetinnerhtml \u2014 ui/snippets/searchBar/SearchBarSuggest/SearchBarSuggestAddress.tsx:67", "shortDescription": {"text": "react dangerouslysetinnerhtml \u2014 ui/snippets/searchBar/SearchBarSuggest/SearchBarSuggestAddress.tsx:67"}, "fullDescription": {"text": "Detection of dangerouslySetInnerHTML from non-constant definition. This can inadvertently expose users to cross-site scripting (XSS) attacks if this comes from user-provided input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize your HTML.\n\nRule: typescript.react.security.audit.react-dangerouslysetinnerhtml.react-dangerouslysetinnerhtml\nSeverity: WARNING\nOWASP: A07:2017 - Cross-Site Scripting (XSS), A03:2021 - Injection, A05:2025 - Injection\nCWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-91f33d0635e82ffe", "name": "react dangerouslysetinnerhtml \u2014 ui/snippets/searchBar/SearchBarSuggest/SearchBarSuggestApp.tsx:46", "shortDescription": {"text": "react dangerouslysetinnerhtml \u2014 ui/snippets/searchBar/SearchBarSuggest/SearchBarSuggestApp.tsx:46"}, "fullDescription": {"text": "Detection of dangerouslySetInnerHTML from non-constant definition. This can inadvertently expose users to cross-site scripting (XSS) attacks if this comes from user-provided input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize your HTML.\n\nRule: typescript.react.security.audit.react-dangerouslysetinnerhtml.react-dangerouslysetinnerhtml\nSeverity: WARNING\nOWASP: A07:2017 - Cross-Site Scripting (XSS), A03:2021 - Injection, A05:2025 - Injection\nCWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-e37c032ae0a04475", "name": "react dangerouslysetinnerhtml \u2014 ui/snippets/searchBar/SearchBarSuggest/SearchBarSuggestBlock.tsx:46", "shortDescription": {"text": "react dangerouslysetinnerhtml \u2014 ui/snippets/searchBar/SearchBarSuggest/SearchBarSuggestBlock.tsx:46"}, "fullDescription": {"text": "Detection of dangerouslySetInnerHTML from non-constant definition. This can inadvertently expose users to cross-site scripting (XSS) attacks if this comes from user-provided input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize your HTML.\n\nRule: typescript.react.security.audit.react-dangerouslysetinnerhtml.react-dangerouslysetinnerhtml\nSeverity: WARNING\nOWASP: A07:2017 - Cross-Site Scripting (XSS), A03:2021 - Injection, A05:2025 - Injection\nCWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-59d76b35af51989a", "name": "react dangerouslysetinnerhtml \u2014 ui/snippets/searchBar/SearchBarSuggest/SearchBarSuggestCluster.tsx:34", "shortDescription": {"text": "react dangerouslysetinnerhtml \u2014 ui/snippets/searchBar/SearchBarSuggest/SearchBarSuggestCluster.tsx:34"}, "fullDescription": {"text": "Detection of dangerouslySetInnerHTML from non-constant definition. This can inadvertently expose users to cross-site scripting (XSS) attacks if this comes from user-provided input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize your HTML.\n\nRule: typescript.react.security.audit.react-dangerouslysetinnerhtml.react-dangerouslysetinnerhtml\nSeverity: WARNING\nOWASP: A07:2017 - Cross-Site Scripting (XSS), A03:2021 - Injection, A05:2025 - Injection\nCWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-fde88164416666be", "name": "react dangerouslysetinnerhtml \u2014 ui/snippets/searchBar/SearchBarSuggest/SearchBarSuggestDomain.tsx:31", "shortDescription": {"text": "react dangerouslysetinnerhtml \u2014 ui/snippets/searchBar/SearchBarSuggest/SearchBarSuggestDomain.tsx:31"}, "fullDescription": {"text": "Detection of dangerouslySetInnerHTML from non-constant definition. This can inadvertently expose users to cross-site scripting (XSS) attacks if this comes from user-provided input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize your HTML.\n\nRule: typescript.react.security.audit.react-dangerouslysetinnerhtml.react-dangerouslysetinnerhtml\nSeverity: WARNING\nOWASP: A07:2017 - Cross-Site Scripting (XSS), A03:2021 - Injection, A05:2025 - Injection\nCWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-f25c08eadee1d588", "name": "react dangerouslysetinnerhtml \u2014 ui/snippets/searchBar/SearchBarSuggest/SearchBarSuggestLabel.tsx:23", "shortDescription": {"text": "react dangerouslysetinnerhtml \u2014 ui/snippets/searchBar/SearchBarSuggest/SearchBarSuggestLabel.tsx:23"}, "fullDescription": {"text": "Detection of dangerouslySetInnerHTML from non-constant definition. This can inadvertently expose users to cross-site scripting (XSS) attacks if this comes from user-provided input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize your HTML.\n\nRule: typescript.react.security.audit.react-dangerouslysetinnerhtml.react-dangerouslysetinnerhtml\nSeverity: WARNING\nOWASP: A07:2017 - Cross-Site Scripting (XSS), A03:2021 - Injection, A05:2025 - Injection\nCWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-91377628a8ea9d15", "name": "react dangerouslysetinnerhtml \u2014 ui/snippets/searchBar/SearchBarSuggest/SearchBarSuggestToken.tsx:42", "shortDescription": {"text": "react dangerouslysetinnerhtml \u2014 ui/snippets/searchBar/SearchBarSuggest/SearchBarSuggestToken.tsx:42"}, "fullDescription": {"text": "Detection of dangerouslySetInnerHTML from non-constant definition. This can inadvertently expose users to cross-site scripting (XSS) attacks if this comes from user-provided input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize your HTML.\n\nRule: typescript.react.security.audit.react-dangerouslysetinnerhtml.react-dangerouslysetinnerhtml\nSeverity: WARNING\nOWASP: A07:2017 - Cross-Site Scripting (XSS), A03:2021 - Injection, A05:2025 - Injection\nCWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-821c8dbb9e19b386", "name": "CVE-2026-102276: brace-expansion 1.1.12 \u2014 deploy/tools/affected-tests/yarn.lock", "shortDescription": {"text": "CVE-2026-102276: brace-expansion 1.1.12 \u2014 deploy/tools/affected-tests/yarn.lock"}, "fullDescription": {"text": "brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns\n\nThe brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10, crafted brace patterns can exhaust the native stack in parseCommaParts because parseCommaParts recursively processes the remainder once per brace group and uses push.apply to pass every element of a very large comma-part array as a function argument. Patterns containing many comma-separated brace groups trigger the recursive path, while the large array trigger\n\nPackage: brace-expansion\nInstalled: 1.1.12\nFixed in: 5.0.10, 3.0.7, 2.1.5, 1.1.19\nSeverity: HIGH\nFix: Upgrade brace-expansion to 5.0.10, 3.0.7, 2.1.5, 1.1.19"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-10dbb1a70a9a332a", "name": "CVE-2026-102278: brace-expansion 1.1.12 \u2014 deploy/tools/affected-tests/yarn.lock", "shortDescription": {"text": "CVE-2026-102278: brace-expansion 1.1.12 \u2014 deploy/tools/affected-tests/yarn.lock"}, "fullDescription": {"text": "brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns\n\nThe brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.20, 2.1.6, 3.0.8, and 5.0.11, deeply nested brace groups cause expand_() to recurse once per nesting level at comma-member and single-set expansion sites, exhausting the native stack before output limits can apply and potentially terminating the Node.js process. expand_ performs uncontrolled recursion for nested brace alternatives and single-part sets. deeply nested brace groups supplied a\n\nPackage: brace-expansion\nInstalled: 1.1.12\nFixed in: 5.0.11, 3.0.8, 2.1.6, 1.1.20\nSeverity: HIGH\nFix: Upgrade brace-expansion to 5.0.11, 3.0.8, 2.1.6, 1.1.20"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-41980c86f2f197ce", "name": "CVE-2026-13149: brace-expansion 1.1.12 \u2014 deploy/tools/affected-tests/yarn.lock", "shortDescription": {"text": "CVE-2026-13149: brace-expansion 1.1.12 \u2014 deploy/tools/affected-tests/yarn.lock"}, "fullDescription": {"text": "brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity\n\nbrace-expansion through 5.0.6 is vulnerable to denial of service. The expand() function exhibits exponential-time complexity in the number of consecutive non-expanding '{}' brace groups. An attacker who passes a crafted string to expand(), directly or transitively, can cause significant CPU consumption and event-loop blocking. The max option does not mitigate this, as it bounds the output size rather than the recursion work.\n\nPackage: brace-expansion\nInstalled: 1.1.12\nFixed in: 5.0.7, 1.1.16, 2.1.2\nSeverity: HIGH\nFix: Upgrade brace-expansion to 5.0.7, 1.1.16, 2.1.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-fa4be07d068deac0", "name": "CVE-2026-14257: brace-expansion 1.1.12 \u2014 deploy/tools/affected-tests/yarn.lock", "shortDescription": {"text": "CVE-2026-14257: brace-expansion 1.1.12 \u2014 deploy/tools/affected-tests/yarn.lock"}, "fullDescription": {"text": "brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function\n\nbrace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand() function limits the number of results with a max option (default 100,000) but does not bound the length of each result string. By chaining multiple brace groups, an attacker keeps the result count under the limit while making each result progressively longer, so total memory scales with both count and string length until the process hits a fatal, uncatchable out-of-memory error. About 7.5 KB of i\n\nPackage: brace-expansion\nInstalled: 1.1.12\nFixed in: 5.0.8, 3.0.3, 2.1.3, 1.1.17\nSeverity: HIGH\nFix: Upgrade brace-expansion to 5.0.8, 3.0.3, 2.1.3, 1.1.17"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-1add15faa940abf2", "name": "CVE-2026-69152: brace-expansion 1.1.12 \u2014 deploy/tools/affected-tests/yarn.lock", "shortDescription": {"text": "CVE-2026-69152: brace-expansion 1.1.12 \u2014 deploy/tools/affected-tests/yarn.lock"}, "fullDescription": {"text": "brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation\n\nThe brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.18, 2.1.4, 3.0.6, and 5.0.9, expand() does not apply maxLength while constructing comma-alternative intermediate arrays or padded sequences, allowing attacker-controlled input to exhaust memory or block the event loop. The fix for CVE-2026-14257 is bypassed by the vulnerability. This issue is fixed in versions 1.1.18, 2.1.4, 3.0.6, and 5.0.9.\n\nPackage: brace-expansion\nInstalled: 1.1.12\nFixed in: 1.1.18, 2.1.4, 3.0.6, 5.0.9\nSeverity: HIGH\nFix: Upgrade brace-expansion to 1.1.18, 2.1.4, 3.0.6, 5.0.9"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-657d9b34553a6802", "name": "CVE-2026-102277: brace-expansion 1.1.12 \u2014 deploy/tools/affected-tests/yarn.lock", "shortDescription": {"text": "CVE-2026-102277: brace-expansion 1.1.12 \u2014 deploy/tools/affected-tests/yarn.lock"}, "fullDescription": {"text": "brace-expansion: brace-expansion: Denial of Service via crafted brace patterns\n\nThe brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.21, 2.1.7, 3.0.9, and 5.0.12, the expand function handles untrusted {a},b}-shaped patterns with many trailing closing braces by restarting its scan once for each trailing closing brace. The successive full-input rescans with linear working-string growth cause quadratic CPU time and memory pressure that can block the Node.js event loop. The process eventually recovers, making the impact a r\n\nPackage: brace-expansion\nInstalled: 1.1.12\nFixed in: 5.0.12, 3.0.9, 2.1.7, 1.1.21\nSeverity: MEDIUM\nFix: Upgrade brace-expansion to 5.0.12, 3.0.9, 2.1.7, 1.1.21"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b5039aa5f590c4f7", "name": "CVE-2026-33750: brace-expansion 1.1.12 \u2014 deploy/tools/affected-tests/yarn.lock", "shortDescription": {"text": "CVE-2026-33750: brace-expansion 1.1.12 \u2014 deploy/tools/affected-tests/yarn.lock"}, "fullDescription": {"text": "brace-expansion: brace-expansion: Denial of Service via zero step value in brace pattern\n\nThe brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to versions 5.0.5, 3.0.2, 2.0.3, and 1.1.13, a brace pattern with a zero step value (e.g., `{1..2..0}`) causes the sequence generation loop to run indefinitely, making the process hang for seconds and allocate heaps of memory. Versions 5.0.5, 3.0.2, 2.0.3, and 1.1.13 fix the issue. As a workaround, sanitize strings passed to `expand()` to ensure a step value of `0` is not used.\n\nPackage: brace-expansion\nInstalled: 1.1.12\nFixed in: 5.0.5, 3.0.2, 2.0.3, 1.1.13\nSeverity: MEDIUM\nFix: Upgrade brace-expansion to 5.0.5, 3.0.2, 2.0.3, 1.1.13"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-35c6e1597850fa15", "name": "CVE-2026-93687: braces 3.0.3 \u2014 deploy/tools/affected-tests/yarn.lock", "shortDescription": {"text": "CVE-2026-93687: braces 3.0.3 \u2014 deploy/tools/affected-tests/yarn.lock"}, "fullDescription": {"text": "braces: braces: Denial of Service via Stack Overflow from Deeply Nested Patterns\n\nbraces through 3.0.3 contains a stack overflow vulnerability in the recursive AST walkers that lack depth guards. Attackers can supply deeply nested brace patterns under the character limit to exhaust the call stack and terminate the Node.js process with an uncaught RangeError.\n\nPackage: braces\nInstalled: 3.0.3\nFixed in: \u2014\nSeverity: HIGH\nFix: No fix version published yet"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-007393e183822c16", "name": "CVE-2026-26996: minimatch 3.1.2 \u2014 deploy/tools/affected-tests/yarn.lock", "shortDescription": {"text": "CVE-2026-26996: minimatch 3.1.2 \u2014 deploy/tools/affected-tests/yarn.lock"}, "fullDescription": {"text": "minimatch: minimatch: Denial of Service via specially crafted glob patterns\n\nminimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains many consecutive * wildcards followed by a literal character that doesn't appear in the test string. Each * compiles to a separate [^/]*? regex group, and when the match fails, V8's regex engine backtracks exponentially across all possible splits. The time complexity is O(4^N) \n\nPackage: minimatch\nInstalled: 3.1.2\nFixed in: 10.2.1, 9.0.6, 8.0.5, 7.4.7, 6.2.1, 5.1.7, 4.2.4, 3.1.3\nSeverity: HIGH\nFix: Upgrade minimatch to 10.2.1, 9.0.6, 8.0.5, 7.4.7, 6.2.1, 5.1.7, 4.2.4, 3.1.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-51af49366bde2ce4", "name": "CVE-2026-27903: minimatch 3.1.2 \u2014 deploy/tools/affected-tests/yarn.lock", "shortDescription": {"text": "CVE-2026-27903: minimatch 3.1.2 \u2014 deploy/tools/affected-tests/yarn.lock"}, "fullDescription": {"text": "minimatch: minimatch: Denial of Service due to unbounded recursive backtracking via crafted glob patterns\n\nminimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3, `matchOne()` performs unbounded recursive backtracking when a glob pattern contains multiple non-adjacent `**` (GLOBSTAR) segments and the input path does not match. The time complexity is O(C(n, k)) -- binomial -- where `n` is the number of path segments and `k` is the number of globstars. With k=11 and n=30, a call\n\nPackage: minimatch\nInstalled: 3.1.2\nFixed in: 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.3\nSeverity: HIGH\nFix: Upgrade minimatch to 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-d67bb290e0651c4c", "name": "CVE-2026-27904: minimatch 3.1.2 \u2014 deploy/tools/affected-tests/yarn.lock", "shortDescription": {"text": "CVE-2026-27904: minimatch 3.1.2 \u2014 deploy/tools/affected-tests/yarn.lock"}, "fullDescription": {"text": "minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions\n\nminimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4, nested `*()` extglobs produce regexps with nested unbounded quantifiers (e.g. `(?:(?:a|b)*)*`), which exhibit catastrophic backtracking in V8. With a 12-byte pattern `*(*(*(a|b)))` and an 18-byte non-matching input, `minimatch()` stalls for over 7 seconds. Adding a single nesting level or a few input characters pushe\n\nPackage: minimatch\nInstalled: 3.1.2\nFixed in: 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.4\nSeverity: HIGH\nFix: Upgrade minimatch to 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.4"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-18610bc6be664e6f", "name": "CVE-2026-67213: nanoid 3.3.8 \u2014 deploy/tools/affected-tests/yarn.lock", "shortDescription": {"text": "CVE-2026-67213: nanoid 3.3.8 \u2014 deploy/tools/affected-tests/yarn.lock"}, "fullDescription": {"text": "nanoid: nanoid: Denial of Service via infinite loop in random ID generation\n\nnanoid (Nano ID) before 5.1.6 contains an infinite loop in the customAlphabet and customRandom functions. When these functions are configured with a size of 0, the internal generation loop never satisfies its exit condition and spins indefinitely, hanging the calling thread. An application that passes an unvalidated, attacker-controlled size of 0 to these functions is exposed to a denial-of-service condition.\n\nPackage: nanoid\nInstalled: 3.3.8\nFixed in: 3.3.18, 5.1.6\nSeverity: HIGH\nFix: Upgrade nanoid to 3.3.18, 5.1.6"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-39ed7a7be5cbfcb0", "name": "CVE-2026-67214: nanoid 3.3.8 \u2014 deploy/tools/affected-tests/yarn.lock", "shortDescription": {"text": "CVE-2026-67214: nanoid 3.3.8 \u2014 deploy/tools/affected-tests/yarn.lock"}, "fullDescription": {"text": "nanoid: nanoid: Denial of Service via negative size input in non-secure module functions\n\nnanoid (Nano ID) before 3.3.16 and 5.1.16 contains an infinite loop in the customAlphabet and nanoid functions of its non-secure module (nanoid/non-secure). When these functions are given a negative size, the loop counter is decremented from a negative value and never reaches its termination condition, spinning indefinitely and hanging the calling thread. An application that passes an unvalidated, attacker-controlled negative size to these functions is exposed to a denial-of-service condition.\n\nPackage: nanoid\nInstalled: 3.3.8\nFixed in: 3.3.16, 5.1.16\nSeverity: HIGH\nFix: Upgrade nanoid to 3.3.16, 5.1.16"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-c9b0546ab895ed17", "name": "CVE-2026-73086: nanoid 3.3.8 \u2014 deploy/tools/affected-tests/yarn.lock", "shortDescription": {"text": "CVE-2026-73086: nanoid 3.3.8 \u2014 deploy/tools/affected-tests/yarn.lock"}, "fullDescription": {"text": "nanoid: nanoid: Predictable ID generation due to integer overflow\n\nnanoid is a secure, URL-friendly, unique string ID generator for JavaScript. Prior to versions 3.3.12 and 5.1.11, the nanoid(size) function in index.js and index.cjs coerces the user-influenced size parameter to a signed 32-bit integer, allowing a value of 2147483648 to become -2147483648 and corrupt the process-wide CSPRNG poolOffset in fillPool(), which causes subsequent session tokens, CSRF tokens, API keys, and unique identifiers to become the deterministic string \"uuuuuuuuuuuuuuuuuuuuu\" unt\n\nPackage: nanoid\nInstalled: 3.3.8\nFixed in: 3.3.12, 5.1.11\nSeverity: HIGH\nFix: Upgrade nanoid to 3.3.12, 5.1.11"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-a4c79448ec054bcd", "name": "CVE-2026-33671: picomatch 2.3.1 \u2014 deploy/tools/affected-tests/yarn.lock", "shortDescription": {"text": "CVE-2026-33671: picomatch 2.3.1 \u2014 deploy/tools/affected-tests/yarn.lock"}, "fullDescription": {"text": "picomatch: Picomatch: Regular Expression Denial of Service via crafted extglob patterns\n\nPicomatch is a glob matcher written JavaScript. Versions prior to 4.0.4, 3.0.2, and 2.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) when processing crafted extglob patterns. Certain patterns using extglob quantifiers such as `+()` and `*()`, especially when combined with overlapping alternatives or nested extglobs, are compiled into regular expressions that can exhibit catastrophic backtracking on non-matching input. Applications are impacted when they allow untrusted users \n\nPackage: picomatch\nInstalled: 2.3.1\nFixed in: 4.0.4, 3.0.2, 2.3.2\nSeverity: HIGH\nFix: Upgrade picomatch to 4.0.4, 3.0.2, 2.3.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-21401a675428b432", "name": "CVE-2026-33672: picomatch 2.3.1 \u2014 deploy/tools/affected-tests/yarn.lock", "shortDescription": {"text": "CVE-2026-33672: picomatch 2.3.1 \u2014 deploy/tools/affected-tests/yarn.lock"}, "fullDescription": {"text": "picomatch: Picomatch: Data integrity compromised via method injection with crafted POSIX bracket expressions\n\nPicomatch is a glob matcher written JavaScript. Versions prior to 4.0.4, 3.0.2, and 2.3.2 are vulnerable to a method injection vulnerability affecting the `POSIX_REGEX_SOURCE` object. Because the object inherits from `Object.prototype`, specially crafted POSIX bracket expressions (e.g., `[[:constructor:]]`) can reference inherited method names. These methods are implicitly converted to strings and injected into the generated regular expression. This leads to incorrect glob matching behavior (int\n\nPackage: picomatch\nInstalled: 2.3.1\nFixed in: 4.0.4, 3.0.2, 2.3.2\nSeverity: MEDIUM\nFix: Upgrade picomatch to 4.0.4, 3.0.2, 2.3.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b0e89acb6f6173b3", "name": "CVE-2026-45623: postcss 8.4.33 \u2014 deploy/tools/affected-tests/yarn.lock", "shortDescription": {"text": "CVE-2026-45623: postcss 8.4.33 \u2014 deploy/tools/affected-tests/yarn.lock"}, "fullDescription": {"text": "postcss: PostCSS: Information disclosure and denial of service via crafted CSS input\n\nPostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.11 and prior, the PreviousMap parses the /*# sourceMappingURL=PATH */ comment from any CSS string passed to process() and dereferences PATH against the local filesystem with no scheme, allowlist, or traversal check. An attacker who controls the CSS input can cause the host process to read any file readable by Node and leak the first ~10 bytes of its\n\nPackage: postcss\nInstalled: 8.4.33\nFixed in: 8.5.12\nSeverity: HIGH\nFix: Upgrade postcss to 8.5.12"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-de6a93b1a20222bb", "name": "CVE-2026-73646: postcss 8.4.33 \u2014 deploy/tools/affected-tests/yarn.lock", "shortDescription": {"text": "CVE-2026-73646: postcss 8.4.33 \u2014 deploy/tools/affected-tests/yarn.lock"}, "fullDescription": {"text": "postcss: PostCSS: Information disclosure via path traversal in source map auto-loading\n\nPostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.18, lib/previous-map.js loadMap() passes attacker-controlled sourceMappingURL values to join(dirname(opts.from), annotation), and loadFile() permits traversed or absolute .map paths, allowing untrusted CSS processed without map: false to disclose sourcesContent from arbitrary reachable .map files through result.map. This issue is fixed in version 8.5.1\n\nPackage: postcss\nInstalled: 8.4.33\nFixed in: 8.5.18\nSeverity: HIGH\nFix: Upgrade postcss to 8.5.18"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-b93511dfbeb91a33", "name": "CVE-2026-41305: postcss 8.4.33 \u2014 deploy/tools/affected-tests/yarn.lock", "shortDescription": {"text": "CVE-2026-41305: postcss 8.4.33 \u2014 deploy/tools/affected-tests/yarn.lock"}, "fullDescription": {"text": "postcss: PostCSS: Cross-Site Scripting (XSS) via improper escaping of style closing tags\n\nPostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Versions prior to 8.5.10 do not escape `</style>` sequences when stringifying CSS ASTs. When user-submitted CSS is parsed and re-stringified for embedding in HTML `<style>` tags, `</style>` in CSS values breaks out of the style context, enabling XSS. Version 8.5.10 fixes the issue.\n\nPackage: postcss\nInstalled: 8.4.33\nFixed in: 8.5.10\nSeverity: MEDIUM\nFix: Upgrade postcss to 8.5.10"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ebdb363d4c71ce31", "name": "CVE-2026-69153: postcss 8.4.33 \u2014 deploy/tools/affected-tests/yarn.lock", "shortDescription": {"text": "CVE-2026-69153: postcss 8.4.33 \u2014 deploy/tools/affected-tests/yarn.lock"}, "fullDescription": {"text": "postcss: PostCSS: Information disclosure via crafted sourceMappingURL\n\nPostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from is unset, an attacker can cause PreviousMap.loadFile() to read an unintended source-map file by supplying an absolute or directory-traversal sourceMappingURL. The resulting map\u2019s sources and sourcesContent may then be exposed to the application. This issue is fixed in version 8.5.19.\n\nPackage: postcss\nInstalled: 8.4.33\nFixed in: 8.5.23\nSeverity: MEDIUM\nFix: Upgrade postcss to 8.5.23"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-aaa05c9edb7b3070", "name": "CVE-2026-93749: source-map-js 1.0.2 \u2014 deploy/tools/affected-tests/yarn.lock", "shortDescription": {"text": "CVE-2026-93749: source-map-js 1.0.2 \u2014 deploy/tools/affected-tests/yarn.lock"}, "fullDescription": {"text": "source-map-js: source-map-js: Denial of Service via malformed indexed source maps\n\nsource-map-js through 1.2.1 fails to validate the per-section offset line value in indexed source maps, allowing attackers to specify arbitrary numeric values. Attackers can supply extremely large offset line values that cause synchronous event loop blocking for extended periods, preventing the service from handling other requests.\n\nPackage: source-map-js\nInstalled: 1.0.2\nFixed in: 1.2.2\nSeverity: HIGH\nFix: Upgrade source-map-js to 1.2.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-5087548433dfcc7a", "name": "CVE-2026-48779: ws 8.18.3 \u2014 deploy/tools/essential-dapps-chains-config-generator/yarn.lock", "shortDescription": {"text": "CVE-2026-48779: ws 8.18.3 \u2014 deploy/tools/essential-dapps-chains-config-generator/yarn.lock"}, "fullDescription": {"text": "ws: ws: Denial of Service via memory exhaustion from small WebSocket fragments\n\nws is an open source WebSocket client and server for Node.js. All versions from 1.1.0 up to (but not including) 5.2.5, from 6.0.0 up to 6.2.4, from 7.0.0 up to 7.5.11, and from 8.0.0 up to 8.21.0 are affected by a memory exhaustion DoS vulnerability. A peer can send a high volume of exceptionally small fragments and data chunks, with modest network traffic, to force the remote peer into allocating and holding structural wrappers that consume far more memory than the default documented message-si\n\nPackage: ws\nInstalled: 8.18.3\nFixed in: 5.2.5, 6.2.4, 7.5.11, 8.21.0\nSeverity: HIGH\nFix: Upgrade ws to 5.2.5, 6.2.4, 7.5.11, 8.21.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-eb5b7ba58572c731", "name": "CVE-2026-45736: ws 8.18.3 \u2014 deploy/tools/essential-dapps-chains-config-generator/yarn.lock", "shortDescription": {"text": "CVE-2026-45736: ws 8.18.3 \u2014 deploy/tools/essential-dapps-chains-config-generator/yarn.lock"}, "fullDescription": {"text": "ws: ws: Uninitialized memory disclosure via `websocket.close()` with `TypedArray`\n\nws is an open source WebSocket client and server for Node.js. Prior to 8.20.1, the websocket.close() implementation is vulnerable to uninitialized memory disclosure when a TypedArray is passed as the reason argument. This vulnerability is fixed in 8.20.1.\n\nPackage: ws\nInstalled: 8.18.3\nFixed in: 8.20.1\nSeverity: MEDIUM\nFix: Upgrade ws to 8.20.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5bc510c763f5b2e5", "name": "CVE-2025-69873: ajv 6.12.6 \u2014 deploy/tools/favicon-generator/yarn.lock", "shortDescription": {"text": "CVE-2025-69873: ajv 6.12.6 \u2014 deploy/tools/favicon-generator/yarn.lock"}, "fullDescription": {"text": "ajv: ReDoS via $data reference\n\najv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled. The pattern keyword accepts runtime data via JSON Pointer syntax ($data reference), which is passed directly to the JavaScript RegExp() constructor without validation. An attacker can inject a malicious regex pattern (e.g., \"^(a|a)*$\") combined with crafted input to cause catastrophic backtracking. A 31-character payload causes approximately 44 seconds\n\nPackage: ajv\nInstalled: 6.12.6\nFixed in: 8.18.0, 6.14.0\nSeverity: MEDIUM\nFix: Upgrade ajv to 8.18.0, 6.14.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ece2ff4480c14ac5", "name": "CVE-2026-93687: braces 3.0.3 \u2014 deploy/tools/favicon-generator/yarn.lock", "shortDescription": {"text": "CVE-2026-93687: braces 3.0.3 \u2014 deploy/tools/favicon-generator/yarn.lock"}, "fullDescription": {"text": "braces: braces: Denial of Service via Stack Overflow from Deeply Nested Patterns\n\nbraces through 3.0.3 contains a stack overflow vulnerability in the recursive AST walkers that lack depth guards. Attackers can supply deeply nested brace patterns under the character limit to exhaust the call stack and terminate the Node.js process with an uncaught RangeError.\n\nPackage: braces\nInstalled: 3.0.3\nFixed in: \u2014\nSeverity: HIGH\nFix: No fix version published yet"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-ea60d8722ee3ac10", "name": "CVE-2026-73088: browserslist 4.24.2 \u2014 deploy/tools/favicon-generator/yarn.lock", "shortDescription": {"text": "CVE-2026-73088: browserslist 4.24.2 \u2014 deploy/tools/favicon-generator/yarn.lock"}, "fullDescription": {"text": "browserslist: Browserslist: Prototype pollution leading to denial of service\n\nBrowserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, normalizeStats() in node.js, reached unconditionally through getStat() and loadStat() on every browserslist() call, processes untrusted browserslist-stats.json, opts.stats, and CLI --stats data with an unguarded for...in loop and plain-object bracket access and assignment, allowing inherited Object.prototype keys including __proto__, toString, valueOf, constructor, hasO\n\nPackage: browserslist\nInstalled: 4.24.2\nFixed in: 4.28.7\nSeverity: HIGH\nFix: Upgrade browserslist to 4.28.7"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-867785b305a8cc68", "name": "CVE-2026-73089: browserslist 4.24.2 \u2014 deploy/tools/favicon-generator/yarn.lock", "shortDescription": {"text": "CVE-2026-73089: browserslist 4.24.2 \u2014 deploy/tools/favicon-generator/yarn.lock"}, "fullDescription": {"text": "browserslist: Browserslist: Denial of Service via unbounded memory growth from distinct query results\n\nBrowserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, index.js retains every distinct `(queries, context)` result in cache and every parseQueries() AST in parseCache without a size cap, TTL, or eviction, allowing an attacker who can influence repeated browserslist() query values, including valid since `<year>-<month>-<day>` queries, to bypass the caller-controlled BROWSERSLIST_DISABLE_CACHE mitigation and cause linear memo\n\nPackage: browserslist\nInstalled: 4.24.2\nFixed in: 4.28.7\nSeverity: HIGH\nFix: Upgrade browserslist to 4.28.7"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-fc0f72bed4c4bf2e", "name": "CVE-2026-33671: picomatch 2.3.1 \u2014 deploy/tools/favicon-generator/yarn.lock", "shortDescription": {"text": "CVE-2026-33671: picomatch 2.3.1 \u2014 deploy/tools/favicon-generator/yarn.lock"}, "fullDescription": {"text": "picomatch: Picomatch: Regular Expression Denial of Service via crafted extglob patterns\n\nPicomatch is a glob matcher written JavaScript. Versions prior to 4.0.4, 3.0.2, and 2.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) when processing crafted extglob patterns. Certain patterns using extglob quantifiers such as `+()` and `*()`, especially when combined with overlapping alternatives or nested extglobs, are compiled into regular expressions that can exhibit catastrophic backtracking on non-matching input. Applications are impacted when they allow untrusted users \n\nPackage: picomatch\nInstalled: 2.3.1\nFixed in: 4.0.4, 3.0.2, 2.3.2\nSeverity: HIGH\nFix: Upgrade picomatch to 4.0.4, 3.0.2, 2.3.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-65741ad692fb86aa", "name": "CVE-2026-33672: picomatch 2.3.1 \u2014 deploy/tools/favicon-generator/yarn.lock", "shortDescription": {"text": "CVE-2026-33672: picomatch 2.3.1 \u2014 deploy/tools/favicon-generator/yarn.lock"}, "fullDescription": {"text": "picomatch: Picomatch: Data integrity compromised via method injection with crafted POSIX bracket expressions\n\nPicomatch is a glob matcher written JavaScript. Versions prior to 4.0.4, 3.0.2, and 2.3.2 are vulnerable to a method injection vulnerability affecting the `POSIX_REGEX_SOURCE` object. Because the object inherits from `Object.prototype`, specially crafted POSIX bracket expressions (e.g., `[[:constructor:]]`) can reference inherited method names. These methods are implicitly converted to strings and injected into the generated regular expression. This leads to incorrect glob matching behavior (int\n\nPackage: picomatch\nInstalled: 2.3.1\nFixed in: 4.0.4, 3.0.2, 2.3.2\nSeverity: MEDIUM\nFix: Upgrade picomatch to 4.0.4, 3.0.2, 2.3.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c295cbaeff69dd96", "name": "GHSA-5c6j-r48x-rmvq: serialize-javascript 6.0.2 \u2014 deploy/tools/favicon-generator/yarn.lock", "shortDescription": {"text": "GHSA-5c6j-r48x-rmvq: serialize-javascript 6.0.2 \u2014 deploy/tools/favicon-generator/yarn.lock"}, "fullDescription": {"text": "Serialize JavaScript is Vulnerable to RCE via RegExp.flags and Date.prototype.toISOString()\n\n### Impact\n\nThe serialize-javascript npm package (versions <= 7.0.2) contains a code injection vulnerability. It is an incomplete fix for CVE-2020-7660.\n\nWhile `RegExp.source` is sanitized, `RegExp.flags` is interpolated directly into the generated output without escaping. A similar issue exists in `Date.prototype.toISOString()`.\n\nIf an attacker can control the input object passed to `serialize()`, they can inject malicious JavaScript via the flags property of a RegExp object. When the serialize\n\nPackage: serialize-javascript\nInstalled: 6.0.2\nFixed in: 7.0.3\nSeverity: HIGH\nFix: Upgrade serialize-javascript to 7.0.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-faec4d77f1cc2521", "name": "CVE-2026-34043: serialize-javascript 6.0.2 \u2014 deploy/tools/favicon-generator/yarn.lock", "shortDescription": {"text": "CVE-2026-34043: serialize-javascript 6.0.2 \u2014 deploy/tools/favicon-generator/yarn.lock"}, "fullDescription": {"text": "serialize-javascript: serialize-javascript: Denial of Service via specially crafted array-like object serialization\n\nSerialize JavaScript to a superset of JSON that includes regular expressions and functions. Prior to version 7.0.5, there is a Denial of Service (DoS) vulnerability caused by CPU exhaustion. When serializing a specially crafted \"array-like\" object (an object that inherits from Array.prototype but has a very large length property), the process enters an intensive loop that consumes 100% CPU and hangs indefinitely. This issue has been patched in version 7.0.5.\n\nPackage: serialize-javascript\nInstalled: 6.0.2\nFixed in: 7.0.5\nSeverity: MEDIUM\nFix: Upgrade serialize-javascript to 7.0.5"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-63fcf8716a774f1a", "name": "GHSA-f88m-g3jw-g9cj: sharp 0.33.5 \u2014 deploy/tools/favicon-generator/yarn.lock", "shortDescription": {"text": "GHSA-f88m-g3jw-g9cj: sharp 0.33.5 \u2014 deploy/tools/favicon-generator/yarn.lock"}, "fullDescription": {"text": "sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591\n\n### Impact\n\nA number of vulnerabilities, two rated as \"High\" severity using CVSSv4, have been discovered and fixed in the upstream libvips dependency.\n\nThose processing untrusted input with versions of sharp prior to 0.35.0 are affected.\n\n### Patches\n\n#### Using prebuilt binaries provided by sharp?\n\nMost people rely on the prebuilt binaries provided by sharp.\n\nPlease upgrade sharp to the latest version, currently 0.35.3, which provides libvips 8.18.3.\n\n#### Using a globally-installed libvips?\n\nP\n\nPackage: sharp\nInstalled: 0.33.5\nFixed in: 0.35.0\nSeverity: HIGH\nFix: Upgrade sharp to 0.35.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-340df363f3e057a7", "name": "GHSA-rgj7-g3m4-5g8c: sharp 0.33.5 \u2014 deploy/tools/favicon-generator/yarn.lock", "shortDescription": {"text": "GHSA-rgj7-g3m4-5g8c: sharp 0.33.5 \u2014 deploy/tools/favicon-generator/yarn.lock"}, "fullDescription": {"text": "sharp: Vulnerabilities in libheif: GHSA-g89c-p67h-r497 and GHSA-2jg2-4ch7-h545\n\n### Impact\nA number of vulnerabilities, two rated as \"Critical\" severity using CVSSv3, have been discovered and fixed in the upstream libheif dependency. These can lead to possible remote code execution (RCE) on glibc-based Linux when run under certain conditions.\n\nThe attack vector for these claims to be \"network\" however sharp does not provide any networking features so this vulnerability is down-rated to a \"High\" severity using CVSSv4 but please note its Subsequent System Impact.\n\nThose proce\n\nPackage: sharp\nInstalled: 0.33.5\nFixed in: 0.35.4\nSeverity: HIGH\nFix: Upgrade sharp to 0.35.4"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-ce67e440de15a49b", "name": "GHSA-wq5f-xc86-pv6w: sharp 0.33.5 \u2014 deploy/tools/favicon-generator/yarn.lock", "shortDescription": {"text": "GHSA-wq5f-xc86-pv6w: sharp 0.33.5 \u2014 deploy/tools/favicon-generator/yarn.lock"}, "fullDescription": {"text": "sharp : Vulnerability in librsvg dependency CVE-2026-96889\n\n### Impact\n\nA memory-related vulnerability has been discovered and fixed in the upstream librsvg dependency. When certain runtime-specific conditions apply, this vulnerability can lead to possible remote code execution (RCE) on glibc-based Linux.\n\n### Patches\n\n#### Using prebuilt binaries provided by sharp?\n\nMost people rely on the prebuilt binaries provided by sharp.\n\nPlease upgrade sharp to the latest version, currently 0.35.5, which provides librsvg 2.63.2.\n\n#### Using a globally-installed li\n\nPackage: sharp\nInstalled: 0.33.5\nFixed in: 0.35.5\nSeverity: HIGH\nFix: Upgrade sharp to 0.35.5"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-db94588c021b8d68", "name": "CVE-2025-68157: webpack 5.95.0 \u2014 deploy/tools/favicon-generator/yarn.lock", "shortDescription": {"text": "CVE-2025-68157: webpack 5.95.0 \u2014 deploy/tools/favicon-generator/yarn.lock"}, "fullDescription": {"text": "webpack: webpack buildHttp HttpUriPlugin allowedUris bypass via HTTP redirects\n\nWebpack is a module bundler. From version 5.49.0 to before 5.104.0, when experiments.buildHttp is enabled, webpack\u2019s HTTP(S) resolver (HttpUriPlugin) enforces allowedUris only for the initial URL, but does not re-validate allowedUris after following HTTP 30x redirects. As a result, an import that appears restricted to a trusted allow-list can be redirected to HTTP(S) URLs outside the allow-list. This is a policy/allow-list bypass that enables build-time SSRF behavior (requests from the build mac\n\nPackage: webpack\nInstalled: 5.95.0\nFixed in: 5.104.0\nSeverity: LOW\nFix: Upgrade webpack to 5.104.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-957f9076a6c4e3fc", "name": "CVE-2025-68458: webpack 5.95.0 \u2014 deploy/tools/favicon-generator/yarn.lock", "shortDescription": {"text": "CVE-2025-68458: webpack 5.95.0 \u2014 deploy/tools/favicon-generator/yarn.lock"}, "fullDescription": {"text": "webpack: webpack buildHttp: allowedUris allow-list bypass via URL userinfo (@) leading to build-time SSRF behavior\n\nWebpack is a module bundler. From version 5.49.0 to before 5.104.1, when experiments.buildHttp is enabled, webpack\u2019s HTTP(S) resolver (HttpUriPlugin) can be bypassed to fetch resources from hosts outside allowedUris by using crafted URLs that include userinfo (username:password@host). If allowedUris enforcement relies on a raw string prefix check (e.g., uri.startsWith(allowed)), a URL that looks allow-listed can pass validation while the actual network request is sent to a different authority/ho\n\nPackage: webpack\nInstalled: 5.95.0\nFixed in: 5.104.1\nSeverity: LOW\nFix: Upgrade webpack to 5.104.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5e88bc9d6c15053e", "name": "CVE-2025-69873: ajv 6.12.6 \u2014 deploy/tools/feature-reporter/yarn.lock", "shortDescription": {"text": "CVE-2025-69873: ajv 6.12.6 \u2014 deploy/tools/feature-reporter/yarn.lock"}, "fullDescription": {"text": "ajv: ReDoS via $data reference\n\najv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled. The pattern keyword accepts runtime data via JSON Pointer syntax ($data reference), which is passed directly to the JavaScript RegExp() constructor without validation. An attacker can inject a malicious regex pattern (e.g., \"^(a|a)*$\") combined with crafted input to cause catastrophic backtracking. A 31-character payload causes approximately 44 seconds\n\nPackage: ajv\nInstalled: 6.12.6\nFixed in: 8.18.0, 6.14.0\nSeverity: MEDIUM\nFix: Upgrade ajv to 8.18.0, 6.14.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-843c083b98aa700d", "name": "CVE-2026-93687: braces 3.0.3 \u2014 deploy/tools/feature-reporter/yarn.lock", "shortDescription": {"text": "CVE-2026-93687: braces 3.0.3 \u2014 deploy/tools/feature-reporter/yarn.lock"}, "fullDescription": {"text": "braces: braces: Denial of Service via Stack Overflow from Deeply Nested Patterns\n\nbraces through 3.0.3 contains a stack overflow vulnerability in the recursive AST walkers that lack depth guards. Attackers can supply deeply nested brace patterns under the character limit to exhaust the call stack and terminate the Node.js process with an uncaught RangeError.\n\nPackage: braces\nInstalled: 3.0.3\nFixed in: \u2014\nSeverity: HIGH\nFix: No fix version published yet"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-76da254276710a55", "name": "CVE-2026-73088: browserslist 4.24.2 \u2014 deploy/tools/feature-reporter/yarn.lock", "shortDescription": {"text": "CVE-2026-73088: browserslist 4.24.2 \u2014 deploy/tools/feature-reporter/yarn.lock"}, "fullDescription": {"text": "browserslist: Browserslist: Prototype pollution leading to denial of service\n\nBrowserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, normalizeStats() in node.js, reached unconditionally through getStat() and loadStat() on every browserslist() call, processes untrusted browserslist-stats.json, opts.stats, and CLI --stats data with an unguarded for...in loop and plain-object bracket access and assignment, allowing inherited Object.prototype keys including __proto__, toString, valueOf, constructor, hasO\n\nPackage: browserslist\nInstalled: 4.24.2\nFixed in: 4.28.7\nSeverity: HIGH\nFix: Upgrade browserslist to 4.28.7"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-ba969d2da1a5f9f0", "name": "CVE-2026-73089: browserslist 4.24.2 \u2014 deploy/tools/feature-reporter/yarn.lock", "shortDescription": {"text": "CVE-2026-73089: browserslist 4.24.2 \u2014 deploy/tools/feature-reporter/yarn.lock"}, "fullDescription": {"text": "browserslist: Browserslist: Denial of Service via unbounded memory growth from distinct query results\n\nBrowserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, index.js retains every distinct `(queries, context)` result in cache and every parseQueries() AST in parseCache without a size cap, TTL, or eviction, allowing an attacker who can influence repeated browserslist() query values, including valid since `<year>-<month>-<day>` queries, to bypass the caller-controlled BROWSERSLIST_DISABLE_CACHE mitigation and cause linear memo\n\nPackage: browserslist\nInstalled: 4.24.2\nFixed in: 4.28.7\nSeverity: HIGH\nFix: Upgrade browserslist to 4.28.7"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-9cb13b4b3575386f", "name": "CVE-2026-33671: picomatch 2.3.1 \u2014 deploy/tools/feature-reporter/yarn.lock", "shortDescription": {"text": "CVE-2026-33671: picomatch 2.3.1 \u2014 deploy/tools/feature-reporter/yarn.lock"}, "fullDescription": {"text": "picomatch: Picomatch: Regular Expression Denial of Service via crafted extglob patterns\n\nPicomatch is a glob matcher written JavaScript. Versions prior to 4.0.4, 3.0.2, and 2.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) when processing crafted extglob patterns. Certain patterns using extglob quantifiers such as `+()` and `*()`, especially when combined with overlapping alternatives or nested extglobs, are compiled into regular expressions that can exhibit catastrophic backtracking on non-matching input. Applications are impacted when they allow untrusted users \n\nPackage: picomatch\nInstalled: 2.3.1\nFixed in: 4.0.4, 3.0.2, 2.3.2\nSeverity: HIGH\nFix: Upgrade picomatch to 4.0.4, 3.0.2, 2.3.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-173f982ca2fce66d", "name": "CVE-2026-33672: picomatch 2.3.1 \u2014 deploy/tools/feature-reporter/yarn.lock", "shortDescription": {"text": "CVE-2026-33672: picomatch 2.3.1 \u2014 deploy/tools/feature-reporter/yarn.lock"}, "fullDescription": {"text": "picomatch: Picomatch: Data integrity compromised via method injection with crafted POSIX bracket expressions\n\nPicomatch is a glob matcher written JavaScript. Versions prior to 4.0.4, 3.0.2, and 2.3.2 are vulnerable to a method injection vulnerability affecting the `POSIX_REGEX_SOURCE` object. Because the object inherits from `Object.prototype`, specially crafted POSIX bracket expressions (e.g., `[[:constructor:]]`) can reference inherited method names. These methods are implicitly converted to strings and injected into the generated regular expression. This leads to incorrect glob matching behavior (int\n\nPackage: picomatch\nInstalled: 2.3.1\nFixed in: 4.0.4, 3.0.2, 2.3.2\nSeverity: MEDIUM\nFix: Upgrade picomatch to 4.0.4, 3.0.2, 2.3.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4e1a795774249a96", "name": "GHSA-5c6j-r48x-rmvq: serialize-javascript 6.0.2 \u2014 deploy/tools/feature-reporter/yarn.lock", "shortDescription": {"text": "GHSA-5c6j-r48x-rmvq: serialize-javascript 6.0.2 \u2014 deploy/tools/feature-reporter/yarn.lock"}, "fullDescription": {"text": "Serialize JavaScript is Vulnerable to RCE via RegExp.flags and Date.prototype.toISOString()\n\n### Impact\n\nThe serialize-javascript npm package (versions <= 7.0.2) contains a code injection vulnerability. It is an incomplete fix for CVE-2020-7660.\n\nWhile `RegExp.source` is sanitized, `RegExp.flags` is interpolated directly into the generated output without escaping. A similar issue exists in `Date.prototype.toISOString()`.\n\nIf an attacker can control the input object passed to `serialize()`, they can inject malicious JavaScript via the flags property of a RegExp object. When the serialize\n\nPackage: serialize-javascript\nInstalled: 6.0.2\nFixed in: 7.0.3\nSeverity: HIGH\nFix: Upgrade serialize-javascript to 7.0.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-b44ec013bd374431", "name": "CVE-2026-34043: serialize-javascript 6.0.2 \u2014 deploy/tools/feature-reporter/yarn.lock", "shortDescription": {"text": "CVE-2026-34043: serialize-javascript 6.0.2 \u2014 deploy/tools/feature-reporter/yarn.lock"}, "fullDescription": {"text": "serialize-javascript: serialize-javascript: Denial of Service via specially crafted array-like object serialization\n\nSerialize JavaScript to a superset of JSON that includes regular expressions and functions. Prior to version 7.0.5, there is a Denial of Service (DoS) vulnerability caused by CPU exhaustion. When serializing a specially crafted \"array-like\" object (an object that inherits from Array.prototype but has a very large length property), the process enters an intensive loop that consumes 100% CPU and hangs indefinitely. This issue has been patched in version 7.0.5.\n\nPackage: serialize-javascript\nInstalled: 6.0.2\nFixed in: 7.0.5\nSeverity: MEDIUM\nFix: Upgrade serialize-javascript to 7.0.5"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a73b041b7a965ca0", "name": "CVE-2025-68157: webpack 5.95.0 \u2014 deploy/tools/feature-reporter/yarn.lock", "shortDescription": {"text": "CVE-2025-68157: webpack 5.95.0 \u2014 deploy/tools/feature-reporter/yarn.lock"}, "fullDescription": {"text": "webpack: webpack buildHttp HttpUriPlugin allowedUris bypass via HTTP redirects\n\nWebpack is a module bundler. From version 5.49.0 to before 5.104.0, when experiments.buildHttp is enabled, webpack\u2019s HTTP(S) resolver (HttpUriPlugin) enforces allowedUris only for the initial URL, but does not re-validate allowedUris after following HTTP 30x redirects. As a result, an import that appears restricted to a trusted allow-list can be redirected to HTTP(S) URLs outside the allow-list. This is a policy/allow-list bypass that enables build-time SSRF behavior (requests from the build mac\n\nPackage: webpack\nInstalled: 5.95.0\nFixed in: 5.104.0\nSeverity: LOW\nFix: Upgrade webpack to 5.104.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-459d4e92ae988f6d", "name": "CVE-2025-68458: webpack 5.95.0 \u2014 deploy/tools/feature-reporter/yarn.lock", "shortDescription": {"text": "CVE-2025-68458: webpack 5.95.0 \u2014 deploy/tools/feature-reporter/yarn.lock"}, "fullDescription": {"text": "webpack: webpack buildHttp: allowedUris allow-list bypass via URL userinfo (@) leading to build-time SSRF behavior\n\nWebpack is a module bundler. From version 5.49.0 to before 5.104.1, when experiments.buildHttp is enabled, webpack\u2019s HTTP(S) resolver (HttpUriPlugin) can be bypassed to fetch resources from hosts outside allowedUris by using crafted URLs that include userinfo (username:password@host). If allowedUris enforcement relies on a raw string prefix check (e.g., uri.startsWith(allowed)), a URL that looks allow-listed can pass validation while the actual network request is sent to a different authority/ho\n\nPackage: webpack\nInstalled: 5.95.0\nFixed in: 5.104.1\nSeverity: LOW\nFix: Upgrade webpack to 5.104.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1c639cd8dbe1a369", "name": "CVE-2026-93687: braces 3.0.3 \u2014 deploy/tools/sitemap-generator/yarn.lock", "shortDescription": {"text": "CVE-2026-93687: braces 3.0.3 \u2014 deploy/tools/sitemap-generator/yarn.lock"}, "fullDescription": {"text": "braces: braces: Denial of Service via Stack Overflow from Deeply Nested Patterns\n\nbraces through 3.0.3 contains a stack overflow vulnerability in the recursive AST walkers that lack depth guards. Attackers can supply deeply nested brace patterns under the character limit to exhaust the call stack and terminate the Node.js process with an uncaught RangeError.\n\nPackage: braces\nInstalled: 3.0.3\nFixed in: \u2014\nSeverity: HIGH\nFix: No fix version published yet"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-757f3e329d7e3775", "name": "CVE-2026-33671: picomatch 2.3.1 \u2014 deploy/tools/sitemap-generator/yarn.lock", "shortDescription": {"text": "CVE-2026-33671: picomatch 2.3.1 \u2014 deploy/tools/sitemap-generator/yarn.lock"}, "fullDescription": {"text": "picomatch: Picomatch: Regular Expression Denial of Service via crafted extglob patterns\n\nPicomatch is a glob matcher written JavaScript. Versions prior to 4.0.4, 3.0.2, and 2.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) when processing crafted extglob patterns. Certain patterns using extglob quantifiers such as `+()` and `*()`, especially when combined with overlapping alternatives or nested extglobs, are compiled into regular expressions that can exhibit catastrophic backtracking on non-matching input. Applications are impacted when they allow untrusted users \n\nPackage: picomatch\nInstalled: 2.3.1\nFixed in: 4.0.4, 3.0.2, 2.3.2\nSeverity: HIGH\nFix: Upgrade picomatch to 4.0.4, 3.0.2, 2.3.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-ec6bff1adfc5674a", "name": "CVE-2026-33672: picomatch 2.3.1 \u2014 deploy/tools/sitemap-generator/yarn.lock", "shortDescription": {"text": "CVE-2026-33672: picomatch 2.3.1 \u2014 deploy/tools/sitemap-generator/yarn.lock"}, "fullDescription": {"text": "picomatch: Picomatch: Data integrity compromised via method injection with crafted POSIX bracket expressions\n\nPicomatch is a glob matcher written JavaScript. Versions prior to 4.0.4, 3.0.2, and 2.3.2 are vulnerable to a method injection vulnerability affecting the `POSIX_REGEX_SOURCE` object. Because the object inherits from `Object.prototype`, specially crafted POSIX bracket expressions (e.g., `[[:constructor:]]`) can reference inherited method names. These methods are implicitly converted to strings and injected into the generated regular expression. This leads to incorrect glob matching behavior (int\n\nPackage: picomatch\nInstalled: 2.3.1\nFixed in: 4.0.4, 3.0.2, 2.3.2\nSeverity: MEDIUM\nFix: Upgrade picomatch to 4.0.4, 3.0.2, 2.3.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c6dd3f7917705b37", "name": "CVE-2026-101916: @grpc/grpc-js 1.10.10 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-101916: @grpc/grpc-js 1.10.10 \u2014 yarn.lock"}, "fullDescription": {"text": "grpc-js: grpc-js: Authentication bypass via improper peer certificate validation\n\n@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.6 and 1.14.5, getAuthContext does not distinguish authorized from unauthorized peer certificates when server credentials set requireClientCertificate to false. When applications use the returned authentication context, they can treat an unauthorized certificate as authorized, causing improper authentication. @grpc/grpc-js-xds can reach this condition when RBAC authentication is enable\n\nPackage: @grpc/grpc-js\nInstalled: 1.10.10\nFixed in: 1.13.6, 1.14.5\nSeverity: HIGH\nFix: Upgrade @grpc/grpc-js to 1.13.6, 1.14.5"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-ecaddd7809399ecd", "name": "CVE-2026-48068: @grpc/grpc-js 1.10.10 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-48068: @grpc/grpc-js 1.10.10 \u2014 yarn.lock"}, "fullDescription": {"text": "grpc-js: @grpc/grpc-js: Server crash via malformed HTTP/2 stream initiation\n\n@grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4, an invalid incoming HTTP/2 stream initiation can cause a server process created using @grpc/grpc-js to crash. This issue is fixed in versions 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4.\n\nPackage: @grpc/grpc-js\nInstalled: 1.10.10\nFixed in: 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, 1.14.4\nSeverity: HIGH\nFix: Upgrade @grpc/grpc-js to 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, 1.14.4"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-dca5fdde90e8cf7a", "name": "CVE-2026-48069: @grpc/grpc-js 1.10.10 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-48069: @grpc/grpc-js 1.10.10 \u2014 yarn.lock"}, "fullDescription": {"text": "grpc-js: @grpc/grpc-js: Client or server crash via malformed compressed message\n\n@grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4, an invalid incoming compressed message can cause a client or server process that uses @grpc/grpc-js to crash. This issue is fixed in versions 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4.\n\nPackage: @grpc/grpc-js\nInstalled: 1.10.10\nFixed in: 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, 1.14.4\nSeverity: HIGH\nFix: Upgrade @grpc/grpc-js to 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, 1.14.4"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-745108ebde167061", "name": "CVE-2026-101915: @grpc/grpc-js 1.10.10 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-101915: @grpc/grpc-js 1.10.10 \u2014 yarn.lock"}, "fullDescription": {"text": "@grpc/grpc-js: The server transmits some error messages thrown by method handlers to the client in status messages\n\n@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.6 and 1.14.5, when an application method handler throws an uncaught error, the server includes its error message in the status message sent to the client. The thrown error message is transmitted to the client, causing sensitive information disclosure when the message contains sensitive data. This issue is fixed in versions 1.13.6 and 1.14.5.\n\nPackage: @grpc/grpc-js\nInstalled: 1.10.10\nFixed in: 1.13.6, 1.14.5\nSeverity: LOW\nFix: Upgrade @grpc/grpc-js to 1.13.6, 1.14.5"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f2faec0e449fae34", "name": "CVE-2026-45783: @libp2p/kad-dht 15.0.2 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-45783: @libp2p/kad-dht 15.0.2 \u2014 yarn.lock"}, "fullDescription": {"text": "@libp2p/kad-dht: Unvalidated PUT_VALUE records allow unbounded disk exhaustion on DHT server nodes\n\nlibp2p is a JavaScript Implementation of libp2p networking stack. Prior to version 16.2.6, an unauthenticated remote peer can exhaust the disk storage of any @libp2p/kad-dht node running in server mode by sending an unbounded stream of PUT_VALUE messages whose keys bypass all content validation. No credentials, no prior relationship, and no protocol deviation beyond a crafted key are required. The victim node's datastore fills until the host disk is exhausted, making the node unavailable. This i\n\nPackage: @libp2p/kad-dht\nInstalled: 15.0.2\nFixed in: 16.2.6\nSeverity: HIGH\nFix: Upgrade @libp2p/kad-dht to 16.2.6"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-cf3c6833351ff5e4", "name": "CVE-2026-86039: @libp2p/peer-store 11.1.4 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-86039: @libp2p/peer-store 11.1.4 \u2014 yarn.lock"}, "fullDescription": {"text": "libp2p: PeerStore accepts attacker-signed PeerRecords for a victim peer ID and stores certified attacker addresses\n\nlibp2p is a JavaScript implementation of the libp2p networking stack. From 8.0.0 until 12.0.24, @libp2p/peer-store in packages/peer-store/src/index.ts uses consumePeerRecord to verify a RecordEnvelope signature but does not require PeerRecord.peerId in the signed payload to equal the signer peer ID derived by RecordEnvelope.openAndCertify. The expectedPeer option checks only the envelope signer, and the gossipsub Peer Exchange path can provide the attacker's own peer ID as expectedPeer. An attac\n\nPackage: @libp2p/peer-store\nInstalled: 11.1.4\nFixed in: 12.0.24\nSeverity: HIGH\nFix: Upgrade @libp2p/peer-store to 12.0.24"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-6e0baea3f603b751", "name": "CVE-2026-44902: @opentelemetry/auto-instrumentations-node 0.43.0 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-44902: @opentelemetry/auto-instrumentations-node 0.43.0 \u2014 yarn.lock"}, "fullDescription": {"text": "opentelemetry-js: opentelemetry/exporter-prometheus: opentelemetry-js: Denial of Service via malformed HTTP request\n\nopentelemetry-js is the OpenTelemetry JavaScript Client. Prior to 0.217.0, a single malformed HTTP request crashes any Node.js process running the OpenTelemetry JS Prometheus exporter. The metrics endpoint (default 0.0.0.0:9464) has no error handling around URL parsing, so a request with an invalid URI causes an uncaught TypeError that terminates the process. This vulnerability is fixed in 0.217.0.\n\nPackage: @opentelemetry/auto-instrumentations-node\nInstalled: 0.43.0\nFixed in: 0.75.0\nSeverity: HIGH\nFix: Upgrade @opentelemetry/auto-instrumentations-node to 0.75.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-968b0cfad3f8800f", "name": "CVE-2026-54285: @opentelemetry/core 1.22.0 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-54285: @opentelemetry/core 1.22.0 \u2014 yarn.lock"}, "fullDescription": {"text": "@opentelemetry/core: opentelemetry-js: @opentelemetry/core: Denial of Service via oversized baggage HTTP headers\n\nopentelemetry-js is the OpenTelemetry JavaScript Client. Prior to 2.8.0, W3CBaggagePropagator.extract() in @opentelemetry/core does not enforce size limits when parsing inbound baggage HTTP headers. The W3C Baggage specification recommends a maximum of 8,192 bytes and 180 entries; these limits were only enforced on the outbound (inject()) path, not on the inbound (extract()) path. Parsing oversized baggage causes memory allocation proportional to the header size without any cap. This vulnerabili\n\nPackage: @opentelemetry/core\nInstalled: 1.22.0\nFixed in: 2.8.0\nSeverity: MEDIUM\nFix: Upgrade @opentelemetry/core to 2.8.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-26146a927985b849", "name": "CVE-2026-54285: @opentelemetry/core 1.27.0 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-54285: @opentelemetry/core 1.27.0 \u2014 yarn.lock"}, "fullDescription": {"text": "@opentelemetry/core: opentelemetry-js: @opentelemetry/core: Denial of Service via oversized baggage HTTP headers\n\nopentelemetry-js is the OpenTelemetry JavaScript Client. Prior to 2.8.0, W3CBaggagePropagator.extract() in @opentelemetry/core does not enforce size limits when parsing inbound baggage HTTP headers. The W3C Baggage specification recommends a maximum of 8,192 bytes and 180 entries; these limits were only enforced on the outbound (inject()) path, not on the inbound (extract()) path. Parsing oversized baggage causes memory allocation proportional to the header size without any cap. This vulnerabili\n\nPackage: @opentelemetry/core\nInstalled: 1.27.0\nFixed in: 2.8.0\nSeverity: MEDIUM\nFix: Upgrade @opentelemetry/core to 2.8.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-60ac3a72299cbf79", "name": "CVE-2026-54285: @opentelemetry/core 1.30.1 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-54285: @opentelemetry/core 1.30.1 \u2014 yarn.lock"}, "fullDescription": {"text": "@opentelemetry/core: opentelemetry-js: @opentelemetry/core: Denial of Service via oversized baggage HTTP headers\n\nopentelemetry-js is the OpenTelemetry JavaScript Client. Prior to 2.8.0, W3CBaggagePropagator.extract() in @opentelemetry/core does not enforce size limits when parsing inbound baggage HTTP headers. The W3C Baggage specification recommends a maximum of 8,192 bytes and 180 entries; these limits were only enforced on the outbound (inject()) path, not on the inbound (extract()) path. Parsing oversized baggage causes memory allocation proportional to the header size without any cap. This vulnerabili\n\nPackage: @opentelemetry/core\nInstalled: 1.30.1\nFixed in: 2.8.0\nSeverity: MEDIUM\nFix: Upgrade @opentelemetry/core to 2.8.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-19e465e86fd514ab", "name": "CVE-2026-104872: @opentelemetry/instrumentation-cassandra-driver 0.36.0 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-104872: @opentelemetry/instrumentation-cassandra-driver 0.36.0 \u2014 yarn.lock"}, "fullDescription": {"text": "@opentelemetry/instrumentation-cassandra-driver: @opentelemetry/instrumentation-knex: @opentelemetry/instrumentation-mongoose: @opentelemetry/instrumentation-mysql: @opentelemetry/instrumentation-mysql2: @opentelemetry/instrumentation-oracledb: @opentelemetry/instrumentation-pg: @opentelemetry/instrumentation-tedious: opentelemetry-js-contrib: Information disclosure via default database username emission in telemetry data\n\nOpenTelemetry JavaScript Contrib provides instrumentation libraries for collecting telemetry from JavaScript applications. Prior to versions 0.66.0 of @opentelemetry/instrumentation-cassandra-driver, 0.65.0 of @opentelemetry/instrumentation-knex, 0.67.0 of @opentelemetry/instrumentation-mongoose, @opentelemetry/instrumentation-mysql, and @opentelemetry/instrumentation-mysql2, 0.46.0 of @opentelemetry/instrumentation-oracledb, 0.73.0 of @opentelemetry/instrumentation-pg, and 0.40.0 of @openteleme\n\nPackage: @opentelemetry/instrumentation-cassandra-driver\nInstalled: 0.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-250b0cf13a4baae4", "name": "CVE-2026-104872: @opentelemetry/instrumentation-knex 0.34.0 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-104872: @opentelemetry/instrumentation-knex 0.34.0 \u2014 yarn.lock"}, "fullDescription": {"text": "@opentelemetry/instrumentation-cassandra-driver: @opentelemetry/instrumentation-knex: @opentelemetry/instrumentation-mongoose: @opentelemetry/instrumentation-mysql: @opentelemetry/instrumentation-mysql2: @opentelemetry/instrumentation-oracledb: @opentelemetry/instrumentation-pg: @opentelemetry/instrumentation-tedious: opentelemetry-js-contrib: Information disclosure via default database username emission in telemetry data\n\nOpenTelemetry JavaScript Contrib provides instrumentation libraries for collecting telemetry from JavaScript applications. Prior to versions 0.66.0 of @opentelemetry/instrumentation-cassandra-driver, 0.65.0 of @opentelemetry/instrumentation-knex, 0.67.0 of @opentelemetry/instrumentation-mongoose, @opentelemetry/instrumentation-mysql, and @opentelemetry/instrumentation-mysql2, 0.46.0 of @opentelemetry/instrumentation-oracledb, 0.73.0 of @opentelemetry/instrumentation-pg, and 0.40.0 of @openteleme\n\nPackage: @opentelemetry/instrumentation-knex\nInstalled: 0.34.0\nFixed in"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d37ee34f5ef96b40", "name": "CVE-2026-104872: @opentelemetry/instrumentation-mongoose 0.36.0 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-104872: @opentelemetry/instrumentation-mongoose 0.36.0 \u2014 yarn.lock"}, "fullDescription": {"text": "@opentelemetry/instrumentation-cassandra-driver: @opentelemetry/instrumentation-knex: @opentelemetry/instrumentation-mongoose: @opentelemetry/instrumentation-mysql: @opentelemetry/instrumentation-mysql2: @opentelemetry/instrumentation-oracledb: @opentelemetry/instrumentation-pg: @opentelemetry/instrumentation-tedious: opentelemetry-js-contrib: Information disclosure via default database username emission in telemetry data\n\nOpenTelemetry JavaScript Contrib provides instrumentation libraries for collecting telemetry from JavaScript applications. Prior to versions 0.66.0 of @opentelemetry/instrumentation-cassandra-driver, 0.65.0 of @opentelemetry/instrumentation-knex, 0.67.0 of @opentelemetry/instrumentation-mongoose, @opentelemetry/instrumentation-mysql, and @opentelemetry/instrumentation-mysql2, 0.46.0 of @opentelemetry/instrumentation-oracledb, 0.73.0 of @opentelemetry/instrumentation-pg, and 0.40.0 of @openteleme\n\nPackage: @opentelemetry/instrumentation-mongoose\nInstalled: 0.36.0\nFixe"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0aa7d41849318628", "name": "CVE-2026-104872: @opentelemetry/instrumentation-mysql 0.36.0 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-104872: @opentelemetry/instrumentation-mysql 0.36.0 \u2014 yarn.lock"}, "fullDescription": {"text": "@opentelemetry/instrumentation-cassandra-driver: @opentelemetry/instrumentation-knex: @opentelemetry/instrumentation-mongoose: @opentelemetry/instrumentation-mysql: @opentelemetry/instrumentation-mysql2: @opentelemetry/instrumentation-oracledb: @opentelemetry/instrumentation-pg: @opentelemetry/instrumentation-tedious: opentelemetry-js-contrib: Information disclosure via default database username emission in telemetry data\n\nOpenTelemetry JavaScript Contrib provides instrumentation libraries for collecting telemetry from JavaScript applications. Prior to versions 0.66.0 of @opentelemetry/instrumentation-cassandra-driver, 0.65.0 of @opentelemetry/instrumentation-knex, 0.67.0 of @opentelemetry/instrumentation-mongoose, @opentelemetry/instrumentation-mysql, and @opentelemetry/instrumentation-mysql2, 0.46.0 of @opentelemetry/instrumentation-oracledb, 0.73.0 of @opentelemetry/instrumentation-pg, and 0.40.0 of @openteleme\n\nPackage: @opentelemetry/instrumentation-mysql\nInstalled: 0.36.0\nFixed i"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-02aa8b683893fc9d", "name": "CVE-2026-104872: @opentelemetry/instrumentation-mysql2 0.36.0 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-104872: @opentelemetry/instrumentation-mysql2 0.36.0 \u2014 yarn.lock"}, "fullDescription": {"text": "@opentelemetry/instrumentation-cassandra-driver: @opentelemetry/instrumentation-knex: @opentelemetry/instrumentation-mongoose: @opentelemetry/instrumentation-mysql: @opentelemetry/instrumentation-mysql2: @opentelemetry/instrumentation-oracledb: @opentelemetry/instrumentation-pg: @opentelemetry/instrumentation-tedious: opentelemetry-js-contrib: Information disclosure via default database username emission in telemetry data\n\nOpenTelemetry JavaScript Contrib provides instrumentation libraries for collecting telemetry from JavaScript applications. Prior to versions 0.66.0 of @opentelemetry/instrumentation-cassandra-driver, 0.65.0 of @opentelemetry/instrumentation-knex, 0.67.0 of @opentelemetry/instrumentation-mongoose, @opentelemetry/instrumentation-mysql, and @opentelemetry/instrumentation-mysql2, 0.46.0 of @opentelemetry/instrumentation-oracledb, 0.73.0 of @opentelemetry/instrumentation-pg, and 0.40.0 of @openteleme\n\nPackage: @opentelemetry/instrumentation-mysql2\nInstalled: 0.36.0\nFixed "}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7feb420e1c189380", "name": "CVE-2026-104872: @opentelemetry/instrumentation-pg 0.39.1 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-104872: @opentelemetry/instrumentation-pg 0.39.1 \u2014 yarn.lock"}, "fullDescription": {"text": "@opentelemetry/instrumentation-cassandra-driver: @opentelemetry/instrumentation-knex: @opentelemetry/instrumentation-mongoose: @opentelemetry/instrumentation-mysql: @opentelemetry/instrumentation-mysql2: @opentelemetry/instrumentation-oracledb: @opentelemetry/instrumentation-pg: @opentelemetry/instrumentation-tedious: opentelemetry-js-contrib: Information disclosure via default database username emission in telemetry data\n\nOpenTelemetry JavaScript Contrib provides instrumentation libraries for collecting telemetry from JavaScript applications. Prior to versions 0.66.0 of @opentelemetry/instrumentation-cassandra-driver, 0.65.0 of @opentelemetry/instrumentation-knex, 0.67.0 of @opentelemetry/instrumentation-mongoose, @opentelemetry/instrumentation-mysql, and @opentelemetry/instrumentation-mysql2, 0.46.0 of @opentelemetry/instrumentation-oracledb, 0.73.0 of @opentelemetry/instrumentation-pg, and 0.40.0 of @openteleme\n\nPackage: @opentelemetry/instrumentation-pg\nInstalled: 0.39.1\nFixed in: "}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7c4c167f1db3171e", "name": "CVE-2026-104872: @opentelemetry/instrumentation-tedious 0.8.0 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-104872: @opentelemetry/instrumentation-tedious 0.8.0 \u2014 yarn.lock"}, "fullDescription": {"text": "@opentelemetry/instrumentation-cassandra-driver: @opentelemetry/instrumentation-knex: @opentelemetry/instrumentation-mongoose: @opentelemetry/instrumentation-mysql: @opentelemetry/instrumentation-mysql2: @opentelemetry/instrumentation-oracledb: @opentelemetry/instrumentation-pg: @opentelemetry/instrumentation-tedious: opentelemetry-js-contrib: Information disclosure via default database username emission in telemetry data\n\nOpenTelemetry JavaScript Contrib provides instrumentation libraries for collecting telemetry from JavaScript applications. Prior to versions 0.66.0 of @opentelemetry/instrumentation-cassandra-driver, 0.65.0 of @opentelemetry/instrumentation-knex, 0.67.0 of @opentelemetry/instrumentation-mongoose, @opentelemetry/instrumentation-mysql, and @opentelemetry/instrumentation-mysql2, 0.46.0 of @opentelemetry/instrumentation-oracledb, 0.73.0 of @opentelemetry/instrumentation-pg, and 0.40.0 of @openteleme\n\nPackage: @opentelemetry/instrumentation-tedious\nInstalled: 0.8.0\nFixed "}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-188c3d735cca0c39", "name": "CVE-2026-59892: @opentelemetry/propagator-jaeger 1.22.0 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-59892: @opentelemetry/propagator-jaeger 1.22.0 \u2014 yarn.lock"}, "fullDescription": {"text": "@opentelemetry/propagator-jaeger: OpenTelemetry JavaScript: Denial of Service via malformed HTTP header decoding\n\nOpenTelemetry JavaScript is the OpenTelemetry JavaScript client. Prior to 2.9.0, @opentelemetry/propagator-jaeger decodes incoming uber-trace-id and uberctx-* HTTP header values with decodeURIComponent() without handling decode errors, allowing an unauthenticated remote attacker to send a malformed percent-encoded value that throws an uncaught URIError and terminates a Node.js process using JaegerPropagator as the active propagator. This issue is fixed in version 2.9.0.\n\nPackage: @opentelemetry/propagator-jaeger\nInstalled: 1.22.0\nFixed in: 2.9.0\nSeverity: HIGH\nFix: Upgrade @opentelemetry/propagator-jaeger to 2.9.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-15494dae25e9c5d8", "name": "CVE-2026-44902: @opentelemetry/sdk-node 0.49.1 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-44902: @opentelemetry/sdk-node 0.49.1 \u2014 yarn.lock"}, "fullDescription": {"text": "opentelemetry-js: opentelemetry/exporter-prometheus: opentelemetry-js: Denial of Service via malformed HTTP request\n\nopentelemetry-js is the OpenTelemetry JavaScript Client. Prior to 0.217.0, a single malformed HTTP request crashes any Node.js process running the OpenTelemetry JS Prometheus exporter. The metrics endpoint (default 0.0.0.0:9464) has no error handling around URL parsing, so a request with an invalid URI causes an uncaught TypeError that terminates the process. This vulnerability is fixed in 0.217.0.\n\nPackage: @opentelemetry/sdk-node\nInstalled: 0.49.1\nFixed in: 0.217.0\nSeverity: HIGH\nFix: Upgrade @opentelemetry/sdk-node to 0.217.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-4e05959161567c88", "name": "CVE-2026-44288: @protobufjs/utf8 1.1.0 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-44288: @protobufjs/utf8 1.1.0 \u2014 yarn.lock"}, "fullDescription": {"text": "protobufjs: protobufjs: Security control bypass due to improper handling of overlong UTF-8 sequences\n\nprotobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs includes a minimal UTF-8 decoder that accepted overlong UTF-8 byte sequences and decoded them to their canonical characters instead of replacing them. An attacker who can provide protobuf binary data decoded through the affected UTF-8 path may be able to bypass application-level checks that inspect raw bytes before protobuf string decoding. For example, bytes that do not contain certain \n\nPackage: @protobufjs/utf8\nInstalled: 1.1.0\nFixed in: 1.1.1\nSeverity: MEDIUM\nFix: Upgrade @protobufjs/utf8 to 1.1.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d9e9dff61977bb76", "name": "CVE-2026-25639: axios 1.12.0 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-25639: axios 1.12.0 \u2014 yarn.lock"}, "fullDescription": {"text": "axios: Axios affected by Denial of Service via __proto__ Key in mergeConfig\n\nAxios is a promise based HTTP client for the browser and Node.js. Prior to versions 0.30.3 and 1.13.5, the mergeConfig function in axios crashes with a TypeError when processing configuration objects containing __proto__ as an own property. An attacker can trigger this by providing a malicious configuration object created via JSON.parse(), causing complete denial of service. This vulnerability is fixed in versions 0.30.3 and 1.13.5.\n\nPackage: axios\nInstalled: 1.12.0\nFixed in: 1.13.5, 0.30.3\nSeverity: HIGH\nFix: Upgrade axios to 1.13.5, 0.30.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-34a45c8fa72b388c", "name": "CVE-2026-42033: axios 1.12.0 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-42033: axios 1.12.0 \u2014 yarn.lock"}, "fullDescription": {"text": "axios: Axios: HTTP Transport Hijacking via Prototype Pollution\n\nAxios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, when Object.prototype has been polluted by any co-dependency with keys that axios reads without a hasOwnProperty guard, an attacker can (a) silently intercept and modify every JSON response before the application sees it, or (b) fully hijack the underlying HTTP transport, gaining access to request credentials, headers, and body. The precondition is prototype pollution from a separate source in the same \n\nPackage: axios\nInstalled: 1.12.0\nFixed in: 1.15.1, 0.31.1\nSeverity: HIGH\nFix: Upgrade axios to 1.15.1, 0.31.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-f500598b24d9eb3a", "name": "CVE-2026-42035: axios 1.12.0 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-42035: axios 1.12.0 \u2014 yarn.lock"}, "fullDescription": {"text": "axios: Axios: Arbitrary HTTP header injection via prototype pollution\n\nAxios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, a prototype pollution gadget exists in the Axios HTTP adapter (lib/adapters/http.js) that allows an attacker to inject arbitrary HTTP headers into outgoing requests. The vulnerability exploits duck-type checking of the data payload, where if Object.prototype is polluted with getHeaders, append, pipe, on, once, and Symbol.toStringTag, Axios misidentifies any plain object payload as a FormData instance an\n\nPackage: axios\nInstalled: 1.12.0\nFixed in: 1.15.1, 0.31.1\nSeverity: HIGH\nFix: Upgrade axios to 1.15.1, 0.31.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-8ba500ed705fda63", "name": "CVE-2026-42043: axios 1.12.0 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-42043: axios 1.12.0 \u2014 yarn.lock"}, "fullDescription": {"text": "axios: Axios: NO_PROXY bypass via crafted URL\n\nAxios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, an attacker who can influence the target URL of an Axios request can use any address in the 127.0.0.0/8 range (other than 127.0.0.1) to completely bypass the NO_PROXY protection. This vulnerability is due to an incomplete for CVE-2025-62718, This vulnerability is fixed in 1.15.1 and 0.31.1.\n\nPackage: axios\nInstalled: 1.12.0\nFixed in: 1.15.1, 0.31.1\nSeverity: HIGH\nFix: Upgrade axios to 1.15.1, 0.31.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-1675bd9a21511a5b", "name": "CVE-2026-42264: axios 1.12.0 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-42264: axios 1.12.0 \u2014 yarn.lock"}, "fullDescription": {"text": "axios: Axios: Prototype pollution allows information disclosure and request manipulation\n\nAxios is a promise based HTTP client for the browser and Node.js. From version 1.0.0 to before version 1.15.2, fFive config properties (auth, baseURL, socketPath, beforeRedirect, and insecureHTTPParser) in the HTTP adapter are read via direct property access without hasOwnProperty guards, making them exploitable as prototype pollution gadgets. When Object.prototype is polluted by another dependency in the same process, axios silently picks up these polluted values on every outbound HTTP request.\n\nPackage: axios\nInstalled: 1.12.0\nFixed in: 1.15.2\nSeverity: HIGH\nFix: Upgrade axios to 1.15.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-6b19072600714dde", "name": "CVE-2026-44486: axios 1.12.0 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-44486: axios 1.12.0 \u2014 yarn.lock"}, "fullDescription": {"text": "axios: Axios: Information disclosure of proxy credentials via HTTP redirects\n\nAxios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios\u2019 Node.js HTTP adapter can leak proxy credentials to a redirect target in affected versions. When a request is sent through an authenticated proxy, Axios may add a Proxy-Authorization header. If Axios then follows a redirect and the redirected request is no longer sent through that proxy, the stale Proxy-Authorization header can remain on the redirected request and be sent to the redirect target. T\n\nPackage: axios\nInstalled: 1.12.0\nFixed in: 1.16.0, 0.32.0\nSeverity: HIGH\nFix: Upgrade axios to 1.16.0, 0.32.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-e46305c9a6b39479", "name": "CVE-2026-44487: axios 1.12.0 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-44487: axios 1.12.0 \u2014 yarn.lock"}, "fullDescription": {"text": "axios: Axios: Information disclosure of proxy credentials via redirect flows\n\nAxios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios\u2019s Node.js HTTP adapter may forward a Proxy-Authorization header to a redirected origin during specific proxy-to-direct redirect flows. This affects Node.js usage, where an initial HTTP request is sent through an authenticated HTTP proxy, redirects are followed, and the redirected URL is no longer proxied. Under affected redirect shapes, the final origin can receive the proxy credential that was in\n\nPackage: axios\nInstalled: 1.12.0\nFixed in: 1.16.0, 0.32.0\nSeverity: HIGH\nFix: Upgrade axios to 1.16.0, 0.32.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-2d667cf8a8182772", "name": "CVE-2026-44488: axios 1.12.0 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-44488: axios 1.12.0 \u2014 yarn.lock"}, "fullDescription": {"text": "axios: Axios: Denial of Service due to unenforced request and response size limits\n\nAxios is a promise based HTTP client for the browser and Node.js. Axios versions 1.7.0 through 1.15.x did not enforce configured request and response size limits when requests were sent with the fetch adapter. Applications that selected adapter: 'fetch', or ran in environments where axios resolved to the fetch adapter, could receive or send bodies larger than maxContentLength or maxBodyLength despite those limits being explicitly configured. This can cause resource exhaustion in server-side usag\n\nPackage: axios\nInstalled: 1.12.0\nFixed in: 1.16.0\nSeverity: HIGH\nFix: Upgrade axios to 1.16.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-604d2190b7c86b3f", "name": "CVE-2026-44494: axios 1.12.0 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-44494: axios 1.12.0 \u2014 yarn.lock"}, "fullDescription": {"text": "axios: Axios: Man-in-the-Middle (MITM) attack via Prototype Pollution\n\nAxios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.16.0, the Axios library is vulnerable to a Prototype Pollution \"Gadget\" attack that allows any Object.prototype pollution in the application's dependency tree to be escalated into a full Man-in-the-Middle (MITM) attack \u2014 intercepting, reading, and modifying all HTTP traffic including authentication credentials. The HTTP adapter at lib/adapters/http.js:670 reads config.proxy via standard property access, whic\n\nPackage: axios\nInstalled: 1.12.0\nFixed in: 1.16.0\nSeverity: HIGH\nFix: Upgrade axios to 1.16.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-59a0ebc4a6d98815", "name": "CVE-2026-44495: axios 1.12.0 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-44495: axios 1.12.0 \u2014 yarn.lock"}, "fullDescription": {"text": "axios: Axios: Information disclosure due to prototype pollution vulnerability\n\nAxios is a promise based HTTP client for the browser and Node.js. From 0.19.0 to before 0.31.1 and 1.15.2, Axios contains prototype-pollution gadgets in request config processing. If another vulnerability in the same JavaScript process has already polluted Object.prototype.transformResponse, affected Axios versions may treat that inherited value as request configuration or as an option validator. Axios does not itself create the prototype pollution. Exploitability requires a separate prototype-p\n\nPackage: axios\nInstalled: 1.12.0\nFixed in: 1.15.2, 0.31.1\nSeverity: HIGH\nFix: Upgrade axios to 1.15.2, 0.31.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-52b573c15f2c0e99", "name": "CVE-2026-44496: axios 1.12.0 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-44496: axios 1.12.0 \u2014 yarn.lock"}, "fullDescription": {"text": "axios: Axios: Client-side Denial of Service via unescaped regex metacharacters in XSRF cookie name\n\nAxios is a promise based HTTP client for the browser and Node.js. Axios versions before 0.32.0 on the 0.x line and before 1.16.0 on the 1.x line build a regular expression from the configured XSRF cookie name without escaping regex metacharacters. In standard browser environments, an attacker who can influence the cookie name passed to axios can cause expensive regex backtracking while axios reads document.cookie. The practical impact is client-side availability degradation, such as freezing the\n\nPackage: axios\nInstalled: 1.12.0\nFixed in: 1.16.0, 0.32.0\nSeverity: HIGH\nFix: Upgrade axios to 1.16.0, 0.32.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-999902dd3739c4fd", "name": "CVE-2025-62718: axios 1.12.0 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2025-62718: axios 1.12.0 \u2014 yarn.lock"}, "fullDescription": {"text": "axios: Axios: Server-Side Request Forgery and proxy bypass due to improper hostname normalization\n\nAxios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.0 and 0.31.0, Axios does not correctly handle hostname normalization when checking NO_PROXY rules. Requests to loopback addresses like localhost. (with a trailing dot) or [::1] (IPv6 literal) skip NO_PROXY matching and go through the configured proxy. This goes against what developers expect and lets attackers force requests through a proxy, even if NO_PROXY is set up to protect loopback or internal services. This is\n\nPackage: axios\nInstalled: 1.12.0\nFixed in: 1.15.0, 0.31.0\nSeverity: MEDIUM\nFix: Upgrade axios to 1.15.0, 0.31.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3f32f84cc58086de", "name": "CVE-2026-101900: axios 1.12.0 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-101900: axios 1.12.0 \u2014 yarn.lock"}, "fullDescription": {"text": "axios: Axios: Outbound HTTP header injection via prototype pollution in fetch adapter\n\nAxios is a promise-based HTTP client for the browser and Node.js. From 1.12.0 until 1.20.0, ResolveConfig reads inherited Symbol.toStringTag, append, and getHeaders properties while resolving FormData headers. A separate same-process prototype-pollution flaw supplies an array or non-plain class instance whose inherited properties make it appear FormData-like; plain objects are blocked. The inherited getHeaders function can return attacker-controlled headers that resolveConfig merges into a fetch\n\nPackage: axios\nInstalled: 1.12.0\nFixed in: 1.20.0\nSeverity: MEDIUM\nFix: Upgrade axios to 1.20.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4982e1fa6657035a", "name": "CVE-2026-101902: axios 1.12.0 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-101902: axios 1.12.0 \u2014 yarn.lock"}, "fullDescription": {"text": "axios: axios: Unintended HTTP method override via prototype pollution gadget\n\nAxios is a promise-based HTTP client for the browser and Node.js. From 0.27.2 until 0.34.0 and 1.20.0, Axios default-instance requests that omit an explicit method can read an inherited method value from Object.prototype. If another vulnerability in the same process pollutes Object.prototype.method, calls such as axios.request({ url }) and axios({ url }) can send a state-changing HTTP method instead of the expected default GET. Axios does not create the prototype pollution source. This is a read\n\nPackage: axios\nInstalled: 1.12.0\nFixed in: 0.34.0, 1.20.0\nSeverity: MEDIUM\nFix: Upgrade axios to 0.34.0, 1.20.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b08d61fba605eb5b", "name": "CVE-2026-101904: axios 1.12.0 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-101904: axios 1.12.0 \u2014 yarn.lock"}, "fullDescription": {"text": "axios: Axios: HTTP header injection via inherited prototype properties\n\nAxios is a promise-based HTTP client for the browser and Node.js. From 1.0.0 until 1.20.0, the dispatchRequest function normalizes inherited Object.prototype.headers from a replacement request configuration. A separate same-process prototype-pollution flaw sets Object.prototype.headers, and trusted request interceptors return a new ordinary configuration without an own headers property. After the interceptor chain, dispatchRequest resolves the inherited headers during normalization. Downstream r\n\nPackage: axios\nInstalled: 1.12.0\nFixed in: 1.20.0\nSeverity: MEDIUM\nFix: Upgrade axios to 1.20.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-78c082783b60979e", "name": "CVE-2026-101908: axios 1.12.0 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-101908: axios 1.12.0 \u2014 yarn.lock"}, "fullDescription": {"text": "axios: Axios: Outbound HTTP request manipulation via fetch adapter prototype pollution\n\nAxios is a promise-based HTTP client for the browser and Node.js. From 1.7.0 until 1.20.0, the fetch adapter constructs a Request with sanitized resolvedOptions but then calls fetch with the original fetchOptions. A separate same-process prototype-pollution flaw populates Object.prototype.headers so fetchOptions.headers resolves through inheritance. The inherited fetchOptions.headers value overrides the sanitized Request headers through the second argument to fetch after Request construction. At\n\nPackage: axios\nInstalled: 1.12.0\nFixed in: 1.20.0\nSeverity: MEDIUM\nFix: Upgrade axios to 1.20.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a30b4a486d9e2613", "name": "CVE-2026-40175: axios 1.12.0 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-40175: axios 1.12.0 \u2014 yarn.lock"}, "fullDescription": {"text": "axios: Axios: Remote Code Execution via Prototype Pollution escalation\n\nAxios is a promise based HTTP client for the browser and Node.js. Versions prior to 1.15.0 and 0.3.1 are vulnerable to a specific gadget-style attack chain in which prototype pollution in a third-party dependency may be leveraged to inject unsanitized header values into outbound requests. This vulnerability is fixed in 1.15.0 and 0.3.1.\n\nPackage: axios\nInstalled: 1.12.0\nFixed in: 1.15.0, 0.31.0\nSeverity: MEDIUM\nFix: Upgrade axios to 1.15.0, 0.31.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b8c20dfd523d7c08", "name": "CVE-2026-42034: axios 1.12.0 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-42034: axios 1.12.0 \u2014 yarn.lock"}, "fullDescription": {"text": "axios: Axios: Denial of Service via oversized streamed uploads bypassing body limits\n\nAxios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, for stream request bodies, maxBodyLength is bypassed when maxRedirects is set to 0 (native http/https transport path). Oversized streamed uploads are sent fully even when the caller sets strict body limits. This vulnerability is fixed in 1.15.1 and 0.31.1.\n\nPackage: axios\nInstalled: 1.12.0\nFixed in: 1.15.1, 0.31.1\nSeverity: MEDIUM\nFix: Upgrade axios to 1.15.1, 0.31.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5932a8e0ce300b1d", "name": "CVE-2026-42036: axios 1.12.0 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-42036: axios 1.12.0 \u2014 yarn.lock"}, "fullDescription": {"text": "axios: Axios: Denial of Service via unbounded stream consumption when 'responseType: 'stream'' is used\n\nAxios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, when responseType: 'stream' is used, Axios returns the response stream without enforcing maxContentLength. This bypasses configured response-size limits and allows unbounded downstream consumption. This vulnerability is fixed in 1.15.1 and 0.31.1.\n\nPackage: axios\nInstalled: 1.12.0\nFixed in: 1.15.1, 0.31.1\nSeverity: MEDIUM\nFix: Upgrade axios to 1.15.1, 0.31.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-26f1956b297a7d69", "name": "CVE-2026-42037: axios 1.12.0 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-42037: axios 1.12.0 \u2014 yarn.lock"}, "fullDescription": {"text": "axios: Node.js: Axios: Information disclosure via CRLF injection in multipart Content-Type header\n\nAxios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.15.1, the FormDataPart constructor in lib/helpers/formDataToStream.js interpolates value.type directly into the Content-Type header of each multipart part without sanitizing CRLF (\\r\\n) sequences. An attacker who controls the .type property of a Blob/File-like object (e.g., via a user-uploaded file in a Node.js proxy service) can inject arbitrary MIME part headers into the multipart form-data body. This bypa\n\nPackage: axios\nInstalled: 1.12.0\nFixed in: 1.15.1\nSeverity: MEDIUM\nFix: Upgrade axios to 1.15.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2174b32d1402be83", "name": "CVE-2026-42038: axios 1.12.0 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-42038: axios 1.12.0 \u2014 yarn.lock"}, "fullDescription": {"text": "axios: Axios: Information disclosure due to `no_proxy` bypass\n\nAxios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, he fix for no_proxy hostname normalization bypass is incomplete. When no_proxy=localhost is set, requests to 127.0.0.1 and [::1] still route through the proxy instead of bypassing it. The shouldBypassProxy() function does pure string matching \u2014 it does not resolve IP aliases or loopback equivalents. This vulnerability is fixed in 1.15.1 and 0.31.1.\n\nPackage: axios\nInstalled: 1.12.0\nFixed in: 1.15.1, 0.31.1\nSeverity: MEDIUM\nFix: Upgrade axios to 1.15.1, 0.31.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-47f3a3fbb129ac71", "name": "CVE-2026-42039: axios 1.12.0 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-42039: axios 1.12.0 \u2014 yarn.lock"}, "fullDescription": {"text": "axios: Node.js: Axios: Denial of Service via unbounded recursion in toFormData with deeply nested request data\n\nAxios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, toFormData recursively walks nested objects with no depth limit, so a deeply nested value passed as request data crashes the Node.js process with a RangeError. This vulnerability is fixed in 1.15.1 and 0.31.1.\n\nPackage: axios\nInstalled: 1.12.0\nFixed in: 1.15.1, 0.31.1\nSeverity: MEDIUM\nFix: Upgrade axios to 1.15.1, 0.31.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0d2a6c6481f96f94", "name": "CVE-2026-42041: axios 1.12.0 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-42041: axios 1.12.0 \u2014 yarn.lock"}, "fullDescription": {"text": "axios: Axios: Authentication bypass due to prototype pollution of HTTP error handling\n\nAxios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, the Axios library is vulnerable to a Prototype Pollution \"Gadget\" attack that allows any Object.prototype pollution to silently suppress all HTTP error responses (401, 403, 500, etc.), causing them to be treated as successful responses. This completely bypasses application-level authentication and error handling. The root cause is that validateStatus is the only config property using the mergeDirectKeys\n\nPackage: axios\nInstalled: 1.12.0\nFixed in: 1.15.1, 0.31.1\nSeverity: MEDIUM\nFix: Upgrade axios to 1.15.1, 0.31.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-eb4381c341ea9649", "name": "CVE-2026-42042: axios 1.12.0 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-42042: axios 1.12.0 \u2014 yarn.lock"}, "fullDescription": {"text": "axios: Axios: XSRF token bypass leading to information disclosure\n\nAxios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, the Axios library's XSRF token protection logic uses JavaScript truthy/falsy semantics instead of strict boolean comparison for the withXSRFToken config property. When this property is set to any truthy non-boolean value (via prototype pollution or misconfiguration), the same-origin check (isURLSameOrigin) is short-circuited, causing XSRF tokens to be sent to all request targets including cross-origin s\n\nPackage: axios\nInstalled: 1.12.0\nFixed in: 1.15.1, 0.31.1\nSeverity: MEDIUM\nFix: Upgrade axios to 1.15.1, 0.31.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4814b215f0361cd8", "name": "CVE-2026-42044: axios 1.12.0 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-42044: axios 1.12.0 \u2014 yarn.lock"}, "fullDescription": {"text": "axios: Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget\n\nAxios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.15.2, he Axios library is vulnerable to a Prototype Pollution \"Gadget\" attack that allows any Object.prototype pollution in the application's dependency tree to be escalated into surgical, invisible modification of all JSON API responses \u2014 including privilege escalation, balance manipulation, and authorization bypass. The default transformResponse function at lib/defaults/index.js:124 calls JSON.parse(data, \n\nPackage: axios\nInstalled: 1.12.0\nFixed in: 1.15.2\nSeverity: MEDIUM\nFix: Upgrade axios to 1.15.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b84c5e07a4a3c752", "name": "CVE-2026-44490: axios 1.12.0 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-44490: axios 1.12.0 \u2014 yarn.lock"}, "fullDescription": {"text": "axios: Axios: Information disclosure and denial of service due to prototype pollution\n\nAxios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, axios exposes two read-side prototype-pollution gadgets. When Object.prototype is polluted by an upstream dependency in the same process (e.g. lodash _.merge / CVE-2018-16487), axios silently picks up the polluted values. (1) lib/utils.js line 406 builds merge()'s accumulator as result = {}, so result[targetKey] (line 414) walks Object.prototype and the polluted bucket's own keys are copied into the mer\n\nPackage: axios\nInstalled: 1.12.0\nFixed in: 1.16.0, 0.32.0\nSeverity: MEDIUM\nFix: Upgrade axios to 1.16.0, 0.32.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-fee523e58d95b956", "name": "CVE-2026-67312: axios 1.12.0 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-67312: axios 1.12.0 \u2014 yarn.lock"}, "fullDescription": {"text": "axios: axios: Denial of Service via uncontrolled recursion in form data processing\n\naxios versions from 0.28.0 before 0.33.0 and from 1.0.0 before 1.18.0 contain uncontrolled recursion in formDataToJSON (exposed as axios.formToJSON() and used internally when serializing FormData with Content-Type: application/json). When an application passes attacker-controlled FormData field names, a field name with thousands of nested bracket-delimited segments causes unbounded recursion in buildPath(), exhausting the JavaScript call stack (RangeError: Maximum call stack size exceeded) and c\n\nPackage: axios\nInstalled: 1.12.0\nFixed in: 0.33.0, 1.18.0\nSeverity: MEDIUM\nFix: Upgrade axios to 0.33.0, 1.18.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-73d12a51b54a5204", "name": "CVE-2026-67313: axios 1.12.0 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-67313: axios 1.12.0 \u2014 yarn.lock"}, "fullDescription": {"text": "axios versions 0.28.0 and later contain uncontrolled recursion in form ...\n\naxios versions 0.28.0 and later contain uncontrolled recursion in formDataToJSON when processing FormData field names with deeply nested bracket segments. Attackers can supply FormData with field names containing thousands of nested brackets to exhaust the JavaScript call stack and trigger RangeError, causing request failure or process termination in applications that do not handle the exception.\n\nPackage: axios\nInstalled: 1.12.0\nFixed in: 0.33.0, 1.18.0\nSeverity: MEDIUM\nFix: Upgrade axios to 0.33.0, 1.18.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1f6f28516376ccde", "name": "CVE-2026-67316: axios 1.12.0 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-67316: axios 1.12.0 \u2014 yarn.lock"}, "fullDescription": {"text": "axios: axios: Prototype Pollution allows unauthorized data transmission and network redirection\n\naxios is vulnerable to read-side prototype-pollution gadgets that can alter request construction when Object.prototype has already been polluted by a separate vulnerability or dependency. In the bodyless method aliases (axios.get(), axios.delete(), axios.head(), axios.options()), inherited data is read via (config || {}).data before config normalization, causing an attacker-controlled body to be sent on requests that did not set one. Additional low-level paths, only reachable when calling export\n\nPackage: axios\nInstalled: 1.12.0\nFixed in: 1.18.0, 0.33.0\nSeverity: MEDIUM\nFix: Upgrade axios to 1.18.0, 0.33.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5cd68c12d3e1f34c", "name": "CVE-2026-67317: axios 1.12.0 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-67317: axios 1.12.0 \u2014 yarn.lock"}, "fullDescription": {"text": "axios: axios: Denial of Service via maxBodyLength bypass with ReadableStream\n\naxios versions 1.7.0 before 1.18.0 fail to enforce maxBodyLength for WHATWG ReadableStream request bodies in the fetch adapter when Content-Length cannot be determined. Attackers can supply unknown-length stream data to bypass upload size limits and cause uncontrolled network egress or resource exhaustion.\n\nPackage: axios\nInstalled: 1.12.0\nFixed in: 1.18.0\nSeverity: MEDIUM\nFix: Upgrade axios to 1.18.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-135a92699243b66c", "name": "CVE-2026-67319: axios 1.12.0 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-67319: axios 1.12.0 \u2014 yarn.lock"}, "fullDescription": {"text": "axios: axios: Information disclosure and data manipulation via prototype pollution\n\naxios before 0.33.0 (and 1.x before 1.18.0) can consume inherited properties from nested request option objects when the JavaScript process's Object.prototype has already been polluted by another component. While the top-level merged config uses a null prototype, nested plain objects such as auth and paramsSerializer are cloned into ordinary objects and read without own-property checks. When an application passes placeholder nested objects such as auth: {} or paramsSerializer: {}, inherited user\n\nPackage: axios\nInstalled: 1.12.0\nFixed in: 0.33.0, 1.18.0\nSeverity: MEDIUM\nFix: Upgrade axios to 0.33.0, 1.18.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-25db8590f42c042f", "name": "CVE-2026-42040: axios 1.12.0 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-42040: axios 1.12.0 \u2014 yarn.lock"}, "fullDescription": {"text": "axios: Axios: Incorrect null byte handling can lead to data integrity issues\n\nAxios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, the encode() function in lib/helpers/AxiosURLSearchParams.js contains a character mapping (charMap) at line 21 that reverses the safe percent-encoding of null bytes. After encodeURIComponent('\\x00') correctly produces the safe sequence %00, the charMap entry '%00': '\\x00' converts it back to a raw null byte. Primary impact is limited because the standard axios request flow is not affected. This vulnerab\n\nPackage: axios\nInstalled: 1.12.0\nFixed in: 1.15.1, 0.31.1\nSeverity: LOW\nFix: Upgrade axios to 1.15.1, 0.31.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8834bd8e6e8e4488", "name": "CVE-2026-101898: axios 1.13.2 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-101898: axios 1.13.2 \u2014 yarn.lock"}, "fullDescription": {"text": "axios: axios: Security control bypass via unapplied HTTP/2 proxy and DNS settings\n\nAxios is a promise-based HTTP client for the browser and Node.js. From 1.13.0 until 1.20.0, Axios HTTP/2 request setup does not consistently apply proxy settings and caller-supplied DNS lookup policy. An HTTPS request uses httpVersion: 2 with explicit config.proxy or environment-derived proxy settings, or relies on caller-supplied config.lookup DNS policy. The HTTP/2 path can connect without the configured proxy behavior or without applying the caller-supplied config.lookup policy before http2.c\n\nPackage: axios\nInstalled: 1.13.2\nFixed in: 1.20.0\nSeverity: HIGH\nFix: Upgrade axios to 1.20.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-0e0a381dde9bc729", "name": "CVE-2026-101901: axios 1.13.2 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-101901: axios 1.13.2 \u2014 yarn.lock"}, "fullDescription": {"text": "axios: Axios: Denial of Service via unhandled error in HTTP/2 session initialization\n\nAxios is a promise-based HTTP client for the browser and Node.js. From 1.13.0 until 1.20.0, Http2Sessions does not install adequate error handling for a ClientHttp2Session during Axios HTTP/2 session initialization or reuse. A request uses httpVersion: 2 and the ClientHttp2Session emits an error during session initialization or reuse. The unhandled session error escapes normal Promise rejection handling. The uncaught error can terminate the Node.js process and cause denial of service. This issue\n\nPackage: axios\nInstalled: 1.13.2\nFixed in: 1.20.0\nSeverity: HIGH\nFix: Upgrade axios to 1.20.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-fb8c362a73e41518", "name": "CVE-2026-25639: axios 1.13.2 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-25639: axios 1.13.2 \u2014 yarn.lock"}, "fullDescription": {"text": "axios: Axios affected by Denial of Service via __proto__ Key in mergeConfig\n\nAxios is a promise based HTTP client for the browser and Node.js. Prior to versions 0.30.3 and 1.13.5, the mergeConfig function in axios crashes with a TypeError when processing configuration objects containing __proto__ as an own property. An attacker can trigger this by providing a malicious configuration object created via JSON.parse(), causing complete denial of service. This vulnerability is fixed in versions 0.30.3 and 1.13.5.\n\nPackage: axios\nInstalled: 1.13.2\nFixed in: 1.13.5, 0.30.3\nSeverity: HIGH\nFix: Upgrade axios to 1.13.5, 0.30.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-33618229c5b1e872", "name": "CVE-2026-42033: axios 1.13.2 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-42033: axios 1.13.2 \u2014 yarn.lock"}, "fullDescription": {"text": "axios: Axios: HTTP Transport Hijacking via Prototype Pollution\n\nAxios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, when Object.prototype has been polluted by any co-dependency with keys that axios reads without a hasOwnProperty guard, an attacker can (a) silently intercept and modify every JSON response before the application sees it, or (b) fully hijack the underlying HTTP transport, gaining access to request credentials, headers, and body. The precondition is prototype pollution from a separate source in the same \n\nPackage: axios\nInstalled: 1.13.2\nFixed in: 1.15.1, 0.31.1\nSeverity: HIGH\nFix: Upgrade axios to 1.15.1, 0.31.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-2e2ef9781b997b91", "name": "CVE-2026-42035: axios 1.13.2 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-42035: axios 1.13.2 \u2014 yarn.lock"}, "fullDescription": {"text": "axios: Axios: Arbitrary HTTP header injection via prototype pollution\n\nAxios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, a prototype pollution gadget exists in the Axios HTTP adapter (lib/adapters/http.js) that allows an attacker to inject arbitrary HTTP headers into outgoing requests. The vulnerability exploits duck-type checking of the data payload, where if Object.prototype is polluted with getHeaders, append, pipe, on, once, and Symbol.toStringTag, Axios misidentifies any plain object payload as a FormData instance an\n\nPackage: axios\nInstalled: 1.13.2\nFixed in: 1.15.1, 0.31.1\nSeverity: HIGH\nFix: Upgrade axios to 1.15.1, 0.31.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-355126c19d8a5649", "name": "CVE-2026-42043: axios 1.13.2 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-42043: axios 1.13.2 \u2014 yarn.lock"}, "fullDescription": {"text": "axios: Axios: NO_PROXY bypass via crafted URL\n\nAxios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, an attacker who can influence the target URL of an Axios request can use any address in the 127.0.0.0/8 range (other than 127.0.0.1) to completely bypass the NO_PROXY protection. This vulnerability is due to an incomplete for CVE-2025-62718, This vulnerability is fixed in 1.15.1 and 0.31.1.\n\nPackage: axios\nInstalled: 1.13.2\nFixed in: 1.15.1, 0.31.1\nSeverity: HIGH\nFix: Upgrade axios to 1.15.1, 0.31.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-59c547e6ab0f5577", "name": "CVE-2026-42264: axios 1.13.2 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-42264: axios 1.13.2 \u2014 yarn.lock"}, "fullDescription": {"text": "axios: Axios: Prototype pollution allows information disclosure and request manipulation\n\nAxios is a promise based HTTP client for the browser and Node.js. From version 1.0.0 to before version 1.15.2, fFive config properties (auth, baseURL, socketPath, beforeRedirect, and insecureHTTPParser) in the HTTP adapter are read via direct property access without hasOwnProperty guards, making them exploitable as prototype pollution gadgets. When Object.prototype is polluted by another dependency in the same process, axios silently picks up these polluted values on every outbound HTTP request.\n\nPackage: axios\nInstalled: 1.13.2\nFixed in: 1.15.2\nSeverity: HIGH\nFix: Upgrade axios to 1.15.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-a43dc645db872a35", "name": "CVE-2026-44486: axios 1.13.2 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-44486: axios 1.13.2 \u2014 yarn.lock"}, "fullDescription": {"text": "axios: Axios: Information disclosure of proxy credentials via HTTP redirects\n\nAxios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios\u2019 Node.js HTTP adapter can leak proxy credentials to a redirect target in affected versions. When a request is sent through an authenticated proxy, Axios may add a Proxy-Authorization header. If Axios then follows a redirect and the redirected request is no longer sent through that proxy, the stale Proxy-Authorization header can remain on the redirected request and be sent to the redirect target. T\n\nPackage: axios\nInstalled: 1.13.2\nFixed in: 1.16.0, 0.32.0\nSeverity: HIGH\nFix: Upgrade axios to 1.16.0, 0.32.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-efeecdcf9f34a090", "name": "CVE-2026-44487: axios 1.13.2 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-44487: axios 1.13.2 \u2014 yarn.lock"}, "fullDescription": {"text": "axios: Axios: Information disclosure of proxy credentials via redirect flows\n\nAxios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios\u2019s Node.js HTTP adapter may forward a Proxy-Authorization header to a redirected origin during specific proxy-to-direct redirect flows. This affects Node.js usage, where an initial HTTP request is sent through an authenticated HTTP proxy, redirects are followed, and the redirected URL is no longer proxied. Under affected redirect shapes, the final origin can receive the proxy credential that was in\n\nPackage: axios\nInstalled: 1.13.2\nFixed in: 1.16.0, 0.32.0\nSeverity: HIGH\nFix: Upgrade axios to 1.16.0, 0.32.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-3c1e15814798a26c", "name": "CVE-2026-44488: axios 1.13.2 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-44488: axios 1.13.2 \u2014 yarn.lock"}, "fullDescription": {"text": "axios: Axios: Denial of Service due to unenforced request and response size limits\n\nAxios is a promise based HTTP client for the browser and Node.js. Axios versions 1.7.0 through 1.15.x did not enforce configured request and response size limits when requests were sent with the fetch adapter. Applications that selected adapter: 'fetch', or ran in environments where axios resolved to the fetch adapter, could receive or send bodies larger than maxContentLength or maxBodyLength despite those limits being explicitly configured. This can cause resource exhaustion in server-side usag\n\nPackage: axios\nInstalled: 1.13.2\nFixed in: 1.16.0\nSeverity: HIGH\nFix: Upgrade axios to 1.16.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-08bd8187a1966d03", "name": "CVE-2026-44494: axios 1.13.2 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-44494: axios 1.13.2 \u2014 yarn.lock"}, "fullDescription": {"text": "axios: Axios: Man-in-the-Middle (MITM) attack via Prototype Pollution\n\nAxios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.16.0, the Axios library is vulnerable to a Prototype Pollution \"Gadget\" attack that allows any Object.prototype pollution in the application's dependency tree to be escalated into a full Man-in-the-Middle (MITM) attack \u2014 intercepting, reading, and modifying all HTTP traffic including authentication credentials. The HTTP adapter at lib/adapters/http.js:670 reads config.proxy via standard property access, whic\n\nPackage: axios\nInstalled: 1.13.2\nFixed in: 1.16.0\nSeverity: HIGH\nFix: Upgrade axios to 1.16.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-f67f5327bdd51495", "name": "CVE-2026-44495: axios 1.13.2 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-44495: axios 1.13.2 \u2014 yarn.lock"}, "fullDescription": {"text": "axios: Axios: Information disclosure due to prototype pollution vulnerability\n\nAxios is a promise based HTTP client for the browser and Node.js. From 0.19.0 to before 0.31.1 and 1.15.2, Axios contains prototype-pollution gadgets in request config processing. If another vulnerability in the same JavaScript process has already polluted Object.prototype.transformResponse, affected Axios versions may treat that inherited value as request configuration or as an option validator. Axios does not itself create the prototype pollution. Exploitability requires a separate prototype-p\n\nPackage: axios\nInstalled: 1.13.2\nFixed in: 1.15.2, 0.31.1\nSeverity: HIGH\nFix: Upgrade axios to 1.15.2, 0.31.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-94f2cb6ab60a120b", "name": "CVE-2026-44496: axios 1.13.2 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-44496: axios 1.13.2 \u2014 yarn.lock"}, "fullDescription": {"text": "axios: Axios: Client-side Denial of Service via unescaped regex metacharacters in XSRF cookie name\n\nAxios is a promise based HTTP client for the browser and Node.js. Axios versions before 0.32.0 on the 0.x line and before 1.16.0 on the 1.x line build a regular expression from the configured XSRF cookie name without escaping regex metacharacters. In standard browser environments, an attacker who can influence the cookie name passed to axios can cause expensive regex backtracking while axios reads document.cookie. The practical impact is client-side availability degradation, such as freezing the\n\nPackage: axios\nInstalled: 1.13.2\nFixed in: 1.16.0, 0.32.0\nSeverity: HIGH\nFix: Upgrade axios to 1.16.0, 0.32.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-0d1b86c921db3c9a", "name": "CVE-2025-62718: axios 1.13.2 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2025-62718: axios 1.13.2 \u2014 yarn.lock"}, "fullDescription": {"text": "axios: Axios: Server-Side Request Forgery and proxy bypass due to improper hostname normalization\n\nAxios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.0 and 0.31.0, Axios does not correctly handle hostname normalization when checking NO_PROXY rules. Requests to loopback addresses like localhost. (with a trailing dot) or [::1] (IPv6 literal) skip NO_PROXY matching and go through the configured proxy. This goes against what developers expect and lets attackers force requests through a proxy, even if NO_PROXY is set up to protect loopback or internal services. This is\n\nPackage: axios\nInstalled: 1.13.2\nFixed in: 1.15.0, 0.31.0\nSeverity: MEDIUM\nFix: Upgrade axios to 1.15.0, 0.31.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5816f71462f73825", "name": "CVE-2026-101900: axios 1.13.2 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-101900: axios 1.13.2 \u2014 yarn.lock"}, "fullDescription": {"text": "axios: Axios: Outbound HTTP header injection via prototype pollution in fetch adapter\n\nAxios is a promise-based HTTP client for the browser and Node.js. From 1.12.0 until 1.20.0, ResolveConfig reads inherited Symbol.toStringTag, append, and getHeaders properties while resolving FormData headers. A separate same-process prototype-pollution flaw supplies an array or non-plain class instance whose inherited properties make it appear FormData-like; plain objects are blocked. The inherited getHeaders function can return attacker-controlled headers that resolveConfig merges into a fetch\n\nPackage: axios\nInstalled: 1.13.2\nFixed in: 1.20.0\nSeverity: MEDIUM\nFix: Upgrade axios to 1.20.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-84728de2016264ab", "name": "CVE-2026-101902: axios 1.13.2 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-101902: axios 1.13.2 \u2014 yarn.lock"}, "fullDescription": {"text": "axios: axios: Unintended HTTP method override via prototype pollution gadget\n\nAxios is a promise-based HTTP client for the browser and Node.js. From 0.27.2 until 0.34.0 and 1.20.0, Axios default-instance requests that omit an explicit method can read an inherited method value from Object.prototype. If another vulnerability in the same process pollutes Object.prototype.method, calls such as axios.request({ url }) and axios({ url }) can send a state-changing HTTP method instead of the expected default GET. Axios does not create the prototype pollution source. This is a read\n\nPackage: axios\nInstalled: 1.13.2\nFixed in: 0.34.0, 1.20.0\nSeverity: MEDIUM\nFix: Upgrade axios to 0.34.0, 1.20.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d021ddef8d6c3198", "name": "CVE-2026-101904: axios 1.13.2 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-101904: axios 1.13.2 \u2014 yarn.lock"}, "fullDescription": {"text": "axios: Axios: HTTP header injection via inherited prototype properties\n\nAxios is a promise-based HTTP client for the browser and Node.js. From 1.0.0 until 1.20.0, the dispatchRequest function normalizes inherited Object.prototype.headers from a replacement request configuration. A separate same-process prototype-pollution flaw sets Object.prototype.headers, and trusted request interceptors return a new ordinary configuration without an own headers property. After the interceptor chain, dispatchRequest resolves the inherited headers during normalization. Downstream r\n\nPackage: axios\nInstalled: 1.13.2\nFixed in: 1.20.0\nSeverity: MEDIUM\nFix: Upgrade axios to 1.20.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-706d03cb7dcec5c8", "name": "CVE-2026-101908: axios 1.13.2 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-101908: axios 1.13.2 \u2014 yarn.lock"}, "fullDescription": {"text": "axios: Axios: Outbound HTTP request manipulation via fetch adapter prototype pollution\n\nAxios is a promise-based HTTP client for the browser and Node.js. From 1.7.0 until 1.20.0, the fetch adapter constructs a Request with sanitized resolvedOptions but then calls fetch with the original fetchOptions. A separate same-process prototype-pollution flaw populates Object.prototype.headers so fetchOptions.headers resolves through inheritance. The inherited fetchOptions.headers value overrides the sanitized Request headers through the second argument to fetch after Request construction. At\n\nPackage: axios\nInstalled: 1.13.2\nFixed in: 1.20.0\nSeverity: MEDIUM\nFix: Upgrade axios to 1.20.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e308abbcca579d7f", "name": "CVE-2026-40175: axios 1.13.2 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-40175: axios 1.13.2 \u2014 yarn.lock"}, "fullDescription": {"text": "axios: Axios: Remote Code Execution via Prototype Pollution escalation\n\nAxios is a promise based HTTP client for the browser and Node.js. Versions prior to 1.15.0 and 0.3.1 are vulnerable to a specific gadget-style attack chain in which prototype pollution in a third-party dependency may be leveraged to inject unsanitized header values into outbound requests. This vulnerability is fixed in 1.15.0 and 0.3.1.\n\nPackage: axios\nInstalled: 1.13.2\nFixed in: 1.15.0, 0.31.0\nSeverity: MEDIUM\nFix: Upgrade axios to 1.15.0, 0.31.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5ad0a6e98841e072", "name": "CVE-2026-42034: axios 1.13.2 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-42034: axios 1.13.2 \u2014 yarn.lock"}, "fullDescription": {"text": "axios: Axios: Denial of Service via oversized streamed uploads bypassing body limits\n\nAxios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, for stream request bodies, maxBodyLength is bypassed when maxRedirects is set to 0 (native http/https transport path). Oversized streamed uploads are sent fully even when the caller sets strict body limits. This vulnerability is fixed in 1.15.1 and 0.31.1.\n\nPackage: axios\nInstalled: 1.13.2\nFixed in: 1.15.1, 0.31.1\nSeverity: MEDIUM\nFix: Upgrade axios to 1.15.1, 0.31.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c490692d658f9737", "name": "CVE-2026-42036: axios 1.13.2 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-42036: axios 1.13.2 \u2014 yarn.lock"}, "fullDescription": {"text": "axios: Axios: Denial of Service via unbounded stream consumption when 'responseType: 'stream'' is used\n\nAxios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, when responseType: 'stream' is used, Axios returns the response stream without enforcing maxContentLength. This bypasses configured response-size limits and allows unbounded downstream consumption. This vulnerability is fixed in 1.15.1 and 0.31.1.\n\nPackage: axios\nInstalled: 1.13.2\nFixed in: 1.15.1, 0.31.1\nSeverity: MEDIUM\nFix: Upgrade axios to 1.15.1, 0.31.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0983496c37cbad35", "name": "CVE-2026-42037: axios 1.13.2 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-42037: axios 1.13.2 \u2014 yarn.lock"}, "fullDescription": {"text": "axios: Node.js: Axios: Information disclosure via CRLF injection in multipart Content-Type header\n\nAxios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.15.1, the FormDataPart constructor in lib/helpers/formDataToStream.js interpolates value.type directly into the Content-Type header of each multipart part without sanitizing CRLF (\\r\\n) sequences. An attacker who controls the .type property of a Blob/File-like object (e.g., via a user-uploaded file in a Node.js proxy service) can inject arbitrary MIME part headers into the multipart form-data body. This bypa\n\nPackage: axios\nInstalled: 1.13.2\nFixed in: 1.15.1\nSeverity: MEDIUM\nFix: Upgrade axios to 1.15.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-71d980cf248364e3", "name": "CVE-2026-42038: axios 1.13.2 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-42038: axios 1.13.2 \u2014 yarn.lock"}, "fullDescription": {"text": "axios: Axios: Information disclosure due to `no_proxy` bypass\n\nAxios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, he fix for no_proxy hostname normalization bypass is incomplete. When no_proxy=localhost is set, requests to 127.0.0.1 and [::1] still route through the proxy instead of bypassing it. The shouldBypassProxy() function does pure string matching \u2014 it does not resolve IP aliases or loopback equivalents. This vulnerability is fixed in 1.15.1 and 0.31.1.\n\nPackage: axios\nInstalled: 1.13.2\nFixed in: 1.15.1, 0.31.1\nSeverity: MEDIUM\nFix: Upgrade axios to 1.15.1, 0.31.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c7a2497b9ca0c3e3", "name": "CVE-2026-42039: axios 1.13.2 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-42039: axios 1.13.2 \u2014 yarn.lock"}, "fullDescription": {"text": "axios: Node.js: Axios: Denial of Service via unbounded recursion in toFormData with deeply nested request data\n\nAxios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, toFormData recursively walks nested objects with no depth limit, so a deeply nested value passed as request data crashes the Node.js process with a RangeError. This vulnerability is fixed in 1.15.1 and 0.31.1.\n\nPackage: axios\nInstalled: 1.13.2\nFixed in: 1.15.1, 0.31.1\nSeverity: MEDIUM\nFix: Upgrade axios to 1.15.1, 0.31.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7ddc6520ce6b31f7", "name": "CVE-2026-42041: axios 1.13.2 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-42041: axios 1.13.2 \u2014 yarn.lock"}, "fullDescription": {"text": "axios: Axios: Authentication bypass due to prototype pollution of HTTP error handling\n\nAxios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, the Axios library is vulnerable to a Prototype Pollution \"Gadget\" attack that allows any Object.prototype pollution to silently suppress all HTTP error responses (401, 403, 500, etc.), causing them to be treated as successful responses. This completely bypasses application-level authentication and error handling. The root cause is that validateStatus is the only config property using the mergeDirectKeys\n\nPackage: axios\nInstalled: 1.13.2\nFixed in: 1.15.1, 0.31.1\nSeverity: MEDIUM\nFix: Upgrade axios to 1.15.1, 0.31.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c09d86627c59d42d", "name": "CVE-2026-42042: axios 1.13.2 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-42042: axios 1.13.2 \u2014 yarn.lock"}, "fullDescription": {"text": "axios: Axios: XSRF token bypass leading to information disclosure\n\nAxios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, the Axios library's XSRF token protection logic uses JavaScript truthy/falsy semantics instead of strict boolean comparison for the withXSRFToken config property. When this property is set to any truthy non-boolean value (via prototype pollution or misconfiguration), the same-origin check (isURLSameOrigin) is short-circuited, causing XSRF tokens to be sent to all request targets including cross-origin s\n\nPackage: axios\nInstalled: 1.13.2\nFixed in: 1.15.1, 0.31.1\nSeverity: MEDIUM\nFix: Upgrade axios to 1.15.1, 0.31.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4b1ff50d93c23a8e", "name": "CVE-2026-42044: axios 1.13.2 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-42044: axios 1.13.2 \u2014 yarn.lock"}, "fullDescription": {"text": "axios: Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget\n\nAxios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.15.2, he Axios library is vulnerable to a Prototype Pollution \"Gadget\" attack that allows any Object.prototype pollution in the application's dependency tree to be escalated into surgical, invisible modification of all JSON API responses \u2014 including privilege escalation, balance manipulation, and authorization bypass. The default transformResponse function at lib/defaults/index.js:124 calls JSON.parse(data, \n\nPackage: axios\nInstalled: 1.13.2\nFixed in: 1.15.2\nSeverity: MEDIUM\nFix: Upgrade axios to 1.15.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0e0022de31a41447", "name": "CVE-2026-44490: axios 1.13.2 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-44490: axios 1.13.2 \u2014 yarn.lock"}, "fullDescription": {"text": "axios: Axios: Information disclosure and denial of service due to prototype pollution\n\nAxios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, axios exposes two read-side prototype-pollution gadgets. When Object.prototype is polluted by an upstream dependency in the same process (e.g. lodash _.merge / CVE-2018-16487), axios silently picks up the polluted values. (1) lib/utils.js line 406 builds merge()'s accumulator as result = {}, so result[targetKey] (line 414) walks Object.prototype and the polluted bucket's own keys are copied into the mer\n\nPackage: axios\nInstalled: 1.13.2\nFixed in: 1.16.0, 0.32.0\nSeverity: MEDIUM\nFix: Upgrade axios to 1.16.0, 0.32.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c5a22d5ffbf77012", "name": "CVE-2026-67312: axios 1.13.2 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-67312: axios 1.13.2 \u2014 yarn.lock"}, "fullDescription": {"text": "axios: axios: Denial of Service via uncontrolled recursion in form data processing\n\naxios versions from 0.28.0 before 0.33.0 and from 1.0.0 before 1.18.0 contain uncontrolled recursion in formDataToJSON (exposed as axios.formToJSON() and used internally when serializing FormData with Content-Type: application/json). When an application passes attacker-controlled FormData field names, a field name with thousands of nested bracket-delimited segments causes unbounded recursion in buildPath(), exhausting the JavaScript call stack (RangeError: Maximum call stack size exceeded) and c\n\nPackage: axios\nInstalled: 1.13.2\nFixed in: 0.33.0, 1.18.0\nSeverity: MEDIUM\nFix: Upgrade axios to 0.33.0, 1.18.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-99b88cd48b9419a3", "name": "CVE-2026-67313: axios 1.13.2 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-67313: axios 1.13.2 \u2014 yarn.lock"}, "fullDescription": {"text": "axios versions 0.28.0 and later contain uncontrolled recursion in form ...\n\naxios versions 0.28.0 and later contain uncontrolled recursion in formDataToJSON when processing FormData field names with deeply nested bracket segments. Attackers can supply FormData with field names containing thousands of nested brackets to exhaust the JavaScript call stack and trigger RangeError, causing request failure or process termination in applications that do not handle the exception.\n\nPackage: axios\nInstalled: 1.13.2\nFixed in: 0.33.0, 1.18.0\nSeverity: MEDIUM\nFix: Upgrade axios to 0.33.0, 1.18.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e4805c2ec4708b60", "name": "CVE-2026-67316: axios 1.13.2 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-67316: axios 1.13.2 \u2014 yarn.lock"}, "fullDescription": {"text": "axios: axios: Prototype Pollution allows unauthorized data transmission and network redirection\n\naxios is vulnerable to read-side prototype-pollution gadgets that can alter request construction when Object.prototype has already been polluted by a separate vulnerability or dependency. In the bodyless method aliases (axios.get(), axios.delete(), axios.head(), axios.options()), inherited data is read via (config || {}).data before config normalization, causing an attacker-controlled body to be sent on requests that did not set one. Additional low-level paths, only reachable when calling export\n\nPackage: axios\nInstalled: 1.13.2\nFixed in: 1.18.0, 0.33.0\nSeverity: MEDIUM\nFix: Upgrade axios to 1.18.0, 0.33.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-703d2bc9758f0dcd", "name": "CVE-2026-67317: axios 1.13.2 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-67317: axios 1.13.2 \u2014 yarn.lock"}, "fullDescription": {"text": "axios: axios: Denial of Service via maxBodyLength bypass with ReadableStream\n\naxios versions 1.7.0 before 1.18.0 fail to enforce maxBodyLength for WHATWG ReadableStream request bodies in the fetch adapter when Content-Length cannot be determined. Attackers can supply unknown-length stream data to bypass upload size limits and cause uncontrolled network egress or resource exhaustion.\n\nPackage: axios\nInstalled: 1.13.2\nFixed in: 1.18.0\nSeverity: MEDIUM\nFix: Upgrade axios to 1.18.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1a2688f744f5013f", "name": "CVE-2026-67318: axios 1.13.2 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-67318: axios 1.13.2 \u2014 yarn.lock"}, "fullDescription": {"text": "axios: axios: Denial of Service due to maxBodyLength bypass in HTTP/2 requests\n\naxios versions >=1.13.0 (Node.js HTTP adapter) fail to enforce the configured maxBodyLength limit on streamed request bodies when requests are sent with httpVersion: 2. Because Node's HTTP/2 request API does not honor the maxBodyLength option and axios's byte-counting stream wrapper is gated on maxRedirects === 0, an attacker who controls a stream passed to axios can cause the application to transmit outbound data exceeding the configured finite maxBodyLength. Impact is limited to resource consu\n\nPackage: axios\nInstalled: 1.13.2\nFixed in: 1.18.0\nSeverity: MEDIUM\nFix: Upgrade axios to 1.18.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-dbb5f11b598e8b96", "name": "CVE-2026-67319: axios 1.13.2 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-67319: axios 1.13.2 \u2014 yarn.lock"}, "fullDescription": {"text": "axios: axios: Information disclosure and data manipulation via prototype pollution\n\naxios before 0.33.0 (and 1.x before 1.18.0) can consume inherited properties from nested request option objects when the JavaScript process's Object.prototype has already been polluted by another component. While the top-level merged config uses a null prototype, nested plain objects such as auth and paramsSerializer are cloned into ordinary objects and read without own-property checks. When an application passes placeholder nested objects such as auth: {} or paramsSerializer: {}, inherited user\n\nPackage: axios\nInstalled: 1.13.2\nFixed in: 0.33.0, 1.18.0\nSeverity: MEDIUM\nFix: Upgrade axios to 0.33.0, 1.18.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-45ac6c674de0c6be", "name": "CVE-2026-42040: axios 1.13.2 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-42040: axios 1.13.2 \u2014 yarn.lock"}, "fullDescription": {"text": "axios: Axios: Incorrect null byte handling can lead to data integrity issues\n\nAxios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, the encode() function in lib/helpers/AxiosURLSearchParams.js contains a character mapping (charMap) at line 21 that reverses the safe percent-encoding of null bytes. After encodeURIComponent('\\x00') correctly produces the safe sequence %00, the charMap entry '%00': '\\x00' converts it back to a raw null byte. Primary impact is limited because the standard axios request flow is not affected. This vulnerab\n\nPackage: axios\nInstalled: 1.13.2\nFixed in: 1.15.1, 0.31.1\nSeverity: LOW\nFix: Upgrade axios to 1.15.1, 0.31.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-99dcaa1b943b6eaa", "name": "CVE-2026-2739: bn.js 5.2.1 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-2739: bn.js 5.2.1 \u2014 yarn.lock"}, "fullDescription": {"text": "bn.js: bn.js: Denial of Service via calling maskn(0)\n\nThis affects versions of the package bn.js before 5.2.3. Calling maskn(0) on any BN instance corrupts the internal state, causing toString(), divmod(), and other methods to enter an infinite loop, hanging the process indefinitely.\n\nPackage: bn.js\nInstalled: 5.2.1\nFixed in: 4.12.3, 5.2.3\nSeverity: MEDIUM\nFix: Upgrade bn.js to 4.12.3, 5.2.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-60bd4fdd8db4975a", "name": "CVE-2026-2739: bn.js 5.2.2 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-2739: bn.js 5.2.2 \u2014 yarn.lock"}, "fullDescription": {"text": "bn.js: bn.js: Denial of Service via calling maskn(0)\n\nThis affects versions of the package bn.js before 5.2.3. Calling maskn(0) on any BN instance corrupts the internal state, causing toString(), divmod(), and other methods to enter an infinite loop, hanging the process indefinitely.\n\nPackage: bn.js\nInstalled: 5.2.2\nFixed in: 4.12.3, 5.2.3\nSeverity: MEDIUM\nFix: Upgrade bn.js to 4.12.3, 5.2.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b0b2711a53b4c077", "name": "CVE-2026-102276: brace-expansion 2.0.1 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-102276: brace-expansion 2.0.1 \u2014 yarn.lock"}, "fullDescription": {"text": "brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns\n\nThe brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10, crafted brace patterns can exhaust the native stack in parseCommaParts because parseCommaParts recursively processes the remainder once per brace group and uses push.apply to pass every element of a very large comma-part array as a function argument. Patterns containing many comma-separated brace groups trigger the recursive path, while the large array trigger\n\nPackage: brace-expansion\nInstalled: 2.0.1\nFixed in: 5.0.10, 3.0.7, 2.1.5, 1.1.19\nSeverity: HIGH\nFix: Upgrade brace-expansion to 5.0.10, 3.0.7, 2.1.5, 1.1.19"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-0ecd8b614867c030", "name": "CVE-2026-102278: brace-expansion 2.0.1 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-102278: brace-expansion 2.0.1 \u2014 yarn.lock"}, "fullDescription": {"text": "brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns\n\nThe brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.20, 2.1.6, 3.0.8, and 5.0.11, deeply nested brace groups cause expand_() to recurse once per nesting level at comma-member and single-set expansion sites, exhausting the native stack before output limits can apply and potentially terminating the Node.js process. expand_ performs uncontrolled recursion for nested brace alternatives and single-part sets. deeply nested brace groups supplied a\n\nPackage: brace-expansion\nInstalled: 2.0.1\nFixed in: 5.0.11, 3.0.8, 2.1.6, 1.1.20\nSeverity: HIGH\nFix: Upgrade brace-expansion to 5.0.11, 3.0.8, 2.1.6, 1.1.20"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-84d6f76c92bf1594", "name": "CVE-2026-13149: brace-expansion 2.0.1 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-13149: brace-expansion 2.0.1 \u2014 yarn.lock"}, "fullDescription": {"text": "brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity\n\nbrace-expansion through 5.0.6 is vulnerable to denial of service. The expand() function exhibits exponential-time complexity in the number of consecutive non-expanding '{}' brace groups. An attacker who passes a crafted string to expand(), directly or transitively, can cause significant CPU consumption and event-loop blocking. The max option does not mitigate this, as it bounds the output size rather than the recursion work.\n\nPackage: brace-expansion\nInstalled: 2.0.1\nFixed in: 5.0.7, 1.1.16, 2.1.2\nSeverity: HIGH\nFix: Upgrade brace-expansion to 5.0.7, 1.1.16, 2.1.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-629e278807f014a0", "name": "CVE-2026-14257: brace-expansion 2.0.1 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-14257: brace-expansion 2.0.1 \u2014 yarn.lock"}, "fullDescription": {"text": "brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function\n\nbrace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand() function limits the number of results with a max option (default 100,000) but does not bound the length of each result string. By chaining multiple brace groups, an attacker keeps the result count under the limit while making each result progressively longer, so total memory scales with both count and string length until the process hits a fatal, uncatchable out-of-memory error. About 7.5 KB of i\n\nPackage: brace-expansion\nInstalled: 2.0.1\nFixed in: 5.0.8, 3.0.3, 2.1.3, 1.1.17\nSeverity: HIGH\nFix: Upgrade brace-expansion to 5.0.8, 3.0.3, 2.1.3, 1.1.17"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-557cec467a1994e7", "name": "CVE-2026-69152: brace-expansion 2.0.1 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-69152: brace-expansion 2.0.1 \u2014 yarn.lock"}, "fullDescription": {"text": "brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation\n\nThe brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.18, 2.1.4, 3.0.6, and 5.0.9, expand() does not apply maxLength while constructing comma-alternative intermediate arrays or padded sequences, allowing attacker-controlled input to exhaust memory or block the event loop. The fix for CVE-2026-14257 is bypassed by the vulnerability. This issue is fixed in versions 1.1.18, 2.1.4, 3.0.6, and 5.0.9.\n\nPackage: brace-expansion\nInstalled: 2.0.1\nFixed in: 1.1.18, 2.1.4, 3.0.6, 5.0.9\nSeverity: HIGH\nFix: Upgrade brace-expansion to 1.1.18, 2.1.4, 3.0.6, 5.0.9"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-d7f9fd79b737dadc", "name": "CVE-2026-102277: brace-expansion 2.0.1 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-102277: brace-expansion 2.0.1 \u2014 yarn.lock"}, "fullDescription": {"text": "brace-expansion: brace-expansion: Denial of Service via crafted brace patterns\n\nThe brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.21, 2.1.7, 3.0.9, and 5.0.12, the expand function handles untrusted {a},b}-shaped patterns with many trailing closing braces by restarting its scan once for each trailing closing brace. The successive full-input rescans with linear working-string growth cause quadratic CPU time and memory pressure that can block the Node.js event loop. The process eventually recovers, making the impact a r\n\nPackage: brace-expansion\nInstalled: 2.0.1\nFixed in: 5.0.12, 3.0.9, 2.1.7, 1.1.21\nSeverity: MEDIUM\nFix: Upgrade brace-expansion to 5.0.12, 3.0.9, 2.1.7, 1.1.21"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-df4b282f33f327f9", "name": "CVE-2026-33750: brace-expansion 2.0.1 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-33750: brace-expansion 2.0.1 \u2014 yarn.lock"}, "fullDescription": {"text": "brace-expansion: brace-expansion: Denial of Service via zero step value in brace pattern\n\nThe brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to versions 5.0.5, 3.0.2, 2.0.3, and 1.1.13, a brace pattern with a zero step value (e.g., `{1..2..0}`) causes the sequence generation loop to run indefinitely, making the process hang for seconds and allocate heaps of memory. Versions 5.0.5, 3.0.2, 2.0.3, and 1.1.13 fix the issue. As a workaround, sanitize strings passed to `expand()` to ensure a step value of `0` is not used.\n\nPackage: brace-expansion\nInstalled: 2.0.1\nFixed in: 5.0.5, 3.0.2, 2.0.3, 1.1.13\nSeverity: MEDIUM\nFix: Upgrade brace-expansion to 5.0.5, 3.0.2, 2.0.3, 1.1.13"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e2f48fb78f6fdc14", "name": "CVE-2025-5889: brace-expansion 2.0.1 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2025-5889: brace-expansion 2.0.1 \u2014 yarn.lock"}, "fullDescription": {"text": "brace-expansion: juliangruber brace-expansion index.js expand redos\n\nA vulnerability was found in juliangruber brace-expansion up to 1.1.11/2.0.1/3.0.0/4.0.0. It has been rated as problematic. Affected by this issue is the function expand of the file index.js. The manipulation leads to inefficient regular expression complexity. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 1.1.12, 2.0.2, 3.0.1 and 4.0.1 i\n\nPackage: brace-expansion\nInstalled: 2.0.1\nFixed in: 2.0.2, 1.1.12, 3.0.1, 4.0.1\nSeverity: LOW\nFix: Upgrade brace-expansion to 2.0.2, 1.1.12, 3.0.1, 4.0.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6eb609aba1cca177", "name": "CVE-2026-93687: braces 3.0.3 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-93687: braces 3.0.3 \u2014 yarn.lock"}, "fullDescription": {"text": "braces: braces: Denial of Service via Stack Overflow from Deeply Nested Patterns\n\nbraces through 3.0.3 contains a stack overflow vulnerability in the recursive AST walkers that lack depth guards. Attackers can supply deeply nested brace patterns under the character limit to exhaust the call stack and terminate the Node.js process with an uncaught RangeError.\n\nPackage: braces\nInstalled: 3.0.3\nFixed in: \u2014\nSeverity: HIGH\nFix: No fix version published yet"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-4710e05dab3afcd5", "name": "CVE-2026-45822: decode-uri-component 0.2.2 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-45822: decode-uri-component 0.2.2 \u2014 yarn.lock"}, "fullDescription": {"text": "decode-uri-component: decode-uri-component: Denial of Service via crafted input\n\ndecode-uri-component through 0.4.1 is vulnerable to denial of service. The decode() function splits input on '%' producing N tokens and calls decodeComponents(), exhibiting super-linear parsing time: 200 '%ab' tokens takes approximately 0.7s, 700 tokens approximately 6s, and 1400 tokens approximately 33s. An attacker can cause significant CPU consumption and event-loop blocking via crafted input.\n\nPackage: decode-uri-component\nInstalled: 0.2.2\nFixed in: 0.5.0\nSeverity: MEDIUM\nFix: Upgrade decode-uri-component to 0.5.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f94a8c35e9ab9f9e", "name": "CVE-2026-35209: defu 6.1.3 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-35209: defu 6.1.3 \u2014 yarn.lock"}, "fullDescription": {"text": "defu: Prototype pollution via `__proto__` key in defaults argument\n\ndefu is software that allows uers to assign default properties recursively. Prior to version 6.1.5, applications that pass unsanitized user input (e.g. parsed JSON request bodies, database records, or config files from untrusted sources) as the first argument to `defu()` are vulnerable to prototype pollution. A crafted payload containing a `__proto__` key can override intended default values in the merged resul. The internal `_defu` function used `Object.assign({}, defaults)` to copy the default\n\nPackage: defu\nInstalled: 6.1.3\nFixed in: 6.1.5\nSeverity: HIGH\nFix: Upgrade defu to 6.1.5"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-2648c0e29f8a61cd", "name": "CVE-2025-15599: dompurify 3.2.6 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2025-15599: dompurify 3.2.6 \u2014 yarn.lock"}, "fullDescription": {"text": "DOMPurify: DOMPurify: Cross-site scripting\n\nDOMPurify 3.1.3 through 3.2.6 and 2.5.3 through 2.5.8 contain a cross-site scripting vulnerability that allows attackers to bypass attribute sanitization by exploiting missing textarea rawtext element validation in the SAFE_FOR_XML regex. Attackers can include closing rawtext tags like </textarea> in attribute values to break out of rawtext contexts and execute JavaScript when sanitized output is placed inside rawtext elements. The 3.x branch was fixed in 3.2.7; the 2.x branch was never patched.\n\nPackage: dompurify\nInstalled: 3.2.6\nFixed in: 3.2.7\nSeverity: MEDIUM\nFix: Upgrade dompurify to 3.2.7"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c3cd10caa34dc5a5", "name": "CVE-2026-0540: dompurify 3.2.6 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-0540: dompurify 3.2.6 \u2014 yarn.lock"}, "fullDescription": {"text": "DOMPurify: DOMPurify: Cross-site scripting vulnerability\n\nDOMPurify 3.1.3 through 3.3.1 and 2.5.3 through 2.5.8, fixed in commit 2726c74, contain a cross-site scripting vulnerability that allows attackers to bypass attribute sanitization by exploiting five missing rawtext elements (noscript, xmp, noembed, noframes, iframe) in the SAFE_FOR_XML regex. Attackers can include payloads like </noscript><img src=x onerror=alert(1)> in attribute values to execute JavaScript when sanitized output is placed inside these unprotected rawtext contexts.\n\nPackage: dompurify\nInstalled: 3.2.6\nFixed in: 3.3.2, 2.5.9\nSeverity: MEDIUM\nFix: Upgrade dompurify to 3.3.2, 2.5.9"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-98ec3212169b5919", "name": "CVE-2026-41238: dompurify 3.2.6 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-41238: dompurify 3.2.6 \u2014 yarn.lock"}, "fullDescription": {"text": "DOMPurify: DOMPurify: Cross-Site Scripting bypass via prototype pollution\n\nDOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Versions 3.0.1 through 3.3.3 are vulnerable to a prototype pollution-based XSS bypass. When an application uses `DOMPurify.sanitize()` with the default configuration (no `CUSTOM_ELEMENT_HANDLING` option), a prior prototype pollution gadget can inject permissive `tagNameCheck` and `attributeNameCheck` regex values into `Object.prototype`, causing DOMPurify to allow arbitrary custom elements with arbitrary attributes\n\nPackage: dompurify\nInstalled: 3.2.6\nFixed in: 3.4.0\nSeverity: MEDIUM\nFix: Upgrade dompurify to 3.4.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-53aa4fa39b5036fb", "name": "CVE-2026-41239: dompurify 3.2.6 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-41239: dompurify 3.2.6 \u2014 yarn.lock"}, "fullDescription": {"text": "DOMPurify: Vue 2: DOMPurify: Cross-site scripting due to incomplete sanitization of template expressions\n\nDOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Starting in version 1.0.10 and prior to version 3.4.0, `SAFE_FOR_TEMPLATES` strips `{{...}}` expressions from untrusted HTML. This works in string mode but not with `RETURN_DOM` or `RETURN_DOM_FRAGMENT`, allowing XSS via template-evaluating frameworks like Vue 2. Version 3.4.0 patches the issue.\n\nPackage: dompurify\nInstalled: 3.2.6\nFixed in: 3.4.0\nSeverity: MEDIUM\nFix: Upgrade dompurify to 3.4.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8f9c5da81c558e9e", "name": "CVE-2026-41240: dompurify 3.2.6 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-41240: dompurify 3.2.6 \u2014 yarn.lock"}, "fullDescription": {"text": "DOMPurify: DOMPurify: Cross-Site Scripting (XSS) via inconsistent tag sanitization\n\nDOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Versions prior to 3.4.0 have an inconsistency between FORBID_TAGS and FORBID_ATTR handling when function-based ADD_TAGS is used. Commit c361baa added an early exit for FORBID_ATTR at line 1214. The same fix was not applied to FORBID_TAGS. At line 1118-1123, when EXTRA_ELEMENT_HANDLING.tagCheck returns true, the short-circuit evaluation skips the FORBID_TAGS check entirely. This allows forbidden elements to survive \n\nPackage: dompurify\nInstalled: 3.2.6\nFixed in: 3.4.0\nSeverity: MEDIUM\nFix: Upgrade dompurify to 3.4.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-847e707ad0721e2f", "name": "CVE-2026-49458: dompurify 3.2.6 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-49458: dompurify 3.2.6 \u2014 yarn.lock"}, "fullDescription": {"text": "dompurify: DOMPurify: Cross-site scripting due to improper sanitization of DOM nodes\n\nDOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.6, DOMPurify.sanitize(node, { IN_PLACE: true }) accepted same-origin foreign-realm DOM nodes while follow-on checks used parent-realm constructors, causing instanceof checks for forms, named node maps, document fragments, and elements to fail and skip clobber, template-content, and shadow-DOM sanitization branches so executable markup could survive. This issue is fixed in version 3.4.6.\n\nPackage: dompurify\nInstalled: 3.2.6\nFixed in: 3.4.6\nSeverity: MEDIUM\nFix: Upgrade dompurify to 3.4.6"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-bfa1175542eae51a", "name": "CVE-2026-49459: dompurify 3.2.6 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-49459: dompurify 3.2.6 \u2014 yarn.lock"}, "fullDescription": {"text": "dompurify: DOMPurify: Cross-site scripting bypass allows arbitrary script execution\n\nDOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.6, DOMPurify.sanitize(root, { IN_PLACE: true }) could preserve event-handler attributes on an attacker-controlled <form> root when a descendant name clobbered properties checked by _isClobbered, because _forceRemove no-opped on the parent-less root and _sanitizeAttributes returned early. This issue is fixed in version 3.4.6.\n\nPackage: dompurify\nInstalled: 3.2.6\nFixed in: 3.4.6\nSeverity: MEDIUM\nFix: Upgrade dompurify to 3.4.6"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-fa9337e3afd1b3a0", "name": "CVE-2026-49978: dompurify 3.2.6 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-49978: dompurify 3.2.6 \u2014 yarn.lock"}, "fullDescription": {"text": "dompurify: DOMPurify: Cross-site scripting vulnerability allows code execution\n\nDOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.7, DOMPurify IN_PLACE sanitization could skip shadow contents attached to an element inside <template>.content, allowing attacker-controlled markup such as event handlers, JavaScript URLs, or scripts to survive and execute when an application cloned and inserted the sanitized template. This issue is fixed in version 3.4.7.\n\nPackage: dompurify\nInstalled: 3.2.6\nFixed in: 3.4.7\nSeverity: MEDIUM\nFix: Upgrade dompurify to 3.4.7"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4b83314a3f2b4d08", "name": "CVE-2026-65898: dompurify 3.2.6 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-65898: dompurify 3.2.6 \u2014 yarn.lock"}, "fullDescription": {"text": "dompurify: DOMPurify: Cross-site scripting via permanent attribute allowlist pollution\n\nDOMPurify before 3.4.11 fails to clone the ALLOWED_ATTR allowlist when setConfig() is used with an uponSanitizeAttribute hook, allowing the hook to permanently mutate the shared allowlist. Attackers can register a hook that conditionally allows dangerous attributes like onerror for trusted elements, then submit untrusted content that inherits the polluted allowlist and executes event handlers as stored XSS.\n\nPackage: dompurify\nInstalled: 3.2.6\nFixed in: 3.4.11\nSeverity: MEDIUM\nFix: Upgrade dompurify to 3.4.11"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0c41cb8d65c9e0dd", "name": "CVE-2026-65902: dompurify 3.2.6 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-65902: dompurify 3.2.6 \u2014 yarn.lock"}, "fullDescription": {"text": "dompurify: DOMPurify: Sanitization bypass via hook manipulation\n\nDOMPurify before 3.4.7 (affected versions <= 3.4.5) passes direct references to the module-level DEFAULT_ALLOWED_TAGS and DEFAULT_ALLOWED_ATTR sets to the uponSanitizeElement and uponSanitizeAttribute hooks via data.allowedTags / data.allowedAttributes when sanitize is called without an explicit cfg.ALLOWED_TAGS / cfg.ALLOWED_ATTR array. A hook that mutates these fields permanently widens the default allow-lists for the lifetime of the DOMPurify instance, so all subsequent default-config sanitiz\n\nPackage: dompurify\nInstalled: 3.2.6\nFixed in: 3.4.7\nSeverity: MEDIUM\nFix: Upgrade dompurify to 3.4.7"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7e0f96292ad49b8a", "name": "CVE-2026-65903: dompurify 3.2.6 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-65903: dompurify 3.2.6 \u2014 yarn.lock"}, "fullDescription": {"text": "dompurify: DOMPurify: Security bypass allows injection of malicious content\n\nDOMPurify before 3.4.0 contains a logic error in the ADD_TAGS function where short-circuit evaluation allows forbidden tags to bypass FORBID_TAGS restrictions. Attackers can craft input containing tags listed in FORBID_TAGS that are also added via ADD_TAGS function, causing them to be retained in sanitized output.\n\nPackage: dompurify\nInstalled: 3.2.6\nFixed in: 3.4.0\nSeverity: MEDIUM\nFix: Upgrade dompurify to 3.4.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-03837ed522732967", "name": "CVE-2026-65912: dompurify 3.2.6 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-65912: dompurify 3.2.6 \u2014 yarn.lock"}, "fullDescription": {"text": "dompurify: DOMPurify: URI validation bypass leads to cross-site scripting\n\nDOMPurify before 3.3.2 contains a URI validation bypass vulnerability when ADD_ATTR is provided as a predicate function via EXTRA_ELEMENT_HANDLING.attributeCheck. Attackers can supply a predicate that accepts specific attribute and tag combinations to bypass URI-safe validation, allowing unsafe protocols like javascript: to survive sanitization and execute as DOM-based XSS when the link is activated.\n\nPackage: dompurify\nInstalled: 3.2.6\nFixed in: 3.3.2\nSeverity: MEDIUM\nFix: Upgrade dompurify to 3.3.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c71d2ea4ec0abaf8", "name": "CVE-2026-65913: dompurify 3.2.6 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-65913: dompurify 3.2.6 \u2014 yarn.lock"}, "fullDescription": {"text": "dompurify: DOMPurify: Cross-Site Scripting (XSS) via prototype pollution in USE_PROFILES mode\n\nDOMPurify before 3.3.2 contains a prototype pollution vulnerability in USE_PROFILES mode that allows attackers to bypass attribute filtering by polluting Array.prototype properties. Attackers can set Array.prototype properties like onclick to true, causing DOMPurify to accept event handlers as allowlisted attributes and resulting in DOM-based XSS when sanitized markup is rendered.\n\nPackage: dompurify\nInstalled: 3.2.6\nFixed in: 3.3.2\nSeverity: MEDIUM\nFix: Upgrade dompurify to 3.3.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a3a3cd8bf9f6873f", "name": "CVE-2026-65914: dompurify 3.2.6 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-65914: dompurify 3.2.6 \u2014 yarn.lock"}, "fullDescription": {"text": "dompurify: DOMPurify: Cross-Site Scripting vulnerability allows arbitrary code execution\n\nDOMPurify before 3.3.2 contains a mutation-XSS vulnerability when sanitized HTML is reinserted into special parsing contexts using innerHTML with wrappers like script, xmp, iframe, noembed, noframes, or noscript. Attackers can craft payloads with closing sequences that break out of the wrapper context during reparsing, reactivating dangerous markup with event handlers to execute JavaScript.\n\nPackage: dompurify\nInstalled: 3.2.6\nFixed in: 3.3.2\nSeverity: MEDIUM\nFix: Upgrade dompurify to 3.3.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c446a46de1f1f737", "name": "GHSA-55q2-fjhq-7xh7: dompurify 3.2.6 \u2014 yarn.lock", "shortDescription": {"text": "GHSA-55q2-fjhq-7xh7: dompurify 3.2.6 \u2014 yarn.lock"}, "fullDescription": {"text": "DOMPurify: IN_PLACE hook removal leaves a detached subtree executable, causing XSS\n\n### Summary\n\nDuring `IN_PLACE` sanitization, a hook that removes an element can leave that element's detached descendants executable. A descendant image can retain its attacker-provided `onload` handler and fire after `sanitize()` returns, even though the returned root is clean and the image remains disconnected from the document.\n\n### Details\n\nIn DOMPurify 3.4.12, `_sanitizeElements()` in `src/purify.ts:1862-1904` runs the `beforeSanitizeElements` or `uponSanitizeElement` hook and returns immed\n\nPackage: dompurify\nInstalled: 3.2.6\nFixed in: 3.4.13\nSeverity: MEDIUM\nFix: Upgrade dompurify to 3.4.13"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-279540406f1e5d1c", "name": "CVE-2026-65899: dompurify 3.2.6 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-65899: dompurify 3.2.6 \u2014 yarn.lock"}, "fullDescription": {"text": "dompurify: DOMPurify: Client-side arbitrary code execution due to improper Trusted Types policy reset\n\nDOMPurify 3.0.0 before 3.4.9 does not reset the retained Trusted Types policy when clearConfig() is called, so a DOMPurify instance reused across trust boundaries stays bound to a previously supplied TRUSTED_TYPES_POLICY. A later caller that requests RETURN_TRUSTED_TYPE output receives a TrustedHTML object created by the old (potentially unsafe) policy rather than a clean default, which can lead to script execution at a Trusted Types sink. Passing TRUSTED_TYPES_POLICY: null on the later call als\n\nPackage: dompurify\nInstalled: 3.2.6\nFixed in: 3.4.9\nSeverity: LOW\nFix: Upgrade dompurify to 3.4.9"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cb798e61775240f2", "name": "CVE-2026-65900: dompurify 3.2.6 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-65900: dompurify 3.2.6 \u2014 yarn.lock"}, "fullDescription": {"text": "dompurify: DOMPurify: Template expression injection allows information disclosure\n\nDOMPurify versions >=3.0.0 and before 3.4.8, when configured with SAFE_FOR_TEMPLATES together with a DOM output mode (RETURN_DOM, RETURN_DOM_FRAGMENT, or IN_PLACE), fail to strip template expressions (e.g. ${evil}, {{evil}}, <%evil%>) inside <template> element content. The final normalization/scrub pass (_scrubTemplateExpressions) uses a NodeIterator and node.normalize() that do not descend into template.content, so expressions that only form after adjacent text nodes merge survive sanitization.\n\nPackage: dompurify\nInstalled: 3.2.6\nFixed in: 3.4.8\nSeverity: LOW\nFix: Upgrade dompurify to 3.4.8"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-83baac09ad719613", "name": "CVE-2026-65901: dompurify 3.2.6 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-65901: dompurify 3.2.6 \u2014 yarn.lock"}, "fullDescription": {"text": "dompurify: DOMPurify: Cross-site scripting vulnerability via attacker-controlled nodeName\n\nDOMPurify through 3.4.6 contains a cross-site scripting vulnerability in IN_PLACE mode that trusts attacker-controlled nodeName on live non-form nodes. Attackers can supply hostile live DOM objects with real script children whose observable nodeName is clobbered to appear as allowed elements, causing scripts to execute when the sanitized tree is inserted into a live document.\n\nPackage: dompurify\nInstalled: 3.2.6\nFixed in: \u2014\nSeverity: LOW\nFix: No fix version published yet"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7e3374172ebc43e3", "name": "CVE-2026-66010: dompurify 3.2.6 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-66010: dompurify 3.2.6 \u2014 yarn.lock"}, "fullDescription": {"text": "dompurify: DOMPurify: Cross-Site Scripting (XSS) via custom element attribute bypass\n\nDOMPurify before 3.4.12 fails to execute afterSanitizeElements hook for custom elements allowed via CUSTOM_ELEMENT_HANDLING.tagNameCheck, allowing attributes to bypass application security policies. Attackers can preserve sensitive attributes on custom elements that later re-inject them into innerHTML sinks, creating second-order XSS gadgets.\n\nPackage: dompurify\nInstalled: 3.2.6\nFixed in: 3.4.12\nSeverity: LOW\nFix: Upgrade dompurify to 3.4.12"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7abf23d0eac4f2ab", "name": "GHSA-6688-9rhm-gjv2: dompurify 3.2.6 \u2014 yarn.lock", "shortDescription": {"text": "GHSA-6688-9rhm-gjv2: dompurify 3.2.6 \u2014 yarn.lock"}, "fullDescription": {"text": "DOMPurify: IN_PLACE returns a force-removed rawtext root whose text carries attacker markup \u2014 pure HTML reparse executes\n\n## Environment\n\n- dompurify 3.4.15 (current npm release); reproduced independently on jsdom 30.0.1 and 29.1.1 (Node.js 20.x / 26.x)\n- Config: `DOMPurify.sanitize(node, { IN_PLACE: true })` on a Node input; `SAFE_FOR_XML` at its default (`true`)\n\n## Summary\n\nThe 3.4.9 fix for the IN_PLACE detached-root class added two protections on the IN_PLACE return path: a fail-closed `TypeError` in `_forceRemove` when a node selected for removal cannot be detached, and a `_neutralizeSubtree` pass (`dist/puri\n\nPackage: dompurify\nInstalled: 3.2.6\nFixed in: 3.4.16\nSeverity: LOW\nFix: Upgrade dompurify to 3.4.16"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-31f0df9ad811fbf6", "name": "GHSA-jggr-w7fw-pc2j: fast-copy 3.0.0 \u2014 yarn.lock", "shortDescription": {"text": "GHSA-jggr-w7fw-pc2j: fast-copy 3.0.0 \u2014 yarn.lock"}, "fullDescription": {"text": "fast-copy: Stack exhaustion in fast-copy when copying deeply-nested values\n\n## Summary\n\n`fast-copy` traverses values recursively with no bound on depth. Copying a sufficiently deeply-nested value exhausts the JavaScript call stack and throws a native `RangeError: Maximum call stack size exceeded` from inside the library.\n\n## Details\n\nBoth `copy` and `copyStrict` recurse once per level of nesting. The value does not need to be circular (circular references were already handled correctly via an internal cache) and it does not need to be large. A plain object nested a few \n\nPackage: fast-copy\nInstalled: 3.0.0\nFixed in: 4.1.0, 3.1.0, 2.2.0\nSeverity: MEDIUM\nFix: Upgrade fast-copy to 4.1.0, 3.1.0, 2.2.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b67265ce686e1a6a", "name": "CVE-2026-45820: fflate 0.4.8 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-45820: fflate 0.4.8 \u2014 yarn.lock"}, "fullDescription": {"text": "fflate: fflate: Denial of Service via crafted ZIP archives\n\nfflate through 0.8.2 is vulnerable to denial of service via an infinite loop in unzipSync(). A crafted ZIP archive with a central directory entry declaring compressed_size=0xFFFFFFFF (ZIP64 sentinel) but missing the required ZIP64 extra field tag 0x0001 causes z64e() to loop indefinitely due to out-of-bounds reads returning undefined, which coerces to 0, keeping the loop condition permanently true.\n\nPackage: fflate\nInstalled: 0.4.8\nFixed in: 0.4.9, 0.5.4, 0.6.11, 0.7.5, 0.8.3\nSeverity: MEDIUM\nFix: Upgrade fflate to 0.4.9, 0.5.4, 0.6.11, 0.7.5, 0.8.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-45fb9e67f1bf6d36", "name": "CVE-2026-45820: fflate 0.8.2 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-45820: fflate 0.8.2 \u2014 yarn.lock"}, "fullDescription": {"text": "fflate: fflate: Denial of Service via crafted ZIP archives\n\nfflate through 0.8.2 is vulnerable to denial of service via an infinite loop in unzipSync(). A crafted ZIP archive with a central directory entry declaring compressed_size=0xFFFFFFFF (ZIP64 sentinel) but missing the required ZIP64 extra field tag 0x0001 causes z64e() to loop indefinitely due to out-of-bounds reads returning undefined, which coerces to 0, keeping the loop condition permanently true.\n\nPackage: fflate\nInstalled: 0.8.2\nFixed in: 0.4.9, 0.5.4, 0.6.11, 0.7.5, 0.8.3\nSeverity: MEDIUM\nFix: Upgrade fflate to 0.4.9, 0.5.4, 0.6.11, 0.7.5, 0.8.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6ec7de12c5e81cd9", "name": "CVE-2026-31808: file-type 20.5.0 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-31808: file-type 20.5.0 \u2014 yarn.lock"}, "fullDescription": {"text": "file-type: file-type: Denial of Service due to infinite loop in ASF file parsing\n\nfile-type detects the file type of a file, stream, or data. Prior to 21.3.1, a denial of service vulnerability exists in the ASF (WMV/WMA) file type detection parser. When parsing a crafted input where an ASF sub-header has a size field of zero, the parser enters an infinite loop. The payload value becomes negative (-24), causing tokenizer.ignore(payload) to move the read position backwards, so the same sub-header is read repeatedly forever. Any application that uses file-type to detect the type\n\nPackage: file-type\nInstalled: 20.5.0\nFixed in: 21.3.1\nSeverity: MEDIUM\nFix: Upgrade file-type to 21.3.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c89cf3707b93de46", "name": "CVE-2026-32630: file-type 20.5.0 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-32630: file-type 20.5.0 \u2014 yarn.lock"}, "fullDescription": {"text": "file-type: file-type: Denial of Service via excessive memory growth from crafted ZIP files\n\nfile-type detects the file type of a file, stream, or data. From 20.0.0 to 21.3.1, a crafted ZIP file can trigger excessive memory growth during type detection in file-type when using fileTypeFromBuffer(), fileTypeFromBlob(), or fileTypeFromFile(). The ZIP inflate output limit is enforced for stream-based detection, but not for known-size inputs. As a result, a small compressed ZIP can cause file-type to inflate and process a much larger payload while probing ZIP-based formats such as OOXML. Thi\n\nPackage: file-type\nInstalled: 20.5.0\nFixed in: 21.3.2\nSeverity: MEDIUM\nFix: Upgrade file-type to 21.3.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7c0e25fb23368dee", "name": "GHSA-r4q5-vmmm-2653: follow-redirects 1.15.9 \u2014 yarn.lock", "shortDescription": {"text": "GHSA-r4q5-vmmm-2653: follow-redirects 1.15.9 \u2014 yarn.lock"}, "fullDescription": {"text": "follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Targets\n\n## Summary\n\nWhen an HTTP request follows a cross-domain redirect (301/302/307/308), `follow-redirects` only strips `authorization`, `proxy-authorization`, and `cookie` headers (matched by regex at index.js:469-476). Any custom authentication header (e.g., `X-API-Key`, `X-Auth-Token`, `Api-Key`, `Token`) is forwarded verbatim to the redirect target.\n\nSince `follow-redirects` is the redirect-handling dependency for **axios** (105K+ stars), this vulnerability affects the entire axios ecosystem.\n\n##\n\nPackage: follow-redirects\nInstalled: 1.15.9\nFixed in: 1.16.0\nSeverity: MEDIUM\nFix: Upgrade follow-redirects to 1.16.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-69836ab8f41a53d4", "name": "CVE-2026-12143: form-data 4.0.4 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-12143: form-data 4.0.4 \u2014 yarn.lock"}, "fullDescription": {"text": "form-data: form-data: Form field override via CRLF injection\n\nform-data is a library for creating readable multipart/form-data streams. In versions through 4.0.5, the `field` argument to `FormData#append` and the `filename` option are concatenated verbatim into the `Content-Disposition` header without escaping carriage return (CR), line feed (LF), or double-quote (\") characters. An application that passes attacker-controlled data as a field name or filename (for example, an API gateway that turns JSON object keys into multipart field names) allows the atta\n\nPackage: form-data\nInstalled: 4.0.4\nFixed in: 2.5.6, 3.0.5, 4.0.6\nSeverity: HIGH\nFix: Upgrade form-data to 2.5.6, 3.0.5, 4.0.6"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-8c3cc29b3ba37a0c", "name": "CVE-2026-23527: h3 1.9.0 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-23527: h3 1.9.0 \u2014 yarn.lock"}, "fullDescription": {"text": "h3: h3: HTTP Request Smuggling due to improper case-sensitive parsing of Transfer-Encoding header\n\nH3 is a minimal H(TTP) framework built for high performance and portability. Prior to 1.15.5, there is a critical HTTP Request Smuggling vulnerability. readRawBody is doing a strict case-sensitive check for the Transfer-Encoding header. It explicitly looks for \"chunked\", but per the RFC, this header should be case-insensitive. This vulnerability is fixed in 1.15.5.\n\nPackage: h3\nInstalled: 1.9.0\nFixed in: 1.15.5\nSeverity: HIGH\nFix: Upgrade h3 to 1.15.5"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-6b9738d0f6d41e41", "name": "CVE-2026-33128: h3 1.9.0 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-33128: h3 1.9.0 \u2014 yarn.lock"}, "fullDescription": {"text": "h3 has a Server-Sent Events Injection via Unsanitized Newlines in Event Stream Fields\n\nH3 is a minimal H(TTP) framework. In versions prior to 1.15.6 and between 2.0.0 through 2.0.1-rc.14, createEventStream is vulnerable to Server-Sent Events (SSE) injection due to missing newline sanitization in formatEventStreamMessage() and formatEventStreamComment(). An attacker who controls any part of an SSE message field (id, event, data, or comment) can inject arbitrary SSE events to connected clients. This issue is fixed in versions 1.15.6 and 2.0.1-rc.15.\n\nPackage: h3\nInstalled: 1.9.0\nFixed in: 2.0.1-rc.15, 1.15.6\nSeverity: HIGH\nFix: Upgrade h3 to 2.0.1-rc.15, 1.15.6"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-829a2d80b8287a56", "name": "GHSA-4hxc-9384-m385: h3 1.9.0 \u2014 yarn.lock", "shortDescription": {"text": "GHSA-4hxc-9384-m385: h3 1.9.0 \u2014 yarn.lock"}, "fullDescription": {"text": "h3: SSE Event Injection via Unsanitized Carriage Return (`\\r`) in EventStream Data and Comment Fields (Bypass of CVE Fix)\n\n## Summary\n\nThe `EventStream` class in h3 fails to sanitize carriage return (`\\r`) characters in `data` and `comment` fields. Per the SSE specification, `\\r` is a valid line terminator, so browsers interpret injected `\\r` as line breaks. This allows an attacker to inject arbitrary SSE events, spoof event types, and split a single `push()` call into multiple distinct browser-parsed events. This is an incomplete fix bypass of commit `7791538` which addressed `\\n` injection but missed `\\r`-only inj\n\nPackage: h3\nInstalled: 1.9.0\nFixed in: 2.0.1-rc.17, 1.15.9\nSeverity: MEDIUM\nFix: Upgrade h3 to 2.0.1-rc.17, 1.15.9"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2ae068f3d6007931", "name": "GHSA-72gr-qfp7-vwhw: h3 1.9.0 \u2014 yarn.lock", "shortDescription": {"text": "GHSA-72gr-qfp7-vwhw: h3 1.9.0 \u2014 yarn.lock"}, "fullDescription": {"text": "h3: Double Decoding in `serveStatic` Bypasses `resolveDotSegments` Path Traversal Protection via `%252e%252e`\n\n## Summary\n\nThe `serveStatic` utility in h3 applies a redundant `decodeURI()` call to the request pathname after `H3Event` has already performed percent-decoding with `%25` preservation. This double decoding converts `%252e%252e` into `%2e%2e`, which bypasses `resolveDotSegments()` (since it checks for literal `.` characters, not percent-encoded equivalents). When the resulting asset ID is resolved by URL-based backends (CDN, S3, object storage), `%2e%2e` is interpreted as `..` per the URL Stand\n\nPackage: h3\nInstalled: 1.9.0\nFixed in: 1.15.9\nSeverity: MEDIUM\nFix: Upgrade h3 to 1.15.9"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4ce14712aa4feb52", "name": "GHSA-wr4h-v87w-p3r7: h3 1.9.0 \u2014 yarn.lock", "shortDescription": {"text": "GHSA-wr4h-v87w-p3r7: h3 1.9.0 \u2014 yarn.lock"}, "fullDescription": {"text": "h3 has a Path Traversal via Percent-Encoded Dot Segments in serveStatic Allows Arbitrary File Read\n\n## Summary\n\n`serveStatic()` in h3 is vulnerable to path traversal via percent-encoded dot segments (`%2e%2e`), allowing an unauthenticated attacker to read arbitrary files outside the intended static directory on Node.js deployments.\n\n## Details\n\nThe vulnerability exists in `src/utils/static.ts` at [line 86](https://github.com/h3js/h3/blob/52c82e18bb643d124b8b9ec3b1f62b081f044611/src/utils/static.ts#L86):\n\n```typescript\nconst originalId = decodeURI(withLeadingSlash(withoutTrailingSlash(event.url\n\nPackage: h3\nInstalled: 1.9.0\nFixed in: 2.0.1-rc.15, 1.15.6\nSeverity: MEDIUM\nFix: Upgrade h3 to 2.0.1-rc.15, 1.15.6"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8063298c12ebcaac", "name": "CVE-2026-29045: hono 4.11.4 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-29045: hono 4.11.4 \u2014 yarn.lock"}, "fullDescription": {"text": "Hono vulnerable to arbitrary file access via serveStatic vulnerability \n\nHono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.12.4, when using serveStatic together with route-based middleware protections (e.g. app.use('/admin/*', ...)), inconsistent URL decoding allowed protected static resources to be accessed without authorization. The router used decodeURI, while serveStatic used decodeURIComponent. This mismatch allowed paths containing encoded slashes (%2F) to bypass middleware protections while still resolving\n\nPackage: hono\nInstalled: 4.11.4\nFixed in: 4.12.4\nSeverity: HIGH\nFix: Upgrade hono to 4.12.4"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-2c7c0e2a9272270b", "name": "CVE-2026-54290: hono 4.11.4 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-54290: hono 4.11.4 \u2014 yarn.lock"}, "fullDescription": {"text": "hono: CORS Middleware reflects any Origin with credentials when `origin` defaults to the wildcard\n\nHono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, with credentials: true and no explicit origin (the default wildcard), the CORS Middleware reflects the request's Origin and sends Access-Control-Allow-Credentials: true. Any site can then make credentialed cross-origin requests and read the responses, exposing cookie-authenticated endpoints to arbitrary origins. This vulnerability is fixed in 4.12.25.\n\nPackage: hono\nInstalled: 4.11.4\nFixed in: 4.12.25\nSeverity: HIGH\nFix: Upgrade hono to 4.12.25"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-a47493778e6d8236", "name": "CVE-2026-24398: hono 4.11.4 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-24398: hono 4.11.4 \u2014 yarn.lock"}, "fullDescription": {"text": "Hono IPv4 address validation bypass in IP Restriction Middleware allows IP spoofing\n\nHono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.11.7, IP Restriction Middleware in Hono is vulnerable to an IP address validation bypass. The `IPV4_REGEX` pattern and `convertIPv4ToBinary` function in `src/utils/ipaddr.ts` do not properly validate that IPv4 octet values are within the valid range of 0-255, allowing attackers to craft malformed IP addresses that bypass IP-based access controls. Version 4.11.7 contains a patch for the issue.\n\nPackage: hono\nInstalled: 4.11.4\nFixed in: 4.11.7\nSeverity: MEDIUM\nFix: Upgrade hono to 4.11.7"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-57cb08a2aa504c94", "name": "CVE-2026-24472: hono 4.11.4 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-24472: hono 4.11.4 \u2014 yarn.lock"}, "fullDescription": {"text": "Hono cache middleware ignores \"Cache-Control: private\" leading to Web Cache Deception\n\nHono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.11.7, Cache Middleware contains an information disclosure vulnerability caused by improper handling of HTTP cache control directives. The middleware does not respect standard cache control headers such as `Cache-Control: private` or `Cache-Control: no-store`, which may result in private or authenticated responses being cached and subsequently exposed to unauthorized users. Version 4.11.7 has \n\nPackage: hono\nInstalled: 4.11.4\nFixed in: 4.11.7\nSeverity: MEDIUM\nFix: Upgrade hono to 4.11.7"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c581cf1a00ca6221", "name": "CVE-2026-24473: hono 4.11.4 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-24473: hono 4.11.4 \u2014 yarn.lock"}, "fullDescription": {"text": "Hono has an Arbitrary Key Read in Serve static Middleware (Cloudflare Workers Adapter)\n\nHono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.11.7, Serve static Middleware for the Cloudflare Workers adapter contains an information disclosure vulnerability that may allow attackers to read arbitrary keys from the Workers environment. Improper validation of user-controlled paths can result in unintended access to internal asset keys. Version 4.11.7 contains a patch for the issue.\n\nPackage: hono\nInstalled: 4.11.4\nFixed in: 4.11.7\nSeverity: MEDIUM\nFix: Upgrade hono to 4.11.7"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-13de1fa8aab9d137", "name": "CVE-2026-24771: hono 4.11.4 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-24771: hono 4.11.4 \u2014 yarn.lock"}, "fullDescription": {"text": "Hono vulnerable to XSS through ErrorBoundary component \n\nHono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.11.7, a Cross-Site Scripting (XSS) vulnerability exists in the `ErrorBoundary` component of the hono/jsx library. Under certain usage patterns, untrusted user-controlled strings may be rendered as raw HTML, allowing arbitrary script execution in the victim's browser. Version 4.11.7 patches the issue.\n\nPackage: hono\nInstalled: 4.11.4\nFixed in: 4.11.7\nSeverity: MEDIUM\nFix: Upgrade hono to 4.11.7"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-46d453835f58fe70", "name": "CVE-2026-29085: hono 4.11.4 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-29085: hono 4.11.4 \u2014 yarn.lock"}, "fullDescription": {"text": "Hono Vulnerable to SSE Control Field Injection via CR/LF in writeSSE()\n\nHono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.12.4, when using streamSSE() in Streaming Helper, the event, id, and retry fields were not validated for carriage return (\\r) or newline (\\n) characters. Because the SSE protocol uses line breaks as field delimiters, this could allow injection of additional SSE fields within the same event frame if untrusted input was passed into these fields. This issue has been patched in version 4.12.4.\n\nPackage: hono\nInstalled: 4.11.4\nFixed in: 4.12.4\nSeverity: MEDIUM\nFix: Upgrade hono to 4.12.4"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e3ec2e6d8a6cc996", "name": "CVE-2026-29086: hono 4.11.4 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-29086: hono 4.11.4 \u2014 yarn.lock"}, "fullDescription": {"text": "Hono Vulnerable to Cookie Attribute Injection via Unsanitized domain and path in setCookie()\n\nHono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.12.4, the setCookie() utility did not validate semicolons (;), carriage returns (\\r), or newline characters (\\n) in the domain and path options when constructing the Set-Cookie header. Because cookie attributes are delimited by semicolons, this could allow injection of additional cookie attributes if untrusted input was passed into these fields. This issue has been patched in version 4.12.4.\n\nPackage: hono\nInstalled: 4.11.4\nFixed in: 4.12.4\nSeverity: MEDIUM\nFix: Upgrade hono to 4.12.4"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-305b10a40aee8174", "name": "CVE-2026-39407: hono 4.11.4 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-39407: hono 4.11.4 \u2014 yarn.lock"}, "fullDescription": {"text": "Hono: Middleware bypass via repeated slashes in serveStatic\n\nHono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.12, a path handling inconsistency in serveStatic allows protected static files to be accessed by using repeated slashes (//) in the request path. When route-based middleware (e.g., /admin/*) is used for authorization, the router may not match paths containing repeated slashes, while serveStatic resolves them as normalized paths. This can lead to a middleware bypass. This vulnerability is fixed in \n\nPackage: hono\nInstalled: 4.11.4\nFixed in: 4.12.12\nSeverity: MEDIUM\nFix: Upgrade hono to 4.12.12"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-dd3f913f894b429e", "name": "CVE-2026-39408: hono 4.11.4 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-39408: hono 4.11.4 \u2014 yarn.lock"}, "fullDescription": {"text": "Hono: Path traversal in toSSG() allows writing files outside the output directory\n\nHono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.12, a path traversal issue in toSSG() allows files to be written outside the configured output directory during static site generation. When using dynamic route parameters via ssgParams, specially crafted values can cause generated file paths to escape the intended output directory. This vulnerability is fixed in 4.12.12.\n\nPackage: hono\nInstalled: 4.11.4\nFixed in: 4.12.12\nSeverity: MEDIUM\nFix: Upgrade hono to 4.12.12"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6b1419aa0c7dc624", "name": "CVE-2026-39409: hono 4.11.4 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-39409: hono 4.11.4 \u2014 yarn.lock"}, "fullDescription": {"text": "Hono has incorrect IP matching in ipRestriction() for IPv4-mapped IPv6 addresses\n\nHono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.12, ipRestriction() does not canonicalize IPv4-mapped IPv6 client addresses (e.g. ::ffff:127.0.0.1) before applying IPv4 allow or deny rules. In environments such as Node.js dual-stack, this can cause IPv4 rules to fail to match, leading to unintended authorization behavior. This vulnerability is fixed in 4.12.12.\n\nPackage: hono\nInstalled: 4.11.4\nFixed in: 4.12.12\nSeverity: MEDIUM\nFix: Upgrade hono to 4.12.12"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-73ece1fc46130763", "name": "CVE-2026-39410: hono 4.11.4 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-39410: hono 4.11.4 \u2014 yarn.lock"}, "fullDescription": {"text": "Hono: Non-breaking space prefix bypass in cookie name handling in getCookie()\n\nHono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.12, a discrepancy between browser cookie parsing and parse() handling allows cookie prefix protections to be bypassed. Cookie names that are treated as distinct by the browser may be normalized to the same key by parse(), allowing attacker-controlled cookies to override legitimate ones. This vulnerability is fixed in 4.12.12.\n\nPackage: hono\nInstalled: 4.11.4\nFixed in: 4.12.12\nSeverity: MEDIUM\nFix: Upgrade hono to 4.12.12"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f1e0a645b17172af", "name": "CVE-2026-44455: hono 4.11.4 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-44455: hono 4.11.4 \u2014 yarn.lock"}, "fullDescription": {"text": "hono/jsx has Unvalidated JSX Tag Names that May Allow HTML Injection\n\nHono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.16, Improper handling of JSX element tag names in hono/jsx allowed unvalidated tag names to be directly inserted into the generated HTML output. When untrusted input is used as a tag name via the programmatic jsx() or createElement() APIs during server-side rendering, specially crafted values may break out of the intended element context and inject unintended HTML. This vulnerability is fixed in 4\n\nPackage: hono\nInstalled: 4.11.4\nFixed in: 4.12.16\nSeverity: MEDIUM\nFix: Upgrade hono to 4.12.16"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6b9e4750f2124d4f", "name": "CVE-2026-44456: hono 4.11.4 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-44456: hono 4.11.4 \u2014 yarn.lock"}, "fullDescription": {"text": "Hono: bodyLimit() can be bypassed for chunked / unknown-length requests\n\nHono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.16, bodyLimit() does not reliably enforce maxSize for requests without a usable Content-Length (e.g. Transfer-Encoding: chunked). Oversized requests can reach handlers and return 200 instead of 413. This vulnerability is fixed in 4.12.16.\n\nPackage: hono\nInstalled: 4.11.4\nFixed in: 4.12.16\nSeverity: MEDIUM\nFix: Upgrade hono to 4.12.16"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-01913cdbdf0071e5", "name": "CVE-2026-44457: hono 4.11.4 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-44457: hono 4.11.4 \u2014 yarn.lock"}, "fullDescription": {"text": "Hono's Cache Middleware ignores Vary: Authorization / Vary: Cookie leading to cross-user cache leakage\n\nHono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.18, Cache Middleware does not skip caching for responses that declare per-user variance via Vary: Authorization or Vary: Cookie. As a result, a response cached for one authenticated user may be served to subsequent requests from different users. This vulnerability is fixed in 4.12.18.\n\nPackage: hono\nInstalled: 4.11.4\nFixed in: 4.12.18\nSeverity: MEDIUM\nFix: Upgrade hono to 4.12.18"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-395f26d9b5516c3c", "name": "CVE-2026-44458: hono 4.11.4 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-44458: hono 4.11.4 \u2014 yarn.lock"}, "fullDescription": {"text": "Hono has CSS Declaration Injection via Style Object Values in JSX SSR\n\nHono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.18, the JSX renderer escapes style attribute object values for HTML but not for CSS. Untrusted input in a style object value or property name can therefore inject additional CSS declarations into the rendered style attribute. The impact is limited to CSS and does not allow JavaScript execution or HTML attribute breakout. This vulnerability is fixed in 4.12.18.\n\nPackage: hono\nInstalled: 4.11.4\nFixed in: 4.12.18\nSeverity: MEDIUM\nFix: Upgrade hono to 4.12.18"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0ebcd6a5c1a190d5", "name": "CVE-2026-47673: hono 4.11.4 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-47673: hono 4.11.4 \u2014 yarn.lock"}, "fullDescription": {"text": "Hono: JWT middleware accepts any Authorization scheme, not only Bearer\n\nHono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.21, the jwt and jwk middlewares do not verify that the Authorization header value uses theBearer scheme. Any two-part header value \u2014 regardless of the scheme name in the first position \u2014 proceeds to JWT verification. A request presenting a valid JWT under a non-Bearer scheme identifier (such as Basic or Token) is authenticated identically to a correctly formed Bearer request. This vulnerability is\n\nPackage: hono\nInstalled: 4.11.4\nFixed in: 4.12.21\nSeverity: MEDIUM\nFix: Upgrade hono to 4.12.21"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b7fc473afe12cd05", "name": "CVE-2026-47674: hono 4.11.4 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-47674: hono 4.11.4 \u2014 yarn.lock"}, "fullDescription": {"text": "Hono: IP Restriction bypasses static deny rules for non-canonical IPv6 \n\nHono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.21, the ip-restriction middleware (hono/ip-restriction) compares incoming IP addresses against configured deny and allow rules using string equality after partial normalization. Non-canonical IPv6 representations of an address already listed in a static rule \u2014 such as compressed forms, explicit-zero forms, or hex-notation IPv4-mapped addresses \u2014 do not match the normalized rule entry, causing the \n\nPackage: hono\nInstalled: 4.11.4\nFixed in: 4.12.21\nSeverity: MEDIUM\nFix: Upgrade hono to 4.12.21"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a44660d2f6fc26f2", "name": "CVE-2026-47675: hono 4.11.4 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-47675: hono 4.11.4 \u2014 yarn.lock"}, "fullDescription": {"text": "Hono: Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie injection\n\nHono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.21, the serialize() function in hono/cookie validates domain and path options against characters that corrupt Set-Cookie header syntax (;, \\r, \\n), but does not apply the same validation to sameSite and priority. An application that passes user-controlled input into either option may produce a Set-Cookie response header containing attacker-chosen additional attributes. This vulnerability is fixed \n\nPackage: hono\nInstalled: 4.11.4\nFixed in: 4.12.21\nSeverity: MEDIUM\nFix: Upgrade hono to 4.12.21"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f77174322025f4e9", "name": "CVE-2026-47676: hono 4.11.4 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-47676: hono 4.11.4 \u2014 yarn.lock"}, "fullDescription": {"text": "Hono: app.mount() strips mount prefix using undecoded path, causing incorrect routing for percent-encoded paths\n\nHono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.21, app.mount() strips the mount prefix from the incoming request path using the raw URL pathname, while route matching is performed against the percent-decoded path. This inconsistency causes the prefix to be stripped at the wrong position when the path contains percent-encoded multi-byte characters, resulting in the mounted sub-application receiving an incorrect path. This vulnerability is fixed\n\nPackage: hono\nInstalled: 4.11.4\nFixed in: 4.12.21\nSeverity: MEDIUM\nFix: Upgrade hono to 4.12.21"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2a665073035500e8", "name": "CVE-2026-54286: hono 4.11.4 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-54286: hono 4.11.4 \u2014 yarn.lock"}, "fullDescription": {"text": "hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`)\n\nHono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, on Windows hosts, an encoded backslash (%5C) in the request path decodes to \\, which the Windows path resolver treats as a separator. serve-static then resolves a single URL segment such as admin\\secret.txt into a nested file under the root and serves it, letting an attacker read static files meant to be protected behind prefix-mounted middleware. This vulnerability is fixed in 4.12.25.\n\nPackage: hono\nInstalled: 4.11.4\nFixed in: 4.12.25\nSeverity: MEDIUM\nFix: Upgrade hono to 4.12.25"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-aedff8236b98cf31", "name": "CVE-2026-54287: hono 4.11.4 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-54287: hono 4.11.4 \u2014 yarn.lock"}, "fullDescription": {"text": "hono: AWS Lambda adapter merges multiple `Set-Cookie` headers into one value, dropping cookies on ALB single-header and Lattice\n\nHono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, on AWS Lambda, the ALB single-header response and the VPC Lattice v2 response join multiple Set-Cookie headers into one comma-separated value. Because commas also appear inside cookie attributes (for example Expires dates), clients cannot split the value back into individual cookies and silently drop or misparse them. This vulnerability is fixed in 4.12.25.\n\nPackage: hono\nInstalled: 4.11.4\nFixed in: 4.12.25\nSeverity: MEDIUM\nFix: Upgrade hono to 4.12.25"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8b5655af0bcd214f", "name": "CVE-2026-54288: hono 4.11.4 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-54288: hono 4.11.4 \u2014 yarn.lock"}, "fullDescription": {"text": "hono: Body Limit Middleware can be bypassed on AWS Lambda by understating `Content-Length`\n\nHono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, the Body Limit Middleware trusts the request's Content-Length header to decide whether a body is within the limit. On AWS Lambda (API Gateway v1/v2, ALB, VPC Lattice, and Lambda@Edge) the body is delivered fully buffered and the adapter builds the request with the client-declared Content-Length, which need not match the actual payload. A client can declare a tiny Content-Length while sending a\n\nPackage: hono\nInstalled: 4.11.4\nFixed in: 4.12.25\nSeverity: MEDIUM\nFix: Upgrade hono to 4.12.25"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-94e489a79d241d17", "name": "CVE-2026-54289: hono 4.11.4 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-54289: hono 4.11.4 \u2014 yarn.lock"}, "fullDescription": {"text": "hono: Lambda@Edge adapter keeps only the last value of a repeated request header, dropping the rest\n\nHono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, on AWS Lambda@Edge, CloudFront delivers a request header that appears more than once as several separate entries. The adapter writes each value with Headers.set instead of Headers.append, so every value overwrites the previous one and only the last reaches the application. Repeated request headers such as X-Forwarded-For, Forwarded, and Via are silently truncated to a single value. Request mid\n\nPackage: hono\nInstalled: 4.11.4\nFixed in: 4.12.25\nSeverity: MEDIUM\nFix: Upgrade hono to 4.12.25"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d02b7031ac7c9030", "name": "CVE-2026-56761: hono 4.11.4 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-56761: hono 4.11.4 \u2014 yarn.lock"}, "fullDescription": {"text": "hono Improperly Handles JSX Attribute Names Allows HTML Injection in hono/jsx SSR\n\nhono before 4.12.14 contains an html injection vulnerability in jsx server-side rendering that allows attackers to inject unintended html by using malformed attribute names. Attackers can craft specially crafted attribute keys containing characters like quotes or angle brackets to break html tag boundaries and inject arbitrary attributes or elements.\n\nPackage: hono\nInstalled: 4.11.4\nFixed in: 4.12.14\nSeverity: MEDIUM\nFix: Upgrade hono to 4.12.14"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b1125e2b3e2542a9", "name": "CVE-2026-56762: hono 4.11.4 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-56762: hono 4.11.4 \u2014 yarn.lock"}, "fullDescription": {"text": "Hono missing validation of cookie name on write path in setCookie()\n\nHono before 4.12.12 does not validate cookie names on the write path in the setCookie(), serialize(), and serializeSigned() functions, allowing invalid characters such as control characters (e.g. \\r or \\n) when an application passes a user-controlled cookie name. This can produce malformed Set-Cookie header values. In modern runtimes such as Node.js and Cloudflare Workers, such invalid header values are rejected and cause a runtime error before the response is sent, so header injection or respon\n\nPackage: hono\nInstalled: 4.11.4\nFixed in: 4.12.12\nSeverity: MEDIUM\nFix: Upgrade hono to 4.12.12"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ad3bd4a94d153a3d", "name": "CVE-2026-56763: hono 4.11.4 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-56763: hono 4.11.4 \u2014 yarn.lock"}, "fullDescription": {"text": "Hono vulnerable to Prototype Pollution possible through __proto__ key allowed in parseBody({ dot: true })\n\nHono before 4.12.7 allows __proto__ key in parseBody with dot option enabled, permitting specially crafted form field names to create objects with __proto__ properties. When parsed results are merged into regular JavaScript objects using unsafe merge patterns, attackers can exploit this to achieve prototype pollution and modify object behavior.\n\nPackage: hono\nInstalled: 4.11.4\nFixed in: 4.12.7\nSeverity: MEDIUM\nFix: Upgrade hono to 4.12.7"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-09b322ac3a299aeb", "name": "CVE-2026-59895: hono 4.11.4 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-59895: hono 4.11.4 \u2014 yarn.lock"}, "fullDescription": {"text": "hono: Hono: Arbitrary markup injection via improper handling of class names in server-side rendering.\n\nHono is a Web application framework that provides support for any JavaScript runtime. From 4.0.0 before 4.12.27, cx() in hono/css composes class names from plain strings but marks the result as already escaped without HTML-escaping the input, allowing untrusted className values used in a JSX class attribute during server-side rendering to break out of the attribute and inject arbitrary markup. This issue is fixed in version 4.12.27.\n\nPackage: hono\nInstalled: 4.11.4\nFixed in: 4.12.27\nSeverity: MEDIUM\nFix: Upgrade hono to 4.12.27"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-cfc7c48a6956dc32", "name": "CVE-2026-59897: hono 4.11.4 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-59897: hono 4.11.4 \u2014 yarn.lock"}, "fullDescription": {"text": "hono: Hono: Information disclosure due to incorrect header de-duplication in AWS API Gateway v1 adapter\n\nHono is a Web application framework that provides support for any JavaScript runtime. From 4.3.3 before 4.12.27, the AWS API Gateway v1 adapter can drop a distinct repeated request header value because it de-duplicates values using a substring comparison instead of an exact match, so middleware or application logic that depends on the complete X-Forwarded-For chain, rate limiting, audit logging, or proxy-chain validation can receive incomplete data. This issue is fixed in version 4.12.27.\n\nPackage: hono\nInstalled: 4.11.4\nFixed in: 4.12.27\nSeverity: MEDIUM\nFix: Upgrade hono to 4.12.27"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c8493291a28abee6", "name": "CVE-2026-69207: hono 4.11.4 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-69207: hono 4.11.4 \u2014 yarn.lock"}, "fullDescription": {"text": "Hono: ReDoS in CORS middleware via Access-Control-Request-Headers\n\nHono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.34, the built-in CORS middleware, hono/cors, is vulnerable to a regular expression denial of service (ReDoS). During a preflight OPTIONS request, the middleware parses the attacker-controlled Access-Control-Request-Headers header using a whitespace-tolerant regular expression whose backtracking makes its running time quadratic in the input length. Because the header value is bounded only by the de\n\nPackage: hono\nInstalled: 4.11.4\nFixed in: 4.12.34\nSeverity: MEDIUM\nFix: Upgrade hono to 4.12.34"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-317480cb97b702ef", "name": "CVE-2026-71850: hono 4.11.4 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-71850: hono 4.11.4 \u2014 yarn.lock"}, "fullDescription": {"text": "Hono: `memo()` retains SSR output across requests, leading to cross-user data disclosure\n\nHono is a Web application framework that provides support for any JavaScript runtime. From 3.8.0 to 4.12.33, memo() from hono/jsx retains the result of a server side render and reuses it for later renders with comparator equal props, and request scoped values read inside the component take no part in that comparison, so a response can contain HTML rendered for another user's request. Components wrapped with memo() are compared by props alone; values read implicitly during rendering, such as JSX \n\nPackage: hono\nInstalled: 4.11.4\nFixed in: 4.12.34\nSeverity: MEDIUM\nFix: Upgrade hono to 4.12.34"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-dc37e1e21a0facec", "name": "CVE-2026-84363: hono 4.11.4 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-84363: hono 4.11.4 \u2014 yarn.lock"}, "fullDescription": {"text": "Hono: Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials\n\nHono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.13.5, Hono's query helpers treat a question mark after a literal hash fragment as the start of a query string, so the application can read request parameters that browsers, new URL(), reverse proxies, filtering rules, parameter allow and deny lists, access logging, request validation, and other middleware do not observe. The Cache Middleware removes the fragment when building its cache key, allowing \n\nPackage: hono\nInstalled: 4.11.4\nFixed in: 4.13.5\nSeverity: MEDIUM\nFix: Upgrade hono to 4.13.5"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ab7d00736b4c3a65", "name": "CVE-2026-84364: hono 4.11.4 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-84364: hono 4.11.4 \u2014 yarn.lock"}, "fullDescription": {"text": "Hono: Unbounded dot-notation nesting in `parseBody()` can cause memory exhaustion\n\nHono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.13.5, when parseBody() expands dot-separated form field names into nested objects with dot-notation parsing enabled, it does not limit the nesting depth or the total number of intermediate objects created. Empty segments are preserved, so one deeply dotted field name can encode one nesting level per byte, while a large number of shallowly dotted fields can create the same amplification across a reque\n\nPackage: hono\nInstalled: 4.11.4\nFixed in: 4.13.5\nSeverity: MEDIUM\nFix: Upgrade hono to 4.13.5"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8b06896ad9bf359b", "name": "CVE-2026-84365: hono 4.11.4 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-84365: hono 4.11.4 \u2014 yarn.lock"}, "fullDescription": {"text": "Hono: Incomplete fix for CVE-2026-39408: `toSSG()` still writes files outside the output directory\n\nHono is a Web application framework that provides support for any JavaScript runtime. From 4.12.12 until 4.13.5, the fix released for CVE-2026-39408 does not cover every traversal sequence, and toSSG() can still write files outside the configured output directory when a route parameter contains consecutive parent-directory segments. Static site generation builds each output path from the route path and values supplied through ssgParams, then verifies that the result stays inside the output direc\n\nPackage: hono\nInstalled: 4.11.4\nFixed in: 4.13.5\nSeverity: MEDIUM\nFix: Upgrade hono to 4.13.5"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-02e1a9a6a892e360", "name": "CVE-2026-93981: hono 4.11.4 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-93981: hono 4.11.4 \u2014 yarn.lock"}, "fullDescription": {"text": "hono: hono/jsx: Cross-Site Scripting via Unescaped Strings\n\nhono before 4.13.7 fails to HTML-escape plain strings rendered by hono/jsx as a child or fallback of Suspense, as a string child of ErrorBoundary alongside an asynchronous sibling, as the single child of a Context.Provider, or as the root value passed to renderToString() or renderToReadableStream() from hono/jsx/dom/server. These paths stringify their input and treat the result as already-escaped markup, so an attacker who controls such a string during server-side rendering can inject arbitrary \n\nPackage: hono\nInstalled: 4.11.4\nFixed in: 4.13.7\nSeverity: MEDIUM\nFix: Upgrade hono to 4.13.7"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-05a4abf3bf20cd51", "name": "CVE-2026-44459: hono 4.11.4 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-44459: hono 4.11.4 \u2014 yarn.lock"}, "fullDescription": {"text": "Hono has improper validation of NumericDate claims (exp, nbf, iat) in JWT verify()\n\nHono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.18, improper validation of the JWT NumericDate claims exp, nbf, and iat in hono/utils/jwt allows tokens with non-spec-compliant claim values to silently bypass time-based checks. This issue is not exploitable by an anonymous attacker; it only manifests when a malformed claim value reaches verify() \u2014 typically when the application itself issues such tokens, or when the signing key is otherwise unde\n\nPackage: hono\nInstalled: 4.11.4\nFixed in: 4.12.18\nSeverity: LOW\nFix: Upgrade hono to 4.12.18"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d2b83c502165593b", "name": "CVE-2026-71849: hono 4.11.4 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-71849: hono 4.11.4 \u2014 yarn.lock"}, "fullDescription": {"text": "Hono: Proxy Helper does not remove response headers listed in the `Connection` header\n\nHono is a Web application framework that provides support for any JavaScript runtime. From 4.7.0 to 4.12.33, the Proxy Helper proxy() function in hono/proxy does not remove response headers named by the origin's Connection header. Per RFC 9110 Section 7.6.1, an intermediary must remove the header fields listed in a message's Connection header field before forwarding the message, in addition to the well known hop by hop headers, but the proxy() function only removed the well known hop by hop head\n\nPackage: hono\nInstalled: 4.11.4\nFixed in: 4.12.34\nSeverity: LOW\nFix: Upgrade hono to 4.12.34"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-80224fe410daf37a", "name": "GHSA-gq3j-xvxp-8hrf: hono 4.11.4 \u2014 yarn.lock", "shortDescription": {"text": "GHSA-gq3j-xvxp-8hrf: hono 4.11.4 \u2014 yarn.lock"}, "fullDescription": {"text": "Hono added timing comparison hardening in basicAuth and bearerAuth\n\n## Summary\n\nThe `basicAuth` and `bearerAuth` middlewares previously used a comparison that was not fully timing-safe.\n\nThe `timingSafeEqual` function used normal string equality (`===`) when comparing hash values. This comparison may stop early if values differ, which can theoretically cause small timing differences.\n\nThe implementation has been updated to use a safer comparison method.\n\n\n## Details\n\nThe issue was caused by the use of normal string equality (`===`) when comparing hash values ins\n\nPackage: hono\nInstalled: 4.11.4\nFixed in: 4.11.10\nSeverity: LOW\nFix: Upgrade hono to 4.11.10"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-91e2849b1fe99681", "name": "CVE-2026-29063: immutable 3.8.2 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-29063: immutable 3.8.2 \u2014 yarn.lock"}, "fullDescription": {"text": "immutable-js: Immutable.js: Arbitrary code execution via Prototype Pollution\n\nImmutable.js provides many Persistent Immutable data structures. Prior to versions 3.8.3, 4.3.7, and 5.1.5, Prototype Pollution is possible in immutable via the mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.toObject() APIs. This issue has been patched in versions 3.8.3, 4.3.7, and 5.1.5.\n\nPackage: immutable\nInstalled: 3.8.2\nFixed in: 4.3.8, 5.1.5, 3.8.3\nSeverity: HIGH\nFix: Upgrade immutable to 4.3.8, 5.1.5, 3.8.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-302e8d5edcfbf20a", "name": "CVE-2026-59879: immutable 3.8.2 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-59879: immutable 3.8.2 \u2014 yarn.lock"}, "fullDescription": {"text": "immutable-js: Immutable.js: Denial of Service due to mishandling of large index values in List operations\n\nImmutable.js provides many Persistent Immutable data structures. Prior to 4.3.9 and 5.1.8, List#set, List#setSize, List#setIn, List#updateIn, and the functional set, setIn, and updateIn mishandle an index or size in the range 2 ** 30 to 2 ** 31 in setListBounds in src/List.js, causing an empty List to enter an uncatchable infinite loop, a populated List to allocate without bound until process abort, or setSize to silently wrap large values. This issue is fixed in versions 4.3.9 and 5.1.8.\n\nPackage: immutable\nInstalled: 3.8.2\nFixed in: 4.3.9, 5.1.8, 3.8.4\nSeverity: HIGH\nFix: Upgrade immutable to 4.3.9, 5.1.8, 3.8.4"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-fb3d9cc4243dd94e", "name": "CVE-2026-59880: immutable 3.8.2 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-59880: immutable 3.8.2 \u2014 yarn.lock"}, "fullDescription": {"text": "Immutable.js provides many Persistent Immutable data structures. Prior ...\n\nImmutable.js provides many Persistent Immutable data structures. Prior to 4.3.9 and 5.1.8, Immutable.Map and Immutable.Set keep keys that share the same 32-bit hash in a HashCollisionNode collision bucket that is scanned linearly, allowing an attacker who controls keys inserted into a Map, such as through Immutable.Map(obj), Immutable.fromJS(obj), state.merge(userObject), or mergeDeep, to craft many colliding keys and degrade insertion and lookup to consume disproportionate CPU. This issue is fi\n\nPackage: immutable\nInstalled: 3.8.2\nFixed in: 4.3.9, 5.1.8, 3.8.4\nSeverity: HIGH\nFix: Upgrade immutable to 4.3.9, 5.1.8, 3.8.4"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-57d9fa7bdd87cad6", "name": "CVE-2026-92599: joi 17.13.3 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-92599: joi 17.13.3 \u2014 yarn.lock"}, "fullDescription": {"text": "joi: joi: Denial of Service via `isoDate` validation regular expression\n\njoi (npm package `joi`, hapi.js) versions >=17.2.0 <17.13.7 and >=18.0.0 <18.2.6 are vulnerable to regular expression denial of service in the `Joi.string().isoDate()` validation rule. One of the regular expressions the rule applies to the input is unanchored, so a valid ISO date followed by a long run of fractional-second digits causes the regex engine to restart its search from every position in the string, yielding time proportional to the square of the input length (about 1.4 s for 64 KB of \n\nPackage: joi\nInstalled: 17.13.3\nFixed in: 17.13.7, 18.2.6\nSeverity: HIGH\nFix: Upgrade joi to 17.13.7, 18.2.6"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-7df61d8e4537898a", "name": "CVE-2026-48038: joi 17.13.3 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-48038: joi 17.13.3 \u2014 yarn.lock"}, "fullDescription": {"text": "joi: joi: Denial of Service via uncaught RangeError on deeply nested input through recursive link() schemas\n\njoi is a schema description language and data validator for JavaScript. Prior to 17.13.4 and 18.2.1, denial of service is possible via an untrapped exception in services validating user-supplied JSON or object input with recursive link() schemas. When validate() is called without try/catch in a request handler, deeply nested input can trigger an unhandled RangeError and potentially crash the process; lower-impact paths using validateAsync() or try/catch produce a RangeError instead of a structur\n\nPackage: joi\nInstalled: 17.13.3\nFixed in: 18.2.1, 17.13.4\nSeverity: MEDIUM\nFix: Upgrade joi to 18.2.1, 17.13.4"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-99a9a05a88b59244", "name": "CVE-2026-90771: joi 17.13.3 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-90771: joi 17.13.3 \u2014 yarn.lock"}, "fullDescription": {"text": "joi: joi: Prototype Pollution via custom messages\n\njoi before versions 17.13.8 and 18.2.9 contains a prototype pollution vulnerability in the messages compilation function that accepts __proto__ as an error code. Attackers can supply __proto__ keys in custom messages to replace the returned object's prototype, breaking downstream code relying on Object.prototype methods.\n\nPackage: joi\nInstalled: 17.13.3\nFixed in: 17.13.8, 18.2.9\nSeverity: MEDIUM\nFix: Upgrade joi to 17.13.8, 18.2.9"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-41533a818f402bf9", "name": "CVE-2026-84367: joi 17.13.3 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-84367: joi 17.13.3 \u2014 yarn.lock"}, "fullDescription": {"text": "joi: joi: Prototype pollution via dynamic key renaming\n\njoi is a schema description language and data validator for JavaScript. From 16.0.0 until 17.13.5 and 18.2.4, joi's lib/types/keys.js internals.rename() implementation used by object().rename() permits a schema that renames keys with a regular-expression source and a Joi.expression() or Joi.x() target that interpolates the pattern's own match data, combined with { multiple: true }, to derive a target from an attacker-controlled input key. An attacker can send x-__proto__ with an object value, ca\n\nPackage: joi\nInstalled: 17.13.3\nFixed in: 17.13.5, 18.2.4\nSeverity: LOW\nFix: Upgrade joi to 17.13.5, 18.2.4"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5469a3bffad71f14", "name": "CVE-2026-84368: joi 17.13.3 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-84368: joi 17.13.3 \u2014 yarn.lock"}, "fullDescription": {"text": "joi: @hapi/joi: joi: Prototype pollution via untrusted input in schema configuration\n\njoi is a schema description language and data validator for JavaScript. From 16.0.0 until 17.13.6 and 18.2.5, the @hapi/joi package through 17.1.1 and the successor joi package contain prototype pollution in lib/messages.js, where exports.compile() and exports.merge() reuse inherited objects for attacker-controlled language keys supplied through messages(), message(), prefs({ messages }), Joi.extend({ messages }), or rule({ message }). A language key named __proto__ writes properties onto Object\n\nPackage: joi\nInstalled: 17.13.3\nFixed in: 17.13.6, 18.2.5\nSeverity: LOW\nFix: Upgrade joi to 17.13.6, 18.2.5"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3c6d689345d79693", "name": "CVE-2026-46625: js-cookie 3.0.1 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-46625: js-cookie 3.0.1 \u2014 yarn.lock"}, "fullDescription": {"text": "js-cookie: JavaScript Cookie: Cookie attribute manipulation via prototype pollution\n\nJavaScript Cookie is a JavaScript API for handling cookies, client-side. Prior to version 3.0.7, js-cookie's internal assign() helper copies properties with for...in + plain assignment. When the source object is produced by JSON.parse, the JSON object's \"__proto__\" member is an own enumerable property, so the for\u2026in enumerates it and the target[key] = source[key] write triggers the Object.prototype.__proto__ setter on the fresh target ({}). The result is a per-instance prototype hijack: Object.p\n\nPackage: js-cookie\nInstalled: 3.0.1\nFixed in: 3.0.7\nSeverity: HIGH\nFix: Upgrade js-cookie to 3.0.7"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-579ac7c5d38b02c7", "name": "CVE-2026-59869: js-yaml 4.1.1 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-59869: js-yaml 4.1.1 \u2014 yarn.lock"}, "fullDescription": {"text": "js-yaml: js-yaml: Denial of Service via crafted YAML documents\n\njs-yaml is a JavaScript YAML parser and dumper. From 3.0.0 before 3.15.0 and from 4.0.0 before 4.3.0, js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly when a chain of mappings uses merge keys where each mapping merges the previous one. This issue is fixed in versions 3.15.0 and 4.3.0.\n\nPackage: js-yaml\nInstalled: 4.1.1\nFixed in: 3.15.0, 4.3.0\nSeverity: HIGH\nFix: Upgrade js-yaml to 3.15.0, 4.3.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-a683cab306b241d7", "name": "CVE-2026-84375: js-yaml 4.1.1 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-84375: js-yaml 4.1.1 \u2014 yarn.lock"}, "fullDescription": {"text": "js-yaml: js-yaml: Denial of Service vulnerability in YAML parsing\n\njs-yaml is a JavaScript YAML parser and dumper. From 3.0.0 until 3.15.2, 4.3.2, and 5.4.1, maxTotalMergeKeys in lib/js-yaml/loader.js and lib/loader.js does not count empty mapping sources while processing the merge key <<. An attacker can alias a large sequence of empty mappings into many merge targets, causing O(N * K) processing while totalMergeKeys remains unchanged and the configured resource limit is never reached. A relatively small YAML document can therefore cause prolonged CPU consumpt\n\nPackage: js-yaml\nInstalled: 4.1.1\nFixed in: 4.3.2, 3.15.2\nSeverity: HIGH\nFix: Upgrade js-yaml to 4.3.2, 3.15.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-a0e3dcf2736c9d95", "name": "GHSA-5p4m-2wfm-xmqj: js-yaml 4.1.1 \u2014 yarn.lock", "shortDescription": {"text": "GHSA-5p4m-2wfm-xmqj: js-yaml 4.1.1 \u2014 yarn.lock"}, "fullDescription": {"text": "JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) \u2014 CVE-2026-59870 fix not backported\n\n# Quadratic CPU consumption in `!!omap` resolution (js-yaml 3.x and 4.x)\n\n## Summary\n\n`resolveYamlOmap()` enforces key uniqueness for `!!omap` sequences with a linear\nscan (`objectKeys.indexOf(...)`) inside the per-element loop, making resolution\n**O(n\u00b2)** in the number of entries. A modestly sized YAML document therefore\nconsumes disproportionate CPU inside `yaml.load()`, giving a denial of service\nagainst any consumer that parses untrusted YAML.\n\n`!!omap` is registered in the **default schema*\n\nPackage: js-yaml\nInstalled: 4.1.1\nFixed in: 4.3.1, 3.15.1\nSeverity: HIGH\nFix: Upgrade js-yaml to 4.3.1, 3.15.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-344d8b12b7c51e6a", "name": "CVE-2026-53550: js-yaml 4.1.1 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-53550: js-yaml 4.1.1 \u2014 yarn.lock"}, "fullDescription": {"text": "js-yaml: js-yaml: Denial of Service via crafted YAML merge keys\n\njs-yaml is a JavaScript YAML parser and dumper. Prior to 4.2.0 and 3.15.0, a crafted YAML document can trigger algorithmic CPU exhaustion in js-yaml merge-key processing (<<) by repeating the same alias many times in a merge sequence. This causes quadratic parse-time behavior relative to input size and can block a Node.js worker/event loop for seconds with a relatively small payload (tens of KB), resulting in denial of service. The issue is in merge handling inside lib/loader.js. This vulnerabil\n\nPackage: js-yaml\nInstalled: 4.1.1\nFixed in: 4.2.0, 3.15.0\nSeverity: MEDIUM\nFix: Upgrade js-yaml to 4.2.0, 3.15.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c7fda804cdbca677", "name": "CVE-2026-48801: linkify-it 5.0.0 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-48801: linkify-it 5.0.0 \u2014 yarn.lock"}, "fullDescription": {"text": "linkify-it: linkify-it: Denial of Service via algorithmic complexity vulnerability\n\nlinkify-it is a links recognition library with full Unicode support. Prior to 5.0.1, LinkifyIt.prototype.match, the package's primary public API, has O(N\u00b2) algorithmic complexity for inputs containing many fuzzy links or emails because the JavaScript-level scan loop re-slices input and re-runs unanchored regex searches on progressively shorter tails. Any service that synchronously renders untrusted Markdown with linkify:true on a request hot path can inherit a worker-process denial of service tr\n\nPackage: linkify-it\nInstalled: 5.0.0\nFixed in: 5.0.1\nSeverity: HIGH\nFix: Upgrade linkify-it to 5.0.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-0a2723cec4f9c38e", "name": "CVE-2026-59887: linkify-it 5.0.0 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-59887: linkify-it 5.0.0 \u2014 yarn.lock"}, "fullDescription": {"text": "linkify-it: linkify-it: Denial of Service via crafted mailto: links\n\nlinkify-it is a links recognition library with full Unicode support. Prior to 5.0.2, the mailto: schema validator used by .test() and .match() can be invoked at every mailto: occurrence and scan the remaining input through src_email_name in lib/re.mjs, causing O(n^2) CPU consumption on crafted user text. This issue is fixed in version 5.0.2.\n\nPackage: linkify-it\nInstalled: 5.0.0\nFixed in: 5.0.2\nSeverity: HIGH\nFix: Upgrade linkify-it to 5.0.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-c8c09c08bb23a25e", "name": "CVE-2026-4800: lodash 4.17.21 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-4800: lodash 4.17.21 \u2014 yarn.lock"}, "fullDescription": {"text": "lodash: lodash: Arbitrary code execution via untrusted input in template imports\n\nImpact:\n\nThe fix for CVE-2021-23337 (https://github.com/advisories/GHSA-35jh-r3h4-6jhm) added validation for the variable option in _.template but did not apply the same validation to options.imports key names. Both paths flow into the same Function() constructor sink.\n\nWhen an application passes untrusted input as options.imports key names, an attacker can inject default-parameter expressions that execute arbitrary code at template compilation time.\n\nAdditionally, _.template uses assignInWith t\n\nPackage: lodash\nInstalled: 4.17.21\nFixed in: 4.18.0\nSeverity: HIGH\nFix: Upgrade lodash to 4.18.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-62e4f989d78fabe9", "name": "CVE-2025-13465: lodash 4.17.21 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2025-13465: lodash 4.17.21 \u2014 yarn.lock"}, "fullDescription": {"text": "lodash: prototype pollution in _.unset and _.omit functions\n\nLodash versions 4.0.0 through 4.17.22 are vulnerable to prototype pollution in the _.unset\u00a0and _.omit\u00a0functions. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes.\n\nThe issue permits deletion of properties but does not allow overwriting their original behavior.\n\nThis issue is patched on 4.17.23\n\nPackage: lodash\nInstalled: 4.17.21\nFixed in: 4.17.23\nSeverity: MEDIUM\nFix: Upgrade lodash to 4.17.23"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5832cfc129b36d19", "name": "CVE-2026-2950: lodash 4.17.21 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-2950: lodash 4.17.21 \u2014 yarn.lock"}, "fullDescription": {"text": "lodash: Lodash: Prototype pollution allows deletion of built-in prototype properties via array path bypass\n\nImpact:\n\nLodash versions 4.17.23 and earlier are vulnerable to prototype pollution in the _.unset and _.omit functions. The fix for (CVE-2025-13465: https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg) only guards against string key members, so an attacker can bypass the check by passing array-wrapped path segments. This allows deletion of properties from built-in prototypes such as Object.prototype, Number.prototype, and String.prototype.\n\nThe issue permits deletion of prot\n\nPackage: lodash\nInstalled: 4.17.21\nFixed in: 4.18.0\nSeverity: MEDIUM\nFix: Upgrade lodash to 4.18.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c0e30e72a7703430", "name": "CVE-2026-2327: markdown-it 14.1.0 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-2327: markdown-it 14.1.0 \u2014 yarn.lock"}, "fullDescription": {"text": "markdown-it: markdown-it: Denial of Service via Regular Expression Denial of Service in linkify function\n\nVersions of the package markdown-it from 13.0.0 and before 14.1.1 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the use of the regex /\\*+$/ in the linkify function. An attacker can supply a long sequence of * characters followed by a non-matching character, which triggers excessive backtracking and may lead to a denial-of-service condition.\n\nPackage: markdown-it\nInstalled: 14.1.0\nFixed in: 14.1.1\nSeverity: MEDIUM\nFix: Upgrade markdown-it to 14.1.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-309f25d9e46935ff", "name": "CVE-2026-48988: markdown-it 14.1.0 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-48988: markdown-it 14.1.0 \u2014 yarn.lock"}, "fullDescription": {"text": "markdown-it: markdown-it: Denial of Service via quadratic processing of smartquotes with typographer enabled\n\nmarkdown-it is a Markdown parser. Versions 14.1.1 and below contain a denial-of-service vulnerability when typographer: true is enabled, due to quadratic (O(n^2)) processing in the smartquotes rule. The issue stems from repeatedly modifying strings with replaceAt(), which performs O(n) slicing and concatenation per quote character. This can cause excessive CPU consumption when parsing quote-heavy, user-supplied markdown and may let attackers degrade or disrupt service availability. Although typo\n\nPackage: markdown-it\nInstalled: 14.1.0\nFixed in: 14.2.0\nSeverity: MEDIUM\nFix: Upgrade markdown-it to 14.2.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-175f9ff3811af138", "name": "GHSA-253c-mchw-3w2r: markdown-it 14.1.0 \u2014 yarn.lock", "shortDescription": {"text": "GHSA-253c-mchw-3w2r: markdown-it 14.1.0 \u2014 yarn.lock"}, "fullDescription": {"text": "markdown-it linkify: true has two quadratic paths, so a few hundred KB of markdown blocks the event loop for tens of seconds\n\n## Summary\n\nTwo independent quadratic paths in the `linkify: true` handling. Both are in markdown-it's own code rather than in linkify-it, which stays linear on both payloads.\n\n`src/rules_core/linkify.ts` calls `arrayReplaceAt` once per linkified text token, and that rebuilds the whole `children` array each time. A paragraph of N soft-broken lines is one inline token with about 2N children, so you get N rebuilds over a 2N array. Schema-less emails are what reach it. A `http://` link gets consume\n\nPackage: markdown-it\nInstalled: 14.1.0\nFixed in: 15.0.1, 14.3.1\nSeverity: MEDIUM\nFix: Upgrade markdown-it to 15.0.1, 14.3.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-41eb8152216a524e", "name": "CVE-2026-26996: minimatch 5.1.0 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-26996: minimatch 5.1.0 \u2014 yarn.lock"}, "fullDescription": {"text": "minimatch: minimatch: Denial of Service via specially crafted glob patterns\n\nminimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains many consecutive * wildcards followed by a literal character that doesn't appear in the test string. Each * compiles to a separate [^/]*? regex group, and when the match fails, V8's regex engine backtracks exponentially across all possible splits. The time complexity is O(4^N) \n\nPackage: minimatch\nInstalled: 5.1.0\nFixed in: 10.2.1, 9.0.6, 8.0.5, 7.4.7, 6.2.1, 5.1.7, 4.2.4, 3.1.3\nSeverity: HIGH\nFix: Upgrade minimatch to 10.2.1, 9.0.6, 8.0.5, 7.4.7, 6.2.1, 5.1.7, 4.2.4, 3.1.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-08be92ce55ccbfb4", "name": "CVE-2026-27903: minimatch 5.1.0 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-27903: minimatch 5.1.0 \u2014 yarn.lock"}, "fullDescription": {"text": "minimatch: minimatch: Denial of Service due to unbounded recursive backtracking via crafted glob patterns\n\nminimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3, `matchOne()` performs unbounded recursive backtracking when a glob pattern contains multiple non-adjacent `**` (GLOBSTAR) segments and the input path does not match. The time complexity is O(C(n, k)) -- binomial -- where `n` is the number of path segments and `k` is the number of globstars. With k=11 and n=30, a call\n\nPackage: minimatch\nInstalled: 5.1.0\nFixed in: 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.3\nSeverity: HIGH\nFix: Upgrade minimatch to 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-f46ae4aec507c3ae", "name": "CVE-2026-27904: minimatch 5.1.0 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-27904: minimatch 5.1.0 \u2014 yarn.lock"}, "fullDescription": {"text": "minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions\n\nminimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4, nested `*()` extglobs produce regexps with nested unbounded quantifiers (e.g. `(?:(?:a|b)*)*`), which exhibit catastrophic backtracking in V8. With a 12-byte pattern `*(*(*(a|b)))` and an 18-byte non-matching input, `minimatch()` stalls for over 7 seconds. Adding a single nesting level or a few input characters pushe\n\nPackage: minimatch\nInstalled: 5.1.0\nFixed in: 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.4\nSeverity: HIGH\nFix: Upgrade minimatch to 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.4"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-5d5d262f359102ba", "name": "CVE-2026-26996: minimatch 7.4.6 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-26996: minimatch 7.4.6 \u2014 yarn.lock"}, "fullDescription": {"text": "minimatch: minimatch: Denial of Service via specially crafted glob patterns\n\nminimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains many consecutive * wildcards followed by a literal character that doesn't appear in the test string. Each * compiles to a separate [^/]*? regex group, and when the match fails, V8's regex engine backtracks exponentially across all possible splits. The time complexity is O(4^N) \n\nPackage: minimatch\nInstalled: 7.4.6\nFixed in: 10.2.1, 9.0.6, 8.0.5, 7.4.7, 6.2.1, 5.1.7, 4.2.4, 3.1.3\nSeverity: HIGH\nFix: Upgrade minimatch to 10.2.1, 9.0.6, 8.0.5, 7.4.7, 6.2.1, 5.1.7, 4.2.4, 3.1.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-8e2ac1b0092038be", "name": "CVE-2026-27903: minimatch 7.4.6 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-27903: minimatch 7.4.6 \u2014 yarn.lock"}, "fullDescription": {"text": "minimatch: minimatch: Denial of Service due to unbounded recursive backtracking via crafted glob patterns\n\nminimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3, `matchOne()` performs unbounded recursive backtracking when a glob pattern contains multiple non-adjacent `**` (GLOBSTAR) segments and the input path does not match. The time complexity is O(C(n, k)) -- binomial -- where `n` is the number of path segments and `k` is the number of globstars. With k=11 and n=30, a call\n\nPackage: minimatch\nInstalled: 7.4.6\nFixed in: 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.3\nSeverity: HIGH\nFix: Upgrade minimatch to 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-7992c3409bcd2893", "name": "CVE-2026-27904: minimatch 7.4.6 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-27904: minimatch 7.4.6 \u2014 yarn.lock"}, "fullDescription": {"text": "minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions\n\nminimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4, nested `*()` extglobs produce regexps with nested unbounded quantifiers (e.g. `(?:(?:a|b)*)*`), which exhibit catastrophic backtracking in V8. With a 12-byte pattern `*(*(*(a|b)))` and an 18-byte non-matching input, `minimatch()` stalls for over 7 seconds. Adding a single nesting level or a few input characters pushe\n\nPackage: minimatch\nInstalled: 7.4.6\nFixed in: 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.4\nSeverity: HIGH\nFix: Upgrade minimatch to 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.4"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-36c2c97d9ce51ced", "name": "CVE-2026-67213: nanoid 3.3.11 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-67213: nanoid 3.3.11 \u2014 yarn.lock"}, "fullDescription": {"text": "nanoid: nanoid: Denial of Service via infinite loop in random ID generation\n\nnanoid (Nano ID) before 5.1.6 contains an infinite loop in the customAlphabet and customRandom functions. When these functions are configured with a size of 0, the internal generation loop never satisfies its exit condition and spins indefinitely, hanging the calling thread. An application that passes an unvalidated, attacker-controlled size of 0 to these functions is exposed to a denial-of-service condition.\n\nPackage: nanoid\nInstalled: 3.3.11\nFixed in: 3.3.18, 5.1.6\nSeverity: HIGH\nFix: Upgrade nanoid to 3.3.18, 5.1.6"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-aa11665da092f037", "name": "CVE-2026-67214: nanoid 3.3.11 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-67214: nanoid 3.3.11 \u2014 yarn.lock"}, "fullDescription": {"text": "nanoid: nanoid: Denial of Service via negative size input in non-secure module functions\n\nnanoid (Nano ID) before 3.3.16 and 5.1.16 contains an infinite loop in the customAlphabet and nanoid functions of its non-secure module (nanoid/non-secure). When these functions are given a negative size, the loop counter is decremented from a negative value and never reaches its termination condition, spinning indefinitely and hanging the calling thread. An application that passes an unvalidated, attacker-controlled negative size to these functions is exposed to a denial-of-service condition.\n\nPackage: nanoid\nInstalled: 3.3.11\nFixed in: 3.3.16, 5.1.16\nSeverity: HIGH\nFix: Upgrade nanoid to 3.3.16, 5.1.16"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-4cbdfb134ada29ee", "name": "CVE-2026-73086: nanoid 3.3.11 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-73086: nanoid 3.3.11 \u2014 yarn.lock"}, "fullDescription": {"text": "nanoid: nanoid: Predictable ID generation due to integer overflow\n\nnanoid is a secure, URL-friendly, unique string ID generator for JavaScript. Prior to versions 3.3.12 and 5.1.11, the nanoid(size) function in index.js and index.cjs coerces the user-influenced size parameter to a signed 32-bit integer, allowing a value of 2147483648 to become -2147483648 and corrupt the process-wide CSPRNG poolOffset in fillPool(), which causes subsequent session tokens, CSRF tokens, API keys, and unique identifiers to become the deterministic string \"uuuuuuuuuuuuuuuuuuuuu\" unt\n\nPackage: nanoid\nInstalled: 3.3.11\nFixed in: 3.3.12, 5.1.11\nSeverity: HIGH\nFix: Upgrade nanoid to 3.3.12, 5.1.11"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-efd3ddfa47bbf30a", "name": "CVE-2026-67213: nanoid 3.3.8 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-67213: nanoid 3.3.8 \u2014 yarn.lock"}, "fullDescription": {"text": "nanoid: nanoid: Denial of Service via infinite loop in random ID generation\n\nnanoid (Nano ID) before 5.1.6 contains an infinite loop in the customAlphabet and customRandom functions. When these functions are configured with a size of 0, the internal generation loop never satisfies its exit condition and spins indefinitely, hanging the calling thread. An application that passes an unvalidated, attacker-controlled size of 0 to these functions is exposed to a denial-of-service condition.\n\nPackage: nanoid\nInstalled: 3.3.8\nFixed in: 3.3.18, 5.1.6\nSeverity: HIGH\nFix: Upgrade nanoid to 3.3.18, 5.1.6"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-8c54b289410ecbee", "name": "CVE-2026-67214: nanoid 3.3.8 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-67214: nanoid 3.3.8 \u2014 yarn.lock"}, "fullDescription": {"text": "nanoid: nanoid: Denial of Service via negative size input in non-secure module functions\n\nnanoid (Nano ID) before 3.3.16 and 5.1.16 contains an infinite loop in the customAlphabet and nanoid functions of its non-secure module (nanoid/non-secure). When these functions are given a negative size, the loop counter is decremented from a negative value and never reaches its termination condition, spinning indefinitely and hanging the calling thread. An application that passes an unvalidated, attacker-controlled negative size to these functions is exposed to a denial-of-service condition.\n\nPackage: nanoid\nInstalled: 3.3.8\nFixed in: 3.3.16, 5.1.16\nSeverity: HIGH\nFix: Upgrade nanoid to 3.3.16, 5.1.16"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-e4f6ac7d31db2777", "name": "CVE-2026-73086: nanoid 3.3.8 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-73086: nanoid 3.3.8 \u2014 yarn.lock"}, "fullDescription": {"text": "nanoid: nanoid: Predictable ID generation due to integer overflow\n\nnanoid is a secure, URL-friendly, unique string ID generator for JavaScript. Prior to versions 3.3.12 and 5.1.11, the nanoid(size) function in index.js and index.cjs coerces the user-influenced size parameter to a signed 32-bit integer, allowing a value of 2147483648 to become -2147483648 and corrupt the process-wide CSPRNG poolOffset in fillPool(), which causes subsequent session tokens, CSRF tokens, API keys, and unique identifiers to become the deterministic string \"uuuuuuuuuuuuuuuuuuuuu\" unt\n\nPackage: nanoid\nInstalled: 3.3.8\nFixed in: 3.3.12, 5.1.11\nSeverity: HIGH\nFix: Upgrade nanoid to 3.3.12, 5.1.11"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-16296f003f1a9330", "name": "CVE-2026-67213: nanoid 5.1.5 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-67213: nanoid 5.1.5 \u2014 yarn.lock"}, "fullDescription": {"text": "nanoid: nanoid: Denial of Service via infinite loop in random ID generation\n\nnanoid (Nano ID) before 5.1.6 contains an infinite loop in the customAlphabet and customRandom functions. When these functions are configured with a size of 0, the internal generation loop never satisfies its exit condition and spins indefinitely, hanging the calling thread. An application that passes an unvalidated, attacker-controlled size of 0 to these functions is exposed to a denial-of-service condition.\n\nPackage: nanoid\nInstalled: 5.1.5\nFixed in: 3.3.18, 5.1.6\nSeverity: HIGH\nFix: Upgrade nanoid to 3.3.18, 5.1.6"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-c000bd62521dc2b0", "name": "CVE-2026-67214: nanoid 5.1.5 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-67214: nanoid 5.1.5 \u2014 yarn.lock"}, "fullDescription": {"text": "nanoid: nanoid: Denial of Service via negative size input in non-secure module functions\n\nnanoid (Nano ID) before 3.3.16 and 5.1.16 contains an infinite loop in the customAlphabet and nanoid functions of its non-secure module (nanoid/non-secure). When these functions are given a negative size, the loop counter is decremented from a negative value and never reaches its termination condition, spinning indefinitely and hanging the calling thread. An application that passes an unvalidated, attacker-controlled negative size to these functions is exposed to a denial-of-service condition.\n\nPackage: nanoid\nInstalled: 5.1.5\nFixed in: 3.3.16, 5.1.16\nSeverity: HIGH\nFix: Upgrade nanoid to 3.3.16, 5.1.16"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-96df44fbb6ca2346", "name": "CVE-2026-73086: nanoid 5.1.5 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-73086: nanoid 5.1.5 \u2014 yarn.lock"}, "fullDescription": {"text": "nanoid: nanoid: Predictable ID generation due to integer overflow\n\nnanoid is a secure, URL-friendly, unique string ID generator for JavaScript. Prior to versions 3.3.12 and 5.1.11, the nanoid(size) function in index.js and index.cjs coerces the user-influenced size parameter to a signed 32-bit integer, allowing a value of 2147483648 to become -2147483648 and corrupt the process-wide CSPRNG poolOffset in fillPool(), which causes subsequent session tokens, CSRF tokens, API keys, and unique identifiers to become the deterministic string \"uuuuuuuuuuuuuuuuuuuuu\" unt\n\nPackage: nanoid\nInstalled: 5.1.5\nFixed in: 3.3.12, 5.1.11\nSeverity: HIGH\nFix: Upgrade nanoid to 3.3.12, 5.1.11"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-cbad5cd64c1ac440", "name": "CVE-2026-67214: nanoid 5.1.6 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-67214: nanoid 5.1.6 \u2014 yarn.lock"}, "fullDescription": {"text": "nanoid: nanoid: Denial of Service via negative size input in non-secure module functions\n\nnanoid (Nano ID) before 3.3.16 and 5.1.16 contains an infinite loop in the customAlphabet and nanoid functions of its non-secure module (nanoid/non-secure). When these functions are given a negative size, the loop counter is decremented from a negative value and never reaches its termination condition, spinning indefinitely and hanging the calling thread. An application that passes an unvalidated, attacker-controlled negative size to these functions is exposed to a denial-of-service condition.\n\nPackage: nanoid\nInstalled: 5.1.6\nFixed in: 3.3.16, 5.1.16\nSeverity: HIGH\nFix: Upgrade nanoid to 3.3.16, 5.1.16"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-b2456a7a0de3e695", "name": "CVE-2026-73086: nanoid 5.1.6 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-73086: nanoid 5.1.6 \u2014 yarn.lock"}, "fullDescription": {"text": "nanoid: nanoid: Predictable ID generation due to integer overflow\n\nnanoid is a secure, URL-friendly, unique string ID generator for JavaScript. Prior to versions 3.3.12 and 5.1.11, the nanoid(size) function in index.js and index.cjs coerces the user-influenced size parameter to a signed 32-bit integer, allowing a value of 2147483648 to become -2147483648 and corrupt the process-wide CSPRNG poolOffset in fillPool(), which causes subsequent session tokens, CSRF tokens, API keys, and unique identifiers to become the deterministic string \"uuuuuuuuuuuuuuuuuuuuu\" unt\n\nPackage: nanoid\nInstalled: 5.1.6\nFixed in: 3.3.12, 5.1.11\nSeverity: HIGH\nFix: Upgrade nanoid to 3.3.12, 5.1.11"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-8cdcafd2bbede696", "name": "CVE-2026-75604: next 15.5.10 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-75604: next 15.5.10 \u2014 yarn.lock"}, "fullDescription": {"text": "next: Next.js: Unauthenticated Remote Code Execution on windows-hosted servers\n\nNext.js is a React framework for building full-stack web applications. From 13.4.0 until 15.5.24 and 16.3.3, Next.js applications using Pages Router or App Router without Cache Components on Windows-hosted servers do not consistently escape backslashes in route segments before constructing incremental-cache paths. In packages/next/src/shared/lib/router/utils/escape-path-delimiters.ts and packages/next/src/server/lib/incremental-cache/file-system-cache.ts, a remote request can supply encoded Wind\n\nPackage: next\nInstalled: 15.5.10\nFixed in: 15.5.24, 16.3.3\nSeverity: CRITICAL\nFix: Upgrade next to 15.5.24, 16.3.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-1d485869bba48cc2", "name": "GHSA-2xp9-vwfh-vxw4: next 15.5.10 \u2014 yarn.lock", "shortDescription": {"text": "GHSA-2xp9-vwfh-vxw4: next 15.5.10 \u2014 yarn.lock"}, "fullDescription": {"text": "Next.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used\n\nA vulnerability in the underlying `libheif` library used by `sharp` which Next.js uses for image optimization can lead to remote code execution when AVIF files are optimized.\n\nUntil a fix has propagated, optimization of AVIF files is disabled.\n\nPackage: next\nInstalled: 15.5.10\nFixed in: 15.5.24, 16.3.3\nSeverity: CRITICAL\nFix: Upgrade next to 15.5.24, 16.3.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-917ed4477ad34c53", "name": "CVE-2026-44573: next 15.5.10 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-44573: next 15.5.10 \u2014 yarn.lock"}, "fullDescription": {"text": "next.js: Next.js: Information disclosure due to middleware bypass in Pages Router with i18n\n\nNext.js is a React framework for building full-stack web applications. From 12.2.0 to before 15.5.16 and 16.2.5, Applications using the Pages Router with i18n configured and middleware/proxy-based authorization can allow unauthorized access to protected page data through locale-less /_next/data/<buildId>/<page>.json requests. In affected configurations, middleware does not run for the unprefixed data route, allowing an attacker to retrieve SSR JSON for protected pages without passing the intende\n\nPackage: next\nInstalled: 15.5.10\nFixed in: 15.5.16, 16.2.5\nSeverity: HIGH\nFix: Upgrade next to 15.5.16, 16.2.5"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-b017dc3c8f44c2a9", "name": "CVE-2026-44574: next 15.5.10 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-44574: next 15.5.10 \u2014 yarn.lock"}, "fullDescription": {"text": "Next.js: Next.js: Authorization bypass via crafted query parameters\n\nNext.js is a React framework for building full-stack web applications. From 15.4.0 to before 15.5.16 and 16.2.5, applications that rely on middleware to protect dynamic routes can be vulnerable to authorization bypass. In affected deployments, specially crafted query parameters can alter the dynamic route value seen by the page while leaving the visible path unchanged, which can allow protected content to be rendered without passing the expected middleware check. This vulnerability is fixed in 1\n\nPackage: next\nInstalled: 15.5.10\nFixed in: 15.5.16, 16.2.5\nSeverity: HIGH\nFix: Upgrade next to 15.5.16, 16.2.5"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-84f45627c9a5216b", "name": "CVE-2026-44575: next 15.5.10 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-44575: next 15.5.10 \u2014 yarn.lock"}, "fullDescription": {"text": "next.js: Next.js: Unauthorized access to protected content via middleware bypass\n\nNext.js is a React framework for building full-stack web applications. From 15.2.0 to before 15.5.16 and 16.2.5, App Router applications that rely on middleware or proxy-based checks for authorization can allow unauthorized access through transport-specific route variants used for segment prefetching. In affected configurations, specially crafted .rsc and segment-prefetch URLs can resolve to the same page without being matched by the intended middleware rule, which can allow protected content to\n\nPackage: next\nInstalled: 15.5.10\nFixed in: 15.5.16, 16.2.5\nSeverity: HIGH\nFix: Upgrade next to 15.5.16, 16.2.5"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-68695c478d8a506b", "name": "CVE-2026-44578: next 15.5.10 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-44578: next 15.5.10 \u2014 yarn.lock"}, "fullDescription": {"text": "Next.js: Next.js: Server-Side Request Forgery via crafted WebSocket upgrade requests\n\nNext.js is a React framework for building full-stack web applications. From 13.4.13 to before 15.5.16 and 16.2.5, self-hosted applications using the built-in Node.js server can be vulnerable to server-side request forgery through crafted WebSocket upgrade requests. An attacker can cause the server to proxy requests to arbitrary internal or external destinations, which may expose internal services or cloud metadata endpoints. Vercel-hosted deployments are not affected. This vulnerability is fixed\n\nPackage: next\nInstalled: 15.5.10\nFixed in: 15.5.16, 16.2.5\nSeverity: HIGH\nFix: Upgrade next to 15.5.16, 16.2.5"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-a86c6599dbe043c8", "name": "CVE-2026-44579: next 15.5.10 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-44579: next 15.5.10 \u2014 yarn.lock"}, "fullDescription": {"text": "next.js: Next.js: Denial of Service via crafted POST requests to server actions\n\nNext.js is a React framework for building full-stack web applications. From  to before 15.5.16 and 16.2.5, applications using Partial Prerendering through the Cache Components feature can be vulnerable to connection exhaustion through crafted POST requests to a server action. In affected configurations, a malicious request can trigger a request-body handling deadlock that leaves connections open for an extended period, consuming file descriptors and server capacity until legitimate users are den\n\nPackage: next\nInstalled: 15.5.10\nFixed in: 15.5.16, 16.2.5\nSeverity: HIGH\nFix: Upgrade next to 15.5.16, 16.2.5"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-8b8513b63c1091b7", "name": "CVE-2026-45109: next 15.5.10 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-45109: next 15.5.10 \u2014 yarn.lock"}, "fullDescription": {"text": "next.js: Next.js: Information disclosure via security fix bypass in middleware with Turbopack\n\nNext.js is a React framework for building full-stack web applications. From 15.2.0 to before 15.5.18 and 16.2.6, it was found that the fix addressing CVE-2026-44575 did not apply to middleware.ts with Turbopack. This vulnerability is fixed in 15.5.18 and 16.2.6.\n\nPackage: next\nInstalled: 15.5.10\nFixed in: 15.5.18, 16.2.6\nSeverity: HIGH\nFix: Upgrade next to 15.5.18, 16.2.6"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-1f2990f9c383332d", "name": "CVE-2026-64641: next 15.5.10 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-64641: next 15.5.10 \u2014 yarn.lock"}, "fullDescription": {"text": "next: Next.js: Denial of Service via crafted requests to App Router with Server Actions\n\nNext.js is a React framework for building full-stack web applications. In versions 13.0.0 through 15.5.20 and 16.0.0 through 16.2.10, crafted requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive CPU usage blocking processing of further requests in the same process. This issue has been fixed in versions 15.5.21 and 16.2.11.\n\nPackage: next\nInstalled: 15.5.10\nFixed in: 15.5.21, 16.2.11\nSeverity: HIGH\nFix: Upgrade next to 15.5.21, 16.2.11"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-8765fd546058c730", "name": "CVE-2026-64645: next 15.5.10 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-64645: next 15.5.10 \u2014 yarn.lock"}, "fullDescription": {"text": "next: Next.js: Server-Side Request Forgery vulnerability\n\nNext.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a\n rewrites() or redirects() rule that builds its external destination hostname from request-controlled input can be pointed at an arbitrary hostname, regardless of the rule's hostname suffix. For a rewrite, Next.js proxies the request to that arbitrary host and serves the response from the application's origin, leading to Server-Side Request forgery. A redirects(\n\nPackage: next\nInstalled: 15.5.10\nFixed in: 15.5.21, 16.2.11\nSeverity: HIGH\nFix: Upgrade next to 15.5.21, 16.2.11"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-b3cfeb310a62d24d", "name": "CVE-2026-64649: next 15.5.10 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-64649: next 15.5.10 \u2014 yarn.lock"}, "fullDescription": {"text": "next: Next.js: Server-Side Request Forgery via malicious host redirection in Server Actions\n\nNext.js is a React framework for building full-stack web applications. In versions 14.1.1 through 15.5.20 and 16.0.0 through 16.2.10, when a Server Action forwards or redirects a request, an attacker can cause the server to send that outbound request to a malicious host (Server-Side Request Forgery). This requires the attacker's request to control Host-associated headers. In some configurations, it's also possible to obtain internal values that weaken middleware/proxy authorization. Applications\n\nPackage: next\nInstalled: 15.5.10\nFixed in: 15.5.21, 16.2.11\nSeverity: HIGH\nFix: Upgrade next to 15.5.21, 16.2.11"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-ad51079eb0a192c2", "name": "GHSA-8h8q-6873-q5fj: next 15.5.10 \u2014 yarn.lock", "shortDescription": {"text": "GHSA-8h8q-6873-q5fj: next 15.5.10 \u2014 yarn.lock"}, "fullDescription": {"text": "Next.js Vulnerable to Denial of Service with Server Components\n\nA vulnerability affects certain React Server Components packages for versions 19.x and frameworks that use the affected packages, including Next.js 13.x, 14.x, 15.x, and 16.x using the App Router. The issue is tracked upstream as [CVE-2026-23870](https://github.com/facebook/react/security/advisories/GHSA-rv78-f8rc-xrxh). \n\nA specially crafted HTTP request can be sent to any App Router Server Function endpoint that, when deserialized, may trigger excessive CPU usage. This can result in denial of \n\nPackage: next\nInstalled: 15.5.10\nFixed in: 15.5.16, 16.2.5\nSeverity: HIGH\nFix: Upgrade next to 15.5.16, 16.2.5"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-b3d63a1574cc8bf9", "name": "GHSA-q4gf-8mx6-v5v3: next 15.5.10 \u2014 yarn.lock", "shortDescription": {"text": "GHSA-q4gf-8mx6-v5v3: next 15.5.10 \u2014 yarn.lock"}, "fullDescription": {"text": "Next.js has a Denial of Service with Server Components\n\nA vulnerability affects certain React Server Components packages for versions 19.x and frameworks that use the affected packages, including Next.js 13.x, 14.x, 15.x, and 16.x using the App Router. The issue is tracked upstream as [CVE-2026-23869](https://github.com/facebook/react/security/advisories/GHSA-479c-33wc-g2pg). You can read more about this advisory our [this changelog](https://vercel.com/changelog/summary-of-cve-2026-23869).\n\nA specially crafted HTTP request can be sent to any App Rout\n\nPackage: next\nInstalled: 15.5.10\nFixed in: 15.5.15, 16.2.3\nSeverity: HIGH\nFix: Upgrade next to 15.5.15, 16.2.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-f34d26f818bb3cc8", "name": "CVE-2026-27980: next 15.5.10 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-27980: next 15.5.10 \u2014 yarn.lock"}, "fullDescription": {"text": "next.js: Next.js: Unbounded next/image disk cache growth can exhaust storage\n\nNext.js is a React framework for building full-stack web applications. Starting in version 10.0.0 and prior to version 16.1.7, the default Next.js image optimization disk cache (`/_next/image`) did not have a configurable upper bound, allowing unbounded cache growth. An attacker could generate many unique image-optimization variants and exhaust disk space, causing denial of service. This is fixed in version 16.1.7 by adding an LRU-backed disk cache with `images.maximumDiskCacheSize`, including e\n\nPackage: next\nInstalled: 15.5.10\nFixed in: 16.1.7, 15.5.14\nSeverity: MEDIUM\nFix: Upgrade next to 16.1.7, 15.5.14"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-694637dc1f574728", "name": "CVE-2026-29057: next 15.5.10 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-29057: next 15.5.10 \u2014 yarn.lock"}, "fullDescription": {"text": "next.js: Next.js: HTTP request smuggling in rewrites\n\nNext.js is a React framework for building full-stack web applications. Starting in version 9.5.0 and prior to versions 15.5.13 and 16.1.7, when Next.js rewrites proxy traffic to an external backend, a crafted `DELETE`/`OPTIONS` request using `Transfer-Encoding: chunked` could trigger request boundary disagreement between the proxy and backend. This could allow request smuggling through rewritten routes. An attacker could smuggle a second request to unintended backend routes (for example, interna\n\nPackage: next\nInstalled: 15.5.10\nFixed in: 16.1.7, 15.5.13\nSeverity: MEDIUM\nFix: Upgrade next to 16.1.7, 15.5.13"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e7370c9f8dab132c", "name": "CVE-2026-44576: next 15.5.10 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-44576: next 15.5.10 \u2014 yarn.lock"}, "fullDescription": {"text": "Next.js: Next.js: Cache poisoning vulnerability in React Server Components\n\nNext.js is a React framework for building full-stack web applications. From 14.2.0 to before 15.5.16 and 16.2.5, applications using React Server Components can be vulnerable to cache poisoning when shared caches do not correctly partition response variants. Under affected conditions, an attacker can cause an RSC response to be served from the original URL and poison shared cache entries so later visitors receive component payloads instead of the expected HTML. This vulnerability is fixed in 15.5\n\nPackage: next\nInstalled: 15.5.10\nFixed in: 15.5.16, 16.2.5\nSeverity: MEDIUM\nFix: Upgrade next to 15.5.16, 16.2.5"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6da19ff581f30dc5", "name": "CVE-2026-44577: next 15.5.10 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-44577: next 15.5.10 \u2014 yarn.lock"}, "fullDescription": {"text": "Next.js: Next.js: Denial of Service via Image Optimization API\n\nNext.js is a React framework for building full-stack web applications. From 10.0.0 to before 15.5.16 and 16.2.5, when self-hosting Next.js with the default image loader, the Image Optimization API fetches local images entirely into memory without enforcing a maximum size limit. An attacker could cause out-of-memory conditions by requesting large local assets from the /_next/image endpoint that match the images.localPatterns configuration (by default, all patterns are allowed). This vulnerability\n\nPackage: next\nInstalled: 15.5.10\nFixed in: 15.5.16, 16.2.5\nSeverity: MEDIUM\nFix: Upgrade next to 15.5.16, 16.2.5"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1e8d2e6a2198e509", "name": "CVE-2026-44580: next 15.5.10 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-44580: next 15.5.10 \u2014 yarn.lock"}, "fullDescription": {"text": "next.js: Next.js: Cross-site scripting allows arbitrary code execution via untrusted script content\n\nNext.js is a React framework for building full-stack web applications. From 13.0.0 to before 15.5.16 and 16.2.5, applications that use beforeInteractive scripts together with untrusted content can be vulnerable to cross-site scripting. In affected versions, serialized script content was not escaped safely before being embedded into the document, which could allow attacker-controlled input to break out of the intended script context and execute arbitrary JavaScript in a visitor's browser. This vu\n\nPackage: next\nInstalled: 15.5.10\nFixed in: 15.5.16, 16.2.5\nSeverity: MEDIUM\nFix: Upgrade next to 15.5.16, 16.2.5"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4ee4810c5c7619a8", "name": "CVE-2026-44581: next 15.5.10 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-44581: next 15.5.10 \u2014 yarn.lock"}, "fullDescription": {"text": "next.js: Next.js: Stored Cross-Site Scripting via malformed nonce values in cached responses\n\nNext.js is a React framework for building full-stack web applications. From 13.4.0 to before 15.5.16 and 16.2.5, App Router applications that rely on CSP nonces can be vulnerable to stored cross-site scripting when deployed behind shared caches. In affected versions, malformed nonce values derived from request headers could be reflected into rendered HTML in an unsafe way, allowing an attacker to poison cached responses and cause script execution for later visitors. This vulnerability is fixed i\n\nPackage: next\nInstalled: 15.5.10\nFixed in: 15.5.16, 16.2.5\nSeverity: MEDIUM\nFix: Upgrade next to 15.5.16, 16.2.5"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-65b6d77558b3cddc", "name": "CVE-2026-64643: next 15.5.10 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-64643: next 15.5.10 \u2014 yarn.lock"}, "fullDescription": {"text": "next: Next.js: Information disclosure via Server Action ID exposure\n\nNext.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, Next.js applications using App Router, Server Actions (use server) or use cache endpoints can be disclosed bypassing any authentication on the pages where these endpoints are usually used. Server Action IDs can be disclosed to unauthenticated users via publicly served client artifacts (for example, static chunks containing action references). Affected users are ap\n\nPackage: next\nInstalled: 15.5.10\nFixed in: 15.5.21, 16.2.11\nSeverity: MEDIUM\nFix: Upgrade next to 15.5.21, 16.2.11"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b2de561e8dca002e", "name": "CVE-2026-64644: next 15.5.10 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-64644: next 15.5.10 \u2014 yarn.lock"}, "fullDescription": {"text": "next: Next.js: Denial of Service via malicious image optimization\n\nNext.js is a React framework for building full-stack web applications. In versions 15.5.0 through 15.5.20 and 16.0.0 through 16.2.10, when self-hosting Next.js with the default image loader, the Image Optimization API can optimize remotely hosted images if configured (not enabled by default). If those images contain malicious content, they can cause CPU exhaustion in /_next/image endpoints.Only config.images.remotePatterns is affected, and just the patterns in that array, whereas config.images.u\n\nPackage: next\nInstalled: 15.5.10\nFixed in: 15.5.21, 16.2.11\nSeverity: MEDIUM\nFix: Upgrade next to 15.5.21, 16.2.11"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9c4c128de5429309", "name": "CVE-2026-64646: next 15.5.10 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-64646: next 15.5.10 \u2014 yarn.lock"}, "fullDescription": {"text": "next: Next.js: Denial of Service via excessive memory consumption in Server Actions\n\nNext.js is a React framework for building full-stack web applications. In versions 13.0.0 through 15.5.20 and 16.0.0 through 16.2.10, requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive memory consumption if that Server Actions uses the Edge runtime. This issue has been fixed in versions 15.5.21 and 16.2.11.\n\nPackage: next\nInstalled: 15.5.10\nFixed in: 15.5.21, 16.2.11\nSeverity: MEDIUM\nFix: Upgrade next to 15.5.21, 16.2.11"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9eaf1e6b87d55b38", "name": "CVE-2026-64647: next 15.5.10 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-64647: next 15.5.10 \u2014 yarn.lock"}, "fullDescription": {"text": "next: Next.js: Information disclosure via server-side request caching\n\nNext.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a server-side fetch with a request body may return a cached response body from a different request to the same URL but different body. Confidential data in the POST's response body would then leak to unauthorized requests. Though the request itself will not be deduped. This is only an issue when receiving request bodies with a content type charset other than UTF-8\n\nPackage: next\nInstalled: 15.5.10\nFixed in: 15.5.21, 16.2.11\nSeverity: MEDIUM\nFix: Upgrade next to 15.5.21, 16.2.11"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-47c47d421642ee2e", "name": "CVE-2026-64648: next 15.5.10 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-64648: next 15.5.10 \u2014 yarn.lock"}, "fullDescription": {"text": "next: Next.js: Information disclosure via server-side fetch cache\n\nNext.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a  server-side fetch with a request body may return a cached response body from a different request to the same URL but different body. Confidential data in the POST's response body would then leak to unauthorized requests. Though the request itself will not be deduped. This only applies to fetch calls with a request that has a different init than the one passed t\n\nPackage: next\nInstalled: 15.5.10\nFixed in: 15.5.21, 16.2.11\nSeverity: MEDIUM\nFix: Upgrade next to 15.5.21, 16.2.11"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-aa0bcbf47e1493aa", "name": "CVE-2026-94484: next 15.5.10 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-94484: next 15.5.10 \u2014 yarn.lock"}, "fullDescription": {"text": "next: Next.js: Denial of Service via response cache poisoning\n\nNext.js is a React framework for building full-stack web applications. From 15.0.0 until 15.5.27 and 16.3.8, applications with a root-level catch-all page and statically generated or Incremental Static Regeneration routes can use a shared response cache key that is insufficiently scoped to the source route. A single unauthenticated crafted request can poison that cache, causing cross-user content substitution or persistent denial of service until the poisoned entry is revalidated or replaced. Th\n\nPackage: next\nInstalled: 15.5.10\nFixed in: 16.3.8, 15.5.27\nSeverity: MEDIUM\nFix: Upgrade next to 16.3.8, 15.5.27"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f2d772f0787a8537", "name": "CVE-2026-94543: next 15.5.10 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-94543: next 15.5.10 \u2014 yarn.lock"}, "fullDescription": {"text": "next: Next.js: Response cache poisoning via improper route binding\n\nNext.js is a React framework for building full-stack web applications. From 15.0.0 until 15.5.27 and 16.3.8, self-hosted applications using the Pages Router with statically generated or Incremental Static Regeneration pages can key a response cache entry without sufficiently binding it to the source route. A request can replace one page's cache entry with content from a different route, causing the affected page to serve incorrect content to every visitor until revalidation. Applications deploye\n\nPackage: next\nInstalled: 15.5.10\nFixed in: 15.5.27, 16.3.8\nSeverity: MEDIUM\nFix: Upgrade next to 15.5.27, 16.3.8"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-58a851356348be37", "name": "CVE-2026-44572: next 15.5.10 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-44572: next 15.5.10 \u2014 yarn.lock"}, "fullDescription": {"text": "next.js: Next.js: Denial of Service due to improper handling of x-nextjs-data header with redirects\n\nNext.js is a React framework for building full-stack web applications. From 12.2.0 to before 15.5.16 and 16.2.5, an external client could send a x-nextjs-data header on a normal request to a path handled by middleware that returns a redirect. When that happened, the middleware/proxy could treat the request as a data request and replace the standard Location redirect header with the internal x-nextjs-redirect header. Browsers do not follow x-nextjs-redirect, so the response became an unusable red\n\nPackage: next\nInstalled: 15.5.10\nFixed in: 15.5.16, 16.2.5\nSeverity: LOW\nFix: Upgrade next to 15.5.16, 16.2.5"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2104590a9f0d24e5", "name": "CVE-2026-44582: next 15.5.10 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-44582: next 15.5.10 \u2014 yarn.lock"}, "fullDescription": {"text": "Next.js: Next.js: Cache poisoning allows incorrect response delivery\n\nNext.js is a React framework for building full-stack web applications. From 13.4.6 to before 15.5.16 and 16.2.5, React Server Component responses can be vulnerable to cache poisoning in deployments that rely on shared caches with insufficient response partitioning. In affected conditions, collisions in the _rsc cache-busting value can allow an attacker to poison cache entries so users receive the wrong response variant for a given URL. This vulnerability is fixed in 15.5.16 and 16.2.5.\n\nPackage: next\nInstalled: 15.5.10\nFixed in: 15.5.16, 16.2.5\nSeverity: LOW\nFix: Upgrade next to 15.5.16, 16.2.5"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fd307d9b59b856cc", "name": "CVE-2026-33891: node-forge 1.3.2 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-33891: node-forge 1.3.2 \u2014 yarn.lock"}, "fullDescription": {"text": "node-forge: node-forge: Denial of Service via infinite loop in BigInteger.modInverse()\n\nForge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, a Denial of Service (DoS) vulnerability exists in the node-forge library due to an infinite loop in the BigInteger.modInverse() function (inherited from the bundled jsbn library). When modInverse() is called with a zero value as input, the internal Extended Euclidean Algorithm enters an unreachable exit condition, causing the process to hang indefinitely and consume 100%\n\nPackage: node-forge\nInstalled: 1.3.2\nFixed in: 1.4.0\nSeverity: HIGH\nFix: Upgrade node-forge to 1.4.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-592ccea91377b459", "name": "CVE-2026-33894: node-forge 1.3.2 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-33894: node-forge 1.3.2 \u2014 yarn.lock"}, "fullDescription": {"text": "node-forge: Forge: Signature Forgery via Weak RSASSA PKCS#1 v1.5 Verification\n\nForge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, RSASSA PKCS#1 v1.5 signature verification accepts forged signatures for low public exponent keys (e=3). Attackers can forge signatures by stuffing \u201cgarbage\u201d bytes within the ASN structure in order to construct a signature that passes verification, enabling Bleichenbacher style forgery. This issue is similar to CVE-2022-24771, but adds bytes in an addition field within th\n\nPackage: node-forge\nInstalled: 1.3.2\nFixed in: 1.4.0\nSeverity: HIGH\nFix: Upgrade node-forge to 1.4.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-d1acfd87fd38b502", "name": "CVE-2026-33895: node-forge 1.3.2 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-33895: node-forge 1.3.2 \u2014 yarn.lock"}, "fullDescription": {"text": "node-forge: Forge: Authentication bypass via forged Ed25519 cryptographic signatures\n\nForge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, Ed25519 signature verification accepts forged non-canonical signatures where the scalar S is not reduced modulo the group order (`S >= L`). A valid signature and its `S + L` variant both verify in forge, while Node.js `crypto.verify` (OpenSSL-backed) rejects the `S + L` variant, as defined by the specification. This class of signature malleability has been exploited in p\n\nPackage: node-forge\nInstalled: 1.3.2\nFixed in: 1.4.0\nSeverity: HIGH\nFix: Upgrade node-forge to 1.4.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-68354bc26b4fbc18", "name": "CVE-2026-33896: node-forge 1.3.2 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-33896: node-forge 1.3.2 \u2014 yarn.lock"}, "fullDescription": {"text": "node-forge: Forge (node-forge): Certificate validation bypass allows unauthorized certificate issuance\n\nForge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, `pki.verifyCertificateChain()` does not enforce RFC 5280 basicConstraints requirements when an intermediate certificate lacks both the `basicConstraints` and `keyUsage` extensions. This allows any leaf certificate (without these extensions) to act as a CA and sign other certificates, which node-forge will accept as valid. Version 1.4.0 patches the issue.\n\nPackage: node-forge\nInstalled: 1.3.2\nFixed in: 1.4.0\nSeverity: HIGH\nFix: Upgrade node-forge to 1.4.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-363a837706bdd091", "name": "CVE-2026-85393: node-forge 1.3.2 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-85393: node-forge 1.3.2 \u2014 yarn.lock"}, "fullDescription": {"text": "node-forge: node-forge: Signature forgery vulnerability in RSA PKCS#1 v1.5 verification\n\nnode-forge through 1.4.0 fails to validate element count in nested DigestAlgorithm sequences during RSA PKCS#1 v1.5 signature verification. Attackers can embed garbage bytes inside the DigestAlgorithm sequence to forge valid signatures for arbitrary messages using low-exponent RSA keys. This is an incomplete fix for CVE-2026-33894.\n\nPackage: node-forge\nInstalled: 1.3.2\nFixed in: \u2014\nSeverity: HIGH\nFix: No fix version published yet"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-855ac6a8d6464a27", "name": "CVE-2026-4926: path-to-regexp 8.1.0 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-4926: path-to-regexp 8.1.0 \u2014 yarn.lock"}, "fullDescription": {"text": "path-to-regexp: path-to-regexp: Denial of Service via crafted regular expressions\n\nImpact:\n\nA bad regular expression is generated any time you have multiple sequential optional groups (curly brace syntax), such as `{a}{b}{c}:z`. The generated regex grows exponentially with the number of groups, causing denial of service.\n\nPatches:\n\nFixed in version 8.4.0.\n\nWorkarounds:\n\nLimit the number of sequential optional groups in route patterns. Avoid passing user-controlled input as route patterns.\n\nPackage: path-to-regexp\nInstalled: 8.1.0\nFixed in: 8.4.0\nSeverity: HIGH\nFix: Upgrade path-to-regexp to 8.4.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-75e457e2385e096c", "name": "CVE-2026-4923: path-to-regexp 8.1.0 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-4923: path-to-regexp 8.1.0 \u2014 yarn.lock"}, "fullDescription": {"text": "path-to-regexp: path-to-regexp: Denial of Service via specially crafted paths with multiple wildcards\n\nImpact:\n\nWhen using multiple wildcards, combined with at least one parameter, a regular expression can be generated that is vulnerable to ReDoS. This backtracking vulnerability requires the second wildcard to be somewhere other than the end of the path.\n\nUnsafe examples:\n\n/*foo-*bar-:baz\n/*a-:b-*c-:d\n/x/*a-:b/*c/y\n\nSafe examples:\n\n/*foo-:bar\n/*foo-:bar-*baz\n\nPatches:\n\nUpgrade to version 8.4.0.\n\nWorkarounds:\n\nIf you are using multiple wildcard parameters, you can check the regex output with a too\n\nPackage: path-to-regexp\nInstalled: 8.1.0\nFixed in: 8.4.0\nSeverity: MEDIUM\nFix: Upgrade path-to-regexp to 8.4.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e8fdc862330341b7", "name": "CVE-2026-56812: phoenix 1.6.15 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-56812: phoenix 1.6.15 \u2014 yarn.lock"}, "fullDescription": {"text": "Phoenix: Presence keys colliding with `Object.prototype` members break existence checks\n\nImproper Check for Unusual or Exceptional Conditions vulnerability in phoenixframework phoenix (Presence JavaScript client) allows an attacker with ordinary channel access to cause a persistent client-side denial of service against every viewer of a presence channel topic.\n\nThis vulnerability is associated with program files assets/js/phoenix/presence.js and program routines Presence.syncState and Presence.syncDiff.\n\nThe Phoenix JavaScript presence client checks whether a presence already exists\n\nPackage: phoenix\nInstalled: 1.6.15\nFixed in: 1.5.15, 1.6.17, 1.7.24, 1.8.9\nSeverity: MEDIUM\nFix: Upgrade phoenix to 1.5.15, 1.6.17, 1.7.24, 1.8.9"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8eb6d146010644ec", "name": "CVE-2026-33671: picomatch 2.3.1 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-33671: picomatch 2.3.1 \u2014 yarn.lock"}, "fullDescription": {"text": "picomatch: Picomatch: Regular Expression Denial of Service via crafted extglob patterns\n\nPicomatch is a glob matcher written JavaScript. Versions prior to 4.0.4, 3.0.2, and 2.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) when processing crafted extglob patterns. Certain patterns using extglob quantifiers such as `+()` and `*()`, especially when combined with overlapping alternatives or nested extglobs, are compiled into regular expressions that can exhibit catastrophic backtracking on non-matching input. Applications are impacted when they allow untrusted users \n\nPackage: picomatch\nInstalled: 2.3.1\nFixed in: 4.0.4, 3.0.2, 2.3.2\nSeverity: HIGH\nFix: Upgrade picomatch to 4.0.4, 3.0.2, 2.3.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-667011c5e0fdd11a", "name": "CVE-2026-33672: picomatch 2.3.1 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-33672: picomatch 2.3.1 \u2014 yarn.lock"}, "fullDescription": {"text": "picomatch: Picomatch: Data integrity compromised via method injection with crafted POSIX bracket expressions\n\nPicomatch is a glob matcher written JavaScript. Versions prior to 4.0.4, 3.0.2, and 2.3.2 are vulnerable to a method injection vulnerability affecting the `POSIX_REGEX_SOURCE` object. Because the object inherits from `Object.prototype`, specially crafted POSIX bracket expressions (e.g., `[[:constructor:]]`) can reference inherited method names. These methods are implicitly converted to strings and injected into the generated regular expression. This leads to incorrect glob matching behavior (int\n\nPackage: picomatch\nInstalled: 2.3.1\nFixed in: 4.0.4, 3.0.2, 2.3.2\nSeverity: MEDIUM\nFix: Upgrade picomatch to 4.0.4, 3.0.2, 2.3.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6c1951d53aecdceb", "name": "CVE-2026-45623: postcss 8.4.31 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-45623: postcss 8.4.31 \u2014 yarn.lock"}, "fullDescription": {"text": "postcss: PostCSS: Information disclosure and denial of service via crafted CSS input\n\nPostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.11 and prior, the PreviousMap parses the /*# sourceMappingURL=PATH */ comment from any CSS string passed to process() and dereferences PATH against the local filesystem with no scheme, allowlist, or traversal check. An attacker who controls the CSS input can cause the host process to read any file readable by Node and leak the first ~10 bytes of its\n\nPackage: postcss\nInstalled: 8.4.31\nFixed in: 8.5.12\nSeverity: HIGH\nFix: Upgrade postcss to 8.5.12"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-a8be87c44852218a", "name": "CVE-2026-73646: postcss 8.4.31 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-73646: postcss 8.4.31 \u2014 yarn.lock"}, "fullDescription": {"text": "postcss: PostCSS: Information disclosure via path traversal in source map auto-loading\n\nPostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.18, lib/previous-map.js loadMap() passes attacker-controlled sourceMappingURL values to join(dirname(opts.from), annotation), and loadFile() permits traversed or absolute .map paths, allowing untrusted CSS processed without map: false to disclose sourcesContent from arbitrary reachable .map files through result.map. This issue is fixed in version 8.5.1\n\nPackage: postcss\nInstalled: 8.4.31\nFixed in: 8.5.18\nSeverity: HIGH\nFix: Upgrade postcss to 8.5.18"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-e98fd9bdbab04beb", "name": "CVE-2026-41305: postcss 8.4.31 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-41305: postcss 8.4.31 \u2014 yarn.lock"}, "fullDescription": {"text": "postcss: PostCSS: Cross-Site Scripting (XSS) via improper escaping of style closing tags\n\nPostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Versions prior to 8.5.10 do not escape `</style>` sequences when stringifying CSS ASTs. When user-submitted CSS is parsed and re-stringified for embedding in HTML `<style>` tags, `</style>` in CSS values breaks out of the style context, enabling XSS. Version 8.5.10 fixes the issue.\n\nPackage: postcss\nInstalled: 8.4.31\nFixed in: 8.5.10\nSeverity: MEDIUM\nFix: Upgrade postcss to 8.5.10"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-693bc5372f5e8ae9", "name": "CVE-2026-69153: postcss 8.4.31 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-69153: postcss 8.4.31 \u2014 yarn.lock"}, "fullDescription": {"text": "postcss: PostCSS: Information disclosure via crafted sourceMappingURL\n\nPostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from is unset, an attacker can cause PreviousMap.loadFile() to read an unintended source-map file by supplying an absolute or directory-traversal sourceMappingURL. The resulting map\u2019s sources and sourcesContent may then be exposed to the application. This issue is fixed in version 8.5.19.\n\nPackage: postcss\nInstalled: 8.4.31\nFixed in: 8.5.23\nSeverity: MEDIUM\nFix: Upgrade postcss to 8.5.23"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0481e4d8b73a642b", "name": "CVE-2026-45623: postcss 8.5.6 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-45623: postcss 8.5.6 \u2014 yarn.lock"}, "fullDescription": {"text": "postcss: PostCSS: Information disclosure and denial of service via crafted CSS input\n\nPostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.11 and prior, the PreviousMap parses the /*# sourceMappingURL=PATH */ comment from any CSS string passed to process() and dereferences PATH against the local filesystem with no scheme, allowlist, or traversal check. An attacker who controls the CSS input can cause the host process to read any file readable by Node and leak the first ~10 bytes of its\n\nPackage: postcss\nInstalled: 8.5.6\nFixed in: 8.5.12\nSeverity: HIGH\nFix: Upgrade postcss to 8.5.12"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-f2e700a2a4e4f27d", "name": "CVE-2026-73646: postcss 8.5.6 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-73646: postcss 8.5.6 \u2014 yarn.lock"}, "fullDescription": {"text": "postcss: PostCSS: Information disclosure via path traversal in source map auto-loading\n\nPostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.18, lib/previous-map.js loadMap() passes attacker-controlled sourceMappingURL values to join(dirname(opts.from), annotation), and loadFile() permits traversed or absolute .map paths, allowing untrusted CSS processed without map: false to disclose sourcesContent from arbitrary reachable .map files through result.map. This issue is fixed in version 8.5.1\n\nPackage: postcss\nInstalled: 8.5.6\nFixed in: 8.5.18\nSeverity: HIGH\nFix: Upgrade postcss to 8.5.18"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-e15dc09be0d0667e", "name": "CVE-2026-41305: postcss 8.5.6 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-41305: postcss 8.5.6 \u2014 yarn.lock"}, "fullDescription": {"text": "postcss: PostCSS: Cross-Site Scripting (XSS) via improper escaping of style closing tags\n\nPostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Versions prior to 8.5.10 do not escape `</style>` sequences when stringifying CSS ASTs. When user-submitted CSS is parsed and re-stringified for embedding in HTML `<style>` tags, `</style>` in CSS values breaks out of the style context, enabling XSS. Version 8.5.10 fixes the issue.\n\nPackage: postcss\nInstalled: 8.5.6\nFixed in: 8.5.10\nSeverity: MEDIUM\nFix: Upgrade postcss to 8.5.10"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1d1b51e97f2e4856", "name": "CVE-2026-69153: postcss 8.5.6 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-69153: postcss 8.5.6 \u2014 yarn.lock"}, "fullDescription": {"text": "postcss: PostCSS: Information disclosure via crafted sourceMappingURL\n\nPostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from is unset, an attacker can cause PreviousMap.loadFile() to read an unintended source-map file by supplying an absolute or directory-traversal sourceMappingURL. The resulting map\u2019s sources and sourcesContent may then be exposed to the application. This issue is fixed in version 8.5.19.\n\nPackage: postcss\nInstalled: 8.5.6\nFixed in: 8.5.23\nSeverity: MEDIUM\nFix: Upgrade postcss to 8.5.23"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3048640810c362a7", "name": "CVE-2026-22028: preact 10.27.2 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-22028: preact 10.27.2 \u2014 yarn.lock"}, "fullDescription": {"text": "preact: Preact: Arbitrary script execution via JSON serialization protection bypass\n\nPreact, a lightweight web development framework, JSON serialization protection to prevent Virtual DOM elements from being constructed from arbitrary JSON. A regression introduced in Preact 10.26.5 caused this protection to be softened. In applications where values from JSON payloads are assumed to be strings and passed unmodified to Preact as children, a specially-crafted JSON payload could be constructed that would be incorrectly treated as a valid VNode. When this chain of failures occurs it c\n\nPackage: preact\nInstalled: 10.27.2\nFixed in: 10.26.10, 10.27.3, 10.28.2\nSeverity: HIGH\nFix: Upgrade preact to 10.26.10, 10.27.3, 10.28.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-580219bb5c4b8d72", "name": "CVE-2026-41242: protobufjs 7.2.5 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-41242: protobufjs 7.2.5 \u2014 yarn.lock"}, "fullDescription": {"text": "protobufjs: protobufjs: Arbitrary code execution via injected protobuf definition type fields\n\nprotobufjs compiles protobuf definitions into JavaScript (JS) functions. In versions prior to 8.0.1 and 7.5.5, attackers can inject arbitrary code in the \"type\" fields of protobuf definitions, which will then execute during object decoding using that definition. Versions 8.0.1 and 7.5.5 patch the issue.\n\nPackage: protobufjs\nInstalled: 7.2.5\nFixed in: 8.0.1, 7.5.5\nSeverity: CRITICAL\nFix: Upgrade protobufjs to 8.0.1, 7.5.5"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-6601e828c2edca1c", "name": "CVE-2026-44289: protobufjs 7.2.5 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-44289: protobufjs 7.2.5 \u2014 yarn.lock"}, "fullDescription": {"text": "protobufjs: protobufjs: Denial of Service via uncontrolled recursion in protobuf decoding\n\nprotobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs could recurse without a depth limit while decoding nested protobuf data. This affected both skipping unknown group fields and generated decoding of nested message fields. A crafted protobuf binary payload could cause the JavaScript call stack to be exhausted during decoding. This vulnerability is fixed in 7.5.6 and 8.0.2.\n\nPackage: protobufjs\nInstalled: 7.2.5\nFixed in: 7.5.6, 8.0.2\nSeverity: HIGH\nFix: Upgrade protobufjs to 7.5.6, 8.0.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-c19298ad34b4f693", "name": "CVE-2026-44290: protobufjs 7.2.5 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-44290: protobufjs 7.2.5 \u2014 yarn.lock"}, "fullDescription": {"text": "protobufjs: protobufjs: Denial of Service via crafted schema\n\nprotobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs allowed certain schema option paths to traverse through inherited object properties while applying options. A crafted protobuf schema or JSON descriptor could cause option handling to write to properties on global JavaScript constructors, corrupting process-wide built-in functionality. This vulnerability is fixed in 7.5.6 and 8.0.2.\n\nPackage: protobufjs\nInstalled: 7.2.5\nFixed in: 7.5.6, 8.0.2\nSeverity: HIGH\nFix: Upgrade protobufjs to 7.5.6, 8.0.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-35535ee4051eec45", "name": "CVE-2026-44291: protobufjs 7.2.5 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-44291: protobufjs 7.2.5 \u2014 yarn.lock"}, "fullDescription": {"text": "protobufjs: protobufjs: Arbitrary Code Execution via prototype pollution\n\nprotobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs used plain objects with inherited prototypes for internal type lookup tables used by generated encode and decode functions. If Object.prototype had already been polluted, those lookup tables could resolve attacker-controlled inherited properties as valid protobuf type information. This could cause attacker-controlled strings to be emitted into generated JavaScript code. This vulnerabilit\n\nPackage: protobufjs\nInstalled: 7.2.5\nFixed in: 7.5.6, 8.0.2\nSeverity: HIGH\nFix: Upgrade protobufjs to 7.5.6, 8.0.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-b468cf223185f439", "name": "CVE-2026-44293: protobufjs 7.2.5 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-44293: protobufjs 7.2.5 \u2014 yarn.lock"}, "fullDescription": {"text": "protobufjs: protobufjs: Arbitrary code execution due to unsafe expression generation from crafted protobuf descriptors\n\nprotobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs generated JavaScript for toObject conversion could include an unsafe expression derived from a schema-controlled bytes field default value. A crafted descriptor with a non-string default value for a bytes field could cause attacker-controlled code to be emitted into the generated conversion function. This vulnerability is fixed in 7.5.6 and 8.0.2.\n\nPackage: protobufjs\nInstalled: 7.2.5\nFixed in: 7.5.6, 8.0.2\nSeverity: HIGH\nFix: Upgrade protobufjs to 7.5.6, 8.0.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-133107001edec2af", "name": "CVE-2026-48712: protobufjs 7.2.5 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-48712: protobufjs 7.2.5 \u2014 yarn.lock"}, "fullDescription": {"text": "protobufjs: protobufjs: Denial of Service via uncontrolled recursion with crafted protobuf payload\n\nprotobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.6.1 and 8.4.1, protobufjs could recurse without a depth limit while converting decoded messages to plain objects or JSON. This affected generated toObject() conversion and the custom google.protobuf.Any JSON conversion path. A crafted protobuf binary payload containing deeply nested Any values could cause the JavaScript call stack to be exhausted during conversion to JSON. This vulnerability is fixed in 7.6.1 and\n\nPackage: protobufjs\nInstalled: 7.2.5\nFixed in: 7.6.1, 8.4.1\nSeverity: HIGH\nFix: Upgrade protobufjs to 7.6.1, 8.4.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-13c9db904b5a20b0", "name": "CVE-2026-44288: protobufjs 7.2.5 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-44288: protobufjs 7.2.5 \u2014 yarn.lock"}, "fullDescription": {"text": "protobufjs: protobufjs: Security control bypass due to improper handling of overlong UTF-8 sequences\n\nprotobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs includes a minimal UTF-8 decoder that accepted overlong UTF-8 byte sequences and decoded them to their canonical characters instead of replacing them. An attacker who can provide protobuf binary data decoded through the affected UTF-8 path may be able to bypass application-level checks that inspect raw bytes before protobuf string decoding. For example, bytes that do not contain certain \n\nPackage: protobufjs\nInstalled: 7.2.5\nFixed in: 7.5.6, 8.0.2\nSeverity: MEDIUM\nFix: Upgrade protobufjs to 7.5.6, 8.0.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-54368280d2bc056c", "name": "CVE-2026-44292: protobufjs 7.2.5 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-44292: protobufjs 7.2.5 \u2014 yarn.lock"}, "fullDescription": {"text": "protobufjs: protobufjs: Data integrity impact due to prototype pollution\n\nprotobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs generated message constructors copied enumerable properties from a provided properties object without filtering the __proto__ key. If an application constructed a message from an attacker-controlled plain object, an own enumerable __proto__ property could alter the prototype of that individual message instance. This vulnerability is fixed in 7.5.6 and 8.0.2.\n\nPackage: protobufjs\nInstalled: 7.2.5\nFixed in: 7.5.6, 8.0.2\nSeverity: MEDIUM\nFix: Upgrade protobufjs to 7.5.6, 8.0.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6cda706cc5dd57f2", "name": "CVE-2026-44294: protobufjs 7.2.5 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-44294: protobufjs 7.2.5 \u2014 yarn.lock"}, "fullDescription": {"text": "protobufjs: protobufjs: Denial of Service due to unescaped control characters in field names\n\nprotobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs generated JavaScript property accessors from schema-controlled field and oneof names. Certain control characters in field names were not escaped before being embedded into generated function bodies. A crafted schema or JSON descriptor could therefore cause generated encode, decode, verify, or conversion functions to fail during compilation. This vulnerability is fixed in 7.5.6 and 8.0.2.\n\nPackage: protobufjs\nInstalled: 7.2.5\nFixed in: 7.5.6, 8.0.2\nSeverity: MEDIUM\nFix: Upgrade protobufjs to 7.5.6, 8.0.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-41c428ef0cbe0062", "name": "CVE-2026-45740: protobufjs 7.2.5 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-45740: protobufjs 7.2.5 \u2014 yarn.lock"}, "fullDescription": {"text": "protobufjs: protobufjs: Denial of Service via crafted JSON descriptors\n\nprotobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.8 and 8.2.0, protobufjs could recurse without a depth limit while expanding nested JSON descriptors through Root.fromJSON() and Namespace.addJSON(). A crafted JSON descriptor with deeply nested namespace definitions could cause the JavaScript call stack to be exhausted during descriptor loading. This vulnerability is fixed in 7.5.8 and 8.2.0.\n\nPackage: protobufjs\nInstalled: 7.2.5\nFixed in: 7.5.8, 8.2.0\nSeverity: MEDIUM\nFix: Upgrade protobufjs to 7.5.8, 8.2.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7f55cf5e1bee2283", "name": "CVE-2026-54269: protobufjs 7.2.5 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-54269: protobufjs 7.2.5 \u2014 yarn.lock"}, "fullDescription": {"text": "protobufjs: protobufjs-cli: protobufjs: Denial of Service due to name collision with runtime helpers\n\nprotobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 8.6.0 and 7.6.3, protobufjs accepted certain schema-derived names that could collide with properties used by protobufjs runtime helpers. The known affected names are fields named hasOwnProperty, field or oneof names such as $type when loaded through protobufjs JSON/reflection descriptors, and service methods whose generated helper name is rpcCall. When affected message or service types were used, protobufjs could r\n\nPackage: protobufjs\nInstalled: 7.2.5\nFixed in: 7.6.3, 8.6.0\nSeverity: MEDIUM\nFix: Upgrade protobufjs to 7.6.3, 8.6.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-bd74496361cd6aaf", "name": "CVE-2026-41242: protobufjs 7.3.2 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-41242: protobufjs 7.3.2 \u2014 yarn.lock"}, "fullDescription": {"text": "protobufjs: protobufjs: Arbitrary code execution via injected protobuf definition type fields\n\nprotobufjs compiles protobuf definitions into JavaScript (JS) functions. In versions prior to 8.0.1 and 7.5.5, attackers can inject arbitrary code in the \"type\" fields of protobuf definitions, which will then execute during object decoding using that definition. Versions 8.0.1 and 7.5.5 patch the issue.\n\nPackage: protobufjs\nInstalled: 7.3.2\nFixed in: 8.0.1, 7.5.5\nSeverity: CRITICAL\nFix: Upgrade protobufjs to 8.0.1, 7.5.5"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-9e2abca1abaefcc5", "name": "CVE-2026-44289: protobufjs 7.3.2 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-44289: protobufjs 7.3.2 \u2014 yarn.lock"}, "fullDescription": {"text": "protobufjs: protobufjs: Denial of Service via uncontrolled recursion in protobuf decoding\n\nprotobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs could recurse without a depth limit while decoding nested protobuf data. This affected both skipping unknown group fields and generated decoding of nested message fields. A crafted protobuf binary payload could cause the JavaScript call stack to be exhausted during decoding. This vulnerability is fixed in 7.5.6 and 8.0.2.\n\nPackage: protobufjs\nInstalled: 7.3.2\nFixed in: 7.5.6, 8.0.2\nSeverity: HIGH\nFix: Upgrade protobufjs to 7.5.6, 8.0.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-3690eaf90bfb3fd6", "name": "CVE-2026-44290: protobufjs 7.3.2 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-44290: protobufjs 7.3.2 \u2014 yarn.lock"}, "fullDescription": {"text": "protobufjs: protobufjs: Denial of Service via crafted schema\n\nprotobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs allowed certain schema option paths to traverse through inherited object properties while applying options. A crafted protobuf schema or JSON descriptor could cause option handling to write to properties on global JavaScript constructors, corrupting process-wide built-in functionality. This vulnerability is fixed in 7.5.6 and 8.0.2.\n\nPackage: protobufjs\nInstalled: 7.3.2\nFixed in: 7.5.6, 8.0.2\nSeverity: HIGH\nFix: Upgrade protobufjs to 7.5.6, 8.0.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-c3e513f9cac03344", "name": "CVE-2026-44291: protobufjs 7.3.2 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-44291: protobufjs 7.3.2 \u2014 yarn.lock"}, "fullDescription": {"text": "protobufjs: protobufjs: Arbitrary Code Execution via prototype pollution\n\nprotobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs used plain objects with inherited prototypes for internal type lookup tables used by generated encode and decode functions. If Object.prototype had already been polluted, those lookup tables could resolve attacker-controlled inherited properties as valid protobuf type information. This could cause attacker-controlled strings to be emitted into generated JavaScript code. This vulnerabilit\n\nPackage: protobufjs\nInstalled: 7.3.2\nFixed in: 7.5.6, 8.0.2\nSeverity: HIGH\nFix: Upgrade protobufjs to 7.5.6, 8.0.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-0a318d920d9a5243", "name": "CVE-2026-44293: protobufjs 7.3.2 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-44293: protobufjs 7.3.2 \u2014 yarn.lock"}, "fullDescription": {"text": "protobufjs: protobufjs: Arbitrary code execution due to unsafe expression generation from crafted protobuf descriptors\n\nprotobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs generated JavaScript for toObject conversion could include an unsafe expression derived from a schema-controlled bytes field default value. A crafted descriptor with a non-string default value for a bytes field could cause attacker-controlled code to be emitted into the generated conversion function. This vulnerability is fixed in 7.5.6 and 8.0.2.\n\nPackage: protobufjs\nInstalled: 7.3.2\nFixed in: 7.5.6, 8.0.2\nSeverity: HIGH\nFix: Upgrade protobufjs to 7.5.6, 8.0.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-35e25072aff917ba", "name": "CVE-2026-48712: protobufjs 7.3.2 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-48712: protobufjs 7.3.2 \u2014 yarn.lock"}, "fullDescription": {"text": "protobufjs: protobufjs: Denial of Service via uncontrolled recursion with crafted protobuf payload\n\nprotobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.6.1 and 8.4.1, protobufjs could recurse without a depth limit while converting decoded messages to plain objects or JSON. This affected generated toObject() conversion and the custom google.protobuf.Any JSON conversion path. A crafted protobuf binary payload containing deeply nested Any values could cause the JavaScript call stack to be exhausted during conversion to JSON. This vulnerability is fixed in 7.6.1 and\n\nPackage: protobufjs\nInstalled: 7.3.2\nFixed in: 7.6.1, 8.4.1\nSeverity: HIGH\nFix: Upgrade protobufjs to 7.6.1, 8.4.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-fee4d6ffbdafd572", "name": "CVE-2026-44288: protobufjs 7.3.2 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-44288: protobufjs 7.3.2 \u2014 yarn.lock"}, "fullDescription": {"text": "protobufjs: protobufjs: Security control bypass due to improper handling of overlong UTF-8 sequences\n\nprotobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs includes a minimal UTF-8 decoder that accepted overlong UTF-8 byte sequences and decoded them to their canonical characters instead of replacing them. An attacker who can provide protobuf binary data decoded through the affected UTF-8 path may be able to bypass application-level checks that inspect raw bytes before protobuf string decoding. For example, bytes that do not contain certain \n\nPackage: protobufjs\nInstalled: 7.3.2\nFixed in: 7.5.6, 8.0.2\nSeverity: MEDIUM\nFix: Upgrade protobufjs to 7.5.6, 8.0.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f00a1128919ad247", "name": "CVE-2026-44292: protobufjs 7.3.2 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-44292: protobufjs 7.3.2 \u2014 yarn.lock"}, "fullDescription": {"text": "protobufjs: protobufjs: Data integrity impact due to prototype pollution\n\nprotobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs generated message constructors copied enumerable properties from a provided properties object without filtering the __proto__ key. If an application constructed a message from an attacker-controlled plain object, an own enumerable __proto__ property could alter the prototype of that individual message instance. This vulnerability is fixed in 7.5.6 and 8.0.2.\n\nPackage: protobufjs\nInstalled: 7.3.2\nFixed in: 7.5.6, 8.0.2\nSeverity: MEDIUM\nFix: Upgrade protobufjs to 7.5.6, 8.0.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1a7015de02e664a1", "name": "CVE-2026-44294: protobufjs 7.3.2 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-44294: protobufjs 7.3.2 \u2014 yarn.lock"}, "fullDescription": {"text": "protobufjs: protobufjs: Denial of Service due to unescaped control characters in field names\n\nprotobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs generated JavaScript property accessors from schema-controlled field and oneof names. Certain control characters in field names were not escaped before being embedded into generated function bodies. A crafted schema or JSON descriptor could therefore cause generated encode, decode, verify, or conversion functions to fail during compilation. This vulnerability is fixed in 7.5.6 and 8.0.2.\n\nPackage: protobufjs\nInstalled: 7.3.2\nFixed in: 7.5.6, 8.0.2\nSeverity: MEDIUM\nFix: Upgrade protobufjs to 7.5.6, 8.0.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a512229ff675ffc2", "name": "CVE-2026-45740: protobufjs 7.3.2 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-45740: protobufjs 7.3.2 \u2014 yarn.lock"}, "fullDescription": {"text": "protobufjs: protobufjs: Denial of Service via crafted JSON descriptors\n\nprotobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.8 and 8.2.0, protobufjs could recurse without a depth limit while expanding nested JSON descriptors through Root.fromJSON() and Namespace.addJSON(). A crafted JSON descriptor with deeply nested namespace definitions could cause the JavaScript call stack to be exhausted during descriptor loading. This vulnerability is fixed in 7.5.8 and 8.2.0.\n\nPackage: protobufjs\nInstalled: 7.3.2\nFixed in: 7.5.8, 8.2.0\nSeverity: MEDIUM\nFix: Upgrade protobufjs to 7.5.8, 8.2.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f6541103ba63cdaa", "name": "CVE-2026-54269: protobufjs 7.3.2 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-54269: protobufjs 7.3.2 \u2014 yarn.lock"}, "fullDescription": {"text": "protobufjs: protobufjs-cli: protobufjs: Denial of Service due to name collision with runtime helpers\n\nprotobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 8.6.0 and 7.6.3, protobufjs accepted certain schema-derived names that could collide with properties used by protobufjs runtime helpers. The known affected names are fields named hasOwnProperty, field or oneof names such as $type when loaded through protobufjs JSON/reflection descriptors, and service methods whose generated helper name is rpcCall. When affected message or service types were used, protobufjs could r\n\nPackage: protobufjs\nInstalled: 7.3.2\nFixed in: 7.6.3, 8.6.0\nSeverity: MEDIUM\nFix: Upgrade protobufjs to 7.6.3, 8.6.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7150a6ebf95026f8", "name": "GHSA-f88m-g3jw-g9cj: sharp 0.34.3 \u2014 yarn.lock", "shortDescription": {"text": "GHSA-f88m-g3jw-g9cj: sharp 0.34.3 \u2014 yarn.lock"}, "fullDescription": {"text": "sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591\n\n### Impact\n\nA number of vulnerabilities, two rated as \"High\" severity using CVSSv4, have been discovered and fixed in the upstream libvips dependency.\n\nThose processing untrusted input with versions of sharp prior to 0.35.0 are affected.\n\n### Patches\n\n#### Using prebuilt binaries provided by sharp?\n\nMost people rely on the prebuilt binaries provided by sharp.\n\nPlease upgrade sharp to the latest version, currently 0.35.3, which provides libvips 8.18.3.\n\n#### Using a globally-installed libvips?\n\nP\n\nPackage: sharp\nInstalled: 0.34.3\nFixed in: 0.35.0\nSeverity: HIGH\nFix: Upgrade sharp to 0.35.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-45313d897d774551", "name": "GHSA-rgj7-g3m4-5g8c: sharp 0.34.3 \u2014 yarn.lock", "shortDescription": {"text": "GHSA-rgj7-g3m4-5g8c: sharp 0.34.3 \u2014 yarn.lock"}, "fullDescription": {"text": "sharp: Vulnerabilities in libheif: GHSA-g89c-p67h-r497 and GHSA-2jg2-4ch7-h545\n\n### Impact\nA number of vulnerabilities, two rated as \"Critical\" severity using CVSSv3, have been discovered and fixed in the upstream libheif dependency. These can lead to possible remote code execution (RCE) on glibc-based Linux when run under certain conditions.\n\nThe attack vector for these claims to be \"network\" however sharp does not provide any networking features so this vulnerability is down-rated to a \"High\" severity using CVSSv4 but please note its Subsequent System Impact.\n\nThose proce\n\nPackage: sharp\nInstalled: 0.34.3\nFixed in: 0.35.4\nSeverity: HIGH\nFix: Upgrade sharp to 0.35.4"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-fafee1132e471e83", "name": "GHSA-wq5f-xc86-pv6w: sharp 0.34.3 \u2014 yarn.lock", "shortDescription": {"text": "GHSA-wq5f-xc86-pv6w: sharp 0.34.3 \u2014 yarn.lock"}, "fullDescription": {"text": "sharp : Vulnerability in librsvg dependency CVE-2026-96889\n\n### Impact\n\nA memory-related vulnerability has been discovered and fixed in the upstream librsvg dependency. When certain runtime-specific conditions apply, this vulnerability can lead to possible remote code execution (RCE) on glibc-based Linux.\n\n### Patches\n\n#### Using prebuilt binaries provided by sharp?\n\nMost people rely on the prebuilt binaries provided by sharp.\n\nPlease upgrade sharp to the latest version, currently 0.35.5, which provides librsvg 2.63.2.\n\n#### Using a globally-installed li\n\nPackage: sharp\nInstalled: 0.34.3\nFixed in: 0.35.5\nSeverity: HIGH\nFix: Upgrade sharp to 0.35.5"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-37c4b9b569d09c38", "name": "CVE-2026-33151: socket.io-parser 4.2.4 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-33151: socket.io-parser 4.2.4 \u2014 yarn.lock"}, "fullDescription": {"text": "socket.io: Socket.IO: Denial of Service due to excessive buffering of specially crafted packets\n\nSocket.IO is an open source, real-time, bidirectional, event-based, communication framework. Prior to versions 3.3.5, 3.4.4, and 4.2.6, a specially crafted Socket.IO packet can make the server wait for a large number of binary attachments and buffer them, which can be exploited to make the server run out of memory. This issue has been patched in versions 3.3.5, 3.4.4, and 4.2.6.\n\nPackage: socket.io-parser\nInstalled: 4.2.4\nFixed in: 3.3.5, 3.4.4, 4.2.6\nSeverity: HIGH\nFix: Upgrade socket.io-parser to 3.3.5, 3.4.4, 4.2.6"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-acb9a0a02f5cec72", "name": "CVE-2026-69185: socket.io-parser 4.2.4 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-69185: socket.io-parser 4.2.4 \u2014 yarn.lock"}, "fullDescription": {"text": "socket.io-parser: Socket.IO: Denial of Service via memory exhaustion from crafted packets\n\nSocket.IO enables bidirectional and low-latency communication for every platform. Prior to 4.2.7, 3.4.5, and 3.3.6, a specially crafted Socket.IO packet can make the server wait for a large number of binary attachments and buffer them, which can be exploited to make the server run out of memory. This vulnerability is fixed in 4.2.7, 3.4.5, and 3.3.6.\n\nPackage: socket.io-parser\nInstalled: 4.2.4\nFixed in: 4.2.7, 3.4.5, 3.3.6\nSeverity: HIGH\nFix: Upgrade socket.io-parser to 4.2.7, 3.4.5, 3.3.6"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-d18c5897bc5fdc15", "name": "CVE-2026-93749: source-map-js 1.2.1 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-93749: source-map-js 1.2.1 \u2014 yarn.lock"}, "fullDescription": {"text": "source-map-js: source-map-js: Denial of Service via malformed indexed source maps\n\nsource-map-js through 1.2.1 fails to validate the per-section offset line value in indexed source maps, allowing attackers to specify arbitrary numeric values. Attackers can supply extremely large offset line values that cause synchronous event loop blocking for extended periods, preventing the service from handling other requests.\n\nPackage: source-map-js\nInstalled: 1.2.1\nFixed in: 1.2.2\nSeverity: HIGH\nFix: Upgrade source-map-js to 1.2.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-4fe334a2dc01e12e", "name": "CVE-2026-104182: stream-json 1.9.1 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-104182: stream-json 1.9.1 \u2014 yarn.lock"}, "fullDescription": {"text": "stream-json: stream-json: Denial of Service via inefficient comment scanning\n\nstream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. Prior to 3.6.0, the JSONC parser at stream-json/jsonc/parser.js and verifier at stream-json/jsonc/verifier.js restart comment-terminator scanning from the opening slash whenever a block or line comment spans an input chunk, while retaining the accumulated comment buffer. Delivering a large valid comment across many small chunks therefore causes quadratic CPU work and can stall the N\n\nPackage: stream-json\nInstalled: 1.9.1\nFixed in: 3.6.0\nSeverity: MEDIUM\nFix: Upgrade stream-json to 3.6.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9acd2e15ba41f763", "name": "CVE-2026-104183: stream-json 1.9.1 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-104183: stream-json 1.9.1 \u2014 yarn.lock"}, "fullDescription": {"text": "stream-json: stream-json: Object prototype manipulation via crafted JSON input\n\nstream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. Prior to 3.6.0, Assembler materializes object properties with plain assignment, so an input key named __proto__ invokes the inherited setter and causes parsed object prototype replacement instead of creating an own data property. Applications that make authorization or feature decisions from inherited values can therefore consume attacker-controlled properties, and a null prototype \n\nPackage: stream-json\nInstalled: 1.9.1\nFixed in: 3.6.0\nSeverity: MEDIUM\nFix: Upgrade stream-json to 3.6.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-864112d1b3d7f130", "name": "CVE-2026-71429: stream-json 1.9.1 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-71429: stream-json 1.9.1 \u2014 yarn.lock"}, "fullDescription": {"text": "stream-json: stream-json: Denial of Service due to inefficient processing of deeply nested JSON\n\nstream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. Prior to 3.5.0, the path filters pick, ignore, filter, and replace in src/core/filters/filter-base.js recompute the full path string from the nesting stack for every checkable token. Because the stack length equals the current nesting depth and a checkable token is emitted at every level, a depth D document costs O(D\u00b2) rather than O(D) to process. The issue is triggered by nesting d\n\nPackage: stream-json\nInstalled: 1.9.1\nFixed in: 3.5.0\nSeverity: MEDIUM\nFix: Upgrade stream-json to 3.5.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1560f8b0c7671adf", "name": "CVE-2026-12151: undici 6.21.3 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-12151: undici 6.21.3 \u2014 yarn.lock"}, "fullDescription": {"text": "undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames\n\nImpact:\nThe undici WebSocket client enforces maxPayloadSize on the cumulative byte count of fragments in a message but does not enforce a limit on the number of fragments. A malicious WebSocket server can stream many small or empty continuation frames that each pass per-frame and cumulative-size validation, collectively causing unbounded memory growth in the client process. The result is memory exhaustion and a denial of service.\n\nAffected applications are those using the undici WebSocket client\n\nPackage: undici\nInstalled: 6.21.3\nFixed in: 6.27.0, 7.28.0, 8.5.0\nSeverity: HIGH\nFix: Upgrade undici to 6.27.0, 7.28.0, 8.5.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-bfca7cef3aa28222", "name": "CVE-2026-1526: undici 6.21.3 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-1526: undici 6.21.3 \u2014 yarn.lock"}, "fullDescription": {"text": "undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression\n\nThe undici WebSocket client is vulnerable to a denial-of-service attack via unbounded memory consumption during permessage-deflate decompression. When a WebSocket connection negotiates the permessage-deflate extension, the client decompresses incoming compressed frames without enforcing any limit on the decompressed data size. A malicious WebSocket server can send a small compressed frame (a \"decompression bomb\") that expands to an extremely large size in memory, causing the Node.js process to e\n\nPackage: undici\nInstalled: 6.21.3\nFixed in: 6.24.0, 7.24.0\nSeverity: HIGH\nFix: Upgrade undici to 6.24.0, 7.24.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-a9816a4ab384bdae", "name": "CVE-2026-1528: undici 6.21.3 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-1528: undici 6.21.3 \u2014 yarn.lock"}, "fullDescription": {"text": "undici: undici: Denial of Service via crafted WebSocket frame with large length\n\nImpactA server can reply with a WebSocket frame using the 64-bit length form and an extremely large length. undici's ByteParser overflows internal math, ends up in an invalid state, and throws a fatal TypeError that terminates the process.\n\nPatches\n\nPatched in the undici version v7.24.0 and v6.24.0. Users should upgrade to this version or later.\n\nPackage: undici\nInstalled: 6.21.3\nFixed in: 6.24.0, 7.24.0\nSeverity: HIGH\nFix: Upgrade undici to 6.24.0, 7.24.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-04d670202bf9d46d", "name": "CVE-2026-19534: undici 6.21.3 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-19534: undici 6.21.3 \u2014 yarn.lock"}, "fullDescription": {"text": "undici: undici: Denial of Service via unrequested WebSocket subprotocol\n\nundici's WebSocket client crashes the whole Node.js process during the opening handshake when a server responds with a subprotocol that the client never requested. A default WebSocket connection sends no subprotocol, but if the server's 101 response includes a Sec-WebSocket-Protocol header, undici dereferences a null value while checking it against the requested list and throws an uncaught TypeError. Because that code runs inside a microtask with no surrounding error handling, the exception prop\n\nPackage: undici\nInstalled: 6.21.3\nFixed in: 6.28.1, 7.29.1, 8.10.2\nSeverity: HIGH\nFix: Upgrade undici to 6.28.1, 7.29.1, 8.10.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-b3d8ff2eb14eab6a", "name": "CVE-2026-2229: undici 6.21.3 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-2229: undici 6.21.3 \u2014 yarn.lock"}, "fullDescription": {"text": "undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter\n\nImpactThe undici WebSocket client is vulnerable to a denial-of-service attack due to improper validation of the\u00a0server_max_window_bits\u00a0parameter in the permessage-deflate extension. When a WebSocket client connects to a server, it automatically advertises support for permessage-deflate compression. A malicious server can respond with an out-of-range\u00a0server_max_window_bits\u00a0value (outside zlib's valid range of 8-15). When the server subsequently sends a compressed frame, the client attempts to cre\n\nPackage: undici\nInstalled: 6.21.3\nFixed in: 6.24.0, 7.24.0\nSeverity: HIGH\nFix: Upgrade undici to 6.24.0, 7.24.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-7adcb58e3251fc1c", "name": "CVE-2026-15157: undici 6.21.3 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-15157: undici 6.21.3 \u2014 yarn.lock"}, "fullDescription": {"text": "undici: undici: HTTP header injection via unvalidated blob-like body type property\n\nundici does not validate the type property of a duck-typed blob-like request body before using it as the Content-Type header on the HTTP/1.1 dispatcher. In undici before 6.28.0, from 7.0.0 up to before 7.29.0, and from 8.0.0 up to before 8.9.0, an application that passes a hand-rolled blob-like body (via request, stream, pipeline, or dispatch) whose type is derived from untrusted input allows an attacker to inject CRLF sequences and append arbitrary HTTP headers, potentially smuggling a second r\n\nPackage: undici\nInstalled: 6.21.3\nFixed in: 6.28.0, 7.29.0, 8.9.0\nSeverity: MEDIUM\nFix: Upgrade undici to 6.28.0, 7.29.0, 8.9.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a601bae8eca9a1b2", "name": "CVE-2026-1525: undici 6.21.3 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-1525: undici 6.21.3 \u2014 yarn.lock"}, "fullDescription": {"text": "undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers\n\nUndici allows duplicate HTTP\u00a0Content-Length\u00a0headers when they are provided in an array with case-variant names (e.g.,\u00a0Content-Length\u00a0and\u00a0content-length). This produces malformed HTTP/1.1 requests with multiple conflicting\u00a0Content-Length\u00a0values on the wire.\n\nWho is impacted:\n\n  *  Applications using\u00a0undici.request(),\u00a0undici.Client, or similar low-level APIs with headers passed as flat arrays\n  *  Applications that accept user-controlled header names without case-normalization\n\n\nPotential conseque\n\nPackage: undici\nInstalled: 6.21.3\nFixed in: 6.24.0, 7.24.0\nSeverity: MEDIUM\nFix: Upgrade undici to 6.24.0, 7.24.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5d187951fa4cb37e", "name": "CVE-2026-1527: undici 6.21.3 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-1527: undici 6.21.3 \u2014 yarn.lock"}, "fullDescription": {"text": "undici: Undici: HTTP header injection and request smuggling vulnerability\n\nImpactWhen an application passes user-controlled input to the\u00a0upgrade\u00a0option of\u00a0client.request(), an attacker can inject CRLF sequences (\\r\\n) to:\n\n  *  Inject arbitrary HTTP headers\n  *  Terminate the HTTP request prematurely and smuggle raw data to non-HTTP services (Redis, Memcached, Elasticsearch)\nThe vulnerability exists because undici writes the\u00a0upgrade\u00a0value directly to the socket without validating for invalid header characters:\n\n// lib/dispatcher/client-h1.js:1121\nif (upgrade) {\n  heade\n\nPackage: undici\nInstalled: 6.21.3\nFixed in: 6.24.0, 7.24.0\nSeverity: MEDIUM\nFix: Upgrade undici to 6.24.0, 7.24.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-35669d712f34cf7c", "name": "CVE-2026-16728: undici 6.21.3 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-16728: undici 6.21.3 \u2014 yarn.lock"}, "fullDescription": {"text": "undici: undici: Response desynchronization via retry interceptor with mismatched Content-Length\n\nundici's retry interceptor can deliver a response whose body length does not match the Content-Length header exposed to the application after a retry or resume of a partial response. In undici before 6.28.0, from 7.0.0 up to before 7.29.0, and from 8.0.0 up to before 8.9.0, a malicious or faulty upstream can return a partial response with a mismatched framing header, close the socket early, and have the retry interceptor assemble a body of a different length while the original Content-Length sta\n\nPackage: undici\nInstalled: 6.21.3\nFixed in: 6.28.0, 7.29.0, 8.9.0\nSeverity: MEDIUM\nFix: Upgrade undici to 6.28.0, 7.29.0, 8.9.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0905f1593fa9411c", "name": "CVE-2026-16729: undici 6.21.3 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-16729: undici 6.21.3 \u2014 yarn.lock"}, "fullDescription": {"text": "undici: Undici: Cookie attribute injection allows bypassing security protections\n\nundici's setCookie function does not fully sanitize cookie attributes. In undici before 6.28.0, from 7.0.0 up to before 7.29.0, and from 8.0.0 up to before 8.9.0, a domain value is not checked for semicolons and entries in the unparsed array are not sanitized, so attacker-influenced input can inject additional cookie attributes. For example, a domain value containing a semicolon can append attributes such as SameSite, and an unparsed entry can inject attributes such as HttpOnly, without the call\n\nPackage: undici\nInstalled: 6.21.3\nFixed in: 6.28.0, 7.29.0, 8.9.0\nSeverity: MEDIUM\nFix: Upgrade undici to 6.28.0, 7.29.0, 8.9.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ba0ec2e0f202ec7e", "name": "CVE-2026-22036: undici 6.21.3 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-22036: undici 6.21.3 \u2014 yarn.lock"}, "fullDescription": {"text": "undici: Undici: Denial of Service via excessive decompression steps\n\nUndici is an HTTP/1.1 client for Node.js. Prior to 7.18.0 and 6.23.0, the number of links in the decompression chain is unbounded and the default maxHeaderSize allows a malicious server to insert thousands compression steps leading to high CPU usage and excessive memory allocation. This vulnerability is fixed in 7.18.0 and 6.23.0.\n\nPackage: undici\nInstalled: 6.21.3\nFixed in: 7.18.2, 6.23.0\nSeverity: MEDIUM\nFix: Upgrade undici to 7.18.2, 6.23.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ba40a31259d151d6", "name": "CVE-2026-9679: undici 6.21.3 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-9679: undici 6.21.3 \u2014 yarn.lock"}, "fullDescription": {"text": "undici: undici vulnerable to HTTP header injection via Set-Cookie percent-decoding\n\nImpact:\nundici's cookie parser in parseSetCookie percent-decodes cookie values via qsUnescape, turning encoded sequences like %0D%0A, %00, %3B, and %3D into their literal byte equivalents. RFC 6265 \u00a75.4 does not specify any decoding and browsers do not decode either.\n\nApplications that parse a Set-Cookie header and then forward the parsed value into a response header (proxies, middleware, SSR frameworks) become vulnerable to HTTP response header injection: an attacker-controlled upstream can inj\n\nPackage: undici\nInstalled: 6.21.3\nFixed in: 6.27.0, 7.28.0, 8.5.0\nSeverity: MEDIUM\nFix: Upgrade undici to 6.27.0, 7.28.0, 8.5.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-58bc1dd8caf8ba00", "name": "CVE-2026-11525: undici 6.21.3 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-11525: undici 6.21.3 \u2014 yarn.lock"}, "fullDescription": {"text": "undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header\n\nImpact:\nWhen undici parses a Set-Cookie header, it accepts any SameSite attribute value that contains Strict, Lax, or None as a substring, rather than the case-insensitive exact match specified by RFC 6265. Non-spec values are silently mapped to one of the three standard tokens. For example, SameSite=NoneOfYourBusiness is parsed as None (the most permissive setting), and SameSite=StrictLax is parsed as Lax (a downgrade from Strict).\n\nAffected applications are those that consume Set-Cookie header\n\nPackage: undici\nInstalled: 6.21.3\nFixed in: 6.27.0, 7.28.0, 8.5.0\nSeverity: LOW\nFix: Upgrade undici to 6.27.0, 7.28.0, 8.5.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0098c3e48f18d109", "name": "CVE-2026-18540: undici 6.21.3 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-18540: undici 6.21.3 \u2014 yarn.lock"}, "fullDescription": {"text": "undici: undici: HTTP response splitting via retry interceptor\n\nundici's retry interceptor can append the body of a ranged retry response to bytes already delivered from an earlier partial response while still presenting the original response's status and headers. This happens when an upstream server delivers part of a body without a trustworthy resume checkpoint, for example a non-success response whose headers were already sent or a partial-content response with an unusable content range, then closes the connection and answers the resumed range request wit\n\nPackage: undici\nInstalled: 6.21.3\nFixed in: 6.28.1, 7.29.1, 8.10.2\nSeverity: LOW\nFix: Upgrade undici to 6.28.1, 7.29.1, 8.10.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-88b34eeee3ed3a9d", "name": "CVE-2026-6733: undici 6.21.3 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-6733: undici 6.21.3 \u2014 yarn.lock"}, "fullDescription": {"text": "undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery.\n\nImpact:\nUndici's HTTP/1.1 client is vulnerable to response queue poisoning on reused keep-alive sockets. An attacker-controlled upstream server can inject an unsolicited HTTP/1.1 response onto an idle socket after a request completes. When the client dispatches the next request on that socket, it associates the injected response with the new request, causing responses to be delivered to the wrong requests.\n\nThis requires an attacker-controlled or compromised upstream HTTP/1.1 server and keep-ali\n\nPackage: undici\nInstalled: 6.21.3\nFixed in: 6.27.0, 7.28.0, 8.5.0\nSeverity: LOW\nFix: Upgrade undici to 6.27.0, 7.28.0, 8.5.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-46002aa9abb5c54f", "name": "CVE-2026-41907: uuid 8.3.2 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-41907: uuid 8.3.2 \u2014 yarn.lock"}, "fullDescription": {"text": "uuid: uuid: Out-of-bounds write vulnerability impacts data integrity and confidentiality\n\nuuid is for the creation of RFC9562 (formerly RFC4122) UUIDs. Prior to 14.0.0, v3, v5, and v6 accept external output buffers but do not reject out-of-range writes (small buf or large offset). This allows silent partial writes into caller-provided buffers. This vulnerability is fixed in 14.0.0.\n\nPackage: uuid\nInstalled: 8.3.2\nFixed in: 11.1.1, 12.0.1, 13.0.1\nSeverity: MEDIUM\nFix: Upgrade uuid to 11.1.1, 12.0.1, 13.0.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9b2e3c18b7e07a01", "name": "CVE-2026-41907: uuid 9.0.1 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-41907: uuid 9.0.1 \u2014 yarn.lock"}, "fullDescription": {"text": "uuid: uuid: Out-of-bounds write vulnerability impacts data integrity and confidentiality\n\nuuid is for the creation of RFC9562 (formerly RFC4122) UUIDs. Prior to 14.0.0, v3, v5, and v6 accept external output buffers but do not reject out-of-range writes (small buf or large offset). This allows silent partial writes into caller-provided buffers. This vulnerability is fixed in 14.0.0.\n\nPackage: uuid\nInstalled: 9.0.1\nFixed in: 11.1.1, 12.0.1, 13.0.1\nSeverity: MEDIUM\nFix: Upgrade uuid to 11.1.1, 12.0.1, 13.0.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-00ca8193ae54742a", "name": "CVE-2026-59952: valibot 1.2.0 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-59952: valibot 1.2.0 \u2014 yarn.lock"}, "fullDescription": {"text": "Valibot: record() issue paths can make flatten() throw for inherited Object property names\n\nValibot helps validate data using a schema. Versions prior to 1.4.2 can throw a TypeError inside its flatten() helper when validation issues contain attacker-controlled object keys such as toString, valueOf, or hasOwnProperty. The issue is reachable through normal record() validation. record() intentionally filters __proto__, prototype, and constructor, but it still accepts other own keys that collide with inherited Object.prototype properties. If the record key schema or value schema rejects su\n\nPackage: valibot\nInstalled: 1.2.0\nFixed in: 1.4.2\nSeverity: MEDIUM\nFix: Upgrade valibot to 1.4.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ad8f480f81462770", "name": "CVE-2026-48779: ws 7.5.10 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-48779: ws 7.5.10 \u2014 yarn.lock"}, "fullDescription": {"text": "ws: ws: Denial of Service via memory exhaustion from small WebSocket fragments\n\nws is an open source WebSocket client and server for Node.js. All versions from 1.1.0 up to (but not including) 5.2.5, from 6.0.0 up to 6.2.4, from 7.0.0 up to 7.5.11, and from 8.0.0 up to 8.21.0 are affected by a memory exhaustion DoS vulnerability. A peer can send a high volume of exceptionally small fragments and data chunks, with modest network traffic, to force the remote peer into allocating and holding structural wrappers that consume far more memory than the default documented message-si\n\nPackage: ws\nInstalled: 7.5.10\nFixed in: 5.2.5, 6.2.4, 7.5.11, 8.21.0\nSeverity: HIGH\nFix: Upgrade ws to 5.2.5, 6.2.4, 7.5.11, 8.21.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-0c9f6eb49736293f", "name": "CVE-2026-48779: ws 8.17.1 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-48779: ws 8.17.1 \u2014 yarn.lock"}, "fullDescription": {"text": "ws: ws: Denial of Service via memory exhaustion from small WebSocket fragments\n\nws is an open source WebSocket client and server for Node.js. All versions from 1.1.0 up to (but not including) 5.2.5, from 6.0.0 up to 6.2.4, from 7.0.0 up to 7.5.11, and from 8.0.0 up to 8.21.0 are affected by a memory exhaustion DoS vulnerability. A peer can send a high volume of exceptionally small fragments and data chunks, with modest network traffic, to force the remote peer into allocating and holding structural wrappers that consume far more memory than the default documented message-si\n\nPackage: ws\nInstalled: 8.17.1\nFixed in: 5.2.5, 6.2.4, 7.5.11, 8.21.0\nSeverity: HIGH\nFix: Upgrade ws to 5.2.5, 6.2.4, 7.5.11, 8.21.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-7d276b7b7bf1e466", "name": "CVE-2026-45736: ws 8.17.1 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-45736: ws 8.17.1 \u2014 yarn.lock"}, "fullDescription": {"text": "ws: ws: Uninitialized memory disclosure via `websocket.close()` with `TypedArray`\n\nws is an open source WebSocket client and server for Node.js. Prior to 8.20.1, the websocket.close() implementation is vulnerable to uninitialized memory disclosure when a TypedArray is passed as the reason argument. This vulnerability is fixed in 8.20.1.\n\nPackage: ws\nInstalled: 8.17.1\nFixed in: 8.20.1\nSeverity: MEDIUM\nFix: Upgrade ws to 8.20.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-eb608b90f043a6c2", "name": "CVE-2026-48779: ws 8.18.2 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-48779: ws 8.18.2 \u2014 yarn.lock"}, "fullDescription": {"text": "ws: ws: Denial of Service via memory exhaustion from small WebSocket fragments\n\nws is an open source WebSocket client and server for Node.js. All versions from 1.1.0 up to (but not including) 5.2.5, from 6.0.0 up to 6.2.4, from 7.0.0 up to 7.5.11, and from 8.0.0 up to 8.21.0 are affected by a memory exhaustion DoS vulnerability. A peer can send a high volume of exceptionally small fragments and data chunks, with modest network traffic, to force the remote peer into allocating and holding structural wrappers that consume far more memory than the default documented message-si\n\nPackage: ws\nInstalled: 8.18.2\nFixed in: 5.2.5, 6.2.4, 7.5.11, 8.21.0\nSeverity: HIGH\nFix: Upgrade ws to 5.2.5, 6.2.4, 7.5.11, 8.21.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-2fc0a0bf071555e4", "name": "CVE-2026-45736: ws 8.18.2 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-45736: ws 8.18.2 \u2014 yarn.lock"}, "fullDescription": {"text": "ws: ws: Uninitialized memory disclosure via `websocket.close()` with `TypedArray`\n\nws is an open source WebSocket client and server for Node.js. Prior to 8.20.1, the websocket.close() implementation is vulnerable to uninitialized memory disclosure when a TypedArray is passed as the reason argument. This vulnerability is fixed in 8.20.1.\n\nPackage: ws\nInstalled: 8.18.2\nFixed in: 8.20.1\nSeverity: MEDIUM\nFix: Upgrade ws to 8.20.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a0a170f8441ba76b", "name": "CVE-2026-48779: ws 8.18.3 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-48779: ws 8.18.3 \u2014 yarn.lock"}, "fullDescription": {"text": "ws: ws: Denial of Service via memory exhaustion from small WebSocket fragments\n\nws is an open source WebSocket client and server for Node.js. All versions from 1.1.0 up to (but not including) 5.2.5, from 6.0.0 up to 6.2.4, from 7.0.0 up to 7.5.11, and from 8.0.0 up to 8.21.0 are affected by a memory exhaustion DoS vulnerability. A peer can send a high volume of exceptionally small fragments and data chunks, with modest network traffic, to force the remote peer into allocating and holding structural wrappers that consume far more memory than the default documented message-si\n\nPackage: ws\nInstalled: 8.18.3\nFixed in: 5.2.5, 6.2.4, 7.5.11, 8.21.0\nSeverity: HIGH\nFix: Upgrade ws to 5.2.5, 6.2.4, 7.5.11, 8.21.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-e393613925a458f0", "name": "CVE-2026-45736: ws 8.18.3 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-45736: ws 8.18.3 \u2014 yarn.lock"}, "fullDescription": {"text": "ws: ws: Uninitialized memory disclosure via `websocket.close()` with `TypedArray`\n\nws is an open source WebSocket client and server for Node.js. Prior to 8.20.1, the websocket.close() implementation is vulnerable to uninitialized memory disclosure when a TypedArray is passed as the reason argument. This vulnerability is fixed in 8.20.1.\n\nPackage: ws\nInstalled: 8.18.3\nFixed in: 8.20.1\nSeverity: MEDIUM\nFix: Upgrade ws to 8.20.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-254d4cc9e2930cd2", "name": "CVE-2026-33532: yaml 1.10.2 \u2014 yarn.lock", "shortDescription": {"text": "CVE-2026-33532: yaml 1.10.2 \u2014 yarn.lock"}, "fullDescription": {"text": "yaml: yaml: Denial of Service via deeply nested YAML document parsing\n\n`yaml` is a YAML parser and serialiser for JavaScript. Parsing a YAML document with a version of `yaml` on the 1.x branch prior to 1.10.3 or on the 2.x branch prior to 2.8.3 may throw a RangeError due to a stack overflow. The node resolution/composition phase uses recursive function calls without a depth bound. An attacker who can supply YAML for parsing can trigger a `RangeError: Maximum call stack size exceeded` with a small payload (~2\u201310 KB). The `RangeError` is not a `YAMLParseError`, so ap\n\nPackage: yaml\nInstalled: 1.10.2\nFixed in: 2.8.3, 1.10.3\nSeverity: MEDIUM\nFix: Upgrade yaml to 2.8.3, 1.10.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-72ff79e0f8219b60", "name": "DS-0013: 'RUN cd ...' to change directory \u2014 Dockerfile", "shortDescription": {"text": "DS-0013: 'RUN cd ...' to change directory \u2014 Dockerfile"}, "fullDescription": {"text": "'RUN cd ...' to change directory\n\nRUN should not be used to change directory: 'cd ./deploy/tools/envs-validator && yarn build'. Use 'WORKDIR' statement instead.\n\nRule: DS-0013\nSeverity: MEDIUM\nTarget: Dockerfile"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ecdad6dd24b35793", "name": "DS-0025: 'apk add' is missing '--no-cache' \u2014 Dockerfile", "shortDescription": {"text": "DS-0025: 'apk add' is missing '--no-cache' \u2014 Dockerfile"}, "fullDescription": {"text": "'apk add' is missing '--no-cache'\n\n'--no-cache' is missed: apk add git\n\nRule: DS-0025\nSeverity: HIGH\nTarget: Dockerfile"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-3c4041c454cda88e", "name": "DS-0026: No HEALTHCHECK defined \u2014 Dockerfile", "shortDescription": {"text": "DS-0026: No HEALTHCHECK defined \u2014 Dockerfile"}, "fullDescription": {"text": "No HEALTHCHECK defined\n\nAdd HEALTHCHECK instruction in your Dockerfile\n\nRule: DS-0026\nSeverity: LOW\nTarget: Dockerfile"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e71bf15a11ae5bac", "name": "Secret leak: JWT token \u2014 playwright/fixtures/rewards.ts", "shortDescription": {"text": "Secret leak: JWT token \u2014 playwright/fixtures/rewards.ts"}, "fullDescription": {"text": "Trivy detected a possible secret in `playwright/fixtures/rewards.ts`.\n\nRule: jwt-token\nSeverity: MEDIUM\nMatch (redacted): const token = '*****************************************************************\n\nAction: rotate the credential and remove it from the repo. Use a secrets manager or environment variables."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1bd0c17b30417b2f", "name": "Agent authority lacks a verifier contract: .cursor/mcp.json", "shortDescription": {"text": "Agent authority lacks a verifier contract: .cursor/mcp.json"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9a5c0be8a5b51c9d", "name": "Agent authority lacks a verifier contract: .cursor/commands/prepare-release.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .cursor/commands/prepare-release.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-bd2de54cfacd54e6", "name": "Agent authority lacks a verifier contract: .cursor/commands/get-checks-status.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .cursor/commands/get-checks-status.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8e280d936ac9c991", "name": "Agent authority lacks a verifier contract: .cursor/commands/deploy-demo.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .cursor/commands/deploy-demo.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7273992ac051fe63", "name": "Docker base image is tag-pinned but not digest-pinned: node:22.14.0-alpine", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: node:22.14.0-alpine"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-aa5acaa49eb8315b", "name": "Containers defined but no K8s/orchestration manifest found", "shortDescription": {"text": "Containers defined but no K8s/orchestration manifest found"}, "fullDescription": {"text": "Repo has Dockerfiles/compose but no Kubernetes/Nomad manifests. If the target deployment is K8s, the manifests may live in a separate ops repo."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-944494b2302c88e3", "name": "Runtime dotenv file present in repo: configs/envs/.env.main", "shortDescription": {"text": "Runtime dotenv file present in repo: configs/envs/.env.main"}, "fullDescription": {"text": "`configs/envs/.env.main` looks like a runtime dotenv file. No high-confidence secret value was matched, but runtime dotenv files often drift into live credentials. Move real values to a secret manager and keep only `.env.example` style templates in source control."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.65}}, {"id": "scanner-90dbd29fbbc03d88", "name": "Runtime dotenv file present in repo: configs/envs/.env.neon_devnet", "shortDescription": {"text": "Runtime dotenv file present in repo: configs/envs/.env.neon_devnet"}, "fullDescription": {"text": "`configs/envs/.env.neon_devnet` looks like a runtime dotenv file. No high-confidence secret value was matched, but runtime dotenv files often drift into live credentials. Move real values to a secret manager and keep only `.env.example` style templates in source control."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.65}}, {"id": "scanner-a800531d49ef4572", "name": "Runtime dotenv file present in repo: configs/envs/.env.eth_sepolia", "shortDescription": {"text": "Runtime dotenv file present in repo: configs/envs/.env.eth_sepolia"}, "fullDescription": {"text": "`configs/envs/.env.eth_sepolia` looks like a runtime dotenv file. No high-confidence secret value was matched, but runtime dotenv files often drift into live credentials. Move real values to a secret manager and keep only `.env.example` style templates in source control."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.65}}, {"id": "scanner-fe07c9f8fc819d0a", "name": "Runtime dotenv file present in repo: configs/envs/.env.rootstock_testnet", "shortDescription": {"text": "Runtime dotenv file present in repo: configs/envs/.env.rootstock_testnet"}, "fullDescription": {"text": "`configs/envs/.env.rootstock_testnet` looks like a runtime dotenv file. No high-confidence secret value was matched, but runtime dotenv files often drift into live credentials. Move real values to a secret manager and keep only `.env.example` style templates in source control."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.65}}, {"id": "scanner-ce27c046b7562dba", "name": "Runtime dotenv file present in repo: configs/envs/.env.pw", "shortDescription": {"text": "Runtime dotenv file present in repo: configs/envs/.env.pw"}, "fullDescription": {"text": "`configs/envs/.env.pw` looks like a runtime dotenv file. No high-confidence secret value was matched, but runtime dotenv files often drift into live credentials. Move real values to a secret manager and keep only `.env.example` style templates in source control."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.65}}, {"id": "scanner-5deec18807cdf733", "name": "Runtime dotenv file present in repo: configs/envs/.env.optimism", "shortDescription": {"text": "Runtime dotenv file present in repo: configs/envs/.env.optimism"}, "fullDescription": {"text": "`configs/envs/.env.optimism` looks like a runtime dotenv file. No high-confidence secret value was matched, but runtime dotenv files often drift into live credentials. Move real values to a secret manager and keep only `.env.example` style templates in source control."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.65}}, {"id": "scanner-9005aa7e4901f385", "name": "Runtime dotenv file present in repo: configs/envs/.env.garnet", "shortDescription": {"text": "Runtime dotenv file present in repo: configs/envs/.env.garnet"}, "fullDescription": {"text": "`configs/envs/.env.garnet` looks like a runtime dotenv file. No high-confidence secret value was matched, but runtime dotenv files often drift into live credentials. Move real values to a secret manager and keep only `.env.example` style templates in source control."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.65}}, {"id": "scanner-7ce8037fe0d68f5e", "name": "Runtime dotenv file present in repo: configs/envs/.env.polygon", "shortDescription": {"text": "Runtime dotenv file present in repo: configs/envs/.env.polygon"}, "fullDescription": {"text": "`configs/envs/.env.polygon` looks like a runtime dotenv file. No high-confidence secret value was matched, but runtime dotenv files often drift into live credentials. Move real values to a secret manager and keep only `.env.example` style templates in source control."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.65}}, {"id": "scanner-6078fc6c53315a5b", "name": "Runtime dotenv file present in repo: configs/envs/.env.arbitrum_nova", "shortDescription": {"text": "Runtime dotenv file present in repo: configs/envs/.env.arbitrum_nova"}, "fullDescription": {"text": "`configs/envs/.env.arbitrum_nova` looks like a runtime dotenv file. No high-confidence secret value was matched, but runtime dotenv files often drift into live credentials. Move real values to a secret manager and keep only `.env.example` style templates in source control."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.65}}, {"id": "scanner-cd00dc83ad020881", "name": "Runtime dotenv file present in repo: configs/envs/.env.gnosis", "shortDescription": {"text": "Runtime dotenv file present in repo: configs/envs/.env.gnosis"}, "fullDescription": {"text": "`configs/envs/.env.gnosis` looks like a runtime dotenv file. No high-confidence secret value was matched, but runtime dotenv files often drift into live credentials. Move real values to a secret manager and keep only `.env.example` style templates in source control."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.65}}, {"id": "scanner-5b48d9438ec72607", "name": "Runtime dotenv file present in repo: configs/envs/.env.mega_eth", "shortDescription": {"text": "Runtime dotenv file present in repo: configs/envs/.env.mega_eth"}, "fullDescription": {"text": "`configs/envs/.env.mega_eth` looks like a runtime dotenv file. No high-confidence secret value was matched, but runtime dotenv files often drift into live credentials. Move real values to a secret manager and keep only `.env.example` style templates in source control."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.65}}, {"id": "scanner-42eec27c27dfb009", "name": "Runtime dotenv file present in repo: configs/envs/.env.mekong", "shortDescription": {"text": "Runtime dotenv file present in repo: configs/envs/.env.mekong"}, "fullDescription": {"text": "`configs/envs/.env.mekong` looks like a runtime dotenv file. No high-confidence secret value was matched, but runtime dotenv files often drift into live credentials. Move real values to a secret manager and keep only `.env.example` style templates in source control."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.65}}, {"id": "scanner-f69b5573ab866d2e", "name": "Runtime dotenv file present in repo: configs/envs/.env.scroll_sepolia", "shortDescription": {"text": "Runtime dotenv file present in repo: configs/envs/.env.scroll_sepolia"}, "fullDescription": {"text": "`configs/envs/.env.scroll_sepolia` looks like a runtime dotenv file. No high-confidence secret value was matched, but runtime dotenv files often drift into live credentials. Move real values to a secret manager and keep only `.env.example` style templates in source control."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.65}}, {"id": "scanner-db69d35afb7a1a5f", "name": "Runtime dotenv file present in repo: configs/envs/.env.vitest", "shortDescription": {"text": "Runtime dotenv file present in repo: configs/envs/.env.vitest"}, "fullDescription": {"text": "`configs/envs/.env.vitest` looks like a runtime dotenv file. No high-confidence secret value was matched, but runtime dotenv files often drift into live credentials. Move real values to a secret manager and keep only `.env.example` style templates in source control."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.65}}, {"id": "scanner-2b0e1ad9e0010439", "name": "Runtime dotenv file present in repo: configs/envs/.env.zetachain_testnet", "shortDescription": {"text": "Runtime dotenv file present in repo: configs/envs/.env.zetachain_testnet"}, "fullDescription": {"text": "`configs/envs/.env.zetachain_testnet` looks like a runtime dotenv file. No high-confidence secret value was matched, but runtime dotenv files often drift into live credentials. Move real values to a secret manager and keep only `.env.example` style templates in source control."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.65}}, {"id": "scanner-b757b88f9204b2d8", "name": "Runtime dotenv file present in repo: configs/envs/.env.zora", "shortDescription": {"text": "Runtime dotenv file present in repo: configs/envs/.env.zora"}, "fullDescription": {"text": "`configs/envs/.env.zora` looks like a runtime dotenv file. No high-confidence secret value was matched, but runtime dotenv files often drift into live credentials. Move real values to a secret manager and keep only `.env.example` style templates in source control."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.65}}, {"id": "scanner-a8240fc30f2f604d", "name": "Runtime dotenv file present in repo: configs/envs/.env.optimism_sepolia", "shortDescription": {"text": "Runtime dotenv file present in repo: configs/envs/.env.optimism_sepolia"}, "fullDescription": {"text": "`configs/envs/.env.optimism_sepolia` looks like a runtime dotenv file. No high-confidence secret value was matched, but runtime dotenv files often drift into live credentials. Move real values to a secret manager and keep only `.env.example` style templates in source control."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.65}}, {"id": "scanner-2cf7771d0d14938e", "name": "Runtime dotenv file present in repo: configs/envs/.env.filecoin", "shortDescription": {"text": "Runtime dotenv file present in repo: configs/envs/.env.filecoin"}, "fullDescription": {"text": "`configs/envs/.env.filecoin` looks like a runtime dotenv file. No high-confidence secret value was matched, but runtime dotenv files often drift into live credentials. Move real values to a secret manager and keep only `.env.example` style templates in source control."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.65}}, {"id": "scanner-dfce6069a60d02dc", "name": "Runtime dotenv file present in repo: configs/envs/.env.optimism_interop_0", "shortDescription": {"text": "Runtime dotenv file present in repo: configs/envs/.env.optimism_interop_0"}, "fullDescription": {"text": "`configs/envs/.env.optimism_interop_0` looks like a runtime dotenv file. No high-confidence secret value was matched, but runtime dotenv files often drift into live credentials. Move real values to a secret manager and keep only `.env.example` style templates in source control."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.65}}, {"id": "scanner-36327ed33bae6dfa", "name": "Runtime dotenv file present in repo: configs/envs/.env.zksync", "shortDescription": {"text": "Runtime dotenv file present in repo: configs/envs/.env.zksync"}, "fullDescription": {"text": "`configs/envs/.env.zksync` looks like a runtime dotenv file. No high-confidence secret value was matched, but runtime dotenv files often drift into live credentials. Move real values to a secret manager and keep only `.env.example` style templates in source control."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.65}}, {"id": "scanner-1742dcfd11d0f8bf", "name": "Runtime dotenv file present in repo: configs/envs/.env.tac_spb", "shortDescription": {"text": "Runtime dotenv file present in repo: configs/envs/.env.tac_spb"}, "fullDescription": {"text": "`configs/envs/.env.tac_spb` looks like a runtime dotenv file. No high-confidence secret value was matched, but runtime dotenv files often drift into live credentials. Move real values to a secret manager and keep only `.env.example` style templates in source control."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.65}}, {"id": "scanner-1367eb14231fc9e1", "name": "Runtime dotenv file present in repo: configs/envs/.env.zetachain", "shortDescription": {"text": "Runtime dotenv file present in repo: configs/envs/.env.zetachain"}, "fullDescription": {"text": "`configs/envs/.env.zetachain` looks like a runtime dotenv file. No high-confidence secret value was matched, but runtime dotenv files often drift into live credentials. Move real values to a secret manager and keep only `.env.example` style templates in source control."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.65}}, {"id": "scanner-67ec88be9023a91e", "name": "Runtime dotenv file present in repo: configs/envs/.env.localhost", "shortDescription": {"text": "Runtime dotenv file present in repo: configs/envs/.env.localhost"}, "fullDescription": {"text": "`configs/envs/.env.localhost` looks like a runtime dotenv file. No high-confidence secret value was matched, but runtime dotenv files often drift into live credentials. Move real values to a secret manager and keep only `.env.example` style templates in source control."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.65}}, {"id": "scanner-3eaefdb7f19f2e79", "name": "Runtime dotenv file present in repo: configs/envs/.env.zilliqa", "shortDescription": {"text": "Runtime dotenv file present in repo: configs/envs/.env.zilliqa"}, "fullDescription": {"text": "`configs/envs/.env.zilliqa` looks like a runtime dotenv file. No high-confidence secret value was matched, but runtime dotenv files often drift into live credentials. Move real values to a secret manager and keep only `.env.example` style templates in source control."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.65}}, {"id": "scanner-65a7d843da33f15c", "name": "Runtime dotenv file present in repo: configs/envs/.env.arbitrum", "shortDescription": {"text": "Runtime dotenv file present in repo: configs/envs/.env.arbitrum"}, "fullDescription": {"text": "`configs/envs/.env.arbitrum` looks like a runtime dotenv file. No high-confidence secret value was matched, but runtime dotenv files often drift into live credentials. Move real values to a secret manager and keep only `.env.example` style templates in source control."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.65}}, {"id": "scanner-6cd285b0551d7627", "name": "Runtime dotenv file present in repo: configs/envs/.env.rari_testnet", "shortDescription": {"text": "Runtime dotenv file present in repo: configs/envs/.env.rari_testnet"}, "fullDescription": {"text": "`configs/envs/.env.rari_testnet` looks like a runtime dotenv file. No high-confidence secret value was matched, but runtime dotenv files often drift into live credentials. Move real values to a secret manager and keep only `.env.example` style templates in source control."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.65}}, {"id": "scanner-7fa10f3534aec598", "name": "Runtime dotenv file present in repo: configs/envs/.env.tac", "shortDescription": {"text": "Runtime dotenv file present in repo: configs/envs/.env.tac"}, "fullDescription": {"text": "`configs/envs/.env.tac` looks like a runtime dotenv file. No high-confidence secret value was matched, but runtime dotenv files often drift into live credentials. Move real values to a secret manager and keep only `.env.example` style templates in source control."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.65}}, {"id": "scanner-6405bdb2a925e186", "name": "Runtime dotenv file present in repo: configs/envs/.env.arbitrum_sepolia", "shortDescription": {"text": "Runtime dotenv file present in repo: configs/envs/.env.arbitrum_sepolia"}, "fullDescription": {"text": "`configs/envs/.env.arbitrum_sepolia` looks like a runtime dotenv file. No high-confidence secret value was matched, but runtime dotenv files often drift into live credentials. Move real values to a secret manager and keep only `.env.example` style templates in source control."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.65}}, {"id": "scanner-8bd8689f7dfd2277", "name": "Runtime dotenv file present in repo: configs/envs/.env.celo_sepolia", "shortDescription": {"text": "Runtime dotenv file present in repo: configs/envs/.env.celo_sepolia"}, "fullDescription": {"text": "`configs/envs/.env.celo_sepolia` looks like a runtime dotenv file. It contains secret-looking assignments for NEXT_PUBLIC_VIEWS_ADDRESS_NATIVE_TOKEN_ADDRESS. Move real values to a secret manager and keep only `.env.example` style templates in source control."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 0.82}}, {"id": "scanner-bd2383bd5485a8f3", "name": "Runtime dotenv file present in repo: configs/envs/.env.zkevm", "shortDescription": {"text": "Runtime dotenv file present in repo: configs/envs/.env.zkevm"}, "fullDescription": {"text": "`configs/envs/.env.zkevm` looks like a runtime dotenv file. No high-confidence secret value was matched, but runtime dotenv files often drift into live credentials. Move real values to a secret manager and keep only `.env.example` style templates in source control."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.65}}, {"id": "scanner-7f098f4259e06b4d", "name": "Runtime dotenv file present in repo: configs/envs/.env.shibarium", "shortDescription": {"text": "Runtime dotenv file present in repo: configs/envs/.env.shibarium"}, "fullDescription": {"text": "`configs/envs/.env.shibarium` looks like a runtime dotenv file. No high-confidence secret value was matched, but runtime dotenv files often drift into live credentials. Move real values to a secret manager and keep only `.env.example` style templates in source control."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.65}}, {"id": "scanner-c4f0ae05084b371e", "name": "Runtime dotenv file present in repo: configs/envs/.env.blackfort_testnet", "shortDescription": {"text": "Runtime dotenv file present in repo: configs/envs/.env.blackfort_testnet"}, "fullDescription": {"text": "`configs/envs/.env.blackfort_testnet` looks like a runtime dotenv file. No high-confidence secret value was matched, but runtime dotenv files often drift into live credentials. Move real values to a secret manager and keep only `.env.example` style templates in source control."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.65}}, {"id": "scanner-4789940b241c7c60", "name": "Runtime dotenv file present in repo: configs/envs/.env.celo", "shortDescription": {"text": "Runtime dotenv file present in repo: configs/envs/.env.celo"}, "fullDescription": {"text": "`configs/envs/.env.celo` looks like a runtime dotenv file. It contains secret-looking assignments for NEXT_PUBLIC_VIEWS_ADDRESS_NATIVE_TOKEN_ADDRESS. Move real values to a secret manager and keep only `.env.example` style templates in source control."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 0.82}}, {"id": "scanner-15d7ca302464c162", "name": "Runtime dotenv file present in repo: configs/envs/.env.base", "shortDescription": {"text": "Runtime dotenv file present in repo: configs/envs/.env.base"}, "fullDescription": {"text": "`configs/envs/.env.base` looks like a runtime dotenv file. No high-confidence secret value was matched, but runtime dotenv files often drift into live credentials. Move real values to a secret manager and keep only `.env.example` style templates in source control."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.65}}, {"id": "scanner-a78c5253a6e5cffa", "name": "Runtime dotenv file present in repo: configs/envs/.env.immutable", "shortDescription": {"text": "Runtime dotenv file present in repo: configs/envs/.env.immutable"}, "fullDescription": {"text": "`configs/envs/.env.immutable` looks like a runtime dotenv file. No high-confidence secret value was matched, but runtime dotenv files often drift into live credentials. Move real values to a secret manager and keep only `.env.example` style templates in source control."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.65}}, {"id": "scanner-f8c7c96001137c46", "name": "Runtime dotenv file present in repo: configs/envs/.env.eth", "shortDescription": {"text": "Runtime dotenv file present in repo: configs/envs/.env.eth"}, "fullDescription": {"text": "`configs/envs/.env.eth` looks like a runtime dotenv file. No high-confidence secret value was matched, but runtime dotenv files often drift into live credentials. Move real values to a secret manager and keep only `.env.example` style templates in source control."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.65}}, {"id": "scanner-3917cf243936ecab", "name": "Runtime dotenv file present in repo: configs/envs/.env.stability_testnet", "shortDescription": {"text": "Runtime dotenv file present in repo: configs/envs/.env.stability_testnet"}, "fullDescription": {"text": "`configs/envs/.env.stability_testnet` looks like a runtime dotenv file. No high-confidence secret value was matched, but runtime dotenv files often drift into live credentials. Move real values to a secret manager and keep only `.env.example` style templates in source control."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.65}}, {"id": "scanner-af68baff5ef502d5", "name": "Runtime dotenv file present in repo: configs/envs/.env.optimism_superchain", "shortDescription": {"text": "Runtime dotenv file present in repo: configs/envs/.env.optimism_superchain"}, "fullDescription": {"text": "`configs/envs/.env.optimism_superchain` looks like a runtime dotenv file. No high-confidence secret value was matched, but runtime dotenv files often drift into live credentials. Move real values to a secret manager and keep only `.env.example` style templates in source control."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.65}}, {"id": "scanner-7ee4dde2b7f36888", "name": "Possible secret in stubs/account.ts", "shortDescription": {"text": "Possible secret in stubs/account.ts"}, "fullDescription": {"text": "Detected 1 occurrence(s) matching generic_api_key. Rotate real credentials and move them to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.72}}, {"id": "scanner-1b5b0e2a70e9f78d", "name": "Insecure pattern 'dangerous_innerhtml' in ui/address/details/AddressQrCode.tsx:93", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in ui/address/details/AddressQrCode.tsx:93"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.65}}, {"id": "scanner-ef5ced18e7789380", "name": "Insecure pattern 'dangerous_innerhtml' in ui/address/details/AddressAlerts.tsx:46", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in ui/address/details/AddressAlerts.tsx:46"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.65}}, {"id": "scanner-68ce4c841653d9b7", "name": "Insecure pattern 'weak_hash' in ui/shared/entities/address/NounsIdenticon.tsx:24", "shortDescription": {"text": "Insecure pattern 'weak_hash' in ui/shared/entities/address/NounsIdenticon.tsx:24"}, "fullDescription": {"text": "Found a known-risky pattern (weak_hash). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ed4c07edfbbc9e4d", "name": "Insecure pattern 'dangerous_innerhtml' in ui/shared/entities/address/AddressIdenticon.tsx:56", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in ui/shared/entities/address/AddressIdenticon.tsx:56"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.65}}, {"id": "scanner-0b88f55b9977eaa4", "name": "Insecure pattern 'dangerous_innerhtml' in ui/snippets/searchBar/SearchBarSuggest/SearchBarSuggestLabel.tsx:23", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in ui/snippets/searchBar/SearchBarSuggest/SearchBarSuggestLabel.tsx:23"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.65}}, {"id": "scanner-59356268ea8aeda7", "name": "Insecure pattern 'dangerous_innerhtml' in ui/snippets/searchBar/SearchBarSuggest/SearchBarSuggestDomain.tsx:31", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in ui/snippets/searchBar/SearchBarSuggest/SearchBarSuggestDomain.tsx:31"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.65}}, {"id": "scanner-7f4a3c3923b58e15", "name": "Insecure pattern 'dangerous_innerhtml' in ui/snippets/searchBar/SearchBarSuggest/SearchBarSuggestCluster.tsx:34", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in ui/snippets/searchBar/SearchBarSuggest/SearchBarSuggestCluster.tsx:34"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.65}}, {"id": "scanner-2461b5ce3501d527", "name": "Insecure pattern 'dangerous_innerhtml' in ui/snippets/searchBar/SearchBarSuggest/SearchBarSuggestApp.tsx:46", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in ui/snippets/searchBar/SearchBarSuggest/SearchBarSuggestApp.tsx:46"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.65}}, {"id": "scanner-8d45cf9e32327a4f", "name": "Insecure pattern 'dangerous_innerhtml' in ui/snippets/searchBar/SearchBarSuggest/SearchBarSuggestAddress.tsx:67", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in ui/snippets/searchBar/SearchBarSuggest/SearchBarSuggestAddress.tsx:67"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.65}}, {"id": "scanner-0b970377a8b33188", "name": "Insecure pattern 'dangerous_innerhtml' in ui/snippets/searchBar/SearchBarSuggest/SearchBarSuggestBlock.tsx:46", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in ui/snippets/searchBar/SearchBarSuggest/SearchBarSuggestBlock.tsx:46"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.65}}, {"id": "scanner-a889c90df71329a4", "name": "Insecure pattern 'dangerous_innerhtml' in ui/snippets/searchBar/SearchBarSuggest/SearchBarSuggestToken.tsx:42", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in ui/snippets/searchBar/SearchBarSuggest/SearchBarSuggestToken.tsx:42"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.65}}, {"id": "scanner-03edbadd19171147", "name": "Insecure pattern 'dangerous_innerhtml' in ui/snippets/header/alerts/MaintenanceAlert.tsx:15", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in ui/snippets/header/alerts/MaintenanceAlert.tsx:15"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.65}}, {"id": "scanner-d0d8165b0f5ba4ed", "name": "Insecure pattern 'document_write' in ui/sol2uml/Sol2UmlDiagram.tsx:63", "shortDescription": {"text": "Insecure pattern 'document_write' in ui/sol2uml/Sol2UmlDiagram.tsx:63"}, "fullDescription": {"text": "Found a known-risky pattern (document_write). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6f44ba9e8b1f1217", "name": "Insecure pattern 'dangerous_innerhtml' in ui/searchResults/SearchResultTableItem.tsx:85", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in ui/searchResults/SearchResultTableItem.tsx:85"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.65}}, {"id": "scanner-1e3756ea2c6e2a1a", "name": "Insecure pattern 'dangerous_innerhtml' in ui/searchResults/SearchResultListItem.tsx:79", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in ui/searchResults/SearchResultListItem.tsx:79"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.65}}, {"id": "scanner-169a549ae1caf603", "name": "Insecure pattern 'dangerous_innerhtml' in ui/searchResults/SearchResultEntityTag.tsx:25", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in ui/searchResults/SearchResultEntityTag.tsx:25"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.65}}, {"id": "scanner-b1dd38adccc6caf1", "name": "Insecure pattern 'direct_innerhtml_assignment' in public/static/capibara/index.js:458", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in public/static/capibara/index.js:458"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.65}}, {"id": "scanner-cb639d9a10a47b23", "name": "package.json defines install-time lifecycle scripts", "shortDescription": {"text": "package.json defines install-time lifecycle scripts"}, "fullDescription": {"text": "preinstall/install/postinstall/prepare scripts execute during dependency installation. Review them carefully for network calls, obfuscation, shell execution, or credential access."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-804d0d16accb65ad", "name": "Very large file: public/static/capibara/index.js (2647 lines)", "shortDescription": {"text": "Very large file: public/static/capibara/index.js (2647 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6893a6c8b0861585", "name": "Very low test-to-source ratio", "shortDescription": {"text": "Very low test-to-source ratio"}, "fullDescription": {"text": "37 test file(s) for 2518 source file(s) (ratio 0.01). Consider adding integration or unit tests for critical paths."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-be5b6ac28962a744", "name": "42 TODO/FIXME markers", "shortDescription": {"text": "42 TODO/FIXME markers"}, "fullDescription": {"text": "High count of TODO/FIXME/HACK markers \u2014 track them as issues so they're not forgotten."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 79 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 285 placeholder/mock markers across 142 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9d79c4077342a7d0", "name": "Runtime service client appears to use placeholder configuration", "shortDescription": {"text": "Runtime service client appears to use placeholder configuration"}, "fullDescription": {"text": "A runtime source file appears to wire Supabase/Firebase/AI/payment-style clients to placeholder URLs, keys, or fallback values. In the Fable corpus this often means the UI/API shape is present while the backend service is not actually configured."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-749d4bc1bd66df5f", "name": "Agent instructions exist but release-hardening basics are missing", "shortDescription": {"text": "Agent instructions exist but release-hardening basics are missing"}, "fullDescription": {"text": "AI-coder instruction files were found, but the repo is missing ci. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a2daa79745cd8247", "name": "Legacy-named symbol `gnu_gpl_v2` in types/api/contract.ts:14", "shortDescription": {"text": "Legacy-named symbol `gnu_gpl_v2` in types/api/contract.ts:14"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0aade0015ce8ad42", "name": "Legacy-named symbol `score_v2` in mocks/contract/solidityscanReport.ts:16", "shortDescription": {"text": "Legacy-named symbol `score_v2` in mocks/contract/solidityscanReport.ts:16"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-87589d87c19a0abd", "name": "Legacy-named symbol `uniswap_v2` in stubs/pools.ts:16", "shortDescription": {"text": "Legacy-named symbol `uniswap_v2` in stubs/pools.ts:16"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ef20b7818aadb625", "name": "Legacy-named symbol `score_v2` in stubs/contract.ts:106", "shortDescription": {"text": "Legacy-named symbol `score_v2` in stubs/contract.ts:106"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2719660c85cb91d8", "name": "Legacy-named symbol `score_v2` in ui/address/SolidityscanReport.tsx:28", "shortDescription": {"text": "Legacy-named symbol `score_v2` in ui/address/SolidityscanReport.tsx:28"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a991bbe144c86f1c", "name": "Fire-and-forget `fetch()` has no rejection handler \u2014 ui/address/details/AddressSaveOnGas.tsx:57", "shortDescription": {"text": "Fire-and-forget `fetch()` has no rejection handler \u2014 ui/address/details/AddressSaveOnGas.tsx:57"}, "fullDescription": {"text": "This fetch result is neither awaited, returned, assigned, nor followed by `.catch(...)`. A network failure can therefore become an unhandled promise rejection. Await/return the promise or attach an explicit rejection handler."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-c7d590d1bdaa869c", "name": "Legacy-named symbol `master_copy` in ui/address/contract/alerts/ContractDetailsAlertProxyPattern.pw.tsx:13", "shortDescription": {"text": "Legacy-named symbol `master_copy` in ui/address/contract/alerts/ContractDetailsAlertProxyPattern.pw.tsx:13"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e672b1ef87a82f44", "name": "Legacy-named symbol `master_copy` in ui/address/contract/alerts/utils.ts:53", "shortDescription": {"text": "Legacy-named symbol `master_copy` in ui/address/contract/alerts/utils.ts:53"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4f44a3253e02c9cf", "name": "Commented-code block (24 lines) in ui/userOp/UserOpSubHeading.tsx:57", "shortDescription": {"text": "Commented-code block (24 lines) in ui/userOp/UserOpSubHeading.tsx:57"}, "fullDescription": {"text": "13 of 24 consecutive comment lines look like executable statements. Confirm the block is obsolete, then delete it or recover it from git history when needed."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 0.72}}, {"id": "scanner-ac80f58fe964483e", "name": "Fire-and-forget `fetch()` has no rejection handler \u2014 ui/shared/ad/CoinzillaTextAd.tsx:37", "shortDescription": {"text": "Fire-and-forget `fetch()` has no rejection handler \u2014 ui/shared/ad/CoinzillaTextAd.tsx:37"}, "fullDescription": {"text": "This fetch result is neither awaited, returned, assigned, nor followed by `.catch(...)`. A network failure can therefore become an unhandled promise rejection. Await/return the promise or attach an explicit rejection handler."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-b408b11f69a0fd41", "name": "Legacy-named symbol `gnu_gpl_v2` in ui/contractVerification/ContractVerificationForm.pw.tsx:64", "shortDescription": {"text": "Legacy-named symbol `gnu_gpl_v2` in ui/contractVerification/ContractVerificationForm.pw.tsx:64"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6eee9c620a003904", "name": "Commented-code block (7 lines) in ui/pages/ValidatorsStability.tsx:67", "shortDescription": {"text": "Commented-code block (7 lines) in ui/pages/ValidatorsStability.tsx:67"}, "fullDescription": {"text": "4 of 7 consecutive comment lines look like executable statements. Confirm the block is obsolete, then delete it or recover it from git history when needed."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 0.72}}, {"id": "scanner-a59c38ae576a8a76", "name": "Commented-code block (6 lines) in ui/tx/TxInternals.tsx:55", "shortDescription": {"text": "Commented-code block (6 lines) in ui/tx/TxInternals.tsx:55"}, "fullDescription": {"text": "6 of 6 consecutive comment lines look like executable statements. Confirm the block is obsolete, then delete it or recover it from git history when needed."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 0.72}}, {"id": "scanner-1bdc9fad8c4cbe2a", "name": "Legacy-named symbol `score_v2` in lib/solidityScan/schema.ts:17", "shortDescription": {"text": "Legacy-named symbol `score_v2` in lib/solidityScan/schema.ts:17"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e69373938ec5ee70", "name": "Fire-and-forget `fetch()` has no rejection handler \u2014 lib/solidityScan/useFetchReport.ts:40", "shortDescription": {"text": "Fire-and-forget `fetch()` has no rejection handler \u2014 lib/solidityScan/useFetchReport.ts:40"}, "fullDescription": {"text": "This fetch result is neither awaited, returned, assigned, nor followed by `.catch(...)`. A network failure can therefore become an unhandled promise rejection. Await/return the promise or attach an explicit rejection handler."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-4de86ef398922fb6", "name": "Fire-and-forget `fetch()` has no rejection handler \u2014 lib/xStarScore/useFetchXStarScore.ts:40", "shortDescription": {"text": "Fire-and-forget `fetch()` has no rejection handler \u2014 lib/xStarScore/useFetchXStarScore.ts:40"}, "fullDescription": {"text": "This fetch result is neither awaited, returned, assigned, nor followed by `.catch(...)`. A network failure can therefore become an unhandled promise rejection. Await/return the promise or attach an explicit rejection handler."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-4bdfc070e2aa2448", "name": "Fire-and-forget `fetch()` has no rejection handler \u2014 lib/hooks/useAdblockDetect.tsx:30", "shortDescription": {"text": "Fire-and-forget `fetch()` has no rejection handler \u2014 lib/hooks/useAdblockDetect.tsx:30"}, "fullDescription": {"text": "This fetch result is neither awaited, returned, assigned, nor followed by `.catch(...)`. A network failure can therefore become an unhandled promise rejection. Await/return the promise or attach an explicit rejection handler."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-7053f94a5b1d2b99", "name": "Legacy-named symbol `gnu_gpl_v2` in lib/contracts/licenses.ts:23", "shortDescription": {"text": "Legacy-named symbol `gnu_gpl_v2` in lib/contracts/licenses.ts:23"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3e36d31151e6fca7", "name": "Fire-and-forget `fetch()` has no rejection handler \u2014 nextjs/getServerSideProps/handlers.ts:60", "shortDescription": {"text": "Fire-and-forget `fetch()` has no rejection handler \u2014 nextjs/getServerSideProps/handlers.ts:60"}, "fullDescription": {"text": "This fetch result is neither awaited, returned, assigned, nor followed by `.catch(...)`. A network failure can therefore become an unhandled promise rejection. Await/return the promise or attach an explicit rejection handler."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-cdc66f56a5e7edf6", "name": "Commented-code block (5 lines) in public/static/capibara/index.js:303", "shortDescription": {"text": "Commented-code block (5 lines) in public/static/capibara/index.js:303"}, "fullDescription": {"text": "5 of 5 consecutive comment lines look like executable statements. Confirm the block is obsolete, then delete it or recover it from git history when needed."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 0.72}}, {"id": "scanner-526af44b904ea9ec", "name": "54 env vars used in code but missing from .env.example", "shortDescription": {"text": "54 env vars used in code but missing from .env.example"}, "fullDescription": {"text": "Drift between code and config docs. The first few: `BUNDLE_ANALYZER`, `CI`, `DISABLE_TRACKING`, `HOSTNAME`, `MASTER_URL`, `NEXT_OPEN_TELEMETRY_ENABLED`, `NEXT_PUBLIC_ADMIN_SERVICE_API_HOST`, `NEXT_PUBLIC_ADVANCED_FILTER_ENABLED` + 46 more. Add them (with a placeholder/comment) to .env.example so onboarding doesn't break."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c25cf7dec790019a", "name": "Vulnerable dependency vite 6.4.1: GHSA-4w7w-66w2-5vf9", "shortDescription": {"text": "Vulnerable dependency vite 6.4.1: GHSA-4w7w-66w2-5vf9"}, "fullDescription": {"text": "OSV.dev reports `vite` at version `6.4.1` (resolved in `deploy/tools/envs-validator/yarn.lock`) is affected by GHSA-4w7w-66w2-5vf9.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-4w7w-66w2-5vf9\nFix: upgrade `vite` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-e2dc5e843f92d283", "name": "Vulnerable dependency vite 6.4.1: GHSA-fx2h-pf6j-xcff", "shortDescription": {"text": "Vulnerable dependency vite 6.4.1: GHSA-fx2h-pf6j-xcff"}, "fullDescription": {"text": "OSV.dev reports `vite` at version `6.4.1` (resolved in `deploy/tools/envs-validator/yarn.lock`) is affected by GHSA-fx2h-pf6j-xcff.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-fx2h-pf6j-xcff\nFix: upgrade `vite` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-95976795a6898947", "name": "Vulnerable dependency vite 6.4.1: GHSA-p9ff-h696-f583", "shortDescription": {"text": "Vulnerable dependency vite 6.4.1: GHSA-p9ff-h696-f583"}, "fullDescription": {"text": "OSV.dev reports `vite` at version `6.4.1` (resolved in `deploy/tools/envs-validator/yarn.lock`) is affected by GHSA-p9ff-h696-f583.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-p9ff-h696-f583\nFix: upgrade `vite` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-13841e47de369b5e", "name": "Vulnerable dependency vite 6.4.1: GHSA-v6wh-96g9-6wx3", "shortDescription": {"text": "Vulnerable dependency vite 6.4.1: GHSA-v6wh-96g9-6wx3"}, "fullDescription": {"text": "OSV.dev reports `vite` at version `6.4.1` (resolved in `deploy/tools/envs-validator/yarn.lock`) is affected by GHSA-v6wh-96g9-6wx3.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-v6wh-96g9-6wx3\nFix: upgrade `vite` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-cdb7d0cc3c09b210", "name": "Vulnerable dependency ws 8.18.3: GHSA-58qx-3vcg-4xpx", "shortDescription": {"text": "Vulnerable dependency ws 8.18.3: GHSA-58qx-3vcg-4xpx"}, "fullDescription": {"text": "OSV.dev reports `ws` at version `8.18.3` (resolved in `deploy/tools/essential-dapps-chains-config-generator/yarn.lock`) is affected by GHSA-58qx-3vcg-4xpx (aka CVE-2026-45736).\n\nws: Uninitialized memory disclosure\n\nAliases: CVE-2026-45736\nAdvisory: https://osv.dev/vulnerability/GHSA-58qx-3vcg-4xpx\nFix: upgrade `ws` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-15d9569d6e1f49e9", "name": "Vulnerable dependency ws 8.18.3: GHSA-96hv-2xvq-fx4p", "shortDescription": {"text": "Vulnerable dependency ws 8.18.3: GHSA-96hv-2xvq-fx4p"}, "fullDescription": {"text": "OSV.dev reports `ws` at version `8.18.3` (resolved in `deploy/tools/essential-dapps-chains-config-generator/yarn.lock`) is affected by GHSA-96hv-2xvq-fx4p (aka CVE-2026-48779).\n\nws: Memory exhaustion DoS from tiny fragments and data chunks\n\nAliases: CVE-2026-48779\nAdvisory: https://osv.dev/vulnerability/GHSA-96hv-2xvq-fx4p\nFix: upgrade `ws` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-990df84c0a830571", "name": "Vulnerable dependency webpack 5.95.0: GHSA-38r7-794h-5758", "shortDescription": {"text": "Vulnerable dependency webpack 5.95.0: GHSA-38r7-794h-5758"}, "fullDescription": {"text": "OSV.dev reports `webpack` at version `5.95.0` (resolved in `deploy/tools/favicon-generator/yarn.lock`) is affected by GHSA-38r7-794h-5758.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-38r7-794h-5758\nFix: upgrade `webpack` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7b37da4ae419f9c7", "name": "Vulnerable dependency webpack 5.95.0: GHSA-8fgc-7cc6-rx7x", "shortDescription": {"text": "Vulnerable dependency webpack 5.95.0: GHSA-8fgc-7cc6-rx7x"}, "fullDescription": {"text": "OSV.dev reports `webpack` at version `5.95.0` (resolved in `deploy/tools/favicon-generator/yarn.lock`) is affected by GHSA-8fgc-7cc6-rx7x.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-8fgc-7cc6-rx7x\nFix: upgrade `webpack` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d1ceaa0335c4793e", "name": "Vulnerable dependency @opentelemetry/auto-instrumentations-node 0.43.0: GHSA-q7rr-3cgh-j5r3", "shortDescription": {"text": "Vulnerable dependency @opentelemetry/auto-instrumentations-node 0.43.0: GHSA-q7rr-3cgh-j5r3"}, "fullDescription": {"text": "OSV.dev reports `@opentelemetry/auto-instrumentations-node` at version `0.43.0` (resolved in `yarn.lock`) is affected by GHSA-q7rr-3cgh-j5r3 (aka CVE-2026-44902).\n\nPrometheus exporter process crash via malformed HTTP request\n\nAliases: CVE-2026-44902\nAdvisory: https://osv.dev/vulnerability/GHSA-q7rr-3cgh-j5r3\nFix: upgrade `@opentelemetry/auto-instrumentations-node` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 1.0}}, {"id": "scanner-acda3f755521f602", "name": "Vulnerable dependency @opentelemetry/sdk-node 0.49.1: GHSA-q7rr-3cgh-j5r3", "shortDescription": {"text": "Vulnerable dependency @opentelemetry/sdk-node 0.49.1: GHSA-q7rr-3cgh-j5r3"}, "fullDescription": {"text": "OSV.dev reports `@opentelemetry/sdk-node` at version `0.49.1` (resolved in `yarn.lock`) is affected by GHSA-q7rr-3cgh-j5r3 (aka CVE-2026-44902).\n\nPrometheus exporter process crash via malformed HTTP request\n\nAliases: CVE-2026-44902\nAdvisory: https://osv.dev/vulnerability/GHSA-q7rr-3cgh-j5r3\nFix: upgrade `@opentelemetry/sdk-node` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 1.0}}, {"id": "scanner-49968a072b4dd2d3", "name": "Vulnerable dependency js-cookie 3.0.1: GHSA-qjx8-664m-686j", "shortDescription": {"text": "Vulnerable dependency js-cookie 3.0.1: GHSA-qjx8-664m-686j"}, "fullDescription": {"text": "OSV.dev reports `js-cookie` at version `3.0.1` (resolved in `yarn.lock`) is affected by GHSA-qjx8-664m-686j.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-qjx8-664m-686j\nFix: upgrade `js-cookie` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a86fbf6d7db0945e", "name": "Vulnerable dependency next 15.5.10: GHSA-267c-6grr-h53f", "shortDescription": {"text": "Vulnerable dependency next 15.5.10: GHSA-267c-6grr-h53f"}, "fullDescription": {"text": "OSV.dev reports `next` at version `15.5.10` (declared in `package.json`) is affected by GHSA-267c-6grr-h53f.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-267c-6grr-h53f\nFix: upgrade `next` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3da4e2297bb88330", "name": "Vulnerable dependency next 15.5.10: GHSA-26hh-7cqf-hhc6", "shortDescription": {"text": "Vulnerable dependency next 15.5.10: GHSA-26hh-7cqf-hhc6"}, "fullDescription": {"text": "OSV.dev reports `next` at version `15.5.10` (declared in `package.json`) is affected by GHSA-26hh-7cqf-hhc6.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-26hh-7cqf-hhc6\nFix: upgrade `next` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-99efe7bac2db9cda", "name": "Vulnerable dependency next 15.5.10: GHSA-2xp9-vwfh-vxw4", "shortDescription": {"text": "Vulnerable dependency next 15.5.10: GHSA-2xp9-vwfh-vxw4"}, "fullDescription": {"text": "OSV.dev reports `next` at version `15.5.10` (declared in `package.json`) is affected by GHSA-2xp9-vwfh-vxw4.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-2xp9-vwfh-vxw4\nFix: upgrade `next` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-35d51c66b88df24c", "name": "Vulnerable dependency next 15.5.10: GHSA-36qx-fr4f-26g5", "shortDescription": {"text": "Vulnerable dependency next 15.5.10: GHSA-36qx-fr4f-26g5"}, "fullDescription": {"text": "OSV.dev reports `next` at version `15.5.10` (declared in `package.json`) is affected by GHSA-36qx-fr4f-26g5.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-36qx-fr4f-26g5\nFix: upgrade `next` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-958e8eb5649a14a1", "name": "Vulnerable dependency next 15.5.10: GHSA-3g8h-86w9-wvmq", "shortDescription": {"text": "Vulnerable dependency next 15.5.10: GHSA-3g8h-86w9-wvmq"}, "fullDescription": {"text": "OSV.dev reports `next` at version `15.5.10` (declared in `package.json`) is affected by GHSA-3g8h-86w9-wvmq.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-3g8h-86w9-wvmq\nFix: upgrade `next` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-931caeae8bc0cfaa", "name": "Vulnerable dependency next 15.5.10: GHSA-3x4c-7xq6-9pq8", "shortDescription": {"text": "Vulnerable dependency next 15.5.10: GHSA-3x4c-7xq6-9pq8"}, "fullDescription": {"text": "OSV.dev reports `next` at version `15.5.10` (declared in `package.json`) is affected by GHSA-3x4c-7xq6-9pq8.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-3x4c-7xq6-9pq8\nFix: upgrade `next` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2cd3984d002b5548", "name": "Vulnerable dependency next 15.5.10: GHSA-4633-3j49-mh5q", "shortDescription": {"text": "Vulnerable dependency next 15.5.10: GHSA-4633-3j49-mh5q"}, "fullDescription": {"text": "OSV.dev reports `next` at version `15.5.10` (declared in `package.json`) is affected by GHSA-4633-3j49-mh5q.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-4633-3j49-mh5q\nFix: upgrade `next` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-406c0621c3eb86a0", "name": "Vulnerable dependency next 15.5.10: GHSA-492v-c6pp-mqqv", "shortDescription": {"text": "Vulnerable dependency next 15.5.10: GHSA-492v-c6pp-mqqv"}, "fullDescription": {"text": "OSV.dev reports `next` at version `15.5.10` (declared in `package.json`) is affected by GHSA-492v-c6pp-mqqv.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-492v-c6pp-mqqv\nFix: upgrade `next` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3835495a59f1926f", "name": "Vulnerable dependency next 15.5.10: GHSA-4c39-4ccg-62r3", "shortDescription": {"text": "Vulnerable dependency next 15.5.10: GHSA-4c39-4ccg-62r3"}, "fullDescription": {"text": "OSV.dev reports `next` at version `15.5.10` (declared in `package.json`) is affected by GHSA-4c39-4ccg-62r3.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-4c39-4ccg-62r3\nFix: upgrade `next` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8fabb913427d57e1", "name": "Vulnerable dependency next 15.5.10: GHSA-4jqv-mc3x-m676", "shortDescription": {"text": "Vulnerable dependency next 15.5.10: GHSA-4jqv-mc3x-m676"}, "fullDescription": {"text": "OSV.dev reports `next` at version `15.5.10` (declared in `package.json`) is affected by GHSA-4jqv-mc3x-m676.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-4jqv-mc3x-m676\nFix: upgrade `next` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a5b9534d5a52b4ae", "name": "Vulnerable dependency next 15.5.10: GHSA-68g3-v927-f742", "shortDescription": {"text": "Vulnerable dependency next 15.5.10: GHSA-68g3-v927-f742"}, "fullDescription": {"text": "OSV.dev reports `next` at version `15.5.10` (declared in `package.json`) is affected by GHSA-68g3-v927-f742.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-68g3-v927-f742\nFix: upgrade `next` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-bb0447a681128f98", "name": "Vulnerable dependency next 15.5.10: GHSA-89xv-2m56-2m9x", "shortDescription": {"text": "Vulnerable dependency next 15.5.10: GHSA-89xv-2m56-2m9x"}, "fullDescription": {"text": "OSV.dev reports `next` at version `15.5.10` (declared in `package.json`) is affected by GHSA-89xv-2m56-2m9x.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-89xv-2m56-2m9x\nFix: upgrade `next` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4b3dec7310e683d2", "name": "Vulnerable dependency next 15.5.10: GHSA-8h8q-6873-q5fj", "shortDescription": {"text": "Vulnerable dependency next 15.5.10: GHSA-8h8q-6873-q5fj"}, "fullDescription": {"text": "OSV.dev reports `next` at version `15.5.10` (declared in `package.json`) is affected by GHSA-8h8q-6873-q5fj.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-8h8q-6873-q5fj\nFix: upgrade `next` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6cc8135681cc8281", "name": "Vulnerable dependency next 15.5.10: GHSA-955p-x3mx-jcvp", "shortDescription": {"text": "Vulnerable dependency next 15.5.10: GHSA-955p-x3mx-jcvp"}, "fullDescription": {"text": "OSV.dev reports `next` at version `15.5.10` (declared in `package.json`) is affected by GHSA-955p-x3mx-jcvp.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-955p-x3mx-jcvp\nFix: upgrade `next` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-09f5e08379c92ab1", "name": "Vulnerable dependency next 15.5.10: GHSA-c4j6-fc7j-m34r", "shortDescription": {"text": "Vulnerable dependency next 15.5.10: GHSA-c4j6-fc7j-m34r"}, "fullDescription": {"text": "OSV.dev reports `next` at version `15.5.10` (declared in `package.json`) is affected by GHSA-c4j6-fc7j-m34r.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-c4j6-fc7j-m34r\nFix: upgrade `next` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-46f6150227fe056f", "name": "Vulnerable dependency next 15.5.10: GHSA-ffhc-5mcf-pf4q", "shortDescription": {"text": "Vulnerable dependency next 15.5.10: GHSA-ffhc-5mcf-pf4q"}, "fullDescription": {"text": "OSV.dev reports `next` at version `15.5.10` (declared in `package.json`) is affected by GHSA-ffhc-5mcf-pf4q.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-ffhc-5mcf-pf4q\nFix: upgrade `next` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f04a82fc0b65b2fd", "name": "Vulnerable dependency next 15.5.10: GHSA-ggv3-7p47-pfv8", "shortDescription": {"text": "Vulnerable dependency next 15.5.10: GHSA-ggv3-7p47-pfv8"}, "fullDescription": {"text": "OSV.dev reports `next` at version `15.5.10` (declared in `package.json`) is affected by GHSA-ggv3-7p47-pfv8.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-ggv3-7p47-pfv8\nFix: upgrade `next` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-81a047fbe4388b8a", "name": "Vulnerable dependency next 15.5.10: GHSA-gx5p-jg67-6x7h", "shortDescription": {"text": "Vulnerable dependency next 15.5.10: GHSA-gx5p-jg67-6x7h"}, "fullDescription": {"text": "OSV.dev reports `next` at version `15.5.10` (declared in `package.json`) is affected by GHSA-gx5p-jg67-6x7h.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-gx5p-jg67-6x7h\nFix: upgrade `next` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7006fed992ec5d72", "name": "Vulnerable dependency next 15.5.10: GHSA-h64f-5h5j-jqjh", "shortDescription": {"text": "Vulnerable dependency next 15.5.10: GHSA-h64f-5h5j-jqjh"}, "fullDescription": {"text": "OSV.dev reports `next` at version `15.5.10` (declared in `package.json`) is affected by GHSA-h64f-5h5j-jqjh.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-h64f-5h5j-jqjh\nFix: upgrade `next` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8fb5f9359bf8be25", "name": "Vulnerable dependency next 15.5.10: GHSA-m99w-x7hq-7vfj", "shortDescription": {"text": "Vulnerable dependency next 15.5.10: GHSA-m99w-x7hq-7vfj"}, "fullDescription": {"text": "OSV.dev reports `next` at version `15.5.10` (declared in `package.json`) is affected by GHSA-m99w-x7hq-7vfj.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-m99w-x7hq-7vfj\nFix: upgrade `next` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a5f89da73c3b62ae", "name": "Vulnerable dependency next 15.5.10: GHSA-mcj8-r9mp-w47p", "shortDescription": {"text": "Vulnerable dependency next 15.5.10: GHSA-mcj8-r9mp-w47p"}, "fullDescription": {"text": "OSV.dev reports `next` at version `15.5.10` (declared in `package.json`) is affected by GHSA-mcj8-r9mp-w47p.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-mcj8-r9mp-w47p\nFix: upgrade `next` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-769e4c6c483ec2bc", "name": "Vulnerable dependency next 15.5.10: GHSA-mg66-mrh9-m8jx", "shortDescription": {"text": "Vulnerable dependency next 15.5.10: GHSA-mg66-mrh9-m8jx"}, "fullDescription": {"text": "OSV.dev reports `next` at version `15.5.10` (declared in `package.json`) is affected by GHSA-mg66-mrh9-m8jx.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-mg66-mrh9-m8jx\nFix: upgrade `next` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8759c79392a0cf54", "name": "Vulnerable dependency next 15.5.10: GHSA-p293-qw3h-jr36", "shortDescription": {"text": "Vulnerable dependency next 15.5.10: GHSA-p293-qw3h-jr36"}, "fullDescription": {"text": "OSV.dev reports `next` at version `15.5.10` (declared in `package.json`) is affected by GHSA-p293-qw3h-jr36.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-p293-qw3h-jr36\nFix: upgrade `next` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-93cc92a6fa1191a1", "name": "Vulnerable dependency next 15.5.10: GHSA-p9j2-gv94-2wf4", "shortDescription": {"text": "Vulnerable dependency next 15.5.10: GHSA-p9j2-gv94-2wf4"}, "fullDescription": {"text": "OSV.dev reports `next` at version `15.5.10` (declared in `package.json`) is affected by GHSA-p9j2-gv94-2wf4.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-p9j2-gv94-2wf4\nFix: upgrade `next` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-477b87563cffc4b6", "name": "Vulnerable dependency next 15.5.10: GHSA-q4gf-8mx6-v5v3", "shortDescription": {"text": "Vulnerable dependency next 15.5.10: GHSA-q4gf-8mx6-v5v3"}, "fullDescription": {"text": "OSV.dev reports `next` at version `15.5.10` (declared in `package.json`) is affected by GHSA-q4gf-8mx6-v5v3.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-q4gf-8mx6-v5v3\nFix: upgrade `next` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-bd135daf676b64d2", "name": "Vulnerable dependency next 15.5.10: GHSA-q8wf-6r8g-63ch", "shortDescription": {"text": "Vulnerable dependency next 15.5.10: GHSA-q8wf-6r8g-63ch"}, "fullDescription": {"text": "OSV.dev reports `next` at version `15.5.10` (declared in `package.json`) is affected by GHSA-q8wf-6r8g-63ch.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-q8wf-6r8g-63ch\nFix: upgrade `next` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-88ceb32a56ef6ae6", "name": "Vulnerable dependency next 15.5.10: GHSA-vfv6-92ff-j949", "shortDescription": {"text": "Vulnerable dependency next 15.5.10: GHSA-vfv6-92ff-j949"}, "fullDescription": {"text": "OSV.dev reports `next` at version `15.5.10` (declared in `package.json`) is affected by GHSA-vfv6-92ff-j949.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-vfv6-92ff-j949\nFix: upgrade `next` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e43a32eed7c0b78f", "name": "Vulnerable dependency next 15.5.10: GHSA-wfc6-r584-vfw7", "shortDescription": {"text": "Vulnerable dependency next 15.5.10: GHSA-wfc6-r584-vfw7"}, "fullDescription": {"text": "OSV.dev reports `next` at version `15.5.10` (declared in `package.json`) is affected by GHSA-wfc6-r584-vfw7.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-wfc6-r584-vfw7\nFix: upgrade `next` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1104aeecee2f754a", "name": "Vulnerable dependency node-fetch 3.2.9: GHSA-vp56-6g26-6827", "shortDescription": {"text": "Vulnerable dependency node-fetch 3.2.9: GHSA-vp56-6g26-6827"}, "fullDescription": {"text": "OSV.dev reports `node-fetch` at version `3.2.9` (declared in `package.json`) is affected by GHSA-vp56-6g26-6827.\nNote: `3.2.9` is the declared floor of a range \u2014 the installed version may be newer.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-vp56-6g26-6827\nFix: upgrade `node-fetch` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-898c0d1ec690b038", "name": "Vulnerable dependency path-to-regexp 8.1.0: GHSA-27v5-c462-wpq7", "shortDescription": {"text": "Vulnerable dependency path-to-regexp 8.1.0: GHSA-27v5-c462-wpq7"}, "fullDescription": {"text": "OSV.dev reports `path-to-regexp` at version `8.1.0` (declared in `package.json`) is affected by GHSA-27v5-c462-wpq7.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-27v5-c462-wpq7\nFix: upgrade `path-to-regexp` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-91d587a7860fc824", "name": "Vulnerable dependency path-to-regexp 8.1.0: GHSA-j3q9-mxjg-w52f", "shortDescription": {"text": "Vulnerable dependency path-to-regexp 8.1.0: GHSA-j3q9-mxjg-w52f"}, "fullDescription": {"text": "OSV.dev reports `path-to-regexp` at version `8.1.0` (declared in `package.json`) is affected by GHSA-j3q9-mxjg-w52f.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-j3q9-mxjg-w52f\nFix: upgrade `path-to-regexp` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-225d1810d66f8c6a", "name": "Vulnerable dependency phoenix 1.6.15: EEF-CVE-2026-56812", "shortDescription": {"text": "Vulnerable dependency phoenix 1.6.15: EEF-CVE-2026-56812"}, "fullDescription": {"text": "OSV.dev reports `phoenix` at version `1.6.15` (declared in `package.json`) is affected by EEF-CVE-2026-56812.\nNote: `1.6.15` is the declared floor of a range \u2014 the installed version may be newer.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/EEF-CVE-2026-56812\nFix: upgrade `phoenix` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-5ac0c1457bbcde9b", "name": "Vulnerable dependency phoenix 1.6.15: GHSA-63mc-hw7g-86rr", "shortDescription": {"text": "Vulnerable dependency phoenix 1.6.15: GHSA-63mc-hw7g-86rr"}, "fullDescription": {"text": "OSV.dev reports `phoenix` at version `1.6.15` (declared in `package.json`) is affected by GHSA-63mc-hw7g-86rr.\nNote: `1.6.15` is the declared floor of a range \u2014 the installed version may be newer.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-63mc-hw7g-86rr\nFix: upgrade `phoenix` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-47d3100a17ae458c", "name": "Vulnerable dependency valibot 1.2.0: GHSA-5qjj-4xww-7phc", "shortDescription": {"text": "Vulnerable dependency valibot 1.2.0: GHSA-5qjj-4xww-7phc"}, "fullDescription": {"text": "OSV.dev reports `valibot` at version `1.2.0` (declared in `package.json`) is affected by GHSA-5qjj-4xww-7phc.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-5qjj-4xww-7phc\nFix: upgrade `valibot` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-be88f307219378f7", "name": "Vulnerable dependency svgo 2.8.0: GHSA-2p49-hgcm-8545", "shortDescription": {"text": "Vulnerable dependency svgo 2.8.0: GHSA-2p49-hgcm-8545"}, "fullDescription": {"text": "OSV.dev reports `svgo` at version `2.8.0` (declared in `package.json`) is affected by GHSA-2p49-hgcm-8545.\nNote: `2.8.0` is the declared floor of a range \u2014 the installed version may be newer.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-2p49-hgcm-8545\nFix: upgrade `svgo` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-435c3b3f34a3ecd5", "name": "Vulnerable dependency svgo 2.8.0: GHSA-4vpr-x523-8j87", "shortDescription": {"text": "Vulnerable dependency svgo 2.8.0: GHSA-4vpr-x523-8j87"}, "fullDescription": {"text": "OSV.dev reports `svgo` at version `2.8.0` (declared in `package.json`) is affected by GHSA-4vpr-x523-8j87.\nNote: `2.8.0` is the declared floor of a range \u2014 the installed version may be newer.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-4vpr-x523-8j87\nFix: upgrade `svgo` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-c1fa422f71df684b", "name": "Vulnerable dependency svgo 2.8.0: GHSA-w27v-7q3p-w38r", "shortDescription": {"text": "Vulnerable dependency svgo 2.8.0: GHSA-w27v-7q3p-w38r"}, "fullDescription": {"text": "OSV.dev reports `svgo` at version `2.8.0` (declared in `package.json`) is affected by GHSA-w27v-7q3p-w38r.\nNote: `2.8.0` is the declared floor of a range \u2014 the installed version may be newer.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-w27v-7q3p-w38r\nFix: upgrade `svgo` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-e44a48a9ad8272eb", "name": "Vulnerable dependency svgo 2.8.0: GHSA-xpqw-6gx7-v673", "shortDescription": {"text": "Vulnerable dependency svgo 2.8.0: GHSA-xpqw-6gx7-v673"}, "fullDescription": {"text": "OSV.dev reports `svgo` at version `2.8.0` (declared in `package.json`) is affected by GHSA-xpqw-6gx7-v673.\nNote: `2.8.0` is the declared floor of a range \u2014 the installed version may be newer.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-xpqw-6gx7-v673\nFix: upgrade `svgo` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-7dc2c222291e4fef", "name": "Vulnerable dependency vitest 4.0.15: GHSA-5xrq-8626-4rwp", "shortDescription": {"text": "Vulnerable dependency vitest 4.0.15: GHSA-5xrq-8626-4rwp"}, "fullDescription": {"text": "OSV.dev reports `vitest` at version `4.0.15` (declared in `package.json`) is affected by GHSA-5xrq-8626-4rwp.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-5xrq-8626-4rwp\nFix: upgrade `vitest` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-20d024cad0d25329", "name": "Vulnerable dependency vitest 4.0.15: GHSA-82fw-gwwq-j7x9", "shortDescription": {"text": "Vulnerable dependency vitest 4.0.15: GHSA-82fw-gwwq-j7x9"}, "fullDescription": {"text": "OSV.dev reports `vitest` at version `4.0.15` (declared in `package.json`) is affected by GHSA-82fw-gwwq-j7x9.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-82fw-gwwq-j7x9\nFix: upgrade `vitest` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-7705f5fc5fa49f5a", "name": "Vulnerable dependency ws 8.17.1: GHSA-58qx-3vcg-4xpx", "shortDescription": {"text": "Vulnerable dependency ws 8.17.1: GHSA-58qx-3vcg-4xpx"}, "fullDescription": {"text": "OSV.dev reports `ws` at version `8.17.1` (declared in `package.json`) is affected by GHSA-58qx-3vcg-4xpx (aka CVE-2026-45736).\nNote: `8.17.1` is the declared floor of a range \u2014 the installed version may be newer.\n\nws: Uninitialized memory disclosure\n\nAliases: CVE-2026-45736\nAdvisory: https://osv.dev/vulnerability/GHSA-58qx-3vcg-4xpx\nFix: upgrade `ws` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-2e3c0776f3ab6a06", "name": "Vulnerable dependency ws 8.17.1: GHSA-96hv-2xvq-fx4p", "shortDescription": {"text": "Vulnerable dependency ws 8.17.1: GHSA-96hv-2xvq-fx4p"}, "fullDescription": {"text": "OSV.dev reports `ws` at version `8.17.1` (declared in `package.json`) is affected by GHSA-96hv-2xvq-fx4p (aka CVE-2026-48779).\nNote: `8.17.1` is the declared floor of a range \u2014 the installed version may be newer.\n\nws: Memory exhaustion DoS from tiny fragments and data chunks\n\nAliases: CVE-2026-48779\nAdvisory: https://osv.dev/vulnerability/GHSA-96hv-2xvq-fx4p\nFix: upgrade `ws` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.7}}, {"id": "scanner-68fc611deae22946", "name": "Vulnerable dependency brace-expansion 1.1.12: GHSA-3jxr-9vmj-r5cp", "shortDescription": {"text": "Vulnerable dependency brace-expansion 1.1.12: GHSA-3jxr-9vmj-r5cp"}, "fullDescription": {"text": "OSV.dev reports `brace-expansion` at version `1.1.12` (resolved in `deploy/tools/affected-tests/yarn.lock`) is affected by GHSA-3jxr-9vmj-r5cp.\nNote: `brace-expansion` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-3jxr-9vmj-r5cp\nFix: upgrade `brace-expansion` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-2875b4976cb23852", "name": "Vulnerable dependency brace-expansion 1.1.12: GHSA-6j4f-fj2g-mc7p", "shortDescription": {"text": "Vulnerable dependency brace-expansion 1.1.12: GHSA-6j4f-fj2g-mc7p"}, "fullDescription": {"text": "OSV.dev reports `brace-expansion` at version `1.1.12` (resolved in `deploy/tools/affected-tests/yarn.lock`) is affected by GHSA-6j4f-fj2g-mc7p.\nNote: `brace-expansion` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-6j4f-fj2g-mc7p\nFix: upgrade `brace-expansion` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-454875edc7909595", "name": "Vulnerable dependency brace-expansion 1.1.12: GHSA-f886-m6hf-6m8v", "shortDescription": {"text": "Vulnerable dependency brace-expansion 1.1.12: GHSA-f886-m6hf-6m8v"}, "fullDescription": {"text": "OSV.dev reports `brace-expansion` at version `1.1.12` (resolved in `deploy/tools/affected-tests/yarn.lock`) is affected by GHSA-f886-m6hf-6m8v.\nNote: `brace-expansion` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-f886-m6hf-6m8v\nFix: upgrade `brace-expansion` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-31787240adfad824", "name": "Vulnerable dependency brace-expansion 1.1.12: GHSA-mh99-v99m-4gvg", "shortDescription": {"text": "Vulnerable dependency brace-expansion 1.1.12: GHSA-mh99-v99m-4gvg"}, "fullDescription": {"text": "OSV.dev reports `brace-expansion` at version `1.1.12` (resolved in `deploy/tools/affected-tests/yarn.lock`) is affected by GHSA-mh99-v99m-4gvg.\nNote: `brace-expansion` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-mh99-v99m-4gvg\nFix: upgrade `brace-expansion` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-69f500265c94b2da", "name": "Vulnerable dependency brace-expansion 1.1.12: GHSA-q2hr-2g5m-vwhr", "shortDescription": {"text": "Vulnerable dependency brace-expansion 1.1.12: GHSA-q2hr-2g5m-vwhr"}, "fullDescription": {"text": "OSV.dev reports `brace-expansion` at version `1.1.12` (resolved in `deploy/tools/affected-tests/yarn.lock`) is affected by GHSA-q2hr-2g5m-vwhr.\nNote: `brace-expansion` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-q2hr-2g5m-vwhr\nFix: upgrade `brace-expansion` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-71a39fb34f255df5", "name": "Vulnerable dependency brace-expansion 1.1.12: GHSA-qhr7-859c-m2p7", "shortDescription": {"text": "Vulnerable dependency brace-expansion 1.1.12: GHSA-qhr7-859c-m2p7"}, "fullDescription": {"text": "OSV.dev reports `brace-expansion` at version `1.1.12` (resolved in `deploy/tools/affected-tests/yarn.lock`) is affected by GHSA-qhr7-859c-m2p7.\nNote: `brace-expansion` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-qhr7-859c-m2p7\nFix: upgrade `brace-expansion` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-798bc4268e43da4c", "name": "Vulnerable dependency brace-expansion 1.1.12: GHSA-rgw5-rvv9-x895", "shortDescription": {"text": "Vulnerable dependency brace-expansion 1.1.12: GHSA-rgw5-rvv9-x895"}, "fullDescription": {"text": "OSV.dev reports `brace-expansion` at version `1.1.12` (resolved in `deploy/tools/affected-tests/yarn.lock`) is affected by GHSA-rgw5-rvv9-x895.\nNote: `brace-expansion` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-rgw5-rvv9-x895\nFix: upgrade `brace-expansion` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-76c1756c34f6e1e8", "name": "Vulnerable dependency braces 3.0.3: GHSA-vfj7-8cjw-p6xm", "shortDescription": {"text": "Vulnerable dependency braces 3.0.3: GHSA-vfj7-8cjw-p6xm"}, "fullDescription": {"text": "OSV.dev reports `braces` at version `3.0.3` (resolved in `deploy/tools/affected-tests/yarn.lock`) is affected by GHSA-vfj7-8cjw-p6xm.\nNote: `braces` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-vfj7-8cjw-p6xm\nFix: upgrade `braces` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-f47d42688cdf31d1", "name": "Vulnerable dependency minimatch 3.1.2: GHSA-23c5-xmqv-rm74", "shortDescription": {"text": "Vulnerable dependency minimatch 3.1.2: GHSA-23c5-xmqv-rm74"}, "fullDescription": {"text": "OSV.dev reports `minimatch` at version `3.1.2` (resolved in `deploy/tools/affected-tests/yarn.lock`) is affected by GHSA-23c5-xmqv-rm74.\nNote: `minimatch` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-23c5-xmqv-rm74\nFix: upgrade `minimatch` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-7004ab356a3c1d29", "name": "Vulnerable dependency minimatch 3.1.2: GHSA-3ppc-4f35-3m26", "shortDescription": {"text": "Vulnerable dependency minimatch 3.1.2: GHSA-3ppc-4f35-3m26"}, "fullDescription": {"text": "OSV.dev reports `minimatch` at version `3.1.2` (resolved in `deploy/tools/affected-tests/yarn.lock`) is affected by GHSA-3ppc-4f35-3m26.\nNote: `minimatch` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-3ppc-4f35-3m26\nFix: upgrade `minimatch` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-96b72949d819d5f1", "name": "Vulnerable dependency minimatch 3.1.2: GHSA-7r86-cg39-jmmj", "shortDescription": {"text": "Vulnerable dependency minimatch 3.1.2: GHSA-7r86-cg39-jmmj"}, "fullDescription": {"text": "OSV.dev reports `minimatch` at version `3.1.2` (resolved in `deploy/tools/affected-tests/yarn.lock`) is affected by GHSA-7r86-cg39-jmmj.\nNote: `minimatch` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-7r86-cg39-jmmj\nFix: upgrade `minimatch` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-d47f9cde521580bd", "name": "Vulnerable dependency nanoid 3.3.8: GHSA-28wg-ghj8-5hjv", "shortDescription": {"text": "Vulnerable dependency nanoid 3.3.8: GHSA-28wg-ghj8-5hjv"}, "fullDescription": {"text": "OSV.dev reports `nanoid` at version `3.3.8` (resolved in `deploy/tools/affected-tests/yarn.lock`) is affected by GHSA-28wg-ghj8-5hjv (aka CVE-2026-67214).\nNote: `nanoid` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nnanoid: non-secure generators can loop indefinitely with negative size\n\nAliases: CVE-2026-67214\nAdvisory: https://osv.dev/vulnerability/GHSA-28wg-ghj8-5hjv\nFix: upgrade `nanoid` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-2e695e679618a156", "name": "Vulnerable dependency nanoid 3.3.8: GHSA-2v37-7h3g-55p8", "shortDescription": {"text": "Vulnerable dependency nanoid 3.3.8: GHSA-2v37-7h3g-55p8"}, "fullDescription": {"text": "OSV.dev reports `nanoid` at version `3.3.8` (resolved in `deploy/tools/affected-tests/yarn.lock`) is affected by GHSA-2v37-7h3g-55p8 (aka CVE-2026-67213).\nNote: `nanoid` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nnanoid: custom generators can loop indefinitely when size is zero\n\nAliases: CVE-2026-67213\nAdvisory: https://osv.dev/vulnerability/GHSA-2v37-7h3g-55p8\nFix: upgrade `nanoid` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-2b02141a74a32c94", "name": "Vulnerable dependency nanoid 3.3.8: GHSA-xwg4-73v4-xw9w", "shortDescription": {"text": "Vulnerable dependency nanoid 3.3.8: GHSA-xwg4-73v4-xw9w"}, "fullDescription": {"text": "OSV.dev reports `nanoid` at version `3.3.8` (resolved in `deploy/tools/affected-tests/yarn.lock`) is affected by GHSA-xwg4-73v4-xw9w.\nNote: `nanoid` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-xwg4-73v4-xw9w\nFix: upgrade `nanoid` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-cc181c14ce32f934", "name": "Vulnerable dependency picomatch 2.3.1: GHSA-3v7f-55p6-f55p", "shortDescription": {"text": "Vulnerable dependency picomatch 2.3.1: GHSA-3v7f-55p6-f55p"}, "fullDescription": {"text": "OSV.dev reports `picomatch` at version `2.3.1` (resolved in `deploy/tools/affected-tests/yarn.lock`) is affected by GHSA-3v7f-55p6-f55p (aka CVE-2026-33672).\nNote: `picomatch` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nPicomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching\n\nAliases: CVE-2026-33672\nAdvisory: https://osv.dev/vulnerability/GHSA-3v7f-55p6-f55p\nFix: upgrade `picomatch` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-981131207e45022c", "name": "Vulnerable dependency picomatch 2.3.1: GHSA-c2c7-rcm5-vvqj", "shortDescription": {"text": "Vulnerable dependency picomatch 2.3.1: GHSA-c2c7-rcm5-vvqj"}, "fullDescription": {"text": "OSV.dev reports `picomatch` at version `2.3.1` (resolved in `deploy/tools/affected-tests/yarn.lock`) is affected by GHSA-c2c7-rcm5-vvqj (aka CVE-2026-33671).\nNote: `picomatch` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nPicomatch has a ReDoS vulnerability via extglob quantifiers\n\nAliases: CVE-2026-33671\nAdvisory: https://osv.dev/vulnerability/GHSA-c2c7-rcm5-vvqj\nFix: upgrade `picomatch` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-e9a717971a8ee372", "name": "Vulnerable dependency postcss 8.4.33: GHSA-6g55-p6wh-862q", "shortDescription": {"text": "Vulnerable dependency postcss 8.4.33: GHSA-6g55-p6wh-862q"}, "fullDescription": {"text": "OSV.dev reports `postcss` at version `8.4.33` (resolved in `deploy/tools/affected-tests/yarn.lock`) is affected by GHSA-6g55-p6wh-862q (aka CVE-2026-45623).\nNote: `postcss` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nPostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments\n\nAliases: CVE-2026-45623\nAdvisory: https://osv.dev/vulnerability/GHSA-6g55-p6wh-862q\nFix: upgrade `postcss` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-5a2f175e58f0e3c3", "name": "Vulnerable dependency postcss 8.4.33: GHSA-fxqj-rqcc-2cmp", "shortDescription": {"text": "Vulnerable dependency postcss 8.4.33: GHSA-fxqj-rqcc-2cmp"}, "fullDescription": {"text": "OSV.dev reports `postcss` at version `8.4.33` (resolved in `deploy/tools/affected-tests/yarn.lock`) is affected by GHSA-fxqj-rqcc-2cmp (aka CVE-2026-69153).\nNote: `postcss` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nPostCSS: incomplete fix of GHSA-6g55-p6wh-862q \u2014 attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset\n\nAliases: CVE-2026-69153\nAdvisory: https://osv.dev/vulnerability/GHSA-fxqj-rqcc-2cmp\nFix: upgrade `postcss` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-f048b4385e3f5381", "name": "Vulnerable dependency postcss 8.4.33: GHSA-qx2v-qp2m-jg93", "shortDescription": {"text": "Vulnerable dependency postcss 8.4.33: GHSA-qx2v-qp2m-jg93"}, "fullDescription": {"text": "OSV.dev reports `postcss` at version `8.4.33` (resolved in `deploy/tools/affected-tests/yarn.lock`) is affected by GHSA-qx2v-qp2m-jg93 (aka CVE-2026-41305).\nNote: `postcss` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nPostCSS has XSS via Unescaped </style> in its CSS Stringify Output\n\nAliases: CVE-2026-41305\nAdvisory: https://osv.dev/vulnerability/GHSA-qx2v-qp2m-jg93\nFix: upgrade `postcss` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-05f8dae8994e4f65", "name": "Vulnerable dependency postcss 8.4.33: GHSA-r28c-9q8g-f849", "shortDescription": {"text": "Vulnerable dependency postcss 8.4.33: GHSA-r28c-9q8g-f849"}, "fullDescription": {"text": "OSV.dev reports `postcss` at version `8.4.33` (resolved in `deploy/tools/affected-tests/yarn.lock`) is affected by GHSA-r28c-9q8g-f849.\nNote: `postcss` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-r28c-9q8g-f849\nFix: upgrade `postcss` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-e90f15c51f57a3c0", "name": "Vulnerable dependency source-map-js 1.0.2: GHSA-68fv-2mgg-jv7q", "shortDescription": {"text": "Vulnerable dependency source-map-js 1.0.2: GHSA-68fv-2mgg-jv7q"}, "fullDescription": {"text": "OSV.dev reports `source-map-js` at version `1.0.2` (resolved in `deploy/tools/affected-tests/yarn.lock`) is affected by GHSA-68fv-2mgg-jv7q (aka CVE-2026-93749).\nNote: `source-map-js` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nsource-map-js allows event-loop denial of service through indexed source-map section offsets\n\nAliases: CVE-2026-93749\nAdvisory: https://osv.dev/vulnerability/GHSA-68fv-2mgg-jv7q\nFix: upgrade `source-map-js` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-cad2d71b7bdcb655", "name": "Vulnerable dependency nanoid 3.3.11: GHSA-28wg-ghj8-5hjv", "shortDescription": {"text": "Vulnerable dependency nanoid 3.3.11: GHSA-28wg-ghj8-5hjv"}, "fullDescription": {"text": "OSV.dev reports `nanoid` at version `3.3.11` (resolved in `deploy/tools/envs-validator/yarn.lock`) is affected by GHSA-28wg-ghj8-5hjv (aka CVE-2026-67214).\nNote: `nanoid` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nnanoid: non-secure generators can loop indefinitely with negative size\n\nAliases: CVE-2026-67214\nAdvisory: https://osv.dev/vulnerability/GHSA-28wg-ghj8-5hjv\nFix: upgrade `nanoid` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-d3d83a637007323d", "name": "Vulnerable dependency nanoid 3.3.11: GHSA-2v37-7h3g-55p8", "shortDescription": {"text": "Vulnerable dependency nanoid 3.3.11: GHSA-2v37-7h3g-55p8"}, "fullDescription": {"text": "OSV.dev reports `nanoid` at version `3.3.11` (resolved in `deploy/tools/envs-validator/yarn.lock`) is affected by GHSA-2v37-7h3g-55p8 (aka CVE-2026-67213).\nNote: `nanoid` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nnanoid: custom generators can loop indefinitely when size is zero\n\nAliases: CVE-2026-67213\nAdvisory: https://osv.dev/vulnerability/GHSA-2v37-7h3g-55p8\nFix: upgrade `nanoid` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-3a52ef576c7010ff", "name": "Vulnerable dependency nanoid 3.3.11: GHSA-xwg4-73v4-xw9w", "shortDescription": {"text": "Vulnerable dependency nanoid 3.3.11: GHSA-xwg4-73v4-xw9w"}, "fullDescription": {"text": "OSV.dev reports `nanoid` at version `3.3.11` (resolved in `deploy/tools/envs-validator/yarn.lock`) is affected by GHSA-xwg4-73v4-xw9w.\nNote: `nanoid` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-xwg4-73v4-xw9w\nFix: upgrade `nanoid` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-af7c2d1a698b18f8", "name": "Vulnerable dependency picomatch 4.0.3: GHSA-3v7f-55p6-f55p", "shortDescription": {"text": "Vulnerable dependency picomatch 4.0.3: GHSA-3v7f-55p6-f55p"}, "fullDescription": {"text": "OSV.dev reports `picomatch` at version `4.0.3` (resolved in `deploy/tools/envs-validator/yarn.lock`) is affected by GHSA-3v7f-55p6-f55p (aka CVE-2026-33672).\nNote: `picomatch` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nPicomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching\n\nAliases: CVE-2026-33672\nAdvisory: https://osv.dev/vulnerability/GHSA-3v7f-55p6-f55p\nFix: upgrade `picomatch` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-8ef68a6260fd350e", "name": "Vulnerable dependency picomatch 4.0.3: GHSA-c2c7-rcm5-vvqj", "shortDescription": {"text": "Vulnerable dependency picomatch 4.0.3: GHSA-c2c7-rcm5-vvqj"}, "fullDescription": {"text": "OSV.dev reports `picomatch` at version `4.0.3` (resolved in `deploy/tools/envs-validator/yarn.lock`) is affected by GHSA-c2c7-rcm5-vvqj (aka CVE-2026-33671).\nNote: `picomatch` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nPicomatch has a ReDoS vulnerability via extglob quantifiers\n\nAliases: CVE-2026-33671\nAdvisory: https://osv.dev/vulnerability/GHSA-c2c7-rcm5-vvqj\nFix: upgrade `picomatch` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-4d9ae268eb82c2ed", "name": "Vulnerable dependency postcss 8.5.6: GHSA-6g55-p6wh-862q", "shortDescription": {"text": "Vulnerable dependency postcss 8.5.6: GHSA-6g55-p6wh-862q"}, "fullDescription": {"text": "OSV.dev reports `postcss` at version `8.5.6` (resolved in `deploy/tools/envs-validator/yarn.lock`) is affected by GHSA-6g55-p6wh-862q (aka CVE-2026-45623).\nNote: `postcss` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nPostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments\n\nAliases: CVE-2026-45623\nAdvisory: https://osv.dev/vulnerability/GHSA-6g55-p6wh-862q\nFix: upgrade `postcss` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-491e13682d9ce0c5", "name": "Vulnerable dependency postcss 8.5.6: GHSA-fxqj-rqcc-2cmp", "shortDescription": {"text": "Vulnerable dependency postcss 8.5.6: GHSA-fxqj-rqcc-2cmp"}, "fullDescription": {"text": "OSV.dev reports `postcss` at version `8.5.6` (resolved in `deploy/tools/envs-validator/yarn.lock`) is affected by GHSA-fxqj-rqcc-2cmp (aka CVE-2026-69153).\nNote: `postcss` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nPostCSS: incomplete fix of GHSA-6g55-p6wh-862q \u2014 attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset\n\nAliases: CVE-2026-69153\nAdvisory: https://osv.dev/vulnerability/GHSA-fxqj-rqcc-2cmp\nFix: upgrade `postcss` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-b4f81b2dc6b69677", "name": "Vulnerable dependency postcss 8.5.6: GHSA-qx2v-qp2m-jg93", "shortDescription": {"text": "Vulnerable dependency postcss 8.5.6: GHSA-qx2v-qp2m-jg93"}, "fullDescription": {"text": "OSV.dev reports `postcss` at version `8.5.6` (resolved in `deploy/tools/envs-validator/yarn.lock`) is affected by GHSA-qx2v-qp2m-jg93 (aka CVE-2026-41305).\nNote: `postcss` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nPostCSS has XSS via Unescaped </style> in its CSS Stringify Output\n\nAliases: CVE-2026-41305\nAdvisory: https://osv.dev/vulnerability/GHSA-qx2v-qp2m-jg93\nFix: upgrade `postcss` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-204a5d086d1f3785", "name": "Vulnerable dependency postcss 8.5.6: GHSA-r28c-9q8g-f849", "shortDescription": {"text": "Vulnerable dependency postcss 8.5.6: GHSA-r28c-9q8g-f849"}, "fullDescription": {"text": "OSV.dev reports `postcss` at version `8.5.6` (resolved in `deploy/tools/envs-validator/yarn.lock`) is affected by GHSA-r28c-9q8g-f849.\nNote: `postcss` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-r28c-9q8g-f849\nFix: upgrade `postcss` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-d4ce37127b6f57d4", "name": "Vulnerable dependency rollup 4.53.2: GHSA-mw96-cpmx-2vgc", "shortDescription": {"text": "Vulnerable dependency rollup 4.53.2: GHSA-mw96-cpmx-2vgc"}, "fullDescription": {"text": "OSV.dev reports `rollup` at version `4.53.2` (resolved in `deploy/tools/envs-validator/yarn.lock`) is affected by GHSA-mw96-cpmx-2vgc (aka CVE-2026-27606).\nNote: `rollup` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nRollup 4 has Arbitrary File Write via Path Traversal\n\nAliases: CVE-2026-27606\nAdvisory: https://osv.dev/vulnerability/GHSA-mw96-cpmx-2vgc\nFix: upgrade `rollup` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-b1750de7c68da10a", "name": "Vulnerable dependency source-map-js 1.2.1: GHSA-68fv-2mgg-jv7q", "shortDescription": {"text": "Vulnerable dependency source-map-js 1.2.1: GHSA-68fv-2mgg-jv7q"}, "fullDescription": {"text": "OSV.dev reports `source-map-js` at version `1.2.1` (resolved in `deploy/tools/envs-validator/yarn.lock`) is affected by GHSA-68fv-2mgg-jv7q (aka CVE-2026-93749).\nNote: `source-map-js` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nsource-map-js allows event-loop denial of service through indexed source-map section offsets\n\nAliases: CVE-2026-93749\nAdvisory: https://osv.dev/vulnerability/GHSA-68fv-2mgg-jv7q\nFix: upgrade `source-map-js` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-3abc497e1edc688b", "name": "Vulnerable dependency rollup 4.52.4: GHSA-mw96-cpmx-2vgc", "shortDescription": {"text": "Vulnerable dependency rollup 4.52.4: GHSA-mw96-cpmx-2vgc"}, "fullDescription": {"text": "OSV.dev reports `rollup` at version `4.52.4` (resolved in `deploy/tools/essential-dapps-chains-config-generator/yarn.lock`) is affected by GHSA-mw96-cpmx-2vgc (aka CVE-2026-27606).\nNote: `rollup` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nRollup 4 has Arbitrary File Write via Path Traversal\n\nAliases: CVE-2026-27606\nAdvisory: https://osv.dev/vulnerability/GHSA-mw96-cpmx-2vgc\nFix: upgrade `rollup` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-a8c1b631f2dbc924", "name": "Dependency @blockscout/multichain-aggregator-types is a major version behind", "shortDescription": {"text": "Dependency @blockscout/multichain-aggregator-types is a major version behind"}, "fullDescription": {"text": "`@blockscout/multichain-aggregator-types` is pinned at `1.6.3-alpha.3` in `package.json` while the latest release on the npm registry is `2.1.8` \u2014 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `@blockscout/multichain-aggregator-types` to `2.1.8`."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 0.9}}, {"id": "scanner-04843d685e2e0cfe", "name": "Dependency @blockscout/tac-operation-lifecycle-types is a major version behind", "shortDescription": {"text": "Dependency @blockscout/tac-operation-lifecycle-types is a major version behind"}, "fullDescription": {"text": "`@blockscout/tac-operation-lifecycle-types` is pinned at `0.0.1-alpha.6` in `package.json` while the latest release on the npm registry is `1.2.0` \u2014 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `@blockscout/tac-operation-lifecycle-types` to `1.2.0`."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 0.9}}, {"id": "scanner-d0d23e744e6253de", "name": "Dependency @growthbook/growthbook-react is a major version behind", "shortDescription": {"text": "Dependency @growthbook/growthbook-react is a major version behind"}, "fullDescription": {"text": "`@growthbook/growthbook-react` is pinned at `0.21.0` in `package.json` while the latest release on the npm registry is `1.8.0` \u2014 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `@growthbook/growthbook-react` to `1.8.0`."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 0.9}}, {"id": "scanner-4d96aaa36a2ef51d", "name": "Dependency @helia/verified-fetch is two or more major versions behind", "shortDescription": {"text": "Dependency @helia/verified-fetch is two or more major versions behind"}, "fullDescription": {"text": "`@helia/verified-fetch` is pinned at `2.6.12` in `package.json` while the latest release on the npm registry is `8.1.2` \u2014 6 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `@helia/verified-fetch` to `8.1.2`."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-4f99afd417647973", "name": "Dependency @metamask/post-message-stream is two or more major versions behind", "shortDescription": {"text": "Dependency @metamask/post-message-stream is two or more major versions behind"}, "fullDescription": {"text": "`@metamask/post-message-stream` is pinned at `7.0.0` in `package.json` while the latest release on the npm registry is `10.0.0` \u2014 3 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `@metamask/post-message-stream` to `10.0.0`."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-79eb338fadb6db9b", "name": "Dependency @metamask/providers is two or more major versions behind", "shortDescription": {"text": "Dependency @metamask/providers is two or more major versions behind"}, "fullDescription": {"text": "`@metamask/providers` is pinned at `10.2.1` in `package.json` while the latest release on the npm registry is `22.1.1` \u2014 12 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `@metamask/providers` to `22.1.1`."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-e7cd08ce12d72ede", "name": "Dependency @next/bundle-analyzer is a major version behind", "shortDescription": {"text": "Dependency @next/bundle-analyzer is a major version behind"}, "fullDescription": {"text": "`@next/bundle-analyzer` is pinned at `15.5.9` in `package.json` while the latest release on the npm registry is `16.4.1` \u2014 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `@next/bundle-analyzer` to `16.4.1`."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 0.9}}, {"id": "scanner-732da2e1235bafda", "name": "Dependency @opentelemetry/exporter-jaeger is a major version behind", "shortDescription": {"text": "Dependency @opentelemetry/exporter-jaeger is a major version behind"}, "fullDescription": {"text": "`@opentelemetry/exporter-jaeger` is pinned at `1.27.0` in `package.json` while the latest release on the npm registry is `2.12.0` \u2014 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `@opentelemetry/exporter-jaeger` to `2.12.0`."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 0.9}}, {"id": "scanner-417f3f3854c03788", "name": "Dependency @opentelemetry/resources is a major version behind", "shortDescription": {"text": "Dependency @opentelemetry/resources is a major version behind"}, "fullDescription": {"text": "`@opentelemetry/resources` is pinned at `1.22.0` in `package.json` while the latest release on the npm registry is `2.12.0` \u2014 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `@opentelemetry/resources` to `2.12.0`."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 0.9}}, {"id": "scanner-ad28e8bc4836a1a6", "name": "Dependency @opentelemetry/sdk-trace-node is a major version behind", "shortDescription": {"text": "Dependency @opentelemetry/sdk-trace-node is a major version behind"}, "fullDescription": {"text": "`@opentelemetry/sdk-trace-node` is pinned at `1.22.0` in `package.json` while the latest release on the npm registry is `2.12.0` \u2014 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `@opentelemetry/sdk-trace-node` to `2.12.0`."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 0.9}}, {"id": "scanner-1746a749e4719c7c", "name": "Dependency @rollbar/react is a major version behind", "shortDescription": {"text": "Dependency @rollbar/react is a major version behind"}, "fullDescription": {"text": "`@rollbar/react` is pinned at `0.12.1` in `package.json` while the latest release on the npm registry is `1.2.0` \u2014 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `@rollbar/react` to `1.2.0`."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 0.9}}, {"id": "scanner-3f4e59e763fcaf3c", "name": "Dependency @scure/base is a major version behind", "shortDescription": {"text": "Dependency @scure/base is a major version behind"}, "fullDescription": {"text": "`@scure/base` is pinned at `1.1.9` in `package.json` while the latest release on the npm registry is `2.4.0` \u2014 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `@scure/base` to `2.4.0`."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 0.9}}, {"id": "scanner-b22150f1c8a5d73d", "name": "Dangling fetch: POST /node-api/monitoring/invalid-api-schema (ui/address/details/AddressSaveOnGas.tsx:57)", "shortDescription": {"text": "Dangling fetch: POST /node-api/monitoring/invalid-api-schema (ui/address/details/AddressSaveOnGas.tsx:57)"}, "fullDescription": {"text": "`ui/address/details/AddressSaveOnGas.tsx:57` calls `POST /node-api/monitoring/invalid-api-schema` but no backend route in the scanned graph matches that path. This is a likely runtime 404 unless an external gateway or unsupported router provides it.\n\nTool: fetch\nNormalized path used for matching: `/node-api/monitoring/invalid-api-schema`"}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 0.9}}, {"id": "scanner-e589f37257a778f4", "name": "Dangling fetch: POST /node-api/monitoring/invalid-api-schema (lib/solidityScan/useFetchReport.ts:40)", "shortDescription": {"text": "Dangling fetch: POST /node-api/monitoring/invalid-api-schema (lib/solidityScan/useFetchReport.ts:40)"}, "fullDescription": {"text": "`lib/solidityScan/useFetchReport.ts:40` calls `POST /node-api/monitoring/invalid-api-schema` but no backend route in the scanned graph matches that path. This is a likely runtime 404 unless an external gateway or unsupported router provides it.\n\nTool: fetch\nNormalized path used for matching: `/node-api/monitoring/invalid-api-schema`"}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 0.9}}, {"id": "scanner-b5521e2fb7c9d935", "name": "Dangling fetch: POST /node-api/monitoring/pageview (lib/monitoring/usePageViewTracking.ts:48)", "shortDescription": {"text": "Dangling fetch: POST /node-api/monitoring/pageview (lib/monitoring/usePageViewTracking.ts:48)"}, "fullDescription": {"text": "`lib/monitoring/usePageViewTracking.ts:48` calls `POST /node-api/monitoring/pageview` but no backend route in the scanned graph matches that path. This is a likely runtime 404 unless an external gateway or unsupported router provides it.\n\nTool: fetch\nNormalized path used for matching: `/node-api/monitoring/pageview`"}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 0.9}}, {"id": "scanner-eb41c50faece4371", "name": "Dangling fetch: POST /node-api/monitoring/invalid-api-schema (lib/xStarScore/useFetchXStarScore.ts:40)", "shortDescription": {"text": "Dangling fetch: POST /node-api/monitoring/invalid-api-schema (lib/xStarScore/useFetchXStarScore.ts:40)"}, "fullDescription": {"text": "`lib/xStarScore/useFetchXStarScore.ts:40` calls `POST /node-api/monitoring/invalid-api-schema` but no backend route in the scanned graph matches that path. This is a likely runtime 404 unless an external gateway or unsupported router provides it.\n\nTool: fetch\nNormalized path used for matching: `/node-api/monitoring/invalid-api-schema`"}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 0.9}}, {"id": "scanner-7e6d161776b758bd", "name": "16 backend endpoints not called by scanned frontend", "shortDescription": {"text": "16 backend endpoints not called by scanned frontend"}, "fullDescription": {"text": "No scanned frontend call matched these backend routes. Sample: ANY /api/buildUrl, ANY /api/useApiQueries, ANY /api/useApiQuery, ANY /api/getResourceParams, ANY /api/useQueryClientConfig, ANY /api/useApiFetch, ANY /api/useApiInfiniteQuery, ANY /api/getSocketUrl + 8 more. This is fine when endpoints serve external clients (mobile apps, SDKs, third-party integrations, server-side webhooks). Otherwise document consumers or remove dead routes."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/30842"}, "properties": {"repository": "SidraChain/blockscout-frontend", "repoUrl": "https://github.com/SidraChain/blockscout-frontend", "branch": "main"}, "results": [{"ruleId": "scanner-195b68c2e71f903b", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 types/api/address.ts:24"}, "properties": {"repobilityId": "ab80ba46dc2c26da", "scanner": "scanner-primary", "fingerprint": "195b68c2e71f903b", "layer": "frontend", "severity": "info", "confidence": 0.7, "tags": ["frontend-quality", "fq.todo-marker"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "types/api/address.ts"}, "region": {"startLine": 24}}}]}, {"ruleId": "scanner-56db74f7b31d8b13", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 ui/address/AddressTokenTransfers.pw.tsx:17"}, "properties": {"repobilityId": "2f9a4b1c0c0aaf7d", "scanner": "scanner-primary", "fingerprint": "56db74f7b31d8b13", "layer": "frontend", "severity": "info", "confidence": 0.7, "tags": ["frontend-quality", "fq.todo-marker"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ui/address/AddressTokenTransfers.pw.tsx"}, "region": {"startLine": 17}}}]}, {"ruleId": "scanner-796168dc0dc7cb9d", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 ui/address/AddressTxs.pw.tsx:101"}, "properties": {"repobilityId": "ce1070e9a1b2c183", "scanner": "scanner-primary", "fingerprint": "796168dc0dc7cb9d", "layer": "frontend", "severity": "info", "confidence": 0.7, "tags": ["frontend-quality", "fq.todo-marker"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ui/address/AddressTxs.pw.tsx"}, "region": {"startLine": 101}}}]}, {"ruleId": "scanner-ab79a8af4f5afa6e", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 ui/address/details/AddressQrCode.tsx:93"}, "properties": {"repobilityId": "f39f451fdabf8d85", "scanner": "scanner-primary", "fingerprint": "ab79a8af4f5afa6e", "layer": "frontend", "severity": "medium", "confidence": 0.8, "tags": ["frontend-quality", "fq.dangerous-html"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ui/address/details/AddressQrCode.tsx"}, "region": {"startLine": 93}}}]}, {"ruleId": "scanner-be2b47b60b9b86b9", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 ui/address/details/AddressAlerts.tsx:46"}, "properties": {"repobilityId": "e2a4ca9188170a36", "scanner": "scanner-primary", "fingerprint": "be2b47b60b9b86b9", "layer": "frontend", "severity": "medium", "confidence": 0.8, "tags": ["frontend-quality", "fq.dangerous-html"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ui/address/details/AddressAlerts.tsx"}, "region": {"startLine": 46}}}]}, {"ruleId": "scanner-fc160d1c421a4110", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 ui/address/contract/ContractDetails.pw.tsx:17"}, "properties": {"repobilityId": "d18a9b3b3bef350a", "scanner": "scanner-primary", "fingerprint": "fc160d1c421a4110", "layer": "frontend", "severity": "info", "confidence": 0.7, "tags": ["frontend-quality", "fq.todo-marker"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ui/address/contract/ContractDetails.pw.tsx"}, "region": {"startLine": 17}}}]}, {"ruleId": "scanner-7c8a3fa0394ec64c", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 ui/address/contract/alerts/ContractDetailsAlerts.pw.tsx:10"}, "properties": {"repobilityId": "f88914d57f4f7c7d", "scanner": "scanner-primary", "fingerprint": "7c8a3fa0394ec64c", "layer": "frontend", "severity": "info", "confidence": 0.7, "tags": ["frontend-quality", "fq.todo-marker"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ui/address/contract/alerts/ContractDetailsAlerts.pw.tsx"}, "region": {"startLine": 10}}}]}, {"ruleId": "scanner-bec6a319688be409", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 ui/marketplace/Rating/PopoverContent.tsx:74"}, "properties": {"repobilityId": "c3e07715633043cd", "scanner": "scanner-primary", "fingerprint": "bec6a319688be409", "layer": "frontend", "severity": "info", "confidence": 0.7, "tags": ["frontend-quality", "fq.todo-marker"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ui/marketplace/Rating/PopoverContent.tsx"}, "region": {"startLine": 74}}}]}, {"ruleId": "scanner-0dc213868a125553", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 ui/optimismSuperchain/home/ChainIndicators.tsx:53"}, "properties": {"repobilityId": "fc7eb30ef1eb00fc", "scanner": "scanner-primary", "fingerprint": "0dc213868a125553", "layer": "frontend", "severity": "info", "confidence": 0.7, "tags": ["frontend-quality", "fq.todo-marker"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ui/optimismSuperchain/home/ChainIndicators.tsx"}, "region": {"startLine": 53}}}]}, {"ruleId": "scanner-a853cbde25b601cd", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 ui/shared/layout/Layout.pw.tsx:9"}, "properties": {"repobilityId": "daf66dae76744020", "scanner": "scanner-primary", "fingerprint": "a853cbde25b601cd", "layer": "frontend", "severity": "info", "confidence": 0.7, "tags": ["frontend-quality", "fq.todo-marker"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ui/shared/layout/Layout.pw.tsx"}, "region": {"startLine": 9}}}]}, {"ruleId": "scanner-efa39f1173bf6e50", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 ui/shared/layout/LayoutError.pw.tsx:9"}, "properties": {"repobilityId": "635f1586a426c991", "scanner": "scanner-primary", "fingerprint": "efa39f1173bf6e50", "layer": "frontend", "severity": "info", "confidence": 0.7, "tags": ["frontend-quality", "fq.todo-marker"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ui/shared/layout/LayoutError.pw.tsx"}, "region": {"startLine": 9}}}]}, {"ruleId": "scanner-641b02f7f8857ed9", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 ui/shared/layout/LayoutHome.pw.tsx:8"}, "properties": {"repobilityId": "59a48c852cf391df", "scanner": "scanner-primary", "fingerprint": "641b02f7f8857ed9", "layer": "frontend", "severity": "info", "confidence": 0.7, "tags": ["frontend-quality", "fq.todo-marker"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ui/shared/layout/LayoutHome.pw.tsx"}, "region": {"startLine": 8}}}]}, {"ruleId": "scanner-219805c308147e35", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 ui/shared/monaco/CodeEditor.tsx:232"}, "properties": {"repobilityId": "f1d747381c67c189", "scanner": "scanner-primary", "fingerprint": "219805c308147e35", "layer": "frontend", "severity": "info", "confidence": 0.7, "tags": ["frontend-quality", "fq.todo-marker"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ui/shared/monaco/CodeEditor.tsx"}, "region": {"startLine": 232}}}]}, {"ruleId": "scanner-42fa69046b0adaf6", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 ui/shared/monaco/utils/addFileImportDecorations.ts:31"}, "properties": {"repobilityId": "ad177e94c5338620", "scanner": "scanner-primary", "fingerprint": "42fa69046b0adaf6", "layer": "frontend", "severity": "info", "confidence": 0.7, "tags": ["frontend-quality", "fq.todo-marker"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ui/shared/monaco/utils/addFileImportDecorations.ts"}, "region": {"startLine": 31}}}]}, {"ruleId": "scanner-b0d72727c28dc80f", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 ui/shared/monaco/utils/getFullPathOfImportedFile.ts:3"}, "properties": {"repobilityId": "4fd98416ec254b17", "scanner": "scanner-primary", "fingerprint": "b0d72727c28dc80f", "layer": "frontend", "severity": "info", "confidence": 0.7, "tags": ["frontend-quality", "fq.todo-marker"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ui/shared/monaco/utils/getFullPathOfImportedFile.ts"}, "region": {"startLine": 3}}}]}, {"ruleId": "scanner-5b25a205a5c8973c", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 ui/shared/AccountActionsMenu/items/PrivateTagMenuItem.tsx:61"}, "properties": {"repobilityId": "91f3578c63f7a54e", "scanner": "scanner-primary", "fingerprint": "5b25a205a5c8973c", "layer": "frontend", "severity": "info", "confidence": 0.7, "tags": ["frontend-quality", "fq.todo-marker"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ui/shared/AccountActionsMenu/items/PrivateTagMenuItem.tsx"}, "region": {"startLine": 61}}}]}, {"ruleId": "scanner-4d60cc7e770b1c20", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 ui/shared/AccountActionsMenu/items/PublicTagMenuItem.tsx:20"}, "properties": {"repobilityId": "6bea112db93d5b6c", "scanner": "scanner-primary", "fingerprint": "4d60cc7e770b1c20", "layer": "frontend", "severity": "info", "confidence": 0.7, "tags": ["frontend-quality", "fq.todo-marker"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ui/shared/AccountActionsMenu/items/PublicTagMenuItem.tsx"}, "region": {"startLine": 20}}}]}, {"ruleId": "scanner-566c275faf5abd9c", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 ui/shared/nft/NftMediaFullscreenModal.tsx:35"}, "properties": {"repobilityId": "7d604b1e99aea7f5", "scanner": "scanner-primary", "fingerprint": "566c275faf5abd9c", "layer": "frontend", "severity": "info", "confidence": 0.7, "tags": ["frontend-quality", "fq.todo-marker"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ui/shared/nft/NftMediaFullscreenModal.tsx"}, "region": {"startLine": 35}}}]}, {"ruleId": "scanner-664356af7e075fb1", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 ui/shared/entities/address/AddressIdenticon.tsx:56"}, "properties": {"repobilityId": "a7fe775bfe933f00", "scanner": "scanner-primary", "fingerprint": "664356af7e075fb1", "layer": "frontend", "severity": "medium", "confidence": 0.8, "tags": ["frontend-quality", "fq.dangerous-html"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ui/shared/entities/address/AddressIdenticon.tsx"}, "region": {"startLine": 56}}}]}, {"ruleId": "scanner-dffdec9341c90238", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 ui/shared/pagination/useQueryWithPages.ts:194"}, "properties": {"repobilityId": "74eb2acfe81c56b5", "scanner": "scanner-primary", "fingerprint": "dffdec9341c90238", "layer": "frontend", "severity": "info", "confidence": 0.7, "tags": ["frontend-quality", "fq.todo-marker"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ui/shared/pagination/useQueryWithPages.ts"}, "region": {"startLine": 194}}}]}, {"ruleId": "scanner-40f52740bb090f1b", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 ui/home/indicators/ChainIndicators.tsx:67"}, "properties": {"repobilityId": "ac6e65807befb9f2", "scanner": "scanner-primary", "fingerprint": "40f52740bb090f1b", "layer": "frontend", "severity": "info", "confidence": 0.7, "tags": ["frontend-quality", "fq.todo-marker"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ui/home/indicators/ChainIndicators.tsx"}, "region": {"startLine": 67}}}]}, {"ruleId": "scanner-3398e5fd54455608", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 ui/pages/Home.pw.tsx:35"}, "properties": {"repobilityId": "07b1b47912e89ac9", "scanner": "scanner-primary", "fingerprint": "3398e5fd54455608", "layer": "frontend", "severity": "info", "confidence": 0.7, "tags": ["frontend-quality", "fq.todo-marker"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ui/pages/Home.pw.tsx"}, "region": {"startLine": 35}}}]}, {"ruleId": "scanner-52963fa9e6d979f9", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 ui/pages/Tokens.pw.tsx:29"}, "properties": {"repobilityId": "a9c80f7c7d1927f5", "scanner": "scanner-primary", "fingerprint": "52963fa9e6d979f9", "layer": "frontend", "severity": "info", "confidence": 0.7, "tags": ["frontend-quality", "fq.todo-marker"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ui/pages/Tokens.pw.tsx"}, "region": {"startLine": 29}}}]}, {"ruleId": "scanner-f1d259cebf829669", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 ui/pages/TokenTransfers.pw.tsx:9"}, "properties": {"repobilityId": "186011f567bc9bd0", "scanner": "scanner-primary", "fingerprint": "f1d259cebf829669", "layer": "frontend", "severity": "info", "confidence": 0.7, "tags": ["frontend-quality", "fq.todo-marker"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ui/pages/TokenTransfers.pw.tsx"}, "region": {"startLine": 9}}}]}, {"ruleId": "scanner-e6efeeb6b4cf5fac", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 ui/pages/Blocks.pw.tsx:18"}, "properties": {"repobilityId": "4000f8b167607f55", "scanner": "scanner-primary", "fingerprint": "e6efeeb6b4cf5fac", "layer": "frontend", "severity": "info", "confidence": 0.7, "tags": ["frontend-quality", "fq.todo-marker"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ui/pages/Blocks.pw.tsx"}, "region": {"startLine": 18}}}]}, {"ruleId": "scanner-40a0969c81d5f255", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 ui/pages/Token.pw.tsx:24"}, "properties": {"repobilityId": "8a6365ebe1e48e9d", "scanner": "scanner-primary", "fingerprint": "40a0969c81d5f255", "layer": "frontend", "severity": "info", "confidence": 0.7, "tags": ["frontend-quality", "fq.todo-marker"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ui/pages/Token.pw.tsx"}, "region": {"startLine": 24}}}]}, {"ruleId": "scanner-119c50d3bc309481", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 ui/snippets/navigation/vertical/NavigationDesktop.pw.tsx:54"}, "properties": {"repobilityId": "887e020e2e9e774b", "scanner": "scanner-primary", "fingerprint": "119c50d3bc309481", "layer": "frontend", "severity": "info", "confidence": 0.7, "tags": ["frontend-quality", "fq.todo-marker"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ui/snippets/navigation/vertical/NavigationDesktop.pw.tsx"}, "region": {"startLine": 54}}}]}, {"ruleId": "scanner-e0c37cbaf8d5865c", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 ui/snippets/auth/AuthModal.tsx:187"}, "properties": {"repobilityId": "32d191eade1a09a3", "scanner": "scanner-primary", "fingerprint": "e0c37cbaf8d5865c", "layer": "frontend", "severity": "info", "confidence": 0.7, "tags": ["frontend-quality", "fq.todo-marker"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ui/snippets/auth/AuthModal.tsx"}, "region": {"startLine": 187}}}]}, {"ruleId": "scanner-3610ca6170fc7b0b", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 ui/snippets/searchBar/SearchBarSuggest/SearchBarSuggestDomain.tsx:31"}, "properties": {"repobilityId": "a3f96674b801c835", "scanner": "scanner-primary", "fingerprint": "3610ca6170fc7b0b", "layer": "frontend", "severity": "medium", "confidence": 0.8, "tags": ["frontend-quality", "fq.dangerous-html"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ui/snippets/searchBar/SearchBarSuggest/SearchBarSuggestDomain.tsx"}, "region": {"startLine": 31}}}]}, {"ruleId": "scanner-a50c8a41c5543e69", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 ui/snippets/searchBar/SearchBarSuggest/SearchBarSuggestCluster.tsx:34"}, "properties": {"repobilityId": "a6401e632287ecbf", "scanner": "scanner-primary", "fingerprint": "a50c8a41c5543e69", "layer": "frontend", "severity": "medium", "confidence": 0.8, "tags": ["frontend-quality", "fq.dangerous-html"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ui/snippets/searchBar/SearchBarSuggest/SearchBarSuggestCluster.tsx"}, "region": {"startLine": 34}}}]}, {"ruleId": "scanner-0806f5bceda570b7", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 ui/snippets/searchBar/SearchBarSuggest/SearchBarSuggestApp.tsx:46"}, "properties": {"repobilityId": "356d39f28a776cce", "scanner": "scanner-primary", "fingerprint": "0806f5bceda570b7", "layer": "frontend", "severity": "medium", "confidence": 0.8, "tags": ["frontend-quality", "fq.dangerous-html"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ui/snippets/searchBar/SearchBarSuggest/SearchBarSuggestApp.tsx"}, "region": {"startLine": 46}}}]}, {"ruleId": "scanner-03ca2537cc9b0bf6", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 ui/snippets/searchBar/SearchBarSuggest/SearchBarSuggestAddress.tsx:67"}, "properties": {"repobilityId": "f10321a101264b73", "scanner": "scanner-primary", "fingerprint": "03ca2537cc9b0bf6", "layer": "frontend", "severity": "medium", "confidence": 0.8, "tags": ["frontend-quality", "fq.dangerous-html"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ui/snippets/searchBar/SearchBarSuggest/SearchBarSuggestAddress.tsx"}, "region": {"startLine": 67}}}]}, {"ruleId": "scanner-bee09a060aa801e8", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 ui/snippets/searchBar/SearchBarSuggest/SearchBarSuggestBlock.tsx:46"}, "properties": {"repobilityId": "2c1317330914650f", "scanner": "scanner-primary", "fingerprint": "bee09a060aa801e8", "layer": "frontend", "severity": "medium", "confidence": 0.8, "tags": ["frontend-quality", "fq.dangerous-html"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ui/snippets/searchBar/SearchBarSuggest/SearchBarSuggestBlock.tsx"}, "region": {"startLine": 46}}}]}, {"ruleId": "scanner-c3f413e50b5dcb26", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 ui/snippets/searchBar/SearchBarSuggest/SearchBarSuggestToken.tsx:42"}, "properties": {"repobilityId": "b568e083a9ee65a0", "scanner": "scanner-primary", "fingerprint": "c3f413e50b5dcb26", "layer": "frontend", "severity": "medium", "confidence": 0.8, "tags": ["frontend-quality", "fq.dangerous-html"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ui/snippets/searchBar/SearchBarSuggest/SearchBarSuggestToken.tsx"}, "region": {"startLine": 42}}}]}, {"ruleId": "scanner-631cf38ba0311c1c", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 ui/snippets/header/alerts/MaintenanceAlert.tsx:15"}, "properties": {"repobilityId": "fec9dea22c564613", "scanner": "scanner-primary", "fingerprint": "631cf38ba0311c1c", "layer": "frontend", "severity": "medium", "confidence": 0.8, "tags": ["frontend-quality", "fq.dangerous-html"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ui/snippets/header/alerts/MaintenanceAlert.tsx"}, "region": {"startLine": 15}}}]}, {"ruleId": "scanner-e5e707fb5d5f26aa", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 ui/searchResults/SearchResultTableItem.tsx:85"}, "properties": {"repobilityId": "c73c5ba9ad5839ae", "scanner": "scanner-primary", "fingerprint": "e5e707fb5d5f26aa", "layer": "frontend", "severity": "medium", "confidence": 0.8, "tags": ["frontend-quality", "fq.dangerous-html"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ui/searchResults/SearchResultTableItem.tsx"}, "region": {"startLine": 85}}}]}, {"ruleId": "scanner-f8227d0b835ee484", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 ui/searchResults/SearchResultListItem.tsx:79"}, "properties": {"repobilityId": "1a3ce018e6a05ebc", "scanner": "scanner-primary", "fingerprint": "f8227d0b835ee484", "layer": "frontend", "severity": "medium", "confidence": 0.8, "tags": ["frontend-quality", "fq.dangerous-html"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ui/searchResults/SearchResultListItem.tsx"}, "region": {"startLine": 79}}}]}, {"ruleId": "scanner-fc21b4d5a3b47e95", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 ui/searchResults/SearchResultEntityTag.tsx:25"}, "properties": {"repobilityId": "a3243488bd406821", "scanner": "scanner-primary", "fingerprint": "fc21b4d5a3b47e95", "layer": "frontend", "severity": "medium", "confidence": 0.8, "tags": ["frontend-quality", "fq.dangerous-html"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ui/searchResults/SearchResultEntityTag.tsx"}, "region": {"startLine": 25}}}]}, {"ruleId": "scanner-fe03435f8ab7e26e", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 toolkit/chakra/icon-button.tsx:13"}, "properties": {"repobilityId": "afce5d6804ba423f", "scanner": "scanner-primary", "fingerprint": "fe03435f8ab7e26e", "layer": "frontend", "severity": "info", "confidence": 0.7, "tags": ["frontend-quality", "fq.todo-marker"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "toolkit/chakra/icon-button.tsx"}, "region": {"startLine": 13}}}]}, {"ruleId": "scanner-efa3a988eedc7ad8", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 toolkit/chakra/select.tsx:176"}, "properties": {"repobilityId": "81fd4f689f234142", "scanner": "scanner-primary", "fingerprint": "efa3a988eedc7ad8", "layer": "frontend", "severity": "info", "confidence": 0.7, "tags": ["frontend-quality", "fq.todo-marker"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "toolkit/chakra/select.tsx"}, "region": {"startLine": 176}}}]}, {"ruleId": "scanner-a6b3b8650cd37630", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 toolkit/chakra/tooltip.tsx:117"}, "properties": {"repobilityId": "1435206728919a1f", "scanner": "scanner-primary", "fingerprint": "a6b3b8650cd37630", "layer": "frontend", "severity": "info", "confidence": 0.7, "tags": ["frontend-quality", "fq.todo-marker"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "toolkit/chakra/tooltip.tsx"}, "region": {"startLine": 117}}}]}, {"ruleId": "scanner-9cdce2eeb40de40b", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 toolkit/package/src/index.ts:40"}, "properties": {"repobilityId": "4ba67c33362f4f37", "scanner": "scanner-primary", "fingerprint": "9cdce2eeb40de40b", "layer": "frontend", "severity": "info", "confidence": 0.7, "tags": ["frontend-quality", "fq.todo-marker"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "toolkit/package/src/index.ts"}, "region": {"startLine": 40}}}]}, {"ruleId": "scanner-0d782c15f08fdd8f", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 toolkit/components/charts/ChartFullscreenDialog.tsx:40"}, "properties": {"repobilityId": "9daf93dad841f778", "scanner": "scanner-primary", "fingerprint": "0d782c15f08fdd8f", "layer": "frontend", "severity": "info", "confidence": 0.7, "tags": ["frontend-quality", "fq.todo-marker"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "toolkit/components/charts/ChartFullscreenDialog.tsx"}, "region": {"startLine": 40}}}]}, {"ruleId": "scanner-95da9948de762b6d", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 toolkit/components/truncation/TruncatedTextTooltip.tsx:39"}, "properties": {"repobilityId": "4508c4696170c17a", "scanner": "scanner-primary", "fingerprint": "95da9948de762b6d", "layer": "frontend", "severity": "info", "confidence": 0.7, "tags": ["frontend-quality", "fq.todo-marker"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "toolkit/components/truncation/TruncatedTextTooltip.tsx"}, "region": {"startLine": 39}}}]}, {"ruleId": "scanner-44372368e06ccdd3", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 toolkit/theme/globals/scrollbar.ts:22"}, "properties": {"repobilityId": "9d95477ce9027a28", "scanner": "scanner-primary", "fingerprint": "44372368e06ccdd3", "layer": "frontend", "severity": "info", "confidence": 0.7, "tags": ["frontend-quality", "fq.todo-marker"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "toolkit/theme/globals/scrollbar.ts"}, "region": {"startLine": 22}}}]}, {"ruleId": "scanner-a6f1b6f7d0edbc46", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 lib/networks/getNetworkTitle.ts:3"}, "properties": {"repobilityId": "50e7625b6f9b8e87", "scanner": "scanner-primary", "fingerprint": "a6f1b6f7d0edbc46", "layer": "frontend", "severity": "info", "confidence": 0.7, "tags": ["frontend-quality", "fq.todo-marker"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "lib/networks/getNetworkTitle.ts"}, "region": {"startLine": 3}}}]}, {"ruleId": "scanner-95f3f80ccd7fd9b1", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 lib/metadata/templates/description.ts:7"}, "properties": {"repobilityId": "746eab4c14d8184f", "scanner": "scanner-primary", "fingerprint": "95f3f80ccd7fd9b1", "layer": "frontend", "severity": "info", "confidence": 0.7, "tags": ["frontend-quality", "fq.todo-marker"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "lib/metadata/templates/description.ts"}, "region": {"startLine": 7}}}]}, {"ruleId": "scanner-01ac87c3a284ce62", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 nextjs/utils/fetchProxy.ts:14"}, "properties": {"repobilityId": "91cb6f0781e410dc", "scanner": "scanner-primary", "fingerprint": "01ac87c3a284ce62", "layer": "frontend", "severity": "info", "confidence": 0.7, "tags": ["frontend-quality", "fq.todo-marker"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "nextjs/utils/fetchProxy.ts"}, "region": {"startLine": 14}}}]}, {"ruleId": "scanner-af3c80604da283e4", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 playwright/lib.tsx:48"}, "properties": {"repobilityId": "b4d5e139a02197e3", "scanner": "scanner-primary", "fingerprint": "af3c80604da283e4", "layer": "frontend", "severity": "info", "confidence": 0.7, "tags": ["frontend-quality", "fq.todo-marker"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "playwright/lib.tsx"}, "region": {"startLine": 48}}}]}, {"ruleId": "scanner-1d99ba53793c8935", "level": "note", "message": {"text": "Debug `console.log` remains in browser-facing code \u2014 playwright/lib.tsx:61"}, "properties": {"repobilityId": "44cd190c5808c76a", "scanner": "scanner-primary", "fingerprint": "1d99ba53793c8935", "layer": "frontend", "severity": "low", "confidence": 0.85, "tags": ["frontend-quality", "fq.console-leak"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "playwright/lib.tsx"}, "region": {"startLine": 61}}}]}, {"ruleId": "scanner-f9576c11a4239c3f", "level": "warning", "message": {"text": "detect child process \u2014 deploy/tools/affected-tests/index.js:98"}, "properties": {"repobilityId": "14300fa4359e73e0", "scanner": "scanner-primary", "fingerprint": "f9576c11a4239c3f", "layer": "security", "severity": "medium", "confidence": 0.55, "tags": ["semgrep", "security", "javascript"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "deploy/tools/affected-tests/index.js"}, "region": {"startLine": 98}}}]}, {"ruleId": "scanner-ddf9c384923c8a99", "level": "warning", "message": {"text": "react dangerouslysetinnerhtml \u2014 ui/searchResults/SearchResultEntityTag.tsx:25"}, "properties": {"repobilityId": "2feb2e340a2532c0", "scanner": "scanner-primary", "fingerprint": "ddf9c384923c8a99", "layer": "security", "severity": "medium", "confidence": 0.7, "tags": ["semgrep", "security", "react"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ui/searchResults/SearchResultEntityTag.tsx"}, "region": {"startLine": 25}}}]}, {"ruleId": "scanner-db6d9a5e9f1f8cab", "level": "warning", "message": {"text": "react dangerouslysetinnerhtml \u2014 ui/searchResults/SearchResultListItem.tsx:79"}, "properties": {"repobilityId": "efadaf7a9b2af772", "scanner": "scanner-primary", "fingerprint": "db6d9a5e9f1f8cab", "layer": "security", "severity": "medium", "confidence": 0.7, "tags": ["semgrep", "security", "react"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ui/searchResults/SearchResultListItem.tsx"}, "region": {"startLine": 79}}}]}, {"ruleId": "scanner-3690cac81d4cb48d", "level": "warning", "message": {"text": "react dangerouslysetinnerhtml \u2014 ui/searchResults/SearchResultTableItem.tsx:85"}, "properties": {"repobilityId": "0999273f9a9db8cb", "scanner": "scanner-primary", "fingerprint": "3690cac81d4cb48d", "layer": "security", "severity": "medium", "confidence": 0.7, "tags": ["semgrep", "security", "react"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ui/searchResults/SearchResultTableItem.tsx"}, "region": {"startLine": 85}}}]}, {"ruleId": "scanner-fe511ed23de0f42b", "level": "warning", "message": {"text": "react dangerouslysetinnerhtml \u2014 ui/shared/entities/address/AddressIdenticon.tsx:56"}, "properties": {"repobilityId": "faa936ee00691654", "scanner": "scanner-primary", "fingerprint": "fe511ed23de0f42b", "layer": "security", "severity": "medium", "confidence": 0.7, "tags": ["semgrep", "security", "react"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ui/shared/entities/address/AddressIdenticon.tsx"}, "region": {"startLine": 56}}}]}, {"ruleId": "scanner-23d47e8e17b92560", "level": "warning", "message": {"text": "react dangerouslysetinnerhtml \u2014 ui/snippets/searchBar/SearchBarSuggest/SearchBarSuggestAddress.tsx:67"}, "properties": {"repobilityId": "7ab21b375f9fac4a", "scanner": "scanner-primary", "fingerprint": "23d47e8e17b92560", "layer": "security", "severity": "medium", "confidence": 0.7, "tags": ["semgrep", "security", "react"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ui/snippets/searchBar/SearchBarSuggest/SearchBarSuggestAddress.tsx"}, "region": {"startLine": 67}}}]}, {"ruleId": "scanner-91f33d0635e82ffe", "level": "warning", "message": {"text": "react dangerouslysetinnerhtml \u2014 ui/snippets/searchBar/SearchBarSuggest/SearchBarSuggestApp.tsx:46"}, "properties": {"repobilityId": "033a463591668fd1", "scanner": "scanner-primary", "fingerprint": "91f33d0635e82ffe", "layer": "security", "severity": "medium", "confidence": 0.7, "tags": ["semgrep", "security", "react"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ui/snippets/searchBar/SearchBarSuggest/SearchBarSuggestApp.tsx"}, "region": {"startLine": 46}}}]}, {"ruleId": "scanner-e37c032ae0a04475", "level": "warning", "message": {"text": "react dangerouslysetinnerhtml \u2014 ui/snippets/searchBar/SearchBarSuggest/SearchBarSuggestBlock.tsx:46"}, "properties": {"repobilityId": "2373496ec115f2df", "scanner": "scanner-primary", "fingerprint": "e37c032ae0a04475", "layer": "security", "severity": "medium", "confidence": 0.7, "tags": ["semgrep", "security", "react"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ui/snippets/searchBar/SearchBarSuggest/SearchBarSuggestBlock.tsx"}, "region": {"startLine": 46}}}]}, {"ruleId": "scanner-59d76b35af51989a", "level": "warning", "message": {"text": "react dangerouslysetinnerhtml \u2014 ui/snippets/searchBar/SearchBarSuggest/SearchBarSuggestCluster.tsx:34"}, "properties": {"repobilityId": "3414b952dcf6772c", "scanner": "scanner-primary", "fingerprint": "59d76b35af51989a", "layer": "security", "severity": "medium", "confidence": 0.7, "tags": ["semgrep", "security", "react"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ui/snippets/searchBar/SearchBarSuggest/SearchBarSuggestCluster.tsx"}, "region": {"startLine": 34}}}]}, {"ruleId": "scanner-fde88164416666be", "level": "warning", "message": {"text": "react dangerouslysetinnerhtml \u2014 ui/snippets/searchBar/SearchBarSuggest/SearchBarSuggestDomain.tsx:31"}, "properties": {"repobilityId": "32c486814039ee80", "scanner": "scanner-primary", "fingerprint": "fde88164416666be", "layer": "security", "severity": "medium", "confidence": 0.7, "tags": ["semgrep", "security", "react"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ui/snippets/searchBar/SearchBarSuggest/SearchBarSuggestDomain.tsx"}, "region": {"startLine": 31}}}]}, {"ruleId": "scanner-f25c08eadee1d588", "level": "warning", "message": {"text": "react dangerouslysetinnerhtml \u2014 ui/snippets/searchBar/SearchBarSuggest/SearchBarSuggestLabel.tsx:23"}, "properties": {"repobilityId": "c26d6d57f21e89cd", "scanner": "scanner-primary", "fingerprint": "f25c08eadee1d588", "layer": "security", "severity": "medium", "confidence": 0.7, "tags": ["semgrep", "security", "react"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ui/snippets/searchBar/SearchBarSuggest/SearchBarSuggestLabel.tsx"}, "region": {"startLine": 23}}}]}, {"ruleId": "scanner-91377628a8ea9d15", "level": "warning", "message": {"text": "react dangerouslysetinnerhtml \u2014 ui/snippets/searchBar/SearchBarSuggest/SearchBarSuggestToken.tsx:42"}, "properties": {"repobilityId": "0d11f4b8206b51fc", "scanner": "scanner-primary", "fingerprint": "91377628a8ea9d15", "layer": "security", "severity": "medium", "confidence": 0.7, "tags": ["semgrep", "security", "react"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ui/snippets/searchBar/SearchBarSuggest/SearchBarSuggestToken.tsx"}, "region": {"startLine": 42}}}]}, {"ruleId": "scanner-821c8dbb9e19b386", "level": "error", "message": {"text": "CVE-2026-102276: brace-expansion 1.1.12 \u2014 deploy/tools/affected-tests/yarn.lock"}, "properties": {"repobilityId": "f9ef18c68c01ccdd", "scanner": "scanner-primary", "fingerprint": "821c8dbb9e19b386", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-102276"]}}, {"ruleId": "scanner-10dbb1a70a9a332a", "level": "error", "message": {"text": "CVE-2026-102278: brace-expansion 1.1.12 \u2014 deploy/tools/affected-tests/yarn.lock"}, "properties": {"repobilityId": "09af9a9170173234", "scanner": "scanner-primary", "fingerprint": "10dbb1a70a9a332a", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-102278"]}}, {"ruleId": "scanner-41980c86f2f197ce", "level": "error", "message": {"text": "CVE-2026-13149: brace-expansion 1.1.12 \u2014 deploy/tools/affected-tests/yarn.lock"}, "properties": {"repobilityId": "d188555c252b9f3d", "scanner": "scanner-primary", "fingerprint": "41980c86f2f197ce", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-13149"]}}, {"ruleId": "scanner-fa4be07d068deac0", "level": "error", "message": {"text": "CVE-2026-14257: brace-expansion 1.1.12 \u2014 deploy/tools/affected-tests/yarn.lock"}, "properties": {"repobilityId": "e1b6ecb8aeb34493", "scanner": "scanner-primary", "fingerprint": "fa4be07d068deac0", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-14257"]}}, {"ruleId": "scanner-1add15faa940abf2", "level": "error", "message": {"text": "CVE-2026-69152: brace-expansion 1.1.12 \u2014 deploy/tools/affected-tests/yarn.lock"}, "properties": {"repobilityId": "e5e2bf9a4ca44f90", "scanner": "scanner-primary", "fingerprint": "1add15faa940abf2", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-69152"]}}, {"ruleId": "scanner-657d9b34553a6802", "level": "warning", "message": {"text": "CVE-2026-102277: brace-expansion 1.1.12 \u2014 deploy/tools/affected-tests/yarn.lock"}, "properties": {"repobilityId": "86af090e2e962566", "scanner": "scanner-primary", "fingerprint": "657d9b34553a6802", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-102277"]}}, {"ruleId": "scanner-b5039aa5f590c4f7", "level": "warning", "message": {"text": "CVE-2026-33750: brace-expansion 1.1.12 \u2014 deploy/tools/affected-tests/yarn.lock"}, "properties": {"repobilityId": "cf4d7d5cd07e0648", "scanner": "scanner-primary", "fingerprint": "b5039aa5f590c4f7", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-33750"]}}, {"ruleId": "scanner-35c6e1597850fa15", "level": "error", "message": {"text": "CVE-2026-93687: braces 3.0.3 \u2014 deploy/tools/affected-tests/yarn.lock"}, "properties": {"repobilityId": "a8614967354c2c4f", "scanner": "scanner-primary", "fingerprint": "35c6e1597850fa15", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-93687"]}}, {"ruleId": "scanner-007393e183822c16", "level": "error", "message": {"text": "CVE-2026-26996: minimatch 3.1.2 \u2014 deploy/tools/affected-tests/yarn.lock"}, "properties": {"repobilityId": "f7fb34ef9800c3a3", "scanner": "scanner-primary", "fingerprint": "007393e183822c16", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-26996"]}}, {"ruleId": "scanner-51af49366bde2ce4", "level": "error", "message": {"text": "CVE-2026-27903: minimatch 3.1.2 \u2014 deploy/tools/affected-tests/yarn.lock"}, "properties": {"repobilityId": "44de6a6c989748a2", "scanner": "scanner-primary", "fingerprint": "51af49366bde2ce4", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-27903"]}}, {"ruleId": "scanner-d67bb290e0651c4c", "level": "error", "message": {"text": "CVE-2026-27904: minimatch 3.1.2 \u2014 deploy/tools/affected-tests/yarn.lock"}, "properties": {"repobilityId": "a63fe0ee021969f0", "scanner": "scanner-primary", "fingerprint": "d67bb290e0651c4c", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-27904"]}}, {"ruleId": "scanner-18610bc6be664e6f", "level": "error", "message": {"text": "CVE-2026-67213: nanoid 3.3.8 \u2014 deploy/tools/affected-tests/yarn.lock"}, "properties": {"repobilityId": "f38cd373476613df", "scanner": "scanner-primary", "fingerprint": "18610bc6be664e6f", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-67213"]}}, {"ruleId": "scanner-39ed7a7be5cbfcb0", "level": "error", "message": {"text": "CVE-2026-67214: nanoid 3.3.8 \u2014 deploy/tools/affected-tests/yarn.lock"}, "properties": {"repobilityId": "8db1f1a86ab74f6f", "scanner": "scanner-primary", "fingerprint": "39ed7a7be5cbfcb0", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-67214"]}}, {"ruleId": "scanner-c9b0546ab895ed17", "level": "error", "message": {"text": "CVE-2026-73086: nanoid 3.3.8 \u2014 deploy/tools/affected-tests/yarn.lock"}, "properties": {"repobilityId": "fec15d051161a692", "scanner": "scanner-primary", "fingerprint": "c9b0546ab895ed17", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-73086"]}}, {"ruleId": "scanner-a4c79448ec054bcd", "level": "error", "message": {"text": "CVE-2026-33671: picomatch 2.3.1 \u2014 deploy/tools/affected-tests/yarn.lock"}, "properties": {"repobilityId": "d0f33c0a8358875c", "scanner": "scanner-primary", "fingerprint": "a4c79448ec054bcd", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-33671"]}}, {"ruleId": "scanner-21401a675428b432", "level": "warning", "message": {"text": "CVE-2026-33672: picomatch 2.3.1 \u2014 deploy/tools/affected-tests/yarn.lock"}, "properties": {"repobilityId": "b5bba4a5c125caa8", "scanner": "scanner-primary", "fingerprint": "21401a675428b432", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-33672"]}}, {"ruleId": "scanner-b0e89acb6f6173b3", "level": "error", "message": {"text": "CVE-2026-45623: postcss 8.4.33 \u2014 deploy/tools/affected-tests/yarn.lock"}, "properties": {"repobilityId": "34a6cabeb81f9957", "scanner": "scanner-primary", "fingerprint": "b0e89acb6f6173b3", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-45623"]}}, {"ruleId": "scanner-de6a93b1a20222bb", "level": "error", "message": {"text": "CVE-2026-73646: postcss 8.4.33 \u2014 deploy/tools/affected-tests/yarn.lock"}, "properties": {"repobilityId": "0cb7c7c8e5610bc1", "scanner": "scanner-primary", "fingerprint": "de6a93b1a20222bb", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-73646"]}}, {"ruleId": "scanner-b93511dfbeb91a33", "level": "warning", "message": {"text": "CVE-2026-41305: postcss 8.4.33 \u2014 deploy/tools/affected-tests/yarn.lock"}, "properties": {"repobilityId": "090dc6b39aaf9bea", "scanner": "scanner-primary", "fingerprint": "b93511dfbeb91a33", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-41305"]}}, {"ruleId": "scanner-ebdb363d4c71ce31", "level": "warning", "message": {"text": "CVE-2026-69153: postcss 8.4.33 \u2014 deploy/tools/affected-tests/yarn.lock"}, "properties": {"repobilityId": "d06f8626d65b09c6", "scanner": "scanner-primary", "fingerprint": "ebdb363d4c71ce31", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-69153"]}}, {"ruleId": "scanner-aaa05c9edb7b3070", "level": "error", "message": {"text": "CVE-2026-93749: source-map-js 1.0.2 \u2014 deploy/tools/affected-tests/yarn.lock"}, "properties": {"repobilityId": "c1fc4c99b76a43e2", "scanner": "scanner-primary", "fingerprint": "aaa05c9edb7b3070", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-93749"]}}, {"ruleId": "scanner-5087548433dfcc7a", "level": "error", "message": {"text": "CVE-2026-48779: ws 8.18.3 \u2014 deploy/tools/essential-dapps-chains-config-generator/yarn.lock"}, "properties": {"repobilityId": "c083b47d0c18296a", "scanner": "scanner-primary", "fingerprint": "5087548433dfcc7a", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-48779"]}}, {"ruleId": "scanner-eb5b7ba58572c731", "level": "warning", "message": {"text": "CVE-2026-45736: ws 8.18.3 \u2014 deploy/tools/essential-dapps-chains-config-generator/yarn.lock"}, "properties": {"repobilityId": "2d1da0d211715348", "scanner": "scanner-primary", "fingerprint": "eb5b7ba58572c731", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-45736"]}}, {"ruleId": "scanner-5bc510c763f5b2e5", "level": "warning", "message": {"text": "CVE-2025-69873: ajv 6.12.6 \u2014 deploy/tools/favicon-generator/yarn.lock"}, "properties": {"repobilityId": "d75f3ef7ddd23aa2", "scanner": "scanner-primary", "fingerprint": "5bc510c763f5b2e5", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-69873"]}}, {"ruleId": "scanner-ece2ff4480c14ac5", "level": "error", "message": {"text": "CVE-2026-93687: braces 3.0.3 \u2014 deploy/tools/favicon-generator/yarn.lock"}, "properties": {"repobilityId": "3f1845cf6ff9e416", "scanner": "scanner-primary", "fingerprint": "ece2ff4480c14ac5", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-93687"]}}, {"ruleId": "scanner-ea60d8722ee3ac10", "level": "error", "message": {"text": "CVE-2026-73088: browserslist 4.24.2 \u2014 deploy/tools/favicon-generator/yarn.lock"}, "properties": {"repobilityId": "cdab9b6d82148aca", "scanner": "scanner-primary", "fingerprint": "ea60d8722ee3ac10", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-73088"]}}, {"ruleId": "scanner-867785b305a8cc68", "level": "error", "message": {"text": "CVE-2026-73089: browserslist 4.24.2 \u2014 deploy/tools/favicon-generator/yarn.lock"}, "properties": {"repobilityId": "6a8d9616ddd13c66", "scanner": "scanner-primary", "fingerprint": "867785b305a8cc68", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-73089"]}}, {"ruleId": "scanner-fc0f72bed4c4bf2e", "level": "error", "message": {"text": "CVE-2026-33671: picomatch 2.3.1 \u2014 deploy/tools/favicon-generator/yarn.lock"}, "properties": {"repobilityId": "23f2dbc95a722258", "scanner": "scanner-primary", "fingerprint": "fc0f72bed4c4bf2e", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-33671"]}}, {"ruleId": "scanner-65741ad692fb86aa", "level": "warning", "message": {"text": "CVE-2026-33672: picomatch 2.3.1 \u2014 deploy/tools/favicon-generator/yarn.lock"}, "properties": {"repobilityId": "3ff769d7b5caec32", "scanner": "scanner-primary", "fingerprint": "65741ad692fb86aa", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-33672"]}}, {"ruleId": "scanner-c295cbaeff69dd96", "level": "error", "message": {"text": "GHSA-5c6j-r48x-rmvq: serialize-javascript 6.0.2 \u2014 deploy/tools/favicon-generator/yarn.lock"}, "properties": {"repobilityId": "68d6140c3dfec68f", "scanner": "scanner-primary", "fingerprint": "c295cbaeff69dd96", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-5c6j-r48x-rmvq"]}}, {"ruleId": "scanner-faec4d77f1cc2521", "level": "warning", "message": {"text": "CVE-2026-34043: serialize-javascript 6.0.2 \u2014 deploy/tools/favicon-generator/yarn.lock"}, "properties": {"repobilityId": "a88e22d34629efe5", "scanner": "scanner-primary", "fingerprint": "faec4d77f1cc2521", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-34043"]}}, {"ruleId": "scanner-63fcf8716a774f1a", "level": "error", "message": {"text": "GHSA-f88m-g3jw-g9cj: sharp 0.33.5 \u2014 deploy/tools/favicon-generator/yarn.lock"}, "properties": {"repobilityId": "7e0384d4a3d66608", "scanner": "scanner-primary", "fingerprint": "63fcf8716a774f1a", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-f88m-g3jw-g9cj"]}}, {"ruleId": "scanner-340df363f3e057a7", "level": "error", "message": {"text": "GHSA-rgj7-g3m4-5g8c: sharp 0.33.5 \u2014 deploy/tools/favicon-generator/yarn.lock"}, "properties": {"repobilityId": "c6914f1825215df2", "scanner": "scanner-primary", "fingerprint": "340df363f3e057a7", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-rgj7-g3m4-5g8c"]}}, {"ruleId": "scanner-ce67e440de15a49b", "level": "error", "message": {"text": "GHSA-wq5f-xc86-pv6w: sharp 0.33.5 \u2014 deploy/tools/favicon-generator/yarn.lock"}, "properties": {"repobilityId": "e3f859624aa8fa83", "scanner": "scanner-primary", "fingerprint": "ce67e440de15a49b", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-wq5f-xc86-pv6w"]}}, {"ruleId": "scanner-db94588c021b8d68", "level": "note", "message": {"text": "CVE-2025-68157: webpack 5.95.0 \u2014 deploy/tools/favicon-generator/yarn.lock"}, "properties": {"repobilityId": "a2c4913b388d02c6", "scanner": "scanner-primary", "fingerprint": "db94588c021b8d68", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-68157"]}}, {"ruleId": "scanner-957f9076a6c4e3fc", "level": "note", "message": {"text": "CVE-2025-68458: webpack 5.95.0 \u2014 deploy/tools/favicon-generator/yarn.lock"}, "properties": {"repobilityId": "8d4eaa63b3085e95", "scanner": "scanner-primary", "fingerprint": "957f9076a6c4e3fc", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-68458"]}}, {"ruleId": "scanner-5e88bc9d6c15053e", "level": "warning", "message": {"text": "CVE-2025-69873: ajv 6.12.6 \u2014 deploy/tools/feature-reporter/yarn.lock"}, "properties": {"repobilityId": "7cb884e406b1bb5c", "scanner": "scanner-primary", "fingerprint": "5e88bc9d6c15053e", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-69873"]}}, {"ruleId": "scanner-843c083b98aa700d", "level": "error", "message": {"text": "CVE-2026-93687: braces 3.0.3 \u2014 deploy/tools/feature-reporter/yarn.lock"}, "properties": {"repobilityId": "fc6fbe826b953424", "scanner": "scanner-primary", "fingerprint": "843c083b98aa700d", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-93687"]}}, {"ruleId": "scanner-76da254276710a55", "level": "error", "message": {"text": "CVE-2026-73088: browserslist 4.24.2 \u2014 deploy/tools/feature-reporter/yarn.lock"}, "properties": {"repobilityId": "ac567d49b05f4be1", "scanner": "scanner-primary", "fingerprint": "76da254276710a55", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-73088"]}}, {"ruleId": "scanner-ba969d2da1a5f9f0", "level": "error", "message": {"text": "CVE-2026-73089: browserslist 4.24.2 \u2014 deploy/tools/feature-reporter/yarn.lock"}, "properties": {"repobilityId": "41818a40fec95dc8", "scanner": "scanner-primary", "fingerprint": "ba969d2da1a5f9f0", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-73089"]}}, {"ruleId": "scanner-9cb13b4b3575386f", "level": "error", "message": {"text": "CVE-2026-33671: picomatch 2.3.1 \u2014 deploy/tools/feature-reporter/yarn.lock"}, "properties": {"repobilityId": "6a16b86038e7e4e0", "scanner": "scanner-primary", "fingerprint": "9cb13b4b3575386f", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-33671"]}}, {"ruleId": "scanner-173f982ca2fce66d", "level": "warning", "message": {"text": "CVE-2026-33672: picomatch 2.3.1 \u2014 deploy/tools/feature-reporter/yarn.lock"}, "properties": {"repobilityId": "4249e0cd9989d479", "scanner": "scanner-primary", "fingerprint": "173f982ca2fce66d", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-33672"]}}, {"ruleId": "scanner-4e1a795774249a96", "level": "error", "message": {"text": "GHSA-5c6j-r48x-rmvq: serialize-javascript 6.0.2 \u2014 deploy/tools/feature-reporter/yarn.lock"}, "properties": {"repobilityId": "62a8c38f7ef06b96", "scanner": "scanner-primary", "fingerprint": "4e1a795774249a96", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-5c6j-r48x-rmvq"]}}, {"ruleId": "scanner-b44ec013bd374431", "level": "warning", "message": {"text": "CVE-2026-34043: serialize-javascript 6.0.2 \u2014 deploy/tools/feature-reporter/yarn.lock"}, "properties": {"repobilityId": "09c5f5d6b2d40c1d", "scanner": "scanner-primary", "fingerprint": "b44ec013bd374431", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-34043"]}}, {"ruleId": "scanner-a73b041b7a965ca0", "level": "note", "message": {"text": "CVE-2025-68157: webpack 5.95.0 \u2014 deploy/tools/feature-reporter/yarn.lock"}, "properties": {"repobilityId": "c2d632109242aa7b", "scanner": "scanner-primary", "fingerprint": "a73b041b7a965ca0", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-68157"]}}, {"ruleId": "scanner-459d4e92ae988f6d", "level": "note", "message": {"text": "CVE-2025-68458: webpack 5.95.0 \u2014 deploy/tools/feature-reporter/yarn.lock"}, "properties": {"repobilityId": "6bec1c00b5110df4", "scanner": "scanner-primary", "fingerprint": "459d4e92ae988f6d", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-68458"]}}, {"ruleId": "scanner-1c639cd8dbe1a369", "level": "error", "message": {"text": "CVE-2026-93687: braces 3.0.3 \u2014 deploy/tools/sitemap-generator/yarn.lock"}, "properties": {"repobilityId": "e678819e223d20ee", "scanner": "scanner-primary", "fingerprint": "1c639cd8dbe1a369", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-93687"]}}, {"ruleId": "scanner-757f3e329d7e3775", "level": "error", "message": {"text": "CVE-2026-33671: picomatch 2.3.1 \u2014 deploy/tools/sitemap-generator/yarn.lock"}, "properties": {"repobilityId": "bcfe9259299a9f40", "scanner": "scanner-primary", "fingerprint": "757f3e329d7e3775", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-33671"]}}, {"ruleId": "scanner-ec6bff1adfc5674a", "level": "warning", "message": {"text": "CVE-2026-33672: picomatch 2.3.1 \u2014 deploy/tools/sitemap-generator/yarn.lock"}, "properties": {"repobilityId": "73c2cdbf5681e1c5", "scanner": "scanner-primary", "fingerprint": "ec6bff1adfc5674a", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-33672"]}}, {"ruleId": "scanner-c6dd3f7917705b37", "level": "error", "message": {"text": "CVE-2026-101916: @grpc/grpc-js 1.10.10 \u2014 yarn.lock"}, "properties": {"repobilityId": "71e887c460b61732", "scanner": "scanner-primary", "fingerprint": "c6dd3f7917705b37", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-101916"]}}, {"ruleId": "scanner-ecaddd7809399ecd", "level": "error", "message": {"text": "CVE-2026-48068: @grpc/grpc-js 1.10.10 \u2014 yarn.lock"}, "properties": {"repobilityId": "5763b2ecdf6173a8", "scanner": "scanner-primary", "fingerprint": "ecaddd7809399ecd", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-48068"]}}, {"ruleId": "scanner-dca5fdde90e8cf7a", "level": "error", "message": {"text": "CVE-2026-48069: @grpc/grpc-js 1.10.10 \u2014 yarn.lock"}, "properties": {"repobilityId": "a685934258d7f120", "scanner": "scanner-primary", "fingerprint": "dca5fdde90e8cf7a", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-48069"]}}, {"ruleId": "scanner-745108ebde167061", "level": "note", "message": {"text": "CVE-2026-101915: @grpc/grpc-js 1.10.10 \u2014 yarn.lock"}, "properties": {"repobilityId": "64e0acd2a684864b", "scanner": "scanner-primary", "fingerprint": "745108ebde167061", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-101915"]}}, {"ruleId": "scanner-f2faec0e449fae34", "level": "error", "message": {"text": "CVE-2026-45783: @libp2p/kad-dht 15.0.2 \u2014 yarn.lock"}, "properties": {"repobilityId": "aee9ec86e855480a", "scanner": "scanner-primary", "fingerprint": "f2faec0e449fae34", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-45783"]}}, {"ruleId": "scanner-cf3c6833351ff5e4", "level": "error", "message": {"text": "CVE-2026-86039: @libp2p/peer-store 11.1.4 \u2014 yarn.lock"}, "properties": {"repobilityId": "8cbb8380b1d81cbd", "scanner": "scanner-primary", "fingerprint": "cf3c6833351ff5e4", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-86039"]}}, {"ruleId": "scanner-6e0baea3f603b751", "level": "error", "message": {"text": "CVE-2026-44902: @opentelemetry/auto-instrumentations-node 0.43.0 \u2014 yarn.lock"}, "properties": {"repobilityId": "b1da2f98879897cf", "scanner": "scanner-primary", "fingerprint": "6e0baea3f603b751", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44902"]}}, {"ruleId": "scanner-968b0cfad3f8800f", "level": "warning", "message": {"text": "CVE-2026-54285: @opentelemetry/core 1.22.0 \u2014 yarn.lock"}, "properties": {"repobilityId": "4647bfc9bd4c5fa1", "scanner": "scanner-primary", "fingerprint": "968b0cfad3f8800f", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-54285"]}}, {"ruleId": "scanner-26146a927985b849", "level": "warning", "message": {"text": "CVE-2026-54285: @opentelemetry/core 1.27.0 \u2014 yarn.lock"}, "properties": {"repobilityId": "4647bfc9bd4c5fa1", "scanner": "scanner-primary", "fingerprint": "26146a927985b849", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-54285"]}}, {"ruleId": "scanner-60ac3a72299cbf79", "level": "warning", "message": {"text": "CVE-2026-54285: @opentelemetry/core 1.30.1 \u2014 yarn.lock"}, "properties": {"repobilityId": "4647bfc9bd4c5fa1", "scanner": "scanner-primary", "fingerprint": "60ac3a72299cbf79", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-54285"]}}, {"ruleId": "scanner-19e465e86fd514ab", "level": "warning", "message": {"text": "CVE-2026-104872: @opentelemetry/instrumentation-cassandra-driver 0.36.0 \u2014 yarn.lock"}, "properties": {"repobilityId": "eae8930bf0d93e19", "scanner": "scanner-primary", "fingerprint": "19e465e86fd514ab", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-104872"]}}, {"ruleId": "scanner-250b0cf13a4baae4", "level": "warning", "message": {"text": "CVE-2026-104872: @opentelemetry/instrumentation-knex 0.34.0 \u2014 yarn.lock"}, "properties": {"repobilityId": "a2583ef795262e4b", "scanner": "scanner-primary", "fingerprint": "250b0cf13a4baae4", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-104872"]}}, {"ruleId": "scanner-d37ee34f5ef96b40", "level": "warning", "message": {"text": "CVE-2026-104872: @opentelemetry/instrumentation-mongoose 0.36.0 \u2014 yarn.lock"}, "properties": {"repobilityId": "013caf621200ca13", "scanner": "scanner-primary", "fingerprint": "d37ee34f5ef96b40", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-104872"]}}, {"ruleId": "scanner-0aa7d41849318628", "level": "warning", "message": {"text": "CVE-2026-104872: @opentelemetry/instrumentation-mysql 0.36.0 \u2014 yarn.lock"}, "properties": {"repobilityId": "c6ea7b36cef8fbd8", "scanner": "scanner-primary", "fingerprint": "0aa7d41849318628", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-104872"]}}, {"ruleId": "scanner-02aa8b683893fc9d", "level": "warning", "message": {"text": "CVE-2026-104872: @opentelemetry/instrumentation-mysql2 0.36.0 \u2014 yarn.lock"}, "properties": {"repobilityId": "f2c8a574fde6572b", "scanner": "scanner-primary", "fingerprint": "02aa8b683893fc9d", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-104872"]}}, {"ruleId": "scanner-7feb420e1c189380", "level": "warning", "message": {"text": "CVE-2026-104872: @opentelemetry/instrumentation-pg 0.39.1 \u2014 yarn.lock"}, "properties": {"repobilityId": "650674c94ad792de", "scanner": "scanner-primary", "fingerprint": "7feb420e1c189380", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-104872"]}}, {"ruleId": "scanner-7c4c167f1db3171e", "level": "warning", "message": {"text": "CVE-2026-104872: @opentelemetry/instrumentation-tedious 0.8.0 \u2014 yarn.lock"}, "properties": {"repobilityId": "0f58c2352eabb1e6", "scanner": "scanner-primary", "fingerprint": "7c4c167f1db3171e", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-104872"]}}, {"ruleId": "scanner-188c3d735cca0c39", "level": "error", "message": {"text": "CVE-2026-59892: @opentelemetry/propagator-jaeger 1.22.0 \u2014 yarn.lock"}, "properties": {"repobilityId": "0cb6ef46cf17287c", "scanner": "scanner-primary", "fingerprint": "188c3d735cca0c39", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59892"]}}, {"ruleId": "scanner-15494dae25e9c5d8", "level": "error", "message": {"text": "CVE-2026-44902: @opentelemetry/sdk-node 0.49.1 \u2014 yarn.lock"}, "properties": {"repobilityId": "1d341f5ccd4b973a", "scanner": "scanner-primary", "fingerprint": "15494dae25e9c5d8", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44902"]}}, {"ruleId": "scanner-4e05959161567c88", "level": "warning", "message": {"text": "CVE-2026-44288: @protobufjs/utf8 1.1.0 \u2014 yarn.lock"}, "properties": {"repobilityId": "c8fc7e5de0014255", "scanner": "scanner-primary", "fingerprint": "4e05959161567c88", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44288"]}}, {"ruleId": "scanner-d9e9dff61977bb76", "level": "error", "message": {"text": "CVE-2026-25639: axios 1.12.0 \u2014 yarn.lock"}, "properties": {"repobilityId": "2eed54fcd38b4a73", "scanner": "scanner-primary", "fingerprint": "d9e9dff61977bb76", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-25639"]}}, {"ruleId": "scanner-34a45c8fa72b388c", "level": "error", "message": {"text": "CVE-2026-42033: axios 1.12.0 \u2014 yarn.lock"}, "properties": {"repobilityId": "cc318db50890ce9e", "scanner": "scanner-primary", "fingerprint": "34a45c8fa72b388c", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-42033"]}}, {"ruleId": "scanner-f500598b24d9eb3a", "level": "error", "message": {"text": "CVE-2026-42035: axios 1.12.0 \u2014 yarn.lock"}, "properties": {"repobilityId": "397b20c4120c01f8", "scanner": "scanner-primary", "fingerprint": "f500598b24d9eb3a", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-42035"]}}, {"ruleId": "scanner-8ba500ed705fda63", "level": "error", "message": {"text": "CVE-2026-42043: axios 1.12.0 \u2014 yarn.lock"}, "properties": {"repobilityId": "f25c3f738b8d6245", "scanner": "scanner-primary", "fingerprint": "8ba500ed705fda63", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-42043"]}}, {"ruleId": "scanner-1675bd9a21511a5b", "level": "error", "message": {"text": "CVE-2026-42264: axios 1.12.0 \u2014 yarn.lock"}, "properties": {"repobilityId": "76852ff171a18806", "scanner": "scanner-primary", "fingerprint": "1675bd9a21511a5b", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-42264"]}}, {"ruleId": "scanner-6b19072600714dde", "level": "error", "message": {"text": "CVE-2026-44486: axios 1.12.0 \u2014 yarn.lock"}, "properties": {"repobilityId": "3cc07aadc7c9c8fb", "scanner": "scanner-primary", "fingerprint": "6b19072600714dde", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44486"]}}, {"ruleId": "scanner-e46305c9a6b39479", "level": "error", "message": {"text": "CVE-2026-44487: axios 1.12.0 \u2014 yarn.lock"}, "properties": {"repobilityId": "d0578ac77c69c510", "scanner": "scanner-primary", "fingerprint": "e46305c9a6b39479", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44487"]}}, {"ruleId": "scanner-2d667cf8a8182772", "level": "error", "message": {"text": "CVE-2026-44488: axios 1.12.0 \u2014 yarn.lock"}, "properties": {"repobilityId": "cc870f00cc8d5fe9", "scanner": "scanner-primary", "fingerprint": "2d667cf8a8182772", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44488"]}}, {"ruleId": "scanner-604d2190b7c86b3f", "level": "error", "message": {"text": "CVE-2026-44494: axios 1.12.0 \u2014 yarn.lock"}, "properties": {"repobilityId": "3fbacfc503e6c94f", "scanner": "scanner-primary", "fingerprint": "604d2190b7c86b3f", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44494"]}}, {"ruleId": "scanner-59a0ebc4a6d98815", "level": "error", "message": {"text": "CVE-2026-44495: axios 1.12.0 \u2014 yarn.lock"}, "properties": {"repobilityId": "42c54677da6f47a3", "scanner": "scanner-primary", "fingerprint": "59a0ebc4a6d98815", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44495"]}}, {"ruleId": "scanner-52b573c15f2c0e99", "level": "error", "message": {"text": "CVE-2026-44496: axios 1.12.0 \u2014 yarn.lock"}, "properties": {"repobilityId": "a107ab4495aeda04", "scanner": "scanner-primary", "fingerprint": "52b573c15f2c0e99", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44496"]}}, {"ruleId": "scanner-999902dd3739c4fd", "level": "warning", "message": {"text": "CVE-2025-62718: axios 1.12.0 \u2014 yarn.lock"}, "properties": {"repobilityId": "9dc47dfb8bd92dae", "scanner": "scanner-primary", "fingerprint": "999902dd3739c4fd", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-62718"]}}, {"ruleId": "scanner-3f32f84cc58086de", "level": "warning", "message": {"text": "CVE-2026-101900: axios 1.12.0 \u2014 yarn.lock"}, "properties": {"repobilityId": "c9c465b9a7a07d73", "scanner": "scanner-primary", "fingerprint": "3f32f84cc58086de", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-101900"]}}, {"ruleId": "scanner-4982e1fa6657035a", "level": "warning", "message": {"text": "CVE-2026-101902: axios 1.12.0 \u2014 yarn.lock"}, "properties": {"repobilityId": "f6535a2b73baab5b", "scanner": "scanner-primary", "fingerprint": "4982e1fa6657035a", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-101902"]}}, {"ruleId": "scanner-b08d61fba605eb5b", "level": "warning", "message": {"text": "CVE-2026-101904: axios 1.12.0 \u2014 yarn.lock"}, "properties": {"repobilityId": "baf0f5d7a597f8d7", "scanner": "scanner-primary", "fingerprint": "b08d61fba605eb5b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-101904"]}}, {"ruleId": "scanner-78c082783b60979e", "level": "warning", "message": {"text": "CVE-2026-101908: axios 1.12.0 \u2014 yarn.lock"}, "properties": {"repobilityId": "2bfa571a9da3aa44", "scanner": "scanner-primary", "fingerprint": "78c082783b60979e", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-101908"]}}, {"ruleId": "scanner-a30b4a486d9e2613", "level": "warning", "message": {"text": "CVE-2026-40175: axios 1.12.0 \u2014 yarn.lock"}, "properties": {"repobilityId": "05f67dcbd0029f16", "scanner": "scanner-primary", "fingerprint": "a30b4a486d9e2613", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-40175"]}}, {"ruleId": "scanner-b8c20dfd523d7c08", "level": "warning", "message": {"text": "CVE-2026-42034: axios 1.12.0 \u2014 yarn.lock"}, "properties": {"repobilityId": "8dbea20e00dbe06e", "scanner": "scanner-primary", "fingerprint": "b8c20dfd523d7c08", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-42034"]}}, {"ruleId": "scanner-5932a8e0ce300b1d", "level": "warning", "message": {"text": "CVE-2026-42036: axios 1.12.0 \u2014 yarn.lock"}, "properties": {"repobilityId": "0102868726e6760f", "scanner": "scanner-primary", "fingerprint": "5932a8e0ce300b1d", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-42036"]}}, {"ruleId": "scanner-26f1956b297a7d69", "level": "warning", "message": {"text": "CVE-2026-42037: axios 1.12.0 \u2014 yarn.lock"}, "properties": {"repobilityId": "91c56a3a220ee307", "scanner": "scanner-primary", "fingerprint": "26f1956b297a7d69", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-42037"]}}, {"ruleId": "scanner-2174b32d1402be83", "level": "warning", "message": {"text": "CVE-2026-42038: axios 1.12.0 \u2014 yarn.lock"}, "properties": {"repobilityId": "e5df75761f16fa43", "scanner": "scanner-primary", "fingerprint": "2174b32d1402be83", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-42038"]}}, {"ruleId": "scanner-47f3a3fbb129ac71", "level": "warning", "message": {"text": "CVE-2026-42039: axios 1.12.0 \u2014 yarn.lock"}, "properties": {"repobilityId": "9cacfa79315012ab", "scanner": "scanner-primary", "fingerprint": "47f3a3fbb129ac71", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-42039"]}}, {"ruleId": "scanner-0d2a6c6481f96f94", "level": "warning", "message": {"text": "CVE-2026-42041: axios 1.12.0 \u2014 yarn.lock"}, "properties": {"repobilityId": "e64f6d2b5bcb110b", "scanner": "scanner-primary", "fingerprint": "0d2a6c6481f96f94", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-42041"]}}, {"ruleId": "scanner-eb4381c341ea9649", "level": "warning", "message": {"text": "CVE-2026-42042: axios 1.12.0 \u2014 yarn.lock"}, "properties": {"repobilityId": "f986dc2d6c63d181", "scanner": "scanner-primary", "fingerprint": "eb4381c341ea9649", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-42042"]}}, {"ruleId": "scanner-4814b215f0361cd8", "level": "warning", "message": {"text": "CVE-2026-42044: axios 1.12.0 \u2014 yarn.lock"}, "properties": {"repobilityId": "099e2199c3b22df5", "scanner": "scanner-primary", "fingerprint": "4814b215f0361cd8", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-42044"]}}, {"ruleId": "scanner-b84c5e07a4a3c752", "level": "warning", "message": {"text": "CVE-2026-44490: axios 1.12.0 \u2014 yarn.lock"}, "properties": {"repobilityId": "34a6ad97ebb1852b", "scanner": "scanner-primary", "fingerprint": "b84c5e07a4a3c752", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44490"]}}, {"ruleId": "scanner-fee523e58d95b956", "level": "warning", "message": {"text": "CVE-2026-67312: axios 1.12.0 \u2014 yarn.lock"}, "properties": {"repobilityId": "facaa62859822ca9", "scanner": "scanner-primary", "fingerprint": "fee523e58d95b956", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-67312"]}}, {"ruleId": "scanner-73d12a51b54a5204", "level": "warning", "message": {"text": "CVE-2026-67313: axios 1.12.0 \u2014 yarn.lock"}, "properties": {"repobilityId": "44e13f5a67bfefdf", "scanner": "scanner-primary", "fingerprint": "73d12a51b54a5204", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-67313"]}}, {"ruleId": "scanner-1f6f28516376ccde", "level": "warning", "message": {"text": "CVE-2026-67316: axios 1.12.0 \u2014 yarn.lock"}, "properties": {"repobilityId": "3da6bd1dbd7a5fae", "scanner": "scanner-primary", "fingerprint": "1f6f28516376ccde", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-67316"]}}, {"ruleId": "scanner-5cd68c12d3e1f34c", "level": "warning", "message": {"text": "CVE-2026-67317: axios 1.12.0 \u2014 yarn.lock"}, "properties": {"repobilityId": "79748a62d0ee0518", "scanner": "scanner-primary", "fingerprint": "5cd68c12d3e1f34c", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-67317"]}}, {"ruleId": "scanner-135a92699243b66c", "level": "warning", "message": {"text": "CVE-2026-67319: axios 1.12.0 \u2014 yarn.lock"}, "properties": {"repobilityId": "65f8c36b51f0fb53", "scanner": "scanner-primary", "fingerprint": "135a92699243b66c", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-67319"]}}, {"ruleId": "scanner-25db8590f42c042f", "level": "note", "message": {"text": "CVE-2026-42040: axios 1.12.0 \u2014 yarn.lock"}, "properties": {"repobilityId": "31b26c2b04c25e60", "scanner": "scanner-primary", "fingerprint": "25db8590f42c042f", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-42040"]}}, {"ruleId": "scanner-8834bd8e6e8e4488", "level": "error", "message": {"text": "CVE-2026-101898: axios 1.13.2 \u2014 yarn.lock"}, "properties": {"repobilityId": "f3154d28142848dd", "scanner": "scanner-primary", "fingerprint": "8834bd8e6e8e4488", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-101898"]}}, {"ruleId": "scanner-0e0a381dde9bc729", "level": "error", "message": {"text": "CVE-2026-101901: axios 1.13.2 \u2014 yarn.lock"}, "properties": {"repobilityId": "12e31cf6ff887cfd", "scanner": "scanner-primary", "fingerprint": "0e0a381dde9bc729", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-101901"]}}, {"ruleId": "scanner-fb8c362a73e41518", "level": "error", "message": {"text": "CVE-2026-25639: axios 1.13.2 \u2014 yarn.lock"}, "properties": {"repobilityId": "2eed54fcd38b4a73", "scanner": "scanner-primary", "fingerprint": "fb8c362a73e41518", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-25639"]}}, {"ruleId": "scanner-33618229c5b1e872", "level": "error", "message": {"text": "CVE-2026-42033: axios 1.13.2 \u2014 yarn.lock"}, "properties": {"repobilityId": "cc318db50890ce9e", "scanner": "scanner-primary", "fingerprint": "33618229c5b1e872", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-42033"]}}, {"ruleId": "scanner-2e2ef9781b997b91", "level": "error", "message": {"text": "CVE-2026-42035: axios 1.13.2 \u2014 yarn.lock"}, "properties": {"repobilityId": "397b20c4120c01f8", "scanner": "scanner-primary", "fingerprint": "2e2ef9781b997b91", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-42035"]}}, {"ruleId": "scanner-355126c19d8a5649", "level": "error", "message": {"text": "CVE-2026-42043: axios 1.13.2 \u2014 yarn.lock"}, "properties": {"repobilityId": "f25c3f738b8d6245", "scanner": "scanner-primary", "fingerprint": "355126c19d8a5649", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-42043"]}}, {"ruleId": "scanner-59c547e6ab0f5577", "level": "error", "message": {"text": "CVE-2026-42264: axios 1.13.2 \u2014 yarn.lock"}, "properties": {"repobilityId": "76852ff171a18806", "scanner": "scanner-primary", "fingerprint": "59c547e6ab0f5577", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-42264"]}}, {"ruleId": "scanner-a43dc645db872a35", "level": "error", "message": {"text": "CVE-2026-44486: axios 1.13.2 \u2014 yarn.lock"}, "properties": {"repobilityId": "3cc07aadc7c9c8fb", "scanner": "scanner-primary", "fingerprint": "a43dc645db872a35", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44486"]}}, {"ruleId": "scanner-efeecdcf9f34a090", "level": "error", "message": {"text": "CVE-2026-44487: axios 1.13.2 \u2014 yarn.lock"}, "properties": {"repobilityId": "d0578ac77c69c510", "scanner": "scanner-primary", "fingerprint": "efeecdcf9f34a090", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44487"]}}, {"ruleId": "scanner-3c1e15814798a26c", "level": "error", "message": {"text": "CVE-2026-44488: axios 1.13.2 \u2014 yarn.lock"}, "properties": {"repobilityId": "cc870f00cc8d5fe9", "scanner": "scanner-primary", "fingerprint": "3c1e15814798a26c", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44488"]}}, {"ruleId": "scanner-08bd8187a1966d03", "level": "error", "message": {"text": "CVE-2026-44494: axios 1.13.2 \u2014 yarn.lock"}, "properties": {"repobilityId": "3fbacfc503e6c94f", "scanner": "scanner-primary", "fingerprint": "08bd8187a1966d03", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44494"]}}, {"ruleId": "scanner-f67f5327bdd51495", "level": "error", "message": {"text": "CVE-2026-44495: axios 1.13.2 \u2014 yarn.lock"}, "properties": {"repobilityId": "42c54677da6f47a3", "scanner": "scanner-primary", "fingerprint": "f67f5327bdd51495", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44495"]}}, {"ruleId": "scanner-94f2cb6ab60a120b", "level": "error", "message": {"text": "CVE-2026-44496: axios 1.13.2 \u2014 yarn.lock"}, "properties": {"repobilityId": "a107ab4495aeda04", "scanner": "scanner-primary", "fingerprint": "94f2cb6ab60a120b", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44496"]}}, {"ruleId": "scanner-0d1b86c921db3c9a", "level": "warning", "message": {"text": "CVE-2025-62718: axios 1.13.2 \u2014 yarn.lock"}, "properties": {"repobilityId": "9dc47dfb8bd92dae", "scanner": "scanner-primary", "fingerprint": "0d1b86c921db3c9a", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-62718"]}}, {"ruleId": "scanner-5816f71462f73825", "level": "warning", "message": {"text": "CVE-2026-101900: axios 1.13.2 \u2014 yarn.lock"}, "properties": {"repobilityId": "c9c465b9a7a07d73", "scanner": "scanner-primary", "fingerprint": "5816f71462f73825", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-101900"]}}, {"ruleId": "scanner-84728de2016264ab", "level": "warning", "message": {"text": "CVE-2026-101902: axios 1.13.2 \u2014 yarn.lock"}, "properties": {"repobilityId": "f6535a2b73baab5b", "scanner": "scanner-primary", "fingerprint": "84728de2016264ab", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-101902"]}}, {"ruleId": "scanner-d021ddef8d6c3198", "level": "warning", "message": {"text": "CVE-2026-101904: axios 1.13.2 \u2014 yarn.lock"}, "properties": {"repobilityId": "baf0f5d7a597f8d7", "scanner": "scanner-primary", "fingerprint": "d021ddef8d6c3198", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-101904"]}}, {"ruleId": "scanner-706d03cb7dcec5c8", "level": "warning", "message": {"text": "CVE-2026-101908: axios 1.13.2 \u2014 yarn.lock"}, "properties": {"repobilityId": "2bfa571a9da3aa44", "scanner": "scanner-primary", "fingerprint": "706d03cb7dcec5c8", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-101908"]}}, {"ruleId": "scanner-e308abbcca579d7f", "level": "warning", "message": {"text": "CVE-2026-40175: axios 1.13.2 \u2014 yarn.lock"}, "properties": {"repobilityId": "05f67dcbd0029f16", "scanner": "scanner-primary", "fingerprint": "e308abbcca579d7f", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-40175"]}}, {"ruleId": "scanner-5ad0a6e98841e072", "level": "warning", "message": {"text": "CVE-2026-42034: axios 1.13.2 \u2014 yarn.lock"}, "properties": {"repobilityId": "8dbea20e00dbe06e", "scanner": "scanner-primary", "fingerprint": "5ad0a6e98841e072", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-42034"]}}, {"ruleId": "scanner-c490692d658f9737", "level": "warning", "message": {"text": "CVE-2026-42036: axios 1.13.2 \u2014 yarn.lock"}, "properties": {"repobilityId": "0102868726e6760f", "scanner": "scanner-primary", "fingerprint": "c490692d658f9737", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-42036"]}}, {"ruleId": "scanner-0983496c37cbad35", "level": "warning", "message": {"text": "CVE-2026-42037: axios 1.13.2 \u2014 yarn.lock"}, "properties": {"repobilityId": "91c56a3a220ee307", "scanner": "scanner-primary", "fingerprint": "0983496c37cbad35", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-42037"]}}, {"ruleId": "scanner-71d980cf248364e3", "level": "warning", "message": {"text": "CVE-2026-42038: axios 1.13.2 \u2014 yarn.lock"}, "properties": {"repobilityId": "e5df75761f16fa43", "scanner": "scanner-primary", "fingerprint": "71d980cf248364e3", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-42038"]}}, {"ruleId": "scanner-c7a2497b9ca0c3e3", "level": "warning", "message": {"text": "CVE-2026-42039: axios 1.13.2 \u2014 yarn.lock"}, "properties": {"repobilityId": "9cacfa79315012ab", "scanner": "scanner-primary", "fingerprint": "c7a2497b9ca0c3e3", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-42039"]}}, {"ruleId": "scanner-7ddc6520ce6b31f7", "level": "warning", "message": {"text": "CVE-2026-42041: axios 1.13.2 \u2014 yarn.lock"}, "properties": {"repobilityId": "e64f6d2b5bcb110b", "scanner": "scanner-primary", "fingerprint": "7ddc6520ce6b31f7", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-42041"]}}, {"ruleId": "scanner-c09d86627c59d42d", "level": "warning", "message": {"text": "CVE-2026-42042: axios 1.13.2 \u2014 yarn.lock"}, "properties": {"repobilityId": "f986dc2d6c63d181", "scanner": "scanner-primary", "fingerprint": "c09d86627c59d42d", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-42042"]}}, {"ruleId": "scanner-4b1ff50d93c23a8e", "level": "warning", "message": {"text": "CVE-2026-42044: axios 1.13.2 \u2014 yarn.lock"}, "properties": {"repobilityId": "099e2199c3b22df5", "scanner": "scanner-primary", "fingerprint": "4b1ff50d93c23a8e", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-42044"]}}, {"ruleId": "scanner-0e0022de31a41447", "level": "warning", "message": {"text": "CVE-2026-44490: axios 1.13.2 \u2014 yarn.lock"}, "properties": {"repobilityId": "34a6ad97ebb1852b", "scanner": "scanner-primary", "fingerprint": "0e0022de31a41447", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44490"]}}, {"ruleId": "scanner-c5a22d5ffbf77012", "level": "warning", "message": {"text": "CVE-2026-67312: axios 1.13.2 \u2014 yarn.lock"}, "properties": {"repobilityId": "facaa62859822ca9", "scanner": "scanner-primary", "fingerprint": "c5a22d5ffbf77012", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-67312"]}}, {"ruleId": "scanner-99b88cd48b9419a3", "level": "warning", "message": {"text": "CVE-2026-67313: axios 1.13.2 \u2014 yarn.lock"}, "properties": {"repobilityId": "44e13f5a67bfefdf", "scanner": "scanner-primary", "fingerprint": "99b88cd48b9419a3", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-67313"]}}, {"ruleId": "scanner-e4805c2ec4708b60", "level": "warning", "message": {"text": "CVE-2026-67316: axios 1.13.2 \u2014 yarn.lock"}, "properties": {"repobilityId": "3da6bd1dbd7a5fae", "scanner": "scanner-primary", "fingerprint": "e4805c2ec4708b60", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-67316"]}}, {"ruleId": "scanner-703d2bc9758f0dcd", "level": "warning", "message": {"text": "CVE-2026-67317: axios 1.13.2 \u2014 yarn.lock"}, "properties": {"repobilityId": "79748a62d0ee0518", "scanner": "scanner-primary", "fingerprint": "703d2bc9758f0dcd", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-67317"]}}, {"ruleId": "scanner-1a2688f744f5013f", "level": "warning", "message": {"text": "CVE-2026-67318: axios 1.13.2 \u2014 yarn.lock"}, "properties": {"repobilityId": "5f716881c633b4ef", "scanner": "scanner-primary", "fingerprint": "1a2688f744f5013f", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-67318"]}}, {"ruleId": "scanner-dbb5f11b598e8b96", "level": "warning", "message": {"text": "CVE-2026-67319: axios 1.13.2 \u2014 yarn.lock"}, "properties": {"repobilityId": "65f8c36b51f0fb53", "scanner": "scanner-primary", "fingerprint": "dbb5f11b598e8b96", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-67319"]}}, {"ruleId": "scanner-45ac6c674de0c6be", "level": "note", "message": {"text": "CVE-2026-42040: axios 1.13.2 \u2014 yarn.lock"}, "properties": {"repobilityId": "31b26c2b04c25e60", "scanner": "scanner-primary", "fingerprint": "45ac6c674de0c6be", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-42040"]}}, {"ruleId": "scanner-99dcaa1b943b6eaa", "level": "warning", "message": {"text": "CVE-2026-2739: bn.js 5.2.1 \u2014 yarn.lock"}, "properties": {"repobilityId": "d1a94163028d45ae", "scanner": "scanner-primary", "fingerprint": "99dcaa1b943b6eaa", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-2739"]}}, {"ruleId": "scanner-60bd4fdd8db4975a", "level": "warning", "message": {"text": "CVE-2026-2739: bn.js 5.2.2 \u2014 yarn.lock"}, "properties": {"repobilityId": "d1a94163028d45ae", "scanner": "scanner-primary", "fingerprint": "60bd4fdd8db4975a", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-2739"]}}, {"ruleId": "scanner-b0b2711a53b4c077", "level": "error", "message": {"text": "CVE-2026-102276: brace-expansion 2.0.1 \u2014 yarn.lock"}, "properties": {"repobilityId": "8a05a9518c42808c", "scanner": "scanner-primary", "fingerprint": "b0b2711a53b4c077", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-102276"]}}, {"ruleId": "scanner-0ecd8b614867c030", "level": "error", "message": {"text": "CVE-2026-102278: brace-expansion 2.0.1 \u2014 yarn.lock"}, "properties": {"repobilityId": "44d706e87e854ae3", "scanner": "scanner-primary", "fingerprint": "0ecd8b614867c030", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-102278"]}}, {"ruleId": "scanner-84d6f76c92bf1594", "level": "error", "message": {"text": "CVE-2026-13149: brace-expansion 2.0.1 \u2014 yarn.lock"}, "properties": {"repobilityId": "6e65518804dbc4a0", "scanner": "scanner-primary", "fingerprint": "84d6f76c92bf1594", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-13149"]}}, {"ruleId": "scanner-629e278807f014a0", "level": "error", "message": {"text": "CVE-2026-14257: brace-expansion 2.0.1 \u2014 yarn.lock"}, "properties": {"repobilityId": "2103554f1f980617", "scanner": "scanner-primary", "fingerprint": "629e278807f014a0", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-14257"]}}, {"ruleId": "scanner-557cec467a1994e7", "level": "error", "message": {"text": "CVE-2026-69152: brace-expansion 2.0.1 \u2014 yarn.lock"}, "properties": {"repobilityId": "a5d45e175febdcd2", "scanner": "scanner-primary", "fingerprint": "557cec467a1994e7", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-69152"]}}, {"ruleId": "scanner-d7f9fd79b737dadc", "level": "warning", "message": {"text": "CVE-2026-102277: brace-expansion 2.0.1 \u2014 yarn.lock"}, "properties": {"repobilityId": "ee167a7e14ab1b31", "scanner": "scanner-primary", "fingerprint": "d7f9fd79b737dadc", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-102277"]}}, {"ruleId": "scanner-df4b282f33f327f9", "level": "warning", "message": {"text": "CVE-2026-33750: brace-expansion 2.0.1 \u2014 yarn.lock"}, "properties": {"repobilityId": "ebbc368068e238c2", "scanner": "scanner-primary", "fingerprint": "df4b282f33f327f9", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-33750"]}}, {"ruleId": "scanner-e2f48fb78f6fdc14", "level": "note", "message": {"text": "CVE-2025-5889: brace-expansion 2.0.1 \u2014 yarn.lock"}, "properties": {"repobilityId": "bbab3d9698e1d68c", "scanner": "scanner-primary", "fingerprint": "e2f48fb78f6fdc14", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-5889"]}}, {"ruleId": "scanner-6eb609aba1cca177", "level": "error", "message": {"text": "CVE-2026-93687: braces 3.0.3 \u2014 yarn.lock"}, "properties": {"repobilityId": "5b2ffb9d52ffb898", "scanner": "scanner-primary", "fingerprint": "6eb609aba1cca177", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-93687"]}}, {"ruleId": "scanner-4710e05dab3afcd5", "level": "warning", "message": {"text": "CVE-2026-45822: decode-uri-component 0.2.2 \u2014 yarn.lock"}, "properties": {"repobilityId": "2238a4c868f89637", "scanner": "scanner-primary", "fingerprint": "4710e05dab3afcd5", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-45822"]}}, {"ruleId": "scanner-f94a8c35e9ab9f9e", "level": "error", "message": {"text": "CVE-2026-35209: defu 6.1.3 \u2014 yarn.lock"}, "properties": {"repobilityId": "14e13cec972f3403", "scanner": "scanner-primary", "fingerprint": "f94a8c35e9ab9f9e", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-35209"]}}, {"ruleId": "scanner-2648c0e29f8a61cd", "level": "warning", "message": {"text": "CVE-2025-15599: dompurify 3.2.6 \u2014 yarn.lock"}, "properties": {"repobilityId": "6e23350af5253867", "scanner": "scanner-primary", "fingerprint": "2648c0e29f8a61cd", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-15599"]}}, {"ruleId": "scanner-c3cd10caa34dc5a5", "level": "warning", "message": {"text": "CVE-2026-0540: dompurify 3.2.6 \u2014 yarn.lock"}, "properties": {"repobilityId": "2b8e708ee5d12772", "scanner": "scanner-primary", "fingerprint": "c3cd10caa34dc5a5", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-0540"]}}, {"ruleId": "scanner-98ec3212169b5919", "level": "warning", "message": {"text": "CVE-2026-41238: dompurify 3.2.6 \u2014 yarn.lock"}, "properties": {"repobilityId": "2bda62888a9f17b2", "scanner": "scanner-primary", "fingerprint": "98ec3212169b5919", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-41238"]}}, {"ruleId": "scanner-53aa4fa39b5036fb", "level": "warning", "message": {"text": "CVE-2026-41239: dompurify 3.2.6 \u2014 yarn.lock"}, "properties": {"repobilityId": "c764f7384364eb81", "scanner": "scanner-primary", "fingerprint": "53aa4fa39b5036fb", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-41239"]}}, {"ruleId": "scanner-8f9c5da81c558e9e", "level": "warning", "message": {"text": "CVE-2026-41240: dompurify 3.2.6 \u2014 yarn.lock"}, "properties": {"repobilityId": "a8563d1fa5d14329", "scanner": "scanner-primary", "fingerprint": "8f9c5da81c558e9e", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-41240"]}}, {"ruleId": "scanner-847e707ad0721e2f", "level": "warning", "message": {"text": "CVE-2026-49458: dompurify 3.2.6 \u2014 yarn.lock"}, "properties": {"repobilityId": "280fca12862d1482", "scanner": "scanner-primary", "fingerprint": "847e707ad0721e2f", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-49458"]}}, {"ruleId": "scanner-bfa1175542eae51a", "level": "warning", "message": {"text": "CVE-2026-49459: dompurify 3.2.6 \u2014 yarn.lock"}, "properties": {"repobilityId": "027ddb7f1ac4403f", "scanner": "scanner-primary", "fingerprint": "bfa1175542eae51a", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-49459"]}}, {"ruleId": "scanner-fa9337e3afd1b3a0", "level": "warning", "message": {"text": "CVE-2026-49978: dompurify 3.2.6 \u2014 yarn.lock"}, "properties": {"repobilityId": "d9249e95ac0da726", "scanner": "scanner-primary", "fingerprint": "fa9337e3afd1b3a0", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-49978"]}}, {"ruleId": "scanner-4b83314a3f2b4d08", "level": "warning", "message": {"text": "CVE-2026-65898: dompurify 3.2.6 \u2014 yarn.lock"}, "properties": {"repobilityId": "0aa2e98339205a25", "scanner": "scanner-primary", "fingerprint": "4b83314a3f2b4d08", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-65898"]}}, {"ruleId": "scanner-0c41cb8d65c9e0dd", "level": "warning", "message": {"text": "CVE-2026-65902: dompurify 3.2.6 \u2014 yarn.lock"}, "properties": {"repobilityId": "131f9474a9c6179a", "scanner": "scanner-primary", "fingerprint": "0c41cb8d65c9e0dd", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-65902"]}}, {"ruleId": "scanner-7e0f96292ad49b8a", "level": "warning", "message": {"text": "CVE-2026-65903: dompurify 3.2.6 \u2014 yarn.lock"}, "properties": {"repobilityId": "96c643d11e91d2b4", "scanner": "scanner-primary", "fingerprint": "7e0f96292ad49b8a", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-65903"]}}, {"ruleId": "scanner-03837ed522732967", "level": "warning", "message": {"text": "CVE-2026-65912: dompurify 3.2.6 \u2014 yarn.lock"}, "properties": {"repobilityId": "c7154bf507bfb9fa", "scanner": "scanner-primary", "fingerprint": "03837ed522732967", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-65912"]}}, {"ruleId": "scanner-c71d2ea4ec0abaf8", "level": "warning", "message": {"text": "CVE-2026-65913: dompurify 3.2.6 \u2014 yarn.lock"}, "properties": {"repobilityId": "240f0d2d9dd30515", "scanner": "scanner-primary", "fingerprint": "c71d2ea4ec0abaf8", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-65913"]}}, {"ruleId": "scanner-a3a3cd8bf9f6873f", "level": "warning", "message": {"text": "CVE-2026-65914: dompurify 3.2.6 \u2014 yarn.lock"}, "properties": {"repobilityId": "963a4172d70d1dc3", "scanner": "scanner-primary", "fingerprint": "a3a3cd8bf9f6873f", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-65914"]}}, {"ruleId": "scanner-c446a46de1f1f737", "level": "warning", "message": {"text": "GHSA-55q2-fjhq-7xh7: dompurify 3.2.6 \u2014 yarn.lock"}, "properties": {"repobilityId": "90f13b4660d562b3", "scanner": "scanner-primary", "fingerprint": "c446a46de1f1f737", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-55q2-fjhq-7xh7"]}}, {"ruleId": "scanner-279540406f1e5d1c", "level": "note", "message": {"text": "CVE-2026-65899: dompurify 3.2.6 \u2014 yarn.lock"}, "properties": {"repobilityId": "4bb48bbbe6356db2", "scanner": "scanner-primary", "fingerprint": "279540406f1e5d1c", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-65899"]}}, {"ruleId": "scanner-cb798e61775240f2", "level": "note", "message": {"text": "CVE-2026-65900: dompurify 3.2.6 \u2014 yarn.lock"}, "properties": {"repobilityId": "84bdeb1a24e1a3b0", "scanner": "scanner-primary", "fingerprint": "cb798e61775240f2", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-65900"]}}, {"ruleId": "scanner-83baac09ad719613", "level": "note", "message": {"text": "CVE-2026-65901: dompurify 3.2.6 \u2014 yarn.lock"}, "properties": {"repobilityId": "e842d5a0ea368e6a", "scanner": "scanner-primary", "fingerprint": "83baac09ad719613", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-65901"]}}, {"ruleId": "scanner-7e3374172ebc43e3", "level": "note", "message": {"text": "CVE-2026-66010: dompurify 3.2.6 \u2014 yarn.lock"}, "properties": {"repobilityId": "c4e9665e11ce8489", "scanner": "scanner-primary", "fingerprint": "7e3374172ebc43e3", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-66010"]}}, {"ruleId": "scanner-7abf23d0eac4f2ab", "level": "note", "message": {"text": "GHSA-6688-9rhm-gjv2: dompurify 3.2.6 \u2014 yarn.lock"}, "properties": {"repobilityId": "e552b2679a035192", "scanner": "scanner-primary", "fingerprint": "7abf23d0eac4f2ab", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-6688-9rhm-gjv2"]}}, {"ruleId": "scanner-31f0df9ad811fbf6", "level": "warning", "message": {"text": "GHSA-jggr-w7fw-pc2j: fast-copy 3.0.0 \u2014 yarn.lock"}, "properties": {"repobilityId": "404d6fddfe363ef6", "scanner": "scanner-primary", "fingerprint": "31f0df9ad811fbf6", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-jggr-w7fw-pc2j"]}}, {"ruleId": "scanner-b67265ce686e1a6a", "level": "warning", "message": {"text": "CVE-2026-45820: fflate 0.4.8 \u2014 yarn.lock"}, "properties": {"repobilityId": "14660ea6bf10f581", "scanner": "scanner-primary", "fingerprint": "b67265ce686e1a6a", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-45820"]}}, {"ruleId": "scanner-45fb9e67f1bf6d36", "level": "warning", "message": {"text": "CVE-2026-45820: fflate 0.8.2 \u2014 yarn.lock"}, "properties": {"repobilityId": "14660ea6bf10f581", "scanner": "scanner-primary", "fingerprint": "45fb9e67f1bf6d36", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-45820"]}}, {"ruleId": "scanner-6ec7de12c5e81cd9", "level": "warning", "message": {"text": "CVE-2026-31808: file-type 20.5.0 \u2014 yarn.lock"}, "properties": {"repobilityId": "0a170c90cb4199db", "scanner": "scanner-primary", "fingerprint": "6ec7de12c5e81cd9", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-31808"]}}, {"ruleId": "scanner-c89cf3707b93de46", "level": "warning", "message": {"text": "CVE-2026-32630: file-type 20.5.0 \u2014 yarn.lock"}, "properties": {"repobilityId": "17147ce923d65160", "scanner": "scanner-primary", "fingerprint": "c89cf3707b93de46", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-32630"]}}, {"ruleId": "scanner-7c0e25fb23368dee", "level": "warning", "message": {"text": "GHSA-r4q5-vmmm-2653: follow-redirects 1.15.9 \u2014 yarn.lock"}, "properties": {"repobilityId": "fd377b5094fcafe1", "scanner": "scanner-primary", "fingerprint": "7c0e25fb23368dee", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-r4q5-vmmm-2653"]}}, {"ruleId": "scanner-69836ab8f41a53d4", "level": "error", "message": {"text": "CVE-2026-12143: form-data 4.0.4 \u2014 yarn.lock"}, "properties": {"repobilityId": "cd17c75103da22c9", "scanner": "scanner-primary", "fingerprint": "69836ab8f41a53d4", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-12143"]}}, {"ruleId": "scanner-8c3cc29b3ba37a0c", "level": "error", "message": {"text": "CVE-2026-23527: h3 1.9.0 \u2014 yarn.lock"}, "properties": {"repobilityId": "34ec93e33082b9c5", "scanner": "scanner-primary", "fingerprint": "8c3cc29b3ba37a0c", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-23527"]}}, {"ruleId": "scanner-6b9738d0f6d41e41", "level": "error", "message": {"text": "CVE-2026-33128: h3 1.9.0 \u2014 yarn.lock"}, "properties": {"repobilityId": "7f6e60de01713a83", "scanner": "scanner-primary", "fingerprint": "6b9738d0f6d41e41", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-33128"]}}, {"ruleId": "scanner-829a2d80b8287a56", "level": "warning", "message": {"text": "GHSA-4hxc-9384-m385: h3 1.9.0 \u2014 yarn.lock"}, "properties": {"repobilityId": "e4ef6a8cff506581", "scanner": "scanner-primary", "fingerprint": "829a2d80b8287a56", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-4hxc-9384-m385"]}}, {"ruleId": "scanner-2ae068f3d6007931", "level": "warning", "message": {"text": "GHSA-72gr-qfp7-vwhw: h3 1.9.0 \u2014 yarn.lock"}, "properties": {"repobilityId": "370bb8c17f477612", "scanner": "scanner-primary", "fingerprint": "2ae068f3d6007931", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-72gr-qfp7-vwhw"]}}, {"ruleId": "scanner-4ce14712aa4feb52", "level": "warning", "message": {"text": "GHSA-wr4h-v87w-p3r7: h3 1.9.0 \u2014 yarn.lock"}, "properties": {"repobilityId": "364124e7ca50d937", "scanner": "scanner-primary", "fingerprint": "4ce14712aa4feb52", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-wr4h-v87w-p3r7"]}}, {"ruleId": "scanner-8063298c12ebcaac", "level": "error", "message": {"text": "CVE-2026-29045: hono 4.11.4 \u2014 yarn.lock"}, "properties": {"repobilityId": "fc0d7ed46164cc12", "scanner": "scanner-primary", "fingerprint": "8063298c12ebcaac", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-29045"]}}, {"ruleId": "scanner-2c7c0e2a9272270b", "level": "error", "message": {"text": "CVE-2026-54290: hono 4.11.4 \u2014 yarn.lock"}, "properties": {"repobilityId": "dffb586544d4d1cd", "scanner": "scanner-primary", "fingerprint": "2c7c0e2a9272270b", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-54290"]}}, {"ruleId": "scanner-a47493778e6d8236", "level": "warning", "message": {"text": "CVE-2026-24398: hono 4.11.4 \u2014 yarn.lock"}, "properties": {"repobilityId": "bd24b36d4f5e27f6", "scanner": "scanner-primary", "fingerprint": "a47493778e6d8236", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-24398"]}}, {"ruleId": "scanner-57cb08a2aa504c94", "level": "warning", "message": {"text": "CVE-2026-24472: hono 4.11.4 \u2014 yarn.lock"}, "properties": {"repobilityId": "980934634a47d065", "scanner": "scanner-primary", "fingerprint": "57cb08a2aa504c94", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-24472"]}}, {"ruleId": "scanner-c581cf1a00ca6221", "level": "warning", "message": {"text": "CVE-2026-24473: hono 4.11.4 \u2014 yarn.lock"}, "properties": {"repobilityId": "67c557b93d774aa5", "scanner": "scanner-primary", "fingerprint": "c581cf1a00ca6221", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-24473"]}}, {"ruleId": "scanner-13de1fa8aab9d137", "level": "warning", "message": {"text": "CVE-2026-24771: hono 4.11.4 \u2014 yarn.lock"}, "properties": {"repobilityId": "1e8869ca4de8851c", "scanner": "scanner-primary", "fingerprint": "13de1fa8aab9d137", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-24771"]}}, {"ruleId": "scanner-46d453835f58fe70", "level": "warning", "message": {"text": "CVE-2026-29085: hono 4.11.4 \u2014 yarn.lock"}, "properties": {"repobilityId": "7c0c00d58873b4c1", "scanner": "scanner-primary", "fingerprint": "46d453835f58fe70", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-29085"]}}, {"ruleId": "scanner-e3ec2e6d8a6cc996", "level": "warning", "message": {"text": "CVE-2026-29086: hono 4.11.4 \u2014 yarn.lock"}, "properties": {"repobilityId": "ed2ef3a56382c65c", "scanner": "scanner-primary", "fingerprint": "e3ec2e6d8a6cc996", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-29086"]}}, {"ruleId": "scanner-305b10a40aee8174", "level": "warning", "message": {"text": "CVE-2026-39407: hono 4.11.4 \u2014 yarn.lock"}, "properties": {"repobilityId": "5a94cfa705fca510", "scanner": "scanner-primary", "fingerprint": "305b10a40aee8174", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-39407"]}}, {"ruleId": "scanner-dd3f913f894b429e", "level": "warning", "message": {"text": "CVE-2026-39408: hono 4.11.4 \u2014 yarn.lock"}, "properties": {"repobilityId": "b8d07a1480f17437", "scanner": "scanner-primary", "fingerprint": "dd3f913f894b429e", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-39408"]}}, {"ruleId": "scanner-6b1419aa0c7dc624", "level": "warning", "message": {"text": "CVE-2026-39409: hono 4.11.4 \u2014 yarn.lock"}, "properties": {"repobilityId": "bc99b29843770fb3", "scanner": "scanner-primary", "fingerprint": "6b1419aa0c7dc624", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-39409"]}}, {"ruleId": "scanner-73ece1fc46130763", "level": "warning", "message": {"text": "CVE-2026-39410: hono 4.11.4 \u2014 yarn.lock"}, "properties": {"repobilityId": "20fb2f341b34115a", "scanner": "scanner-primary", "fingerprint": "73ece1fc46130763", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-39410"]}}, {"ruleId": "scanner-f1e0a645b17172af", "level": "warning", "message": {"text": "CVE-2026-44455: hono 4.11.4 \u2014 yarn.lock"}, "properties": {"repobilityId": "71a6b93f815d4ee4", "scanner": "scanner-primary", "fingerprint": "f1e0a645b17172af", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44455"]}}, {"ruleId": "scanner-6b9e4750f2124d4f", "level": "warning", "message": {"text": "CVE-2026-44456: hono 4.11.4 \u2014 yarn.lock"}, "properties": {"repobilityId": "0b45ab4973f26bef", "scanner": "scanner-primary", "fingerprint": "6b9e4750f2124d4f", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44456"]}}, {"ruleId": "scanner-01913cdbdf0071e5", "level": "warning", "message": {"text": "CVE-2026-44457: hono 4.11.4 \u2014 yarn.lock"}, "properties": {"repobilityId": "821f4f7d0b3661f7", "scanner": "scanner-primary", "fingerprint": "01913cdbdf0071e5", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44457"]}}, {"ruleId": "scanner-395f26d9b5516c3c", "level": "warning", "message": {"text": "CVE-2026-44458: hono 4.11.4 \u2014 yarn.lock"}, "properties": {"repobilityId": "ab3e536ac1fc7514", "scanner": "scanner-primary", "fingerprint": "395f26d9b5516c3c", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44458"]}}, {"ruleId": "scanner-0ebcd6a5c1a190d5", "level": "warning", "message": {"text": "CVE-2026-47673: hono 4.11.4 \u2014 yarn.lock"}, "properties": {"repobilityId": "68faaf006edce0cd", "scanner": "scanner-primary", "fingerprint": "0ebcd6a5c1a190d5", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-47673"]}}, {"ruleId": "scanner-b7fc473afe12cd05", "level": "warning", "message": {"text": "CVE-2026-47674: hono 4.11.4 \u2014 yarn.lock"}, "properties": {"repobilityId": "73d9ae0d27fb3973", "scanner": "scanner-primary", "fingerprint": "b7fc473afe12cd05", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-47674"]}}, {"ruleId": "scanner-a44660d2f6fc26f2", "level": "warning", "message": {"text": "CVE-2026-47675: hono 4.11.4 \u2014 yarn.lock"}, "properties": {"repobilityId": "e4c15460ba8dcf1e", "scanner": "scanner-primary", "fingerprint": "a44660d2f6fc26f2", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-47675"]}}, {"ruleId": "scanner-f77174322025f4e9", "level": "warning", "message": {"text": "CVE-2026-47676: hono 4.11.4 \u2014 yarn.lock"}, "properties": {"repobilityId": "2d7eb53cc976f180", "scanner": "scanner-primary", "fingerprint": "f77174322025f4e9", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-47676"]}}, {"ruleId": "scanner-2a665073035500e8", "level": "warning", "message": {"text": "CVE-2026-54286: hono 4.11.4 \u2014 yarn.lock"}, "properties": {"repobilityId": "34e80d8bd4502fca", "scanner": "scanner-primary", "fingerprint": "2a665073035500e8", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-54286"]}}, {"ruleId": "scanner-aedff8236b98cf31", "level": "warning", "message": {"text": "CVE-2026-54287: hono 4.11.4 \u2014 yarn.lock"}, "properties": {"repobilityId": "26526aa3560cdd76", "scanner": "scanner-primary", "fingerprint": "aedff8236b98cf31", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-54287"]}}, {"ruleId": "scanner-8b5655af0bcd214f", "level": "warning", "message": {"text": "CVE-2026-54288: hono 4.11.4 \u2014 yarn.lock"}, "properties": {"repobilityId": "fc87d3d47639713a", "scanner": "scanner-primary", "fingerprint": "8b5655af0bcd214f", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-54288"]}}, {"ruleId": "scanner-94e489a79d241d17", "level": "warning", "message": {"text": "CVE-2026-54289: hono 4.11.4 \u2014 yarn.lock"}, "properties": {"repobilityId": "91b7d6c8bed54a92", "scanner": "scanner-primary", "fingerprint": "94e489a79d241d17", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-54289"]}}, {"ruleId": "scanner-d02b7031ac7c9030", "level": "warning", "message": {"text": "CVE-2026-56761: hono 4.11.4 \u2014 yarn.lock"}, "properties": {"repobilityId": "9036b65623f4d24c", "scanner": "scanner-primary", "fingerprint": "d02b7031ac7c9030", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-56761"]}}, {"ruleId": "scanner-b1125e2b3e2542a9", "level": "warning", "message": {"text": "CVE-2026-56762: hono 4.11.4 \u2014 yarn.lock"}, "properties": {"repobilityId": "c7d59b14d9e95bed", "scanner": "scanner-primary", "fingerprint": "b1125e2b3e2542a9", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-56762"]}}, {"ruleId": "scanner-ad3bd4a94d153a3d", "level": "warning", "message": {"text": "CVE-2026-56763: hono 4.11.4 \u2014 yarn.lock"}, "properties": {"repobilityId": "1c5bed8c833236a2", "scanner": "scanner-primary", "fingerprint": "ad3bd4a94d153a3d", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-56763"]}}, {"ruleId": "scanner-09b322ac3a299aeb", "level": "warning", "message": {"text": "CVE-2026-59895: hono 4.11.4 \u2014 yarn.lock"}, "properties": {"repobilityId": "b84e11f3e438f6a1", "scanner": "scanner-primary", "fingerprint": "09b322ac3a299aeb", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59895"]}}, {"ruleId": "scanner-cfc7c48a6956dc32", "level": "warning", "message": {"text": "CVE-2026-59897: hono 4.11.4 \u2014 yarn.lock"}, "properties": {"repobilityId": "a8796eae58dec680", "scanner": "scanner-primary", "fingerprint": "cfc7c48a6956dc32", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59897"]}}, {"ruleId": "scanner-c8493291a28abee6", "level": "warning", "message": {"text": "CVE-2026-69207: hono 4.11.4 \u2014 yarn.lock"}, "properties": {"repobilityId": "2984e775622ee10f", "scanner": "scanner-primary", "fingerprint": "c8493291a28abee6", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-69207"]}}, {"ruleId": "scanner-317480cb97b702ef", "level": "warning", "message": {"text": "CVE-2026-71850: hono 4.11.4 \u2014 yarn.lock"}, "properties": {"repobilityId": "4b333b64d35e61e4", "scanner": "scanner-primary", "fingerprint": "317480cb97b702ef", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-71850"]}}, {"ruleId": "scanner-dc37e1e21a0facec", "level": "warning", "message": {"text": "CVE-2026-84363: hono 4.11.4 \u2014 yarn.lock"}, "properties": {"repobilityId": "40db9088ca129d17", "scanner": "scanner-primary", "fingerprint": "dc37e1e21a0facec", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-84363"]}}, {"ruleId": "scanner-ab7d00736b4c3a65", "level": "warning", "message": {"text": "CVE-2026-84364: hono 4.11.4 \u2014 yarn.lock"}, "properties": {"repobilityId": "676b07a772f81b1f", "scanner": "scanner-primary", "fingerprint": "ab7d00736b4c3a65", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-84364"]}}, {"ruleId": "scanner-8b06896ad9bf359b", "level": "warning", "message": {"text": "CVE-2026-84365: hono 4.11.4 \u2014 yarn.lock"}, "properties": {"repobilityId": "c0ac2164e6f48f87", "scanner": "scanner-primary", "fingerprint": "8b06896ad9bf359b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-84365"]}}, {"ruleId": "scanner-02e1a9a6a892e360", "level": "warning", "message": {"text": "CVE-2026-93981: hono 4.11.4 \u2014 yarn.lock"}, "properties": {"repobilityId": "105e4238d6804a41", "scanner": "scanner-primary", "fingerprint": "02e1a9a6a892e360", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-93981"]}}, {"ruleId": "scanner-05a4abf3bf20cd51", "level": "note", "message": {"text": "CVE-2026-44459: hono 4.11.4 \u2014 yarn.lock"}, "properties": {"repobilityId": "49f6aa9e0e1f5ad0", "scanner": "scanner-primary", "fingerprint": "05a4abf3bf20cd51", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44459"]}}, {"ruleId": "scanner-d2b83c502165593b", "level": "note", "message": {"text": "CVE-2026-71849: hono 4.11.4 \u2014 yarn.lock"}, "properties": {"repobilityId": "f7bd82b1309ca047", "scanner": "scanner-primary", "fingerprint": "d2b83c502165593b", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-71849"]}}, {"ruleId": "scanner-80224fe410daf37a", "level": "note", "message": {"text": "GHSA-gq3j-xvxp-8hrf: hono 4.11.4 \u2014 yarn.lock"}, "properties": {"repobilityId": "9926520b1d6db881", "scanner": "scanner-primary", "fingerprint": "80224fe410daf37a", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-gq3j-xvxp-8hrf"]}}, {"ruleId": "scanner-91e2849b1fe99681", "level": "error", "message": {"text": "CVE-2026-29063: immutable 3.8.2 \u2014 yarn.lock"}, "properties": {"repobilityId": "12deac9e5f03bc10", "scanner": "scanner-primary", "fingerprint": "91e2849b1fe99681", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-29063"]}}, {"ruleId": "scanner-302e8d5edcfbf20a", "level": "error", "message": {"text": "CVE-2026-59879: immutable 3.8.2 \u2014 yarn.lock"}, "properties": {"repobilityId": "b0508ce55fa4f1d1", "scanner": "scanner-primary", "fingerprint": "302e8d5edcfbf20a", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59879"]}}, {"ruleId": "scanner-fb3d9cc4243dd94e", "level": "error", "message": {"text": "CVE-2026-59880: immutable 3.8.2 \u2014 yarn.lock"}, "properties": {"repobilityId": "57e7722a32acc6e5", "scanner": "scanner-primary", "fingerprint": "fb3d9cc4243dd94e", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59880"]}}, {"ruleId": "scanner-57d9fa7bdd87cad6", "level": "error", "message": {"text": "CVE-2026-92599: joi 17.13.3 \u2014 yarn.lock"}, "properties": {"repobilityId": "e899228751af3b88", "scanner": "scanner-primary", "fingerprint": "57d9fa7bdd87cad6", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-92599"]}}, {"ruleId": "scanner-7df61d8e4537898a", "level": "warning", "message": {"text": "CVE-2026-48038: joi 17.13.3 \u2014 yarn.lock"}, "properties": {"repobilityId": "8e55e34ed2add489", "scanner": "scanner-primary", "fingerprint": "7df61d8e4537898a", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-48038"]}}, {"ruleId": "scanner-99a9a05a88b59244", "level": "warning", "message": {"text": "CVE-2026-90771: joi 17.13.3 \u2014 yarn.lock"}, "properties": {"repobilityId": "9f74dfdec4a766fb", "scanner": "scanner-primary", "fingerprint": "99a9a05a88b59244", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-90771"]}}, {"ruleId": "scanner-41533a818f402bf9", "level": "note", "message": {"text": "CVE-2026-84367: joi 17.13.3 \u2014 yarn.lock"}, "properties": {"repobilityId": "3236c88048703690", "scanner": "scanner-primary", "fingerprint": "41533a818f402bf9", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-84367"]}}, {"ruleId": "scanner-5469a3bffad71f14", "level": "note", "message": {"text": "CVE-2026-84368: joi 17.13.3 \u2014 yarn.lock"}, "properties": {"repobilityId": "237f73657802cb14", "scanner": "scanner-primary", "fingerprint": "5469a3bffad71f14", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-84368"]}}, {"ruleId": "scanner-3c6d689345d79693", "level": "error", "message": {"text": "CVE-2026-46625: js-cookie 3.0.1 \u2014 yarn.lock"}, "properties": {"repobilityId": "439a1ff36a510557", "scanner": "scanner-primary", "fingerprint": "3c6d689345d79693", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-46625"]}}, {"ruleId": "scanner-579ac7c5d38b02c7", "level": "error", "message": {"text": "CVE-2026-59869: js-yaml 4.1.1 \u2014 yarn.lock"}, "properties": {"repobilityId": "5f1c2a552f81bec8", "scanner": "scanner-primary", "fingerprint": "579ac7c5d38b02c7", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59869"]}}, {"ruleId": "scanner-a683cab306b241d7", "level": "error", "message": {"text": "CVE-2026-84375: js-yaml 4.1.1 \u2014 yarn.lock"}, "properties": {"repobilityId": "0a38f7ae91e4fbad", "scanner": "scanner-primary", "fingerprint": "a683cab306b241d7", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-84375"]}}, {"ruleId": "scanner-a0e3dcf2736c9d95", "level": "error", "message": {"text": "GHSA-5p4m-2wfm-xmqj: js-yaml 4.1.1 \u2014 yarn.lock"}, "properties": {"repobilityId": "984a063553bfdc58", "scanner": "scanner-primary", "fingerprint": "a0e3dcf2736c9d95", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-5p4m-2wfm-xmqj"]}}, {"ruleId": "scanner-344d8b12b7c51e6a", "level": "warning", "message": {"text": "CVE-2026-53550: js-yaml 4.1.1 \u2014 yarn.lock"}, "properties": {"repobilityId": "f2a7e68d4f4e4ef0", "scanner": "scanner-primary", "fingerprint": "344d8b12b7c51e6a", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-53550"]}}, {"ruleId": "scanner-c7fda804cdbca677", "level": "error", "message": {"text": "CVE-2026-48801: linkify-it 5.0.0 \u2014 yarn.lock"}, "properties": {"repobilityId": "cbdd75256d036c99", "scanner": "scanner-primary", "fingerprint": "c7fda804cdbca677", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-48801"]}}, {"ruleId": "scanner-0a2723cec4f9c38e", "level": "error", "message": {"text": "CVE-2026-59887: linkify-it 5.0.0 \u2014 yarn.lock"}, "properties": {"repobilityId": "849c6efeeb740a63", "scanner": "scanner-primary", "fingerprint": "0a2723cec4f9c38e", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59887"]}}, {"ruleId": "scanner-c8c09c08bb23a25e", "level": "error", "message": {"text": "CVE-2026-4800: lodash 4.17.21 \u2014 yarn.lock"}, "properties": {"repobilityId": "c28f740f45f6aaf8", "scanner": "scanner-primary", "fingerprint": "c8c09c08bb23a25e", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-4800"]}}, {"ruleId": "scanner-62e4f989d78fabe9", "level": "warning", "message": {"text": "CVE-2025-13465: lodash 4.17.21 \u2014 yarn.lock"}, "properties": {"repobilityId": "33f3e47d7847ac6e", "scanner": "scanner-primary", "fingerprint": "62e4f989d78fabe9", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-13465"]}}, {"ruleId": "scanner-5832cfc129b36d19", "level": "warning", "message": {"text": "CVE-2026-2950: lodash 4.17.21 \u2014 yarn.lock"}, "properties": {"repobilityId": "5b46c686a1c1e330", "scanner": "scanner-primary", "fingerprint": "5832cfc129b36d19", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-2950"]}}, {"ruleId": "scanner-c0e30e72a7703430", "level": "warning", "message": {"text": "CVE-2026-2327: markdown-it 14.1.0 \u2014 yarn.lock"}, "properties": {"repobilityId": "27896fe86d83613b", "scanner": "scanner-primary", "fingerprint": "c0e30e72a7703430", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-2327"]}}, {"ruleId": "scanner-309f25d9e46935ff", "level": "warning", "message": {"text": "CVE-2026-48988: markdown-it 14.1.0 \u2014 yarn.lock"}, "properties": {"repobilityId": "27259b14271c741f", "scanner": "scanner-primary", "fingerprint": "309f25d9e46935ff", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-48988"]}}, {"ruleId": "scanner-175f9ff3811af138", "level": "warning", "message": {"text": "GHSA-253c-mchw-3w2r: markdown-it 14.1.0 \u2014 yarn.lock"}, "properties": {"repobilityId": "cc79d839b0af9f01", "scanner": "scanner-primary", "fingerprint": "175f9ff3811af138", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-253c-mchw-3w2r"]}}, {"ruleId": "scanner-41eb8152216a524e", "level": "error", "message": {"text": "CVE-2026-26996: minimatch 5.1.0 \u2014 yarn.lock"}, "properties": {"repobilityId": "7f720a627af5cf0d", "scanner": "scanner-primary", "fingerprint": "41eb8152216a524e", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-26996"]}}, {"ruleId": "scanner-08be92ce55ccbfb4", "level": "error", "message": {"text": "CVE-2026-27903: minimatch 5.1.0 \u2014 yarn.lock"}, "properties": {"repobilityId": "80250811fd983a49", "scanner": "scanner-primary", "fingerprint": "08be92ce55ccbfb4", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-27903"]}}, {"ruleId": "scanner-f46ae4aec507c3ae", "level": "error", "message": {"text": "CVE-2026-27904: minimatch 5.1.0 \u2014 yarn.lock"}, "properties": {"repobilityId": "1f4ff0045d9fce7c", "scanner": "scanner-primary", "fingerprint": "f46ae4aec507c3ae", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-27904"]}}, {"ruleId": "scanner-5d5d262f359102ba", "level": "error", "message": {"text": "CVE-2026-26996: minimatch 7.4.6 \u2014 yarn.lock"}, "properties": {"repobilityId": "7f720a627af5cf0d", "scanner": "scanner-primary", "fingerprint": "5d5d262f359102ba", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-26996"]}}, {"ruleId": "scanner-8e2ac1b0092038be", "level": "error", "message": {"text": "CVE-2026-27903: minimatch 7.4.6 \u2014 yarn.lock"}, "properties": {"repobilityId": "80250811fd983a49", "scanner": "scanner-primary", "fingerprint": "8e2ac1b0092038be", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-27903"]}}, {"ruleId": "scanner-7992c3409bcd2893", "level": "error", "message": {"text": "CVE-2026-27904: minimatch 7.4.6 \u2014 yarn.lock"}, "properties": {"repobilityId": "1f4ff0045d9fce7c", "scanner": "scanner-primary", "fingerprint": "7992c3409bcd2893", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-27904"]}}, {"ruleId": "scanner-36c2c97d9ce51ced", "level": "error", "message": {"text": "CVE-2026-67213: nanoid 3.3.11 \u2014 yarn.lock"}, "properties": {"repobilityId": "60545091f66c1d16", "scanner": "scanner-primary", "fingerprint": "36c2c97d9ce51ced", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-67213"]}}, {"ruleId": "scanner-aa11665da092f037", "level": "error", "message": {"text": "CVE-2026-67214: nanoid 3.3.11 \u2014 yarn.lock"}, "properties": {"repobilityId": "ce37841bcdfcdbee", "scanner": "scanner-primary", "fingerprint": "aa11665da092f037", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-67214"]}}, {"ruleId": "scanner-4cbdfb134ada29ee", "level": "error", "message": {"text": "CVE-2026-73086: nanoid 3.3.11 \u2014 yarn.lock"}, "properties": {"repobilityId": "cdca87c9dba944dd", "scanner": "scanner-primary", "fingerprint": "4cbdfb134ada29ee", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-73086"]}}, {"ruleId": "scanner-efd3ddfa47bbf30a", "level": "error", "message": {"text": "CVE-2026-67213: nanoid 3.3.8 \u2014 yarn.lock"}, "properties": {"repobilityId": "60545091f66c1d16", "scanner": "scanner-primary", "fingerprint": "efd3ddfa47bbf30a", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-67213"]}}, {"ruleId": "scanner-8c54b289410ecbee", "level": "error", "message": {"text": "CVE-2026-67214: nanoid 3.3.8 \u2014 yarn.lock"}, "properties": {"repobilityId": "ce37841bcdfcdbee", "scanner": "scanner-primary", "fingerprint": "8c54b289410ecbee", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-67214"]}}, {"ruleId": "scanner-e4f6ac7d31db2777", "level": "error", "message": {"text": "CVE-2026-73086: nanoid 3.3.8 \u2014 yarn.lock"}, "properties": {"repobilityId": "cdca87c9dba944dd", "scanner": "scanner-primary", "fingerprint": "e4f6ac7d31db2777", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-73086"]}}, {"ruleId": "scanner-16296f003f1a9330", "level": "error", "message": {"text": "CVE-2026-67213: nanoid 5.1.5 \u2014 yarn.lock"}, "properties": {"repobilityId": "60545091f66c1d16", "scanner": "scanner-primary", "fingerprint": "16296f003f1a9330", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-67213"]}}, {"ruleId": "scanner-c000bd62521dc2b0", "level": "error", "message": {"text": "CVE-2026-67214: nanoid 5.1.5 \u2014 yarn.lock"}, "properties": {"repobilityId": "ce37841bcdfcdbee", "scanner": "scanner-primary", "fingerprint": "c000bd62521dc2b0", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-67214"]}}, {"ruleId": "scanner-96df44fbb6ca2346", "level": "error", "message": {"text": "CVE-2026-73086: nanoid 5.1.5 \u2014 yarn.lock"}, "properties": {"repobilityId": "cdca87c9dba944dd", "scanner": "scanner-primary", "fingerprint": "96df44fbb6ca2346", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-73086"]}}, {"ruleId": "scanner-cbad5cd64c1ac440", "level": "error", "message": {"text": "CVE-2026-67214: nanoid 5.1.6 \u2014 yarn.lock"}, "properties": {"repobilityId": "ce37841bcdfcdbee", "scanner": "scanner-primary", "fingerprint": "cbad5cd64c1ac440", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-67214"]}}, {"ruleId": "scanner-b2456a7a0de3e695", "level": "error", "message": {"text": "CVE-2026-73086: nanoid 5.1.6 \u2014 yarn.lock"}, "properties": {"repobilityId": "cdca87c9dba944dd", "scanner": "scanner-primary", "fingerprint": "b2456a7a0de3e695", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-73086"]}}, {"ruleId": "scanner-8cdcafd2bbede696", "level": "error", "message": {"text": "CVE-2026-75604: next 15.5.10 \u2014 yarn.lock"}, "properties": {"repobilityId": "c7a7e4745f381812", "scanner": "scanner-primary", "fingerprint": "8cdcafd2bbede696", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-75604"]}}, {"ruleId": "scanner-1d485869bba48cc2", "level": "error", "message": {"text": "GHSA-2xp9-vwfh-vxw4: next 15.5.10 \u2014 yarn.lock"}, "properties": {"repobilityId": "58814a69f9251b60", "scanner": "scanner-primary", "fingerprint": "1d485869bba48cc2", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-2xp9-vwfh-vxw4"]}}, {"ruleId": "scanner-917ed4477ad34c53", "level": "error", "message": {"text": "CVE-2026-44573: next 15.5.10 \u2014 yarn.lock"}, "properties": {"repobilityId": "dac7937ca05c975f", "scanner": "scanner-primary", "fingerprint": "917ed4477ad34c53", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44573"]}}, {"ruleId": "scanner-b017dc3c8f44c2a9", "level": "error", "message": {"text": "CVE-2026-44574: next 15.5.10 \u2014 yarn.lock"}, "properties": {"repobilityId": "f516c4b7f4cfa699", "scanner": "scanner-primary", "fingerprint": "b017dc3c8f44c2a9", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44574"]}}, {"ruleId": "scanner-84f45627c9a5216b", "level": "error", "message": {"text": "CVE-2026-44575: next 15.5.10 \u2014 yarn.lock"}, "properties": {"repobilityId": "b50bb33059630c13", "scanner": "scanner-primary", "fingerprint": "84f45627c9a5216b", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44575"]}}, {"ruleId": "scanner-68695c478d8a506b", "level": "error", "message": {"text": "CVE-2026-44578: next 15.5.10 \u2014 yarn.lock"}, "properties": {"repobilityId": "f69c6d8cc48eecc0", "scanner": "scanner-primary", "fingerprint": "68695c478d8a506b", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44578"]}}, {"ruleId": "scanner-a86c6599dbe043c8", "level": "error", "message": {"text": "CVE-2026-44579: next 15.5.10 \u2014 yarn.lock"}, "properties": {"repobilityId": "791b56bd73e17f14", "scanner": "scanner-primary", "fingerprint": "a86c6599dbe043c8", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44579"]}}, {"ruleId": "scanner-8b8513b63c1091b7", "level": "error", "message": {"text": "CVE-2026-45109: next 15.5.10 \u2014 yarn.lock"}, "properties": {"repobilityId": "e89dfbae131e7223", "scanner": "scanner-primary", "fingerprint": "8b8513b63c1091b7", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-45109"]}}, {"ruleId": "scanner-1f2990f9c383332d", "level": "error", "message": {"text": "CVE-2026-64641: next 15.5.10 \u2014 yarn.lock"}, "properties": {"repobilityId": "810a7f7e350ef82c", "scanner": "scanner-primary", "fingerprint": "1f2990f9c383332d", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-64641"]}}, {"ruleId": "scanner-8765fd546058c730", "level": "error", "message": {"text": "CVE-2026-64645: next 15.5.10 \u2014 yarn.lock"}, "properties": {"repobilityId": "d421f326a96d3bc3", "scanner": "scanner-primary", "fingerprint": "8765fd546058c730", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-64645"]}}, {"ruleId": "scanner-b3cfeb310a62d24d", "level": "error", "message": {"text": "CVE-2026-64649: next 15.5.10 \u2014 yarn.lock"}, "properties": {"repobilityId": "15f0e3d2299f2bfa", "scanner": "scanner-primary", "fingerprint": "b3cfeb310a62d24d", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-64649"]}}, {"ruleId": "scanner-ad51079eb0a192c2", "level": "error", "message": {"text": "GHSA-8h8q-6873-q5fj: next 15.5.10 \u2014 yarn.lock"}, "properties": {"repobilityId": "fbe34cd3a5d005dc", "scanner": "scanner-primary", "fingerprint": "ad51079eb0a192c2", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-8h8q-6873-q5fj"]}}, {"ruleId": "scanner-b3d63a1574cc8bf9", "level": "error", "message": {"text": "GHSA-q4gf-8mx6-v5v3: next 15.5.10 \u2014 yarn.lock"}, "properties": {"repobilityId": "e94585adadc8a2d8", "scanner": "scanner-primary", "fingerprint": "b3d63a1574cc8bf9", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-q4gf-8mx6-v5v3"]}}, {"ruleId": "scanner-f34d26f818bb3cc8", "level": "warning", "message": {"text": "CVE-2026-27980: next 15.5.10 \u2014 yarn.lock"}, "properties": {"repobilityId": "4e8ccf83c7ebc59f", "scanner": "scanner-primary", "fingerprint": "f34d26f818bb3cc8", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-27980"]}}, {"ruleId": "scanner-694637dc1f574728", "level": "warning", "message": {"text": "CVE-2026-29057: next 15.5.10 \u2014 yarn.lock"}, "properties": {"repobilityId": "5f1712e01949e6f7", "scanner": "scanner-primary", "fingerprint": "694637dc1f574728", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-29057"]}}, {"ruleId": "scanner-e7370c9f8dab132c", "level": "warning", "message": {"text": "CVE-2026-44576: next 15.5.10 \u2014 yarn.lock"}, "properties": {"repobilityId": "e7181ef7f3b5ba45", "scanner": "scanner-primary", "fingerprint": "e7370c9f8dab132c", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44576"]}}, {"ruleId": "scanner-6da19ff581f30dc5", "level": "warning", "message": {"text": "CVE-2026-44577: next 15.5.10 \u2014 yarn.lock"}, "properties": {"repobilityId": "efae0e26923bc72d", "scanner": "scanner-primary", "fingerprint": "6da19ff581f30dc5", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44577"]}}, {"ruleId": "scanner-1e8d2e6a2198e509", "level": "warning", "message": {"text": "CVE-2026-44580: next 15.5.10 \u2014 yarn.lock"}, "properties": {"repobilityId": "541a648fd4c2a0ec", "scanner": "scanner-primary", "fingerprint": "1e8d2e6a2198e509", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44580"]}}, {"ruleId": "scanner-4ee4810c5c7619a8", "level": "warning", "message": {"text": "CVE-2026-44581: next 15.5.10 \u2014 yarn.lock"}, "properties": {"repobilityId": "39088f00b675767e", "scanner": "scanner-primary", "fingerprint": "4ee4810c5c7619a8", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44581"]}}, {"ruleId": "scanner-65b6d77558b3cddc", "level": "warning", "message": {"text": "CVE-2026-64643: next 15.5.10 \u2014 yarn.lock"}, "properties": {"repobilityId": "4f822772749fbfc4", "scanner": "scanner-primary", "fingerprint": "65b6d77558b3cddc", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-64643"]}}, {"ruleId": "scanner-b2de561e8dca002e", "level": "warning", "message": {"text": "CVE-2026-64644: next 15.5.10 \u2014 yarn.lock"}, "properties": {"repobilityId": "5ef1328ea4137edb", "scanner": "scanner-primary", "fingerprint": "b2de561e8dca002e", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-64644"]}}, {"ruleId": "scanner-9c4c128de5429309", "level": "warning", "message": {"text": "CVE-2026-64646: next 15.5.10 \u2014 yarn.lock"}, "properties": {"repobilityId": "d8ddb58ae398259e", "scanner": "scanner-primary", "fingerprint": "9c4c128de5429309", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-64646"]}}, {"ruleId": "scanner-9eaf1e6b87d55b38", "level": "warning", "message": {"text": "CVE-2026-64647: next 15.5.10 \u2014 yarn.lock"}, "properties": {"repobilityId": "960329729fff3356", "scanner": "scanner-primary", "fingerprint": "9eaf1e6b87d55b38", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-64647"]}}, {"ruleId": "scanner-47c47d421642ee2e", "level": "warning", "message": {"text": "CVE-2026-64648: next 15.5.10 \u2014 yarn.lock"}, "properties": {"repobilityId": "822d68d7d781e634", "scanner": "scanner-primary", "fingerprint": "47c47d421642ee2e", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-64648"]}}, {"ruleId": "scanner-aa0bcbf47e1493aa", "level": "warning", "message": {"text": "CVE-2026-94484: next 15.5.10 \u2014 yarn.lock"}, "properties": {"repobilityId": "27f830a1d7b26f61", "scanner": "scanner-primary", "fingerprint": "aa0bcbf47e1493aa", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-94484"]}}, {"ruleId": "scanner-f2d772f0787a8537", "level": "warning", "message": {"text": "CVE-2026-94543: next 15.5.10 \u2014 yarn.lock"}, "properties": {"repobilityId": "10f74c301d43db25", "scanner": "scanner-primary", "fingerprint": "f2d772f0787a8537", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-94543"]}}, {"ruleId": "scanner-58a851356348be37", "level": "note", "message": {"text": "CVE-2026-44572: next 15.5.10 \u2014 yarn.lock"}, "properties": {"repobilityId": "4b275de5236477b5", "scanner": "scanner-primary", "fingerprint": "58a851356348be37", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44572"]}}, {"ruleId": "scanner-2104590a9f0d24e5", "level": "note", "message": {"text": "CVE-2026-44582: next 15.5.10 \u2014 yarn.lock"}, "properties": {"repobilityId": "a0e0368f7d24ec41", "scanner": "scanner-primary", "fingerprint": "2104590a9f0d24e5", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44582"]}}, {"ruleId": "scanner-fd307d9b59b856cc", "level": "error", "message": {"text": "CVE-2026-33891: node-forge 1.3.2 \u2014 yarn.lock"}, "properties": {"repobilityId": "63f4a4c7859b7874", "scanner": "scanner-primary", "fingerprint": "fd307d9b59b856cc", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-33891"]}}, {"ruleId": "scanner-592ccea91377b459", "level": "error", "message": {"text": "CVE-2026-33894: node-forge 1.3.2 \u2014 yarn.lock"}, "properties": {"repobilityId": "1b845fc7bd2b743b", "scanner": "scanner-primary", "fingerprint": "592ccea91377b459", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-33894"]}}, {"ruleId": "scanner-d1acfd87fd38b502", "level": "error", "message": {"text": "CVE-2026-33895: node-forge 1.3.2 \u2014 yarn.lock"}, "properties": {"repobilityId": "26b7d1b42c9a7b96", "scanner": "scanner-primary", "fingerprint": "d1acfd87fd38b502", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-33895"]}}, {"ruleId": "scanner-68354bc26b4fbc18", "level": "error", "message": {"text": "CVE-2026-33896: node-forge 1.3.2 \u2014 yarn.lock"}, "properties": {"repobilityId": "8c5fb6cabf75dded", "scanner": "scanner-primary", "fingerprint": "68354bc26b4fbc18", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-33896"]}}, {"ruleId": "scanner-363a837706bdd091", "level": "error", "message": {"text": "CVE-2026-85393: node-forge 1.3.2 \u2014 yarn.lock"}, "properties": {"repobilityId": "57445bf85ac0eda2", "scanner": "scanner-primary", "fingerprint": "363a837706bdd091", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-85393"]}}, {"ruleId": "scanner-855ac6a8d6464a27", "level": "error", "message": {"text": "CVE-2026-4926: path-to-regexp 8.1.0 \u2014 yarn.lock"}, "properties": {"repobilityId": "7d0961c7a3623316", "scanner": "scanner-primary", "fingerprint": "855ac6a8d6464a27", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-4926"]}}, {"ruleId": "scanner-75e457e2385e096c", "level": "warning", "message": {"text": "CVE-2026-4923: path-to-regexp 8.1.0 \u2014 yarn.lock"}, "properties": {"repobilityId": "8ebe5d07bfe5eae2", "scanner": "scanner-primary", "fingerprint": "75e457e2385e096c", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-4923"]}}, {"ruleId": "scanner-e8fdc862330341b7", "level": "warning", "message": {"text": "CVE-2026-56812: phoenix 1.6.15 \u2014 yarn.lock"}, "properties": {"repobilityId": "ca53e238d869edc4", "scanner": "scanner-primary", "fingerprint": "e8fdc862330341b7", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-56812"]}}, {"ruleId": "scanner-8eb6d146010644ec", "level": "error", "message": {"text": "CVE-2026-33671: picomatch 2.3.1 \u2014 yarn.lock"}, "properties": {"repobilityId": "30b8a7775409ac86", "scanner": "scanner-primary", "fingerprint": "8eb6d146010644ec", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-33671"]}}, {"ruleId": "scanner-667011c5e0fdd11a", "level": "warning", "message": {"text": "CVE-2026-33672: picomatch 2.3.1 \u2014 yarn.lock"}, "properties": {"repobilityId": "87049301548e072b", "scanner": "scanner-primary", "fingerprint": "667011c5e0fdd11a", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-33672"]}}, {"ruleId": "scanner-6c1951d53aecdceb", "level": "error", "message": {"text": "CVE-2026-45623: postcss 8.4.31 \u2014 yarn.lock"}, "properties": {"repobilityId": "f418cdf2ab5081df", "scanner": "scanner-primary", "fingerprint": "6c1951d53aecdceb", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-45623"]}}, {"ruleId": "scanner-a8be87c44852218a", "level": "error", "message": {"text": "CVE-2026-73646: postcss 8.4.31 \u2014 yarn.lock"}, "properties": {"repobilityId": "292ed0077b07f330", "scanner": "scanner-primary", "fingerprint": "a8be87c44852218a", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-73646"]}}, {"ruleId": "scanner-e98fd9bdbab04beb", "level": "warning", "message": {"text": "CVE-2026-41305: postcss 8.4.31 \u2014 yarn.lock"}, "properties": {"repobilityId": "339b31bad25e0122", "scanner": "scanner-primary", "fingerprint": "e98fd9bdbab04beb", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-41305"]}}, {"ruleId": "scanner-693bc5372f5e8ae9", "level": "warning", "message": {"text": "CVE-2026-69153: postcss 8.4.31 \u2014 yarn.lock"}, "properties": {"repobilityId": "6452fe4820ae00e5", "scanner": "scanner-primary", "fingerprint": "693bc5372f5e8ae9", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-69153"]}}, {"ruleId": "scanner-0481e4d8b73a642b", "level": "error", "message": {"text": "CVE-2026-45623: postcss 8.5.6 \u2014 yarn.lock"}, "properties": {"repobilityId": "f418cdf2ab5081df", "scanner": "scanner-primary", "fingerprint": "0481e4d8b73a642b", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-45623"]}}, {"ruleId": "scanner-f2e700a2a4e4f27d", "level": "error", "message": {"text": "CVE-2026-73646: postcss 8.5.6 \u2014 yarn.lock"}, "properties": {"repobilityId": "292ed0077b07f330", "scanner": "scanner-primary", "fingerprint": "f2e700a2a4e4f27d", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-73646"]}}, {"ruleId": "scanner-e15dc09be0d0667e", "level": "warning", "message": {"text": "CVE-2026-41305: postcss 8.5.6 \u2014 yarn.lock"}, "properties": {"repobilityId": "339b31bad25e0122", "scanner": "scanner-primary", "fingerprint": "e15dc09be0d0667e", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-41305"]}}, {"ruleId": "scanner-1d1b51e97f2e4856", "level": "warning", "message": {"text": "CVE-2026-69153: postcss 8.5.6 \u2014 yarn.lock"}, "properties": {"repobilityId": "6452fe4820ae00e5", "scanner": "scanner-primary", "fingerprint": "1d1b51e97f2e4856", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-69153"]}}, {"ruleId": "scanner-3048640810c362a7", "level": "error", "message": {"text": "CVE-2026-22028: preact 10.27.2 \u2014 yarn.lock"}, "properties": {"repobilityId": "e258a17373034e88", "scanner": "scanner-primary", "fingerprint": "3048640810c362a7", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-22028"]}}, {"ruleId": "scanner-580219bb5c4b8d72", "level": "error", "message": {"text": "CVE-2026-41242: protobufjs 7.2.5 \u2014 yarn.lock"}, "properties": {"repobilityId": "8b885f2af7995cf0", "scanner": "scanner-primary", "fingerprint": "580219bb5c4b8d72", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-41242"]}}, {"ruleId": "scanner-6601e828c2edca1c", "level": "error", "message": {"text": "CVE-2026-44289: protobufjs 7.2.5 \u2014 yarn.lock"}, "properties": {"repobilityId": "5dce1fe93368d8f6", "scanner": "scanner-primary", "fingerprint": "6601e828c2edca1c", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44289"]}}, {"ruleId": "scanner-c19298ad34b4f693", "level": "error", "message": {"text": "CVE-2026-44290: protobufjs 7.2.5 \u2014 yarn.lock"}, "properties": {"repobilityId": "d8ec0a1c2b15162e", "scanner": "scanner-primary", "fingerprint": "c19298ad34b4f693", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44290"]}}, {"ruleId": "scanner-35535ee4051eec45", "level": "error", "message": {"text": "CVE-2026-44291: protobufjs 7.2.5 \u2014 yarn.lock"}, "properties": {"repobilityId": "689c468c2223f49d", "scanner": "scanner-primary", "fingerprint": "35535ee4051eec45", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44291"]}}, {"ruleId": "scanner-b468cf223185f439", "level": "error", "message": {"text": "CVE-2026-44293: protobufjs 7.2.5 \u2014 yarn.lock"}, "properties": {"repobilityId": "fadb742d232fac41", "scanner": "scanner-primary", "fingerprint": "b468cf223185f439", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44293"]}}, {"ruleId": "scanner-133107001edec2af", "level": "error", "message": {"text": "CVE-2026-48712: protobufjs 7.2.5 \u2014 yarn.lock"}, "properties": {"repobilityId": "7369118a9cb0e7a7", "scanner": "scanner-primary", "fingerprint": "133107001edec2af", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-48712"]}}, {"ruleId": "scanner-13c9db904b5a20b0", "level": "warning", "message": {"text": "CVE-2026-44288: protobufjs 7.2.5 \u2014 yarn.lock"}, "properties": {"repobilityId": "74689c4f61691395", "scanner": "scanner-primary", "fingerprint": "13c9db904b5a20b0", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44288"]}}, {"ruleId": "scanner-54368280d2bc056c", "level": "warning", "message": {"text": "CVE-2026-44292: protobufjs 7.2.5 \u2014 yarn.lock"}, "properties": {"repobilityId": "f390eaa8492c3b60", "scanner": "scanner-primary", "fingerprint": "54368280d2bc056c", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44292"]}}, {"ruleId": "scanner-6cda706cc5dd57f2", "level": "warning", "message": {"text": "CVE-2026-44294: protobufjs 7.2.5 \u2014 yarn.lock"}, "properties": {"repobilityId": "48d0d9eb6f714167", "scanner": "scanner-primary", "fingerprint": "6cda706cc5dd57f2", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44294"]}}, {"ruleId": "scanner-41c428ef0cbe0062", "level": "warning", "message": {"text": "CVE-2026-45740: protobufjs 7.2.5 \u2014 yarn.lock"}, "properties": {"repobilityId": "f3f49d131e9cce28", "scanner": "scanner-primary", "fingerprint": "41c428ef0cbe0062", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-45740"]}}, {"ruleId": "scanner-7f55cf5e1bee2283", "level": "warning", "message": {"text": "CVE-2026-54269: protobufjs 7.2.5 \u2014 yarn.lock"}, "properties": {"repobilityId": "77ab403d7da2f1bd", "scanner": "scanner-primary", "fingerprint": "7f55cf5e1bee2283", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-54269"]}}, {"ruleId": "scanner-bd74496361cd6aaf", "level": "error", "message": {"text": "CVE-2026-41242: protobufjs 7.3.2 \u2014 yarn.lock"}, "properties": {"repobilityId": "8b885f2af7995cf0", "scanner": "scanner-primary", "fingerprint": "bd74496361cd6aaf", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-41242"]}}, {"ruleId": "scanner-9e2abca1abaefcc5", "level": "error", "message": {"text": "CVE-2026-44289: protobufjs 7.3.2 \u2014 yarn.lock"}, "properties": {"repobilityId": "5dce1fe93368d8f6", "scanner": "scanner-primary", "fingerprint": "9e2abca1abaefcc5", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44289"]}}, {"ruleId": "scanner-3690eaf90bfb3fd6", "level": "error", "message": {"text": "CVE-2026-44290: protobufjs 7.3.2 \u2014 yarn.lock"}, "properties": {"repobilityId": "d8ec0a1c2b15162e", "scanner": "scanner-primary", "fingerprint": "3690eaf90bfb3fd6", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44290"]}}, {"ruleId": "scanner-c3e513f9cac03344", "level": "error", "message": {"text": "CVE-2026-44291: protobufjs 7.3.2 \u2014 yarn.lock"}, "properties": {"repobilityId": "689c468c2223f49d", "scanner": "scanner-primary", "fingerprint": "c3e513f9cac03344", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44291"]}}, {"ruleId": "scanner-0a318d920d9a5243", "level": "error", "message": {"text": "CVE-2026-44293: protobufjs 7.3.2 \u2014 yarn.lock"}, "properties": {"repobilityId": "fadb742d232fac41", "scanner": "scanner-primary", "fingerprint": "0a318d920d9a5243", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44293"]}}, {"ruleId": "scanner-35e25072aff917ba", "level": "error", "message": {"text": "CVE-2026-48712: protobufjs 7.3.2 \u2014 yarn.lock"}, "properties": {"repobilityId": "7369118a9cb0e7a7", "scanner": "scanner-primary", "fingerprint": "35e25072aff917ba", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-48712"]}}, {"ruleId": "scanner-fee4d6ffbdafd572", "level": "warning", "message": {"text": "CVE-2026-44288: protobufjs 7.3.2 \u2014 yarn.lock"}, "properties": {"repobilityId": "74689c4f61691395", "scanner": "scanner-primary", "fingerprint": "fee4d6ffbdafd572", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44288"]}}, {"ruleId": "scanner-f00a1128919ad247", "level": "warning", "message": {"text": "CVE-2026-44292: protobufjs 7.3.2 \u2014 yarn.lock"}, "properties": {"repobilityId": "f390eaa8492c3b60", "scanner": "scanner-primary", "fingerprint": "f00a1128919ad247", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44292"]}}, {"ruleId": "scanner-1a7015de02e664a1", "level": "warning", "message": {"text": "CVE-2026-44294: protobufjs 7.3.2 \u2014 yarn.lock"}, "properties": {"repobilityId": "48d0d9eb6f714167", "scanner": "scanner-primary", "fingerprint": "1a7015de02e664a1", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44294"]}}, {"ruleId": "scanner-a512229ff675ffc2", "level": "warning", "message": {"text": "CVE-2026-45740: protobufjs 7.3.2 \u2014 yarn.lock"}, "properties": {"repobilityId": "f3f49d131e9cce28", "scanner": "scanner-primary", "fingerprint": "a512229ff675ffc2", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-45740"]}}, {"ruleId": "scanner-f6541103ba63cdaa", "level": "warning", "message": {"text": "CVE-2026-54269: protobufjs 7.3.2 \u2014 yarn.lock"}, "properties": {"repobilityId": "77ab403d7da2f1bd", "scanner": "scanner-primary", "fingerprint": "f6541103ba63cdaa", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-54269"]}}, {"ruleId": "scanner-7150a6ebf95026f8", "level": "error", "message": {"text": "GHSA-f88m-g3jw-g9cj: sharp 0.34.3 \u2014 yarn.lock"}, "properties": {"repobilityId": "cd3bce551301762f", "scanner": "scanner-primary", "fingerprint": "7150a6ebf95026f8", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-f88m-g3jw-g9cj"]}}, {"ruleId": "scanner-45313d897d774551", "level": "error", "message": {"text": "GHSA-rgj7-g3m4-5g8c: sharp 0.34.3 \u2014 yarn.lock"}, "properties": {"repobilityId": "ac95becd1d36c134", "scanner": "scanner-primary", "fingerprint": "45313d897d774551", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-rgj7-g3m4-5g8c"]}}, {"ruleId": "scanner-fafee1132e471e83", "level": "error", "message": {"text": "GHSA-wq5f-xc86-pv6w: sharp 0.34.3 \u2014 yarn.lock"}, "properties": {"repobilityId": "3968bde3a760f1bd", "scanner": "scanner-primary", "fingerprint": "fafee1132e471e83", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-wq5f-xc86-pv6w"]}}, {"ruleId": "scanner-37c4b9b569d09c38", "level": "error", "message": {"text": "CVE-2026-33151: socket.io-parser 4.2.4 \u2014 yarn.lock"}, "properties": {"repobilityId": "3b3087fd1a8ec733", "scanner": "scanner-primary", "fingerprint": "37c4b9b569d09c38", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-33151"]}}, {"ruleId": "scanner-acb9a0a02f5cec72", "level": "error", "message": {"text": "CVE-2026-69185: socket.io-parser 4.2.4 \u2014 yarn.lock"}, "properties": {"repobilityId": "a6202949da323407", "scanner": "scanner-primary", "fingerprint": "acb9a0a02f5cec72", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-69185"]}}, {"ruleId": "scanner-d18c5897bc5fdc15", "level": "error", "message": {"text": "CVE-2026-93749: source-map-js 1.2.1 \u2014 yarn.lock"}, "properties": {"repobilityId": "c010c58ab086de8f", "scanner": "scanner-primary", "fingerprint": "d18c5897bc5fdc15", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-93749"]}}, {"ruleId": "scanner-4fe334a2dc01e12e", "level": "warning", "message": {"text": "CVE-2026-104182: stream-json 1.9.1 \u2014 yarn.lock"}, "properties": {"repobilityId": "21c625a424160852", "scanner": "scanner-primary", "fingerprint": "4fe334a2dc01e12e", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-104182"]}}, {"ruleId": "scanner-9acd2e15ba41f763", "level": "warning", "message": {"text": "CVE-2026-104183: stream-json 1.9.1 \u2014 yarn.lock"}, "properties": {"repobilityId": "11e490dacb335759", "scanner": "scanner-primary", "fingerprint": "9acd2e15ba41f763", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-104183"]}}, {"ruleId": "scanner-864112d1b3d7f130", "level": "warning", "message": {"text": "CVE-2026-71429: stream-json 1.9.1 \u2014 yarn.lock"}, "properties": {"repobilityId": "f7ac250ff6fb2032", "scanner": "scanner-primary", "fingerprint": "864112d1b3d7f130", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-71429"]}}, {"ruleId": "scanner-1560f8b0c7671adf", "level": "error", "message": {"text": "CVE-2026-12151: undici 6.21.3 \u2014 yarn.lock"}, "properties": {"repobilityId": "043eac6070c27c2c", "scanner": "scanner-primary", "fingerprint": "1560f8b0c7671adf", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-12151"]}}, {"ruleId": "scanner-bfca7cef3aa28222", "level": "error", "message": {"text": "CVE-2026-1526: undici 6.21.3 \u2014 yarn.lock"}, "properties": {"repobilityId": "d01780a328cd95e9", "scanner": "scanner-primary", "fingerprint": "bfca7cef3aa28222", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-1526"]}}, {"ruleId": "scanner-a9816a4ab384bdae", "level": "error", "message": {"text": "CVE-2026-1528: undici 6.21.3 \u2014 yarn.lock"}, "properties": {"repobilityId": "7f97c67b9e252ad3", "scanner": "scanner-primary", "fingerprint": "a9816a4ab384bdae", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-1528"]}}, {"ruleId": "scanner-04d670202bf9d46d", "level": "error", "message": {"text": "CVE-2026-19534: undici 6.21.3 \u2014 yarn.lock"}, "properties": {"repobilityId": "32aa44e14582a782", "scanner": "scanner-primary", "fingerprint": "04d670202bf9d46d", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-19534"]}}, {"ruleId": "scanner-b3d8ff2eb14eab6a", "level": "error", "message": {"text": "CVE-2026-2229: undici 6.21.3 \u2014 yarn.lock"}, "properties": {"repobilityId": "57b876062e438b51", "scanner": "scanner-primary", "fingerprint": "b3d8ff2eb14eab6a", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-2229"]}}, {"ruleId": "scanner-7adcb58e3251fc1c", "level": "warning", "message": {"text": "CVE-2026-15157: undici 6.21.3 \u2014 yarn.lock"}, "properties": {"repobilityId": "f8fb482b9aaad126", "scanner": "scanner-primary", "fingerprint": "7adcb58e3251fc1c", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-15157"]}}, {"ruleId": "scanner-a601bae8eca9a1b2", "level": "warning", "message": {"text": "CVE-2026-1525: undici 6.21.3 \u2014 yarn.lock"}, "properties": {"repobilityId": "208a0f05f5b2b849", "scanner": "scanner-primary", "fingerprint": "a601bae8eca9a1b2", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-1525"]}}, {"ruleId": "scanner-5d187951fa4cb37e", "level": "warning", "message": {"text": "CVE-2026-1527: undici 6.21.3 \u2014 yarn.lock"}, "properties": {"repobilityId": "1b259a2d6400f760", "scanner": "scanner-primary", "fingerprint": "5d187951fa4cb37e", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-1527"]}}, {"ruleId": "scanner-35669d712f34cf7c", "level": "warning", "message": {"text": "CVE-2026-16728: undici 6.21.3 \u2014 yarn.lock"}, "properties": {"repobilityId": "2fba9dd08c6bbb12", "scanner": "scanner-primary", "fingerprint": "35669d712f34cf7c", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-16728"]}}, {"ruleId": "scanner-0905f1593fa9411c", "level": "warning", "message": {"text": "CVE-2026-16729: undici 6.21.3 \u2014 yarn.lock"}, "properties": {"repobilityId": "502e50243d4bee29", "scanner": "scanner-primary", "fingerprint": "0905f1593fa9411c", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-16729"]}}, {"ruleId": "scanner-ba0ec2e0f202ec7e", "level": "warning", "message": {"text": "CVE-2026-22036: undici 6.21.3 \u2014 yarn.lock"}, "properties": {"repobilityId": "ba541e598e52468a", "scanner": "scanner-primary", "fingerprint": "ba0ec2e0f202ec7e", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-22036"]}}, {"ruleId": "scanner-ba40a31259d151d6", "level": "warning", "message": {"text": "CVE-2026-9679: undici 6.21.3 \u2014 yarn.lock"}, "properties": {"repobilityId": "2b1fe1b9f9d1ec9a", "scanner": "scanner-primary", "fingerprint": "ba40a31259d151d6", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-9679"]}}, {"ruleId": "scanner-58bc1dd8caf8ba00", "level": "note", "message": {"text": "CVE-2026-11525: undici 6.21.3 \u2014 yarn.lock"}, "properties": {"repobilityId": "3e3a516f335887dc", "scanner": "scanner-primary", "fingerprint": "58bc1dd8caf8ba00", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-11525"]}}, {"ruleId": "scanner-0098c3e48f18d109", "level": "note", "message": {"text": "CVE-2026-18540: undici 6.21.3 \u2014 yarn.lock"}, "properties": {"repobilityId": "b138ebe3f4fdbd98", "scanner": "scanner-primary", "fingerprint": "0098c3e48f18d109", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-18540"]}}, {"ruleId": "scanner-88b34eeee3ed3a9d", "level": "note", "message": {"text": "CVE-2026-6733: undici 6.21.3 \u2014 yarn.lock"}, "properties": {"repobilityId": "2543a9af5697c0e5", "scanner": "scanner-primary", "fingerprint": "88b34eeee3ed3a9d", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-6733"]}}, {"ruleId": "scanner-46002aa9abb5c54f", "level": "warning", "message": {"text": "CVE-2026-41907: uuid 8.3.2 \u2014 yarn.lock"}, "properties": {"repobilityId": "e2acaa3ad33751c7", "scanner": "scanner-primary", "fingerprint": "46002aa9abb5c54f", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-41907"]}}, {"ruleId": "scanner-9b2e3c18b7e07a01", "level": "warning", "message": {"text": "CVE-2026-41907: uuid 9.0.1 \u2014 yarn.lock"}, "properties": {"repobilityId": "e2acaa3ad33751c7", "scanner": "scanner-primary", "fingerprint": "9b2e3c18b7e07a01", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-41907"]}}, {"ruleId": "scanner-00ca8193ae54742a", "level": "warning", "message": {"text": "CVE-2026-59952: valibot 1.2.0 \u2014 yarn.lock"}, "properties": {"repobilityId": "57b02524fa8e0334", "scanner": "scanner-primary", "fingerprint": "00ca8193ae54742a", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59952"]}}, {"ruleId": "scanner-ad8f480f81462770", "level": "error", "message": {"text": "CVE-2026-48779: ws 7.5.10 \u2014 yarn.lock"}, "properties": {"repobilityId": "c7e194c4dddacae1", "scanner": "scanner-primary", "fingerprint": "ad8f480f81462770", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-48779"]}}, {"ruleId": "scanner-0c9f6eb49736293f", "level": "error", "message": {"text": "CVE-2026-48779: ws 8.17.1 \u2014 yarn.lock"}, "properties": {"repobilityId": "c7e194c4dddacae1", "scanner": "scanner-primary", "fingerprint": "0c9f6eb49736293f", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-48779"]}}, {"ruleId": "scanner-7d276b7b7bf1e466", "level": "warning", "message": {"text": "CVE-2026-45736: ws 8.17.1 \u2014 yarn.lock"}, "properties": {"repobilityId": "4f2bff8422dc1cdd", "scanner": "scanner-primary", "fingerprint": "7d276b7b7bf1e466", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-45736"]}}, {"ruleId": "scanner-eb608b90f043a6c2", "level": "error", "message": {"text": "CVE-2026-48779: ws 8.18.2 \u2014 yarn.lock"}, "properties": {"repobilityId": "c7e194c4dddacae1", "scanner": "scanner-primary", "fingerprint": "eb608b90f043a6c2", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-48779"]}}, {"ruleId": "scanner-2fc0a0bf071555e4", "level": "warning", "message": {"text": "CVE-2026-45736: ws 8.18.2 \u2014 yarn.lock"}, "properties": {"repobilityId": "4f2bff8422dc1cdd", "scanner": "scanner-primary", "fingerprint": "2fc0a0bf071555e4", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-45736"]}}, {"ruleId": "scanner-a0a170f8441ba76b", "level": "error", "message": {"text": "CVE-2026-48779: ws 8.18.3 \u2014 yarn.lock"}, "properties": {"repobilityId": "c7e194c4dddacae1", "scanner": "scanner-primary", "fingerprint": "a0a170f8441ba76b", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-48779"]}}, {"ruleId": "scanner-e393613925a458f0", "level": "warning", "message": {"text": "CVE-2026-45736: ws 8.18.3 \u2014 yarn.lock"}, "properties": {"repobilityId": "4f2bff8422dc1cdd", "scanner": "scanner-primary", "fingerprint": "e393613925a458f0", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-45736"]}}, {"ruleId": "scanner-254d4cc9e2930cd2", "level": "warning", "message": {"text": "CVE-2026-33532: yaml 1.10.2 \u2014 yarn.lock"}, "properties": {"repobilityId": "951db27b12f79a8b", "scanner": "scanner-primary", "fingerprint": "254d4cc9e2930cd2", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-33532"]}}, {"ruleId": "scanner-72ff79e0f8219b60", "level": "warning", "message": {"text": "DS-0013: 'RUN cd ...' to change directory \u2014 Dockerfile"}, "properties": {"repobilityId": "975852f52ce6eb22", "scanner": "scanner-primary", "fingerprint": "72ff79e0f8219b60", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-ecdad6dd24b35793", "level": "error", "message": {"text": "DS-0025: 'apk add' is missing '--no-cache' \u2014 Dockerfile"}, "properties": {"repobilityId": "11c314d19a9be40b", "scanner": "scanner-primary", "fingerprint": "ecdad6dd24b35793", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-3c4041c454cda88e", "level": "note", "message": {"text": "DS-0026: No HEALTHCHECK defined \u2014 Dockerfile"}, "properties": {"repobilityId": "da995bb2cfa21f65", "scanner": "scanner-primary", "fingerprint": "3c4041c454cda88e", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-e71bf15a11ae5bac", "level": "warning", "message": {"text": "Secret leak: JWT token \u2014 playwright/fixtures/rewards.ts"}, "properties": {"repobilityId": "e4e0d32e2122736b", "scanner": "scanner-primary", "fingerprint": "e71bf15a11ae5bac", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "secret"]}}, {"ruleId": "scanner-1bd0c17b30417b2f", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .cursor/mcp.json"}, "properties": {"repobilityId": "dd739e66f2986b13", "scanner": "scanner-primary", "fingerprint": "1bd0c17b30417b2f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "mcp_config"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".cursor/mcp.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9a5c0be8a5b51c9d", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .cursor/commands/prepare-release.md"}, "properties": {"repobilityId": "1cc438afc64006c0", "scanner": "scanner-primary", "fingerprint": "9a5c0be8a5b51c9d", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "cursor_rule"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".cursor/commands/prepare-release.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-bd2de54cfacd54e6", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .cursor/commands/get-checks-status.md"}, "properties": {"repobilityId": "cf8cac13e69d335c", "scanner": "scanner-primary", "fingerprint": "bd2de54cfacd54e6", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "cursor_rule"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".cursor/commands/get-checks-status.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8e280d936ac9c991", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .cursor/commands/deploy-demo.md"}, "properties": {"repobilityId": "238ccae203e50695", "scanner": "scanner-primary", "fingerprint": "8e280d936ac9c991", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "cursor_rule"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".cursor/commands/deploy-demo.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7273992ac051fe63", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: node:22.14.0-alpine"}, "properties": {"repobilityId": "d8ed902fe6575c9e", "scanner": "scanner-primary", "fingerprint": "7273992ac051fe63", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Dockerfile"}, "region": {"startLine": 4}}}]}, {"ruleId": "scanner-aa5acaa49eb8315b", "level": "note", "message": {"text": "Containers defined but no K8s/orchestration manifest found"}, "properties": {"repobilityId": "b230ea9b68736081", "scanner": "scanner-primary", "fingerprint": "aa5acaa49eb8315b", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["coverage", "deployment"]}}, {"ruleId": "scanner-944494b2302c88e3", "level": "warning", "message": {"text": "Runtime dotenv file present in repo: configs/envs/.env.main"}, "properties": {"repobilityId": "24548eed0912fd8f", "scanner": "scanner-primary", "fingerprint": "944494b2302c88e3", "layer": "security", "severity": "medium", "confidence": 0.65, "tags": ["secrets", "config", "env-file", "runtime-env"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "configs/envs/.env.main"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-90dbd29fbbc03d88", "level": "warning", "message": {"text": "Runtime dotenv file present in repo: configs/envs/.env.neon_devnet"}, "properties": {"repobilityId": "7057d078fd9e50f6", "scanner": "scanner-primary", "fingerprint": "90dbd29fbbc03d88", "layer": "security", "severity": "medium", "confidence": 0.65, "tags": ["secrets", "config", "env-file", "runtime-env"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "configs/envs/.env.neon_devnet"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a800531d49ef4572", "level": "warning", "message": {"text": "Runtime dotenv file present in repo: configs/envs/.env.eth_sepolia"}, "properties": {"repobilityId": "6baa7382c97ab178", "scanner": "scanner-primary", "fingerprint": "a800531d49ef4572", "layer": "security", "severity": "medium", "confidence": 0.65, "tags": ["secrets", "config", "env-file", "runtime-env"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "configs/envs/.env.eth_sepolia"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-fe07c9f8fc819d0a", "level": "warning", "message": {"text": "Runtime dotenv file present in repo: configs/envs/.env.rootstock_testnet"}, "properties": {"repobilityId": "8840ba2f56447259", "scanner": "scanner-primary", "fingerprint": "fe07c9f8fc819d0a", "layer": "security", "severity": "medium", "confidence": 0.65, "tags": ["secrets", "config", "env-file", "runtime-env"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "configs/envs/.env.rootstock_testnet"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ce27c046b7562dba", "level": "warning", "message": {"text": "Runtime dotenv file present in repo: configs/envs/.env.pw"}, "properties": {"repobilityId": "1a0faab3259a568c", "scanner": "scanner-primary", "fingerprint": "ce27c046b7562dba", "layer": "security", "severity": "medium", "confidence": 0.65, "tags": ["secrets", "config", "env-file", "runtime-env"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "configs/envs/.env.pw"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5deec18807cdf733", "level": "warning", "message": {"text": "Runtime dotenv file present in repo: configs/envs/.env.optimism"}, "properties": {"repobilityId": "4420e4a0ff254680", "scanner": "scanner-primary", "fingerprint": "5deec18807cdf733", "layer": "security", "severity": "medium", "confidence": 0.65, "tags": ["secrets", "config", "env-file", "runtime-env"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "configs/envs/.env.optimism"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9005aa7e4901f385", "level": "warning", "message": {"text": "Runtime dotenv file present in repo: configs/envs/.env.garnet"}, "properties": {"repobilityId": "e8dc6069a37db671", "scanner": "scanner-primary", "fingerprint": "9005aa7e4901f385", "layer": "security", "severity": "medium", "confidence": 0.65, "tags": ["secrets", "config", "env-file", "runtime-env"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "configs/envs/.env.garnet"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7ce8037fe0d68f5e", "level": "warning", "message": {"text": "Runtime dotenv file present in repo: configs/envs/.env.polygon"}, "properties": {"repobilityId": "501f6a4c64665048", "scanner": "scanner-primary", "fingerprint": "7ce8037fe0d68f5e", "layer": "security", "severity": "medium", "confidence": 0.65, "tags": ["secrets", "config", "env-file", "runtime-env"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "configs/envs/.env.polygon"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6078fc6c53315a5b", "level": "warning", "message": {"text": "Runtime dotenv file present in repo: configs/envs/.env.arbitrum_nova"}, "properties": {"repobilityId": "57e99ffdd1bec60e", "scanner": "scanner-primary", "fingerprint": "6078fc6c53315a5b", "layer": "security", "severity": "medium", "confidence": 0.65, "tags": ["secrets", "config", "env-file", "runtime-env"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "configs/envs/.env.arbitrum_nova"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-cd00dc83ad020881", "level": "warning", "message": {"text": "Runtime dotenv file present in repo: configs/envs/.env.gnosis"}, "properties": {"repobilityId": "28a80bfc7f47e5c6", "scanner": "scanner-primary", "fingerprint": "cd00dc83ad020881", "layer": "security", "severity": "medium", "confidence": 0.65, "tags": ["secrets", "config", "env-file", "runtime-env"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "configs/envs/.env.gnosis"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5b48d9438ec72607", "level": "warning", "message": {"text": "Runtime dotenv file present in repo: configs/envs/.env.mega_eth"}, "properties": {"repobilityId": "6b49c2be89f297c5", "scanner": "scanner-primary", "fingerprint": "5b48d9438ec72607", "layer": "security", "severity": "medium", "confidence": 0.65, "tags": ["secrets", "config", "env-file", "runtime-env"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "configs/envs/.env.mega_eth"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-42eec27c27dfb009", "level": "warning", "message": {"text": "Runtime dotenv file present in repo: configs/envs/.env.mekong"}, "properties": {"repobilityId": "0c3082aa7ab702cf", "scanner": "scanner-primary", "fingerprint": "42eec27c27dfb009", "layer": "security", "severity": "medium", "confidence": 0.65, "tags": ["secrets", "config", "env-file", "runtime-env"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "configs/envs/.env.mekong"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f69b5573ab866d2e", "level": "warning", "message": {"text": "Runtime dotenv file present in repo: configs/envs/.env.scroll_sepolia"}, "properties": {"repobilityId": "373a0ec931a2cdfc", "scanner": "scanner-primary", "fingerprint": "f69b5573ab866d2e", "layer": "security", "severity": "medium", "confidence": 0.65, "tags": ["secrets", "config", "env-file", "runtime-env"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "configs/envs/.env.scroll_sepolia"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-db69d35afb7a1a5f", "level": "warning", "message": {"text": "Runtime dotenv file present in repo: configs/envs/.env.vitest"}, "properties": {"repobilityId": "d9fb5fb7e86e51f8", "scanner": "scanner-primary", "fingerprint": "db69d35afb7a1a5f", "layer": "security", "severity": "medium", "confidence": 0.65, "tags": ["secrets", "config", "env-file", "runtime-env"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "configs/envs/.env.vitest"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2b0e1ad9e0010439", "level": "warning", "message": {"text": "Runtime dotenv file present in repo: configs/envs/.env.zetachain_testnet"}, "properties": {"repobilityId": "7466ab5ddd5f67f4", "scanner": "scanner-primary", "fingerprint": "2b0e1ad9e0010439", "layer": "security", "severity": "medium", "confidence": 0.65, "tags": ["secrets", "config", "env-file", "runtime-env"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "configs/envs/.env.zetachain_testnet"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b757b88f9204b2d8", "level": "warning", "message": {"text": "Runtime dotenv file present in repo: configs/envs/.env.zora"}, "properties": {"repobilityId": "811aee2c0d40b971", "scanner": "scanner-primary", "fingerprint": "b757b88f9204b2d8", "layer": "security", "severity": "medium", "confidence": 0.65, "tags": ["secrets", "config", "env-file", "runtime-env"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "configs/envs/.env.zora"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a8240fc30f2f604d", "level": "warning", "message": {"text": "Runtime dotenv file present in repo: configs/envs/.env.optimism_sepolia"}, "properties": {"repobilityId": "7d39212b9cd7ae93", "scanner": "scanner-primary", "fingerprint": "a8240fc30f2f604d", "layer": "security", "severity": "medium", "confidence": 0.65, "tags": ["secrets", "config", "env-file", "runtime-env"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "configs/envs/.env.optimism_sepolia"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2cf7771d0d14938e", "level": "warning", "message": {"text": "Runtime dotenv file present in repo: configs/envs/.env.filecoin"}, "properties": {"repobilityId": "945e2a3d884346c5", "scanner": "scanner-primary", "fingerprint": "2cf7771d0d14938e", "layer": "security", "severity": "medium", "confidence": 0.65, "tags": ["secrets", "config", "env-file", "runtime-env"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "configs/envs/.env.filecoin"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-dfce6069a60d02dc", "level": "warning", "message": {"text": "Runtime dotenv file present in repo: configs/envs/.env.optimism_interop_0"}, "properties": {"repobilityId": "efc648f7bbc1ad1a", "scanner": "scanner-primary", "fingerprint": "dfce6069a60d02dc", "layer": "security", "severity": "medium", "confidence": 0.65, "tags": ["secrets", "config", "env-file", "runtime-env"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "configs/envs/.env.optimism_interop_0"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-36327ed33bae6dfa", "level": "warning", "message": {"text": "Runtime dotenv file present in repo: configs/envs/.env.zksync"}, "properties": {"repobilityId": "d16bcdb1f27404a6", "scanner": "scanner-primary", "fingerprint": "36327ed33bae6dfa", "layer": "security", "severity": "medium", "confidence": 0.65, "tags": ["secrets", "config", "env-file", "runtime-env"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "configs/envs/.env.zksync"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1742dcfd11d0f8bf", "level": "warning", "message": {"text": "Runtime dotenv file present in repo: configs/envs/.env.tac_spb"}, "properties": {"repobilityId": "62c5a97cfc2e1b14", "scanner": "scanner-primary", "fingerprint": "1742dcfd11d0f8bf", "layer": "security", "severity": "medium", "confidence": 0.65, "tags": ["secrets", "config", "env-file", "runtime-env"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "configs/envs/.env.tac_spb"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1367eb14231fc9e1", "level": "warning", "message": {"text": "Runtime dotenv file present in repo: configs/envs/.env.zetachain"}, "properties": {"repobilityId": "fe3ce9ff0991681d", "scanner": "scanner-primary", "fingerprint": "1367eb14231fc9e1", "layer": "security", "severity": "medium", "confidence": 0.65, "tags": ["secrets", "config", "env-file", "runtime-env"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "configs/envs/.env.zetachain"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-67ec88be9023a91e", "level": "warning", "message": {"text": "Runtime dotenv file present in repo: configs/envs/.env.localhost"}, "properties": {"repobilityId": "cc5ffe6497fe6384", "scanner": "scanner-primary", "fingerprint": "67ec88be9023a91e", "layer": "security", "severity": "medium", "confidence": 0.65, "tags": ["secrets", "config", "env-file", "runtime-env"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "configs/envs/.env.localhost"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3eaefdb7f19f2e79", "level": "warning", "message": {"text": "Runtime dotenv file present in repo: configs/envs/.env.zilliqa"}, "properties": {"repobilityId": "3b7cc6399ac4db40", "scanner": "scanner-primary", "fingerprint": "3eaefdb7f19f2e79", "layer": "security", "severity": "medium", "confidence": 0.65, "tags": ["secrets", "config", "env-file", "runtime-env"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "configs/envs/.env.zilliqa"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-65a7d843da33f15c", "level": "warning", "message": {"text": "Runtime dotenv file present in repo: configs/envs/.env.arbitrum"}, "properties": {"repobilityId": "4ffdb8aea584512e", "scanner": "scanner-primary", "fingerprint": "65a7d843da33f15c", "layer": "security", "severity": "medium", "confidence": 0.65, "tags": ["secrets", "config", "env-file", "runtime-env"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "configs/envs/.env.arbitrum"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6cd285b0551d7627", "level": "warning", "message": {"text": "Runtime dotenv file present in repo: configs/envs/.env.rari_testnet"}, "properties": {"repobilityId": "bc0f7386fb34a55b", "scanner": "scanner-primary", "fingerprint": "6cd285b0551d7627", "layer": "security", "severity": "medium", "confidence": 0.65, "tags": ["secrets", "config", "env-file", "runtime-env"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "configs/envs/.env.rari_testnet"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7fa10f3534aec598", "level": "warning", "message": {"text": "Runtime dotenv file present in repo: configs/envs/.env.tac"}, "properties": {"repobilityId": "5f36428d432a3191", "scanner": "scanner-primary", "fingerprint": "7fa10f3534aec598", "layer": "security", "severity": "medium", "confidence": 0.65, "tags": ["secrets", "config", "env-file", "runtime-env"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "configs/envs/.env.tac"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6405bdb2a925e186", "level": "warning", "message": {"text": "Runtime dotenv file present in repo: configs/envs/.env.arbitrum_sepolia"}, "properties": {"repobilityId": "2417ddb415aa0cd0", "scanner": "scanner-primary", "fingerprint": "6405bdb2a925e186", "layer": "security", "severity": "medium", "confidence": 0.65, "tags": ["secrets", "config", "env-file", "runtime-env"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "configs/envs/.env.arbitrum_sepolia"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8bd8689f7dfd2277", "level": "error", "message": {"text": "Runtime dotenv file present in repo: configs/envs/.env.celo_sepolia"}, "properties": {"repobilityId": "155973747eb01a89", "scanner": "scanner-primary", "fingerprint": "8bd8689f7dfd2277", "layer": "security", "severity": "critical", "confidence": 0.82, "tags": ["secrets", "config", "env-file", "runtime-env", "env_file_with_secret"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "configs/envs/.env.celo_sepolia"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-bd2383bd5485a8f3", "level": "warning", "message": {"text": "Runtime dotenv file present in repo: configs/envs/.env.zkevm"}, "properties": {"repobilityId": "5259e7972bd79821", "scanner": "scanner-primary", "fingerprint": "bd2383bd5485a8f3", "layer": "security", "severity": "medium", "confidence": 0.65, "tags": ["secrets", "config", "env-file", "runtime-env"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "configs/envs/.env.zkevm"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7f098f4259e06b4d", "level": "warning", "message": {"text": "Runtime dotenv file present in repo: configs/envs/.env.shibarium"}, "properties": {"repobilityId": "219ea1833cc43714", "scanner": "scanner-primary", "fingerprint": "7f098f4259e06b4d", "layer": "security", "severity": "medium", "confidence": 0.65, "tags": ["secrets", "config", "env-file", "runtime-env"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "configs/envs/.env.shibarium"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c4f0ae05084b371e", "level": "warning", "message": {"text": "Runtime dotenv file present in repo: configs/envs/.env.blackfort_testnet"}, "properties": {"repobilityId": "656a00ba513d9115", "scanner": "scanner-primary", "fingerprint": "c4f0ae05084b371e", "layer": "security", "severity": "medium", "confidence": 0.65, "tags": ["secrets", "config", "env-file", "runtime-env"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "configs/envs/.env.blackfort_testnet"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4789940b241c7c60", "level": "error", "message": {"text": "Runtime dotenv file present in repo: configs/envs/.env.celo"}, "properties": {"repobilityId": "7fd1a31bd212686d", "scanner": "scanner-primary", "fingerprint": "4789940b241c7c60", "layer": "security", "severity": "critical", "confidence": 0.82, "tags": ["secrets", "config", "env-file", "runtime-env", "env_file_with_secret"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "configs/envs/.env.celo"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-15d7ca302464c162", "level": "warning", "message": {"text": "Runtime dotenv file present in repo: configs/envs/.env.base"}, "properties": {"repobilityId": "8f4fe934adaa2055", "scanner": "scanner-primary", "fingerprint": "15d7ca302464c162", "layer": "security", "severity": "medium", "confidence": 0.65, "tags": ["secrets", "config", "env-file", "runtime-env"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "configs/envs/.env.base"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a78c5253a6e5cffa", "level": "warning", "message": {"text": "Runtime dotenv file present in repo: configs/envs/.env.immutable"}, "properties": {"repobilityId": "fb81a32d43500232", "scanner": "scanner-primary", "fingerprint": "a78c5253a6e5cffa", "layer": "security", "severity": "medium", "confidence": 0.65, "tags": ["secrets", "config", "env-file", "runtime-env"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "configs/envs/.env.immutable"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f8c7c96001137c46", "level": "warning", "message": {"text": "Runtime dotenv file present in repo: configs/envs/.env.eth"}, "properties": {"repobilityId": "508c182667609a6e", "scanner": "scanner-primary", "fingerprint": "f8c7c96001137c46", "layer": "security", "severity": "medium", "confidence": 0.65, "tags": ["secrets", "config", "env-file", "runtime-env"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "configs/envs/.env.eth"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3917cf243936ecab", "level": "warning", "message": {"text": "Runtime dotenv file present in repo: configs/envs/.env.stability_testnet"}, "properties": {"repobilityId": "149a97dc41d9fe8a", "scanner": "scanner-primary", "fingerprint": "3917cf243936ecab", "layer": "security", "severity": "medium", "confidence": 0.65, "tags": ["secrets", "config", "env-file", "runtime-env"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "configs/envs/.env.stability_testnet"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-af68baff5ef502d5", "level": "warning", "message": {"text": "Runtime dotenv file present in repo: configs/envs/.env.optimism_superchain"}, "properties": {"repobilityId": "9100a81fe0026164", "scanner": "scanner-primary", "fingerprint": "af68baff5ef502d5", "layer": "security", "severity": "medium", "confidence": 0.65, "tags": ["secrets", "config", "env-file", "runtime-env"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "configs/envs/.env.optimism_superchain"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7ee4dde2b7f36888", "level": "error", "message": {"text": "Possible secret in stubs/account.ts"}, "properties": {"repobilityId": "ac47cc8950ffadff", "scanner": "scanner-primary", "fingerprint": "7ee4dde2b7f36888", "layer": "security", "severity": "high", "confidence": 0.72, "tags": ["secrets", "generic_api_key"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "stubs/account.ts"}, "region": {"startLine": 53}}}]}, {"ruleId": "scanner-1b5b0e2a70e9f78d", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in ui/address/details/AddressQrCode.tsx:93"}, "properties": {"repobilityId": "f8447b24eff371fb", "scanner": "scanner-primary", "fingerprint": "1b5b0e2a70e9f78d", "layer": "security", "severity": "medium", "confidence": 0.65, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ui/address/details/AddressQrCode.tsx"}, "region": {"startLine": 93}}}]}, {"ruleId": "scanner-ef5ced18e7789380", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in ui/address/details/AddressAlerts.tsx:46"}, "properties": {"repobilityId": "ec4defa26beefafb", "scanner": "scanner-primary", "fingerprint": "ef5ced18e7789380", "layer": "security", "severity": "medium", "confidence": 0.65, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ui/address/details/AddressAlerts.tsx"}, "region": {"startLine": 46}}}]}, {"ruleId": "scanner-68ce4c841653d9b7", "level": "warning", "message": {"text": "Insecure pattern 'weak_hash' in ui/shared/entities/address/NounsIdenticon.tsx:24"}, "properties": {"repobilityId": "a41789a130d2d868", "scanner": "scanner-primary", "fingerprint": "68ce4c841653d9b7", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "weak_hash"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ui/shared/entities/address/NounsIdenticon.tsx"}, "region": {"startLine": 24}}}]}, {"ruleId": "scanner-ed4c07edfbbc9e4d", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in ui/shared/entities/address/AddressIdenticon.tsx:56"}, "properties": {"repobilityId": "4b7c995a651e5744", "scanner": "scanner-primary", "fingerprint": "ed4c07edfbbc9e4d", "layer": "security", "severity": "medium", "confidence": 0.65, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ui/shared/entities/address/AddressIdenticon.tsx"}, "region": {"startLine": 56}}}]}, {"ruleId": "scanner-0b88f55b9977eaa4", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in ui/snippets/searchBar/SearchBarSuggest/SearchBarSuggestLabel.tsx:23"}, "properties": {"repobilityId": "a45380a6edec7696", "scanner": "scanner-primary", "fingerprint": "0b88f55b9977eaa4", "layer": "security", "severity": "medium", "confidence": 0.65, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ui/snippets/searchBar/SearchBarSuggest/SearchBarSuggestLabel.tsx"}, "region": {"startLine": 23}}}]}, {"ruleId": "scanner-59356268ea8aeda7", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in ui/snippets/searchBar/SearchBarSuggest/SearchBarSuggestDomain.tsx:31"}, "properties": {"repobilityId": "72a4b17ddc7e78f9", "scanner": "scanner-primary", "fingerprint": "59356268ea8aeda7", "layer": "security", "severity": "medium", "confidence": 0.65, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ui/snippets/searchBar/SearchBarSuggest/SearchBarSuggestDomain.tsx"}, "region": {"startLine": 31}}}]}, {"ruleId": "scanner-7f4a3c3923b58e15", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in ui/snippets/searchBar/SearchBarSuggest/SearchBarSuggestCluster.tsx:34"}, "properties": {"repobilityId": "84b4880ffe65bbcb", "scanner": "scanner-primary", "fingerprint": "7f4a3c3923b58e15", "layer": "security", "severity": "medium", "confidence": 0.65, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ui/snippets/searchBar/SearchBarSuggest/SearchBarSuggestCluster.tsx"}, "region": {"startLine": 34}}}]}, {"ruleId": "scanner-2461b5ce3501d527", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in ui/snippets/searchBar/SearchBarSuggest/SearchBarSuggestApp.tsx:46"}, "properties": {"repobilityId": "32a20d001bebf174", "scanner": "scanner-primary", "fingerprint": "2461b5ce3501d527", "layer": "security", "severity": "medium", "confidence": 0.65, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ui/snippets/searchBar/SearchBarSuggest/SearchBarSuggestApp.tsx"}, "region": {"startLine": 46}}}]}, {"ruleId": "scanner-8d45cf9e32327a4f", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in ui/snippets/searchBar/SearchBarSuggest/SearchBarSuggestAddress.tsx:67"}, "properties": {"repobilityId": "9fd70a1c283b125b", "scanner": "scanner-primary", "fingerprint": "8d45cf9e32327a4f", "layer": "security", "severity": "medium", "confidence": 0.65, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ui/snippets/searchBar/SearchBarSuggest/SearchBarSuggestAddress.tsx"}, "region": {"startLine": 67}}}]}, {"ruleId": "scanner-0b970377a8b33188", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in ui/snippets/searchBar/SearchBarSuggest/SearchBarSuggestBlock.tsx:46"}, "properties": {"repobilityId": "dc0c8d8d88393bbc", "scanner": "scanner-primary", "fingerprint": "0b970377a8b33188", "layer": "security", "severity": "medium", "confidence": 0.65, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ui/snippets/searchBar/SearchBarSuggest/SearchBarSuggestBlock.tsx"}, "region": {"startLine": 46}}}]}, {"ruleId": "scanner-a889c90df71329a4", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in ui/snippets/searchBar/SearchBarSuggest/SearchBarSuggestToken.tsx:42"}, "properties": {"repobilityId": "bbadc1775ad4facf", "scanner": "scanner-primary", "fingerprint": "a889c90df71329a4", "layer": "security", "severity": "medium", "confidence": 0.65, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ui/snippets/searchBar/SearchBarSuggest/SearchBarSuggestToken.tsx"}, "region": {"startLine": 42}}}]}, {"ruleId": "scanner-03edbadd19171147", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in ui/snippets/header/alerts/MaintenanceAlert.tsx:15"}, "properties": {"repobilityId": "173765608bddf929", "scanner": "scanner-primary", "fingerprint": "03edbadd19171147", "layer": "security", "severity": "medium", "confidence": 0.65, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ui/snippets/header/alerts/MaintenanceAlert.tsx"}, "region": {"startLine": 15}}}]}, {"ruleId": "scanner-d0d8165b0f5ba4ed", "level": "note", "message": {"text": "Insecure pattern 'document_write' in ui/sol2uml/Sol2UmlDiagram.tsx:63"}, "properties": {"repobilityId": "06f4ab8c5d0a874e", "scanner": "scanner-primary", "fingerprint": "d0d8165b0f5ba4ed", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["owasp", "document_write"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ui/sol2uml/Sol2UmlDiagram.tsx"}, "region": {"startLine": 63}}}]}, {"ruleId": "scanner-6f44ba9e8b1f1217", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in ui/searchResults/SearchResultTableItem.tsx:85"}, "properties": {"repobilityId": "023eaf899cbc6a46", "scanner": "scanner-primary", "fingerprint": "6f44ba9e8b1f1217", "layer": "security", "severity": "medium", "confidence": 0.65, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ui/searchResults/SearchResultTableItem.tsx"}, "region": {"startLine": 85}}}]}, {"ruleId": "scanner-1e3756ea2c6e2a1a", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in ui/searchResults/SearchResultListItem.tsx:79"}, "properties": {"repobilityId": "197a94e962556cd9", "scanner": "scanner-primary", "fingerprint": "1e3756ea2c6e2a1a", "layer": "security", "severity": "medium", "confidence": 0.65, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ui/searchResults/SearchResultListItem.tsx"}, "region": {"startLine": 79}}}]}, {"ruleId": "scanner-169a549ae1caf603", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in ui/searchResults/SearchResultEntityTag.tsx:25"}, "properties": {"repobilityId": "d4e2150a4fa1ceae", "scanner": "scanner-primary", "fingerprint": "169a549ae1caf603", "layer": "security", "severity": "medium", "confidence": 0.65, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ui/searchResults/SearchResultEntityTag.tsx"}, "region": {"startLine": 25}}}]}, {"ruleId": "scanner-b1dd38adccc6caf1", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in public/static/capibara/index.js:458"}, "properties": {"repobilityId": "4a77f0ba436d33e9", "scanner": "scanner-primary", "fingerprint": "b1dd38adccc6caf1", "layer": "security", "severity": "medium", "confidence": 0.65, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "public/static/capibara/index.js"}, "region": {"startLine": 458}}}]}, {"ruleId": "scanner-cb639d9a10a47b23", "level": "note", "message": {"text": "package.json defines install-time lifecycle scripts"}, "properties": {"repobilityId": "714673743ff59cef", "scanner": "scanner-primary", "fingerprint": "cb639d9a10a47b23", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "npm", "install-scripts"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-804d0d16accb65ad", "level": "note", "message": {"text": "Very large file: public/static/capibara/index.js (2647 lines)"}, "properties": {"repobilityId": "6b9e6fdc40e6f3c7", "scanner": "scanner-primary", "fingerprint": "804d0d16accb65ad", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-6893a6c8b0861585", "level": "warning", "message": {"text": "Very low test-to-source ratio"}, "properties": {"repobilityId": "54a7de3f06314bf0", "scanner": "scanner-primary", "fingerprint": "6893a6c8b0861585", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["tests", "coverage"]}}, {"ruleId": "scanner-be5b6ac28962a744", "level": "note", "message": {"text": "42 TODO/FIXME markers"}, "properties": {"repobilityId": "4b38c118003e07d2", "scanner": "scanner-primary", "fingerprint": "be5b6ac28962a744", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["maintenance"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "9094b3d60670f936", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "8f2a81bb497d4e1b", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-9d79c4077342a7d0", "level": "warning", "message": {"text": "Runtime service client appears to use placeholder configuration"}, "properties": {"repobilityId": "3bc9a1f27b15592d", "scanner": "scanner-primary", "fingerprint": "9d79c4077342a7d0", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "runtime-config", "service-client", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "7827bf2394cd8473", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-749d4bc1bd66df5f", "level": "warning", "message": {"text": "Agent instructions exist but release-hardening basics are missing"}, "properties": {"repobilityId": "7161f4540440454a", "scanner": "scanner-primary", "fingerprint": "749d4bc1bd66df5f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-a2daa79745cd8247", "level": "note", "message": {"text": "Legacy-named symbol `gnu_gpl_v2` in types/api/contract.ts:14"}, "properties": {"repobilityId": "4ff19e3518948b84", "scanner": "scanner-primary", "fingerprint": "a2daa79745cd8247", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-0aade0015ce8ad42", "level": "note", "message": {"text": "Legacy-named symbol `score_v2` in mocks/contract/solidityscanReport.ts:16"}, "properties": {"repobilityId": "03f8cd69ed19b020", "scanner": "scanner-primary", "fingerprint": "0aade0015ce8ad42", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-87589d87c19a0abd", "level": "note", "message": {"text": "Legacy-named symbol `uniswap_v2` in stubs/pools.ts:16"}, "properties": {"repobilityId": "eeeea4ccbef6f419", "scanner": "scanner-primary", "fingerprint": "87589d87c19a0abd", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-ef20b7818aadb625", "level": "note", "message": {"text": "Legacy-named symbol `score_v2` in stubs/contract.ts:106"}, "properties": {"repobilityId": "9d45f6922d01fa55", "scanner": "scanner-primary", "fingerprint": "ef20b7818aadb625", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-2719660c85cb91d8", "level": "note", "message": {"text": "Legacy-named symbol `score_v2` in ui/address/SolidityscanReport.tsx:28"}, "properties": {"repobilityId": "288ffe0840312410", "scanner": "scanner-primary", "fingerprint": "2719660c85cb91d8", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-a991bbe144c86f1c", "level": "warning", "message": {"text": "Fire-and-forget `fetch()` has no rejection handler \u2014 ui/address/details/AddressSaveOnGas.tsx:57"}, "properties": {"repobilityId": "759dc19ab2c485b6", "scanner": "scanner-primary", "fingerprint": "a991bbe144c86f1c", "layer": "quality", "severity": "medium", "confidence": 0.9, "tags": ["integrity", "fragile-runtime", "robustness", "unhandled-promise"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ui/address/details/AddressSaveOnGas.tsx"}, "region": {"startLine": 57}}}]}, {"ruleId": "scanner-c7d590d1bdaa869c", "level": "note", "message": {"text": "Legacy-named symbol `master_copy` in ui/address/contract/alerts/ContractDetailsAlertProxyPattern.pw.tsx:13"}, "properties": {"repobilityId": "41dfa1ffb9fb8092", "scanner": "scanner-primary", "fingerprint": "c7d590d1bdaa869c", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-e672b1ef87a82f44", "level": "note", "message": {"text": "Legacy-named symbol `master_copy` in ui/address/contract/alerts/utils.ts:53"}, "properties": {"repobilityId": "4d881aa082874fb9", "scanner": "scanner-primary", "fingerprint": "e672b1ef87a82f44", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-4f44a3253e02c9cf", "level": "none", "message": {"text": "Commented-code block (24 lines) in ui/userOp/UserOpSubHeading.tsx:57"}, "properties": {"repobilityId": "954557a0907fc1d8", "scanner": "scanner-primary", "fingerprint": "4f44a3253e02c9cf", "layer": "quality", "severity": "info", "confidence": 0.72, "tags": ["integrity", "commented-code", "dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ui/userOp/UserOpSubHeading.tsx"}, "region": {"startLine": 57}}}]}, {"ruleId": "scanner-ac80f58fe964483e", "level": "warning", "message": {"text": "Fire-and-forget `fetch()` has no rejection handler \u2014 ui/shared/ad/CoinzillaTextAd.tsx:37"}, "properties": {"repobilityId": "4458f4bc95ca9d56", "scanner": "scanner-primary", "fingerprint": "ac80f58fe964483e", "layer": "quality", "severity": "medium", "confidence": 0.9, "tags": ["integrity", "fragile-runtime", "robustness", "unhandled-promise"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ui/shared/ad/CoinzillaTextAd.tsx"}, "region": {"startLine": 37}}}]}, {"ruleId": "scanner-b408b11f69a0fd41", "level": "note", "message": {"text": "Legacy-named symbol `gnu_gpl_v2` in ui/contractVerification/ContractVerificationForm.pw.tsx:64"}, "properties": {"repobilityId": "152163cc1b8c3ee2", "scanner": "scanner-primary", "fingerprint": "b408b11f69a0fd41", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-6eee9c620a003904", "level": "none", "message": {"text": "Commented-code block (7 lines) in ui/pages/ValidatorsStability.tsx:67"}, "properties": {"repobilityId": "ebd4f84660b0256e", "scanner": "scanner-primary", "fingerprint": "6eee9c620a003904", "layer": "quality", "severity": "info", "confidence": 0.72, "tags": ["integrity", "commented-code", "dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ui/pages/ValidatorsStability.tsx"}, "region": {"startLine": 67}}}]}, {"ruleId": "scanner-a59c38ae576a8a76", "level": "none", "message": {"text": "Commented-code block (6 lines) in ui/tx/TxInternals.tsx:55"}, "properties": {"repobilityId": "11daac1bbfa3f9e0", "scanner": "scanner-primary", "fingerprint": "a59c38ae576a8a76", "layer": "quality", "severity": "info", "confidence": 0.72, "tags": ["integrity", "commented-code", "dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ui/tx/TxInternals.tsx"}, "region": {"startLine": 55}}}]}, {"ruleId": "scanner-1bdc9fad8c4cbe2a", "level": "note", "message": {"text": "Legacy-named symbol `score_v2` in lib/solidityScan/schema.ts:17"}, "properties": {"repobilityId": "185fe81b2217201e", "scanner": "scanner-primary", "fingerprint": "1bdc9fad8c4cbe2a", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-e69373938ec5ee70", "level": "warning", "message": {"text": "Fire-and-forget `fetch()` has no rejection handler \u2014 lib/solidityScan/useFetchReport.ts:40"}, "properties": {"repobilityId": "81312528780abb1e", "scanner": "scanner-primary", "fingerprint": "e69373938ec5ee70", "layer": "quality", "severity": "medium", "confidence": 0.9, "tags": ["integrity", "fragile-runtime", "robustness", "unhandled-promise"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "lib/solidityScan/useFetchReport.ts"}, "region": {"startLine": 40}}}]}, {"ruleId": "scanner-4de86ef398922fb6", "level": "warning", "message": {"text": "Fire-and-forget `fetch()` has no rejection handler \u2014 lib/xStarScore/useFetchXStarScore.ts:40"}, "properties": {"repobilityId": "e1c3941d99781dcd", "scanner": "scanner-primary", "fingerprint": "4de86ef398922fb6", "layer": "quality", "severity": "medium", "confidence": 0.9, "tags": ["integrity", "fragile-runtime", "robustness", "unhandled-promise"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "lib/xStarScore/useFetchXStarScore.ts"}, "region": {"startLine": 40}}}]}, {"ruleId": "scanner-4bdfc070e2aa2448", "level": "warning", "message": {"text": "Fire-and-forget `fetch()` has no rejection handler \u2014 lib/hooks/useAdblockDetect.tsx:30"}, "properties": {"repobilityId": "5489453b9f19009b", "scanner": "scanner-primary", "fingerprint": "4bdfc070e2aa2448", "layer": "quality", "severity": "medium", "confidence": 0.9, "tags": ["integrity", "fragile-runtime", "robustness", "unhandled-promise"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "lib/hooks/useAdblockDetect.tsx"}, "region": {"startLine": 30}}}]}, {"ruleId": "scanner-7053f94a5b1d2b99", "level": "note", "message": {"text": "Legacy-named symbol `gnu_gpl_v2` in lib/contracts/licenses.ts:23"}, "properties": {"repobilityId": "3b90de89dc3b2690", "scanner": "scanner-primary", "fingerprint": "7053f94a5b1d2b99", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-3e36d31151e6fca7", "level": "warning", "message": {"text": "Fire-and-forget `fetch()` has no rejection handler \u2014 nextjs/getServerSideProps/handlers.ts:60"}, "properties": {"repobilityId": "dfe7b8da7596e7a2", "scanner": "scanner-primary", "fingerprint": "3e36d31151e6fca7", "layer": "quality", "severity": "medium", "confidence": 0.9, "tags": ["integrity", "fragile-runtime", "robustness", "unhandled-promise"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "nextjs/getServerSideProps/handlers.ts"}, "region": {"startLine": 60}}}]}, {"ruleId": "scanner-cdc66f56a5e7edf6", "level": "none", "message": {"text": "Commented-code block (5 lines) in public/static/capibara/index.js:303"}, "properties": {"repobilityId": "94d5b936ffcd915a", "scanner": "scanner-primary", "fingerprint": "cdc66f56a5e7edf6", "layer": "quality", "severity": "info", "confidence": 0.72, "tags": ["integrity", "commented-code", "dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "public/static/capibara/index.js"}, "region": {"startLine": 303}}}]}, {"ruleId": "scanner-526af44b904ea9ec", "level": "note", "message": {"text": "54 env vars used in code but missing from .env.example"}, "properties": {"repobilityId": "313b369fa3c8cca9", "scanner": "scanner-primary", "fingerprint": "526af44b904ea9ec", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "config-drift"]}}, {"ruleId": "scanner-c25cf7dec790019a", "level": "warning", "message": {"text": "Vulnerable dependency vite 6.4.1: GHSA-4w7w-66w2-5vf9"}, "properties": {"repobilityId": "8f492a912139007a", "scanner": "scanner-primary", "fingerprint": "c25cf7dec790019a", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-4w7w-66w2-5vf9", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "deploy/tools/envs-validator/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e2dc5e843f92d283", "level": "warning", "message": {"text": "Vulnerable dependency vite 6.4.1: GHSA-fx2h-pf6j-xcff"}, "properties": {"repobilityId": "ea2c1060b30e2ff5", "scanner": "scanner-primary", "fingerprint": "e2dc5e843f92d283", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-fx2h-pf6j-xcff", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "deploy/tools/envs-validator/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-95976795a6898947", "level": "warning", "message": {"text": "Vulnerable dependency vite 6.4.1: GHSA-p9ff-h696-f583"}, "properties": {"repobilityId": "27aa331eba031f35", "scanner": "scanner-primary", "fingerprint": "95976795a6898947", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-p9ff-h696-f583", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "deploy/tools/envs-validator/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-13841e47de369b5e", "level": "warning", "message": {"text": "Vulnerable dependency vite 6.4.1: GHSA-v6wh-96g9-6wx3"}, "properties": {"repobilityId": "ab7386e4ced67400", "scanner": "scanner-primary", "fingerprint": "13841e47de369b5e", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-v6wh-96g9-6wx3", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "deploy/tools/envs-validator/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-cdb7d0cc3c09b210", "level": "warning", "message": {"text": "Vulnerable dependency ws 8.18.3: GHSA-58qx-3vcg-4xpx"}, "properties": {"repobilityId": "b65c6dffece3e05a", "scanner": "scanner-primary", "fingerprint": "cdb7d0cc3c09b210", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-58qx-3vcg-4xpx", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "deploy/tools/essential-dapps-chains-config-generator/yarn.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-15d9569d6e1f49e9", "level": "error", "message": {"text": "Vulnerable dependency ws 8.18.3: GHSA-96hv-2xvq-fx4p"}, "properties": {"repobilityId": "a3e9cb019eb10d27", "scanner": "scanner-primary", "fingerprint": "15d9569d6e1f49e9", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-96hv-2xvq-fx4p", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "deploy/tools/essential-dapps-chains-config-generator/yarn.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-990df84c0a830571", "level": "warning", "message": {"text": "Vulnerable dependency webpack 5.95.0: GHSA-38r7-794h-5758"}, "properties": {"repobilityId": "40a8016a5296556c", "scanner": "scanner-primary", "fingerprint": "990df84c0a830571", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-38r7-794h-5758"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "deploy/tools/favicon-generator/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7b37da4ae419f9c7", "level": "warning", "message": {"text": "Vulnerable dependency webpack 5.95.0: GHSA-8fgc-7cc6-rx7x"}, "properties": {"repobilityId": "442819ba69a14633", "scanner": "scanner-primary", "fingerprint": "7b37da4ae419f9c7", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-8fgc-7cc6-rx7x"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "deploy/tools/favicon-generator/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d1ceaa0335c4793e", "level": "error", "message": {"text": "Vulnerable dependency @opentelemetry/auto-instrumentations-node 0.43.0: GHSA-q7rr-3cgh-j5r3"}, "properties": {"repobilityId": "9fedc74f1a11beac", "scanner": "scanner-primary", "fingerprint": "d1ceaa0335c4793e", "layer": "dependencies", "severity": "high", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-q7rr-3cgh-j5r3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-acda3f755521f602", "level": "error", "message": {"text": "Vulnerable dependency @opentelemetry/sdk-node 0.49.1: GHSA-q7rr-3cgh-j5r3"}, "properties": {"repobilityId": "369cb084c98e9a2b", "scanner": "scanner-primary", "fingerprint": "acda3f755521f602", "layer": "dependencies", "severity": "high", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-q7rr-3cgh-j5r3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-49968a072b4dd2d3", "level": "warning", "message": {"text": "Vulnerable dependency js-cookie 3.0.1: GHSA-qjx8-664m-686j"}, "properties": {"repobilityId": "033cc685545634ff", "scanner": "scanner-primary", "fingerprint": "49968a072b4dd2d3", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-qjx8-664m-686j"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a86fbf6d7db0945e", "level": "warning", "message": {"text": "Vulnerable dependency next 15.5.10: GHSA-267c-6grr-h53f"}, "properties": {"repobilityId": "0e031e816529e3fb", "scanner": "scanner-primary", "fingerprint": "a86fbf6d7db0945e", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-267c-6grr-h53f"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3da4e2297bb88330", "level": "warning", "message": {"text": "Vulnerable dependency next 15.5.10: GHSA-26hh-7cqf-hhc6"}, "properties": {"repobilityId": "b1b82685b7c0ce88", "scanner": "scanner-primary", "fingerprint": "3da4e2297bb88330", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-26hh-7cqf-hhc6"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-99efe7bac2db9cda", "level": "warning", "message": {"text": "Vulnerable dependency next 15.5.10: GHSA-2xp9-vwfh-vxw4"}, "properties": {"repobilityId": "e7b336890ea64d23", "scanner": "scanner-primary", "fingerprint": "99efe7bac2db9cda", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-2xp9-vwfh-vxw4"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-35d51c66b88df24c", "level": "warning", "message": {"text": "Vulnerable dependency next 15.5.10: GHSA-36qx-fr4f-26g5"}, "properties": {"repobilityId": "a7db5d927ed6096d", "scanner": "scanner-primary", "fingerprint": "35d51c66b88df24c", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-36qx-fr4f-26g5"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-958e8eb5649a14a1", "level": "warning", "message": {"text": "Vulnerable dependency next 15.5.10: GHSA-3g8h-86w9-wvmq"}, "properties": {"repobilityId": "aa89a865a9a56ebe", "scanner": "scanner-primary", "fingerprint": "958e8eb5649a14a1", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-3g8h-86w9-wvmq"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-931caeae8bc0cfaa", "level": "warning", "message": {"text": "Vulnerable dependency next 15.5.10: GHSA-3x4c-7xq6-9pq8"}, "properties": {"repobilityId": "a8ee4501163fcd3e", "scanner": "scanner-primary", "fingerprint": "931caeae8bc0cfaa", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-3x4c-7xq6-9pq8"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2cd3984d002b5548", "level": "warning", "message": {"text": "Vulnerable dependency next 15.5.10: GHSA-4633-3j49-mh5q"}, "properties": {"repobilityId": "fc0604ecc31b1d57", "scanner": "scanner-primary", "fingerprint": "2cd3984d002b5548", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-4633-3j49-mh5q"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-406c0621c3eb86a0", "level": "warning", "message": {"text": "Vulnerable dependency next 15.5.10: GHSA-492v-c6pp-mqqv"}, "properties": {"repobilityId": "d83ae99d1265d955", "scanner": "scanner-primary", "fingerprint": "406c0621c3eb86a0", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-492v-c6pp-mqqv"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3835495a59f1926f", "level": "warning", "message": {"text": "Vulnerable dependency next 15.5.10: GHSA-4c39-4ccg-62r3"}, "properties": {"repobilityId": "145fe35a52288e62", "scanner": "scanner-primary", "fingerprint": "3835495a59f1926f", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-4c39-4ccg-62r3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8fabb913427d57e1", "level": "warning", "message": {"text": "Vulnerable dependency next 15.5.10: GHSA-4jqv-mc3x-m676"}, "properties": {"repobilityId": "28ab2fcf03a856d8", "scanner": "scanner-primary", "fingerprint": "8fabb913427d57e1", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-4jqv-mc3x-m676"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a5b9534d5a52b4ae", "level": "warning", "message": {"text": "Vulnerable dependency next 15.5.10: GHSA-68g3-v927-f742"}, "properties": {"repobilityId": "cd4694d9e167d8e8", "scanner": "scanner-primary", "fingerprint": "a5b9534d5a52b4ae", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-68g3-v927-f742"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-bb0447a681128f98", "level": "warning", "message": {"text": "Vulnerable dependency next 15.5.10: GHSA-89xv-2m56-2m9x"}, "properties": {"repobilityId": "0223537f9ccb7e02", "scanner": "scanner-primary", "fingerprint": "bb0447a681128f98", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-89xv-2m56-2m9x"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4b3dec7310e683d2", "level": "warning", "message": {"text": "Vulnerable dependency next 15.5.10: GHSA-8h8q-6873-q5fj"}, "properties": {"repobilityId": "84a25d820221990f", "scanner": "scanner-primary", "fingerprint": "4b3dec7310e683d2", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-8h8q-6873-q5fj"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6cc8135681cc8281", "level": "warning", "message": {"text": "Vulnerable dependency next 15.5.10: GHSA-955p-x3mx-jcvp"}, "properties": {"repobilityId": "c9de9a173026bb72", "scanner": "scanner-primary", "fingerprint": "6cc8135681cc8281", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-955p-x3mx-jcvp"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-09f5e08379c92ab1", "level": "warning", "message": {"text": "Vulnerable dependency next 15.5.10: GHSA-c4j6-fc7j-m34r"}, "properties": {"repobilityId": "cee5ce38ada5231e", "scanner": "scanner-primary", "fingerprint": "09f5e08379c92ab1", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-c4j6-fc7j-m34r"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-46f6150227fe056f", "level": "warning", "message": {"text": "Vulnerable dependency next 15.5.10: GHSA-ffhc-5mcf-pf4q"}, "properties": {"repobilityId": "56d6a9c2c4f25bcb", "scanner": "scanner-primary", "fingerprint": "46f6150227fe056f", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-ffhc-5mcf-pf4q"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f04a82fc0b65b2fd", "level": "warning", "message": {"text": "Vulnerable dependency next 15.5.10: GHSA-ggv3-7p47-pfv8"}, "properties": {"repobilityId": "6f79077bdb8d24ce", "scanner": "scanner-primary", "fingerprint": "f04a82fc0b65b2fd", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-ggv3-7p47-pfv8"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-81a047fbe4388b8a", "level": "warning", "message": {"text": "Vulnerable dependency next 15.5.10: GHSA-gx5p-jg67-6x7h"}, "properties": {"repobilityId": "55a5f9c1782ee55b", "scanner": "scanner-primary", "fingerprint": "81a047fbe4388b8a", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-gx5p-jg67-6x7h"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7006fed992ec5d72", "level": "warning", "message": {"text": "Vulnerable dependency next 15.5.10: GHSA-h64f-5h5j-jqjh"}, "properties": {"repobilityId": "22f2200882834523", "scanner": "scanner-primary", "fingerprint": "7006fed992ec5d72", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-h64f-5h5j-jqjh"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8fb5f9359bf8be25", "level": "warning", "message": {"text": "Vulnerable dependency next 15.5.10: GHSA-m99w-x7hq-7vfj"}, "properties": {"repobilityId": "6174524894e8f85f", "scanner": "scanner-primary", "fingerprint": "8fb5f9359bf8be25", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-m99w-x7hq-7vfj"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a5f89da73c3b62ae", "level": "warning", "message": {"text": "Vulnerable dependency next 15.5.10: GHSA-mcj8-r9mp-w47p"}, "properties": {"repobilityId": "0fad817734223560", "scanner": "scanner-primary", "fingerprint": "a5f89da73c3b62ae", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-mcj8-r9mp-w47p"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-769e4c6c483ec2bc", "level": "warning", "message": {"text": "Vulnerable dependency next 15.5.10: GHSA-mg66-mrh9-m8jx"}, "properties": {"repobilityId": "cd4101e5e9b84b91", "scanner": "scanner-primary", "fingerprint": "769e4c6c483ec2bc", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-mg66-mrh9-m8jx"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8759c79392a0cf54", "level": "warning", "message": {"text": "Vulnerable dependency next 15.5.10: GHSA-p293-qw3h-jr36"}, "properties": {"repobilityId": "ad2e82f18a5b0767", "scanner": "scanner-primary", "fingerprint": "8759c79392a0cf54", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-p293-qw3h-jr36"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-93cc92a6fa1191a1", "level": "warning", "message": {"text": "Vulnerable dependency next 15.5.10: GHSA-p9j2-gv94-2wf4"}, "properties": {"repobilityId": "a555549149326d39", "scanner": "scanner-primary", "fingerprint": "93cc92a6fa1191a1", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-p9j2-gv94-2wf4"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-477b87563cffc4b6", "level": "warning", "message": {"text": "Vulnerable dependency next 15.5.10: GHSA-q4gf-8mx6-v5v3"}, "properties": {"repobilityId": "67d14fc46196ca07", "scanner": "scanner-primary", "fingerprint": "477b87563cffc4b6", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-q4gf-8mx6-v5v3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-bd135daf676b64d2", "level": "warning", "message": {"text": "Vulnerable dependency next 15.5.10: GHSA-q8wf-6r8g-63ch"}, "properties": {"repobilityId": "7389334b44e66796", "scanner": "scanner-primary", "fingerprint": "bd135daf676b64d2", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-q8wf-6r8g-63ch"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-88ceb32a56ef6ae6", "level": "warning", "message": {"text": "Vulnerable dependency next 15.5.10: GHSA-vfv6-92ff-j949"}, "properties": {"repobilityId": "8f88a2a526154cea", "scanner": "scanner-primary", "fingerprint": "88ceb32a56ef6ae6", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-vfv6-92ff-j949"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e43a32eed7c0b78f", "level": "warning", "message": {"text": "Vulnerable dependency next 15.5.10: GHSA-wfc6-r584-vfw7"}, "properties": {"repobilityId": "e146451e3ce01a5f", "scanner": "scanner-primary", "fingerprint": "e43a32eed7c0b78f", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-wfc6-r584-vfw7"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1104aeecee2f754a", "level": "warning", "message": {"text": "Vulnerable dependency node-fetch 3.2.9: GHSA-vp56-6g26-6827"}, "properties": {"repobilityId": "c035277089fc65df", "scanner": "scanner-primary", "fingerprint": "1104aeecee2f754a", "layer": "dependencies", "severity": "medium", "confidence": 0.7, "tags": ["dependency", "sca", "osv", "GHSA-vp56-6g26-6827"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-898c0d1ec690b038", "level": "warning", "message": {"text": "Vulnerable dependency path-to-regexp 8.1.0: GHSA-27v5-c462-wpq7"}, "properties": {"repobilityId": "0a16c165ff1e043e", "scanner": "scanner-primary", "fingerprint": "898c0d1ec690b038", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-27v5-c462-wpq7"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-91d587a7860fc824", "level": "warning", "message": {"text": "Vulnerable dependency path-to-regexp 8.1.0: GHSA-j3q9-mxjg-w52f"}, "properties": {"repobilityId": "3e5ed903aba27409", "scanner": "scanner-primary", "fingerprint": "91d587a7860fc824", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-j3q9-mxjg-w52f"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-225d1810d66f8c6a", "level": "warning", "message": {"text": "Vulnerable dependency phoenix 1.6.15: EEF-CVE-2026-56812"}, "properties": {"repobilityId": "08e90ef9a96a18ca", "scanner": "scanner-primary", "fingerprint": "225d1810d66f8c6a", "layer": "dependencies", "severity": "medium", "confidence": 0.7, "tags": ["dependency", "sca", "osv", "EEF-CVE-2026-56812"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5ac0c1457bbcde9b", "level": "warning", "message": {"text": "Vulnerable dependency phoenix 1.6.15: GHSA-63mc-hw7g-86rr"}, "properties": {"repobilityId": "8db51f32fd4105da", "scanner": "scanner-primary", "fingerprint": "5ac0c1457bbcde9b", "layer": "dependencies", "severity": "medium", "confidence": 0.7, "tags": ["dependency", "sca", "osv", "GHSA-63mc-hw7g-86rr"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-47d3100a17ae458c", "level": "warning", "message": {"text": "Vulnerable dependency valibot 1.2.0: GHSA-5qjj-4xww-7phc"}, "properties": {"repobilityId": "546c8767157946ee", "scanner": "scanner-primary", "fingerprint": "47d3100a17ae458c", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-5qjj-4xww-7phc"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-be88f307219378f7", "level": "warning", "message": {"text": "Vulnerable dependency svgo 2.8.0: GHSA-2p49-hgcm-8545"}, "properties": {"repobilityId": "938aa813dd57bc1d", "scanner": "scanner-primary", "fingerprint": "be88f307219378f7", "layer": "dependencies", "severity": "medium", "confidence": 0.7, "tags": ["dependency", "sca", "osv", "GHSA-2p49-hgcm-8545", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-435c3b3f34a3ecd5", "level": "warning", "message": {"text": "Vulnerable dependency svgo 2.8.0: GHSA-4vpr-x523-8j87"}, "properties": {"repobilityId": "b692eeb347ca0413", "scanner": "scanner-primary", "fingerprint": "435c3b3f34a3ecd5", "layer": "dependencies", "severity": "medium", "confidence": 0.7, "tags": ["dependency", "sca", "osv", "GHSA-4vpr-x523-8j87", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c1fa422f71df684b", "level": "warning", "message": {"text": "Vulnerable dependency svgo 2.8.0: GHSA-w27v-7q3p-w38r"}, "properties": {"repobilityId": "0cc02e4b1cfbf030", "scanner": "scanner-primary", "fingerprint": "c1fa422f71df684b", "layer": "dependencies", "severity": "medium", "confidence": 0.7, "tags": ["dependency", "sca", "osv", "GHSA-w27v-7q3p-w38r", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e44a48a9ad8272eb", "level": "warning", "message": {"text": "Vulnerable dependency svgo 2.8.0: GHSA-xpqw-6gx7-v673"}, "properties": {"repobilityId": "ae6d93b1acf2b98b", "scanner": "scanner-primary", "fingerprint": "e44a48a9ad8272eb", "layer": "dependencies", "severity": "medium", "confidence": 0.7, "tags": ["dependency", "sca", "osv", "GHSA-xpqw-6gx7-v673", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7dc2c222291e4fef", "level": "warning", "message": {"text": "Vulnerable dependency vitest 4.0.15: GHSA-5xrq-8626-4rwp"}, "properties": {"repobilityId": "5c6952a6d5f709f5", "scanner": "scanner-primary", "fingerprint": "7dc2c222291e4fef", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-5xrq-8626-4rwp", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-20d024cad0d25329", "level": "warning", "message": {"text": "Vulnerable dependency vitest 4.0.15: GHSA-82fw-gwwq-j7x9"}, "properties": {"repobilityId": "714499fe76360dd2", "scanner": "scanner-primary", "fingerprint": "20d024cad0d25329", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-82fw-gwwq-j7x9", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7705f5fc5fa49f5a", "level": "warning", "message": {"text": "Vulnerable dependency ws 8.17.1: GHSA-58qx-3vcg-4xpx"}, "properties": {"repobilityId": "5f1358ccdeba559c", "scanner": "scanner-primary", "fingerprint": "7705f5fc5fa49f5a", "layer": "dependencies", "severity": "medium", "confidence": 0.7, "tags": ["dependency", "sca", "osv", "GHSA-58qx-3vcg-4xpx", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2e3c0776f3ab6a06", "level": "error", "message": {"text": "Vulnerable dependency ws 8.17.1: GHSA-96hv-2xvq-fx4p"}, "properties": {"repobilityId": "e6562ea04da1b9fb", "scanner": "scanner-primary", "fingerprint": "2e3c0776f3ab6a06", "layer": "dependencies", "severity": "high", "confidence": 0.7, "tags": ["dependency", "sca", "osv", "GHSA-96hv-2xvq-fx4p", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-68fc611deae22946", "level": "warning", "message": {"text": "Vulnerable dependency brace-expansion 1.1.12: GHSA-3jxr-9vmj-r5cp"}, "properties": {"repobilityId": "5d2ce580505ef5a7", "scanner": "scanner-primary", "fingerprint": "68fc611deae22946", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-3jxr-9vmj-r5cp", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "deploy/tools/affected-tests/yarn.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2875b4976cb23852", "level": "warning", "message": {"text": "Vulnerable dependency brace-expansion 1.1.12: GHSA-6j4f-fj2g-mc7p"}, "properties": {"repobilityId": "f87c82bff0222583", "scanner": "scanner-primary", "fingerprint": "2875b4976cb23852", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-6j4f-fj2g-mc7p", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "deploy/tools/affected-tests/yarn.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-454875edc7909595", "level": "warning", "message": {"text": "Vulnerable dependency brace-expansion 1.1.12: GHSA-f886-m6hf-6m8v"}, "properties": {"repobilityId": "c4fa6cea7167ee7e", "scanner": "scanner-primary", "fingerprint": "454875edc7909595", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-f886-m6hf-6m8v", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "deploy/tools/affected-tests/yarn.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-31787240adfad824", "level": "warning", "message": {"text": "Vulnerable dependency brace-expansion 1.1.12: GHSA-mh99-v99m-4gvg"}, "properties": {"repobilityId": "0fc24bfbdae70a7f", "scanner": "scanner-primary", "fingerprint": "31787240adfad824", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-mh99-v99m-4gvg", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "deploy/tools/affected-tests/yarn.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-69f500265c94b2da", "level": "warning", "message": {"text": "Vulnerable dependency brace-expansion 1.1.12: GHSA-q2hr-2g5m-vwhr"}, "properties": {"repobilityId": "fc6aeb04f0249297", "scanner": "scanner-primary", "fingerprint": "69f500265c94b2da", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-q2hr-2g5m-vwhr", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "deploy/tools/affected-tests/yarn.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-71a39fb34f255df5", "level": "warning", "message": {"text": "Vulnerable dependency brace-expansion 1.1.12: GHSA-qhr7-859c-m2p7"}, "properties": {"repobilityId": "9900607dd6e83ae5", "scanner": "scanner-primary", "fingerprint": "71a39fb34f255df5", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-qhr7-859c-m2p7", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "deploy/tools/affected-tests/yarn.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-798bc4268e43da4c", "level": "warning", "message": {"text": "Vulnerable dependency brace-expansion 1.1.12: GHSA-rgw5-rvv9-x895"}, "properties": {"repobilityId": "3d617062bafcab77", "scanner": "scanner-primary", "fingerprint": "798bc4268e43da4c", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-rgw5-rvv9-x895", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "deploy/tools/affected-tests/yarn.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-76c1756c34f6e1e8", "level": "warning", "message": {"text": "Vulnerable dependency braces 3.0.3: GHSA-vfj7-8cjw-p6xm"}, "properties": {"repobilityId": "fbbcc80277b25266", "scanner": "scanner-primary", "fingerprint": "76c1756c34f6e1e8", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-vfj7-8cjw-p6xm", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "deploy/tools/affected-tests/yarn.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f47d42688cdf31d1", "level": "warning", "message": {"text": "Vulnerable dependency minimatch 3.1.2: GHSA-23c5-xmqv-rm74"}, "properties": {"repobilityId": "9f7f5897e94c3644", "scanner": "scanner-primary", "fingerprint": "f47d42688cdf31d1", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-23c5-xmqv-rm74", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "deploy/tools/affected-tests/yarn.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7004ab356a3c1d29", "level": "warning", "message": {"text": "Vulnerable dependency minimatch 3.1.2: GHSA-3ppc-4f35-3m26"}, "properties": {"repobilityId": "1f348c9c38426ebf", "scanner": "scanner-primary", "fingerprint": "7004ab356a3c1d29", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-3ppc-4f35-3m26", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "deploy/tools/affected-tests/yarn.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-96b72949d819d5f1", "level": "warning", "message": {"text": "Vulnerable dependency minimatch 3.1.2: GHSA-7r86-cg39-jmmj"}, "properties": {"repobilityId": "20c31d31e282c8df", "scanner": "scanner-primary", "fingerprint": "96b72949d819d5f1", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-7r86-cg39-jmmj", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "deploy/tools/affected-tests/yarn.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d47f9cde521580bd", "level": "error", "message": {"text": "Vulnerable dependency nanoid 3.3.8: GHSA-28wg-ghj8-5hjv"}, "properties": {"repobilityId": "ff2c7ff913879425", "scanner": "scanner-primary", "fingerprint": "d47f9cde521580bd", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-28wg-ghj8-5hjv", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "deploy/tools/affected-tests/yarn.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2e695e679618a156", "level": "error", "message": {"text": "Vulnerable dependency nanoid 3.3.8: GHSA-2v37-7h3g-55p8"}, "properties": {"repobilityId": "eafab0817a020b11", "scanner": "scanner-primary", "fingerprint": "2e695e679618a156", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-2v37-7h3g-55p8", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "deploy/tools/affected-tests/yarn.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2b02141a74a32c94", "level": "warning", "message": {"text": "Vulnerable dependency nanoid 3.3.8: GHSA-xwg4-73v4-xw9w"}, "properties": {"repobilityId": "c1308c4f89e0bd4e", "scanner": "scanner-primary", "fingerprint": "2b02141a74a32c94", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-xwg4-73v4-xw9w", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "deploy/tools/affected-tests/yarn.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-cc181c14ce32f934", "level": "warning", "message": {"text": "Vulnerable dependency picomatch 2.3.1: GHSA-3v7f-55p6-f55p"}, "properties": {"repobilityId": "a2746cb9d8be4794", "scanner": "scanner-primary", "fingerprint": "cc181c14ce32f934", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-3v7f-55p6-f55p", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "deploy/tools/affected-tests/yarn.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-981131207e45022c", "level": "error", "message": {"text": "Vulnerable dependency picomatch 2.3.1: GHSA-c2c7-rcm5-vvqj"}, "properties": {"repobilityId": "676e59b75389f27b", "scanner": "scanner-primary", "fingerprint": "981131207e45022c", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-c2c7-rcm5-vvqj", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "deploy/tools/affected-tests/yarn.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e9a717971a8ee372", "level": "error", "message": {"text": "Vulnerable dependency postcss 8.4.33: GHSA-6g55-p6wh-862q"}, "properties": {"repobilityId": "901778127dc31ab7", "scanner": "scanner-primary", "fingerprint": "e9a717971a8ee372", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-6g55-p6wh-862q", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "deploy/tools/affected-tests/yarn.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5a2f175e58f0e3c3", "level": "warning", "message": {"text": "Vulnerable dependency postcss 8.4.33: GHSA-fxqj-rqcc-2cmp"}, "properties": {"repobilityId": "83aff656874580c8", "scanner": "scanner-primary", "fingerprint": "5a2f175e58f0e3c3", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-fxqj-rqcc-2cmp", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "deploy/tools/affected-tests/yarn.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f048b4385e3f5381", "level": "warning", "message": {"text": "Vulnerable dependency postcss 8.4.33: GHSA-qx2v-qp2m-jg93"}, "properties": {"repobilityId": "0a35de3e8e972504", "scanner": "scanner-primary", "fingerprint": "f048b4385e3f5381", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-qx2v-qp2m-jg93", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "deploy/tools/affected-tests/yarn.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-05f8dae8994e4f65", "level": "warning", "message": {"text": "Vulnerable dependency postcss 8.4.33: GHSA-r28c-9q8g-f849"}, "properties": {"repobilityId": "9b0f478f6699716d", "scanner": "scanner-primary", "fingerprint": "05f8dae8994e4f65", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-r28c-9q8g-f849", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "deploy/tools/affected-tests/yarn.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e90f15c51f57a3c0", "level": "error", "message": {"text": "Vulnerable dependency source-map-js 1.0.2: GHSA-68fv-2mgg-jv7q"}, "properties": {"repobilityId": "6b40a3c0cbb9db91", "scanner": "scanner-primary", "fingerprint": "e90f15c51f57a3c0", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-68fv-2mgg-jv7q", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "deploy/tools/affected-tests/yarn.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-cad2d71b7bdcb655", "level": "error", "message": {"text": "Vulnerable dependency nanoid 3.3.11: GHSA-28wg-ghj8-5hjv"}, "properties": {"repobilityId": "a28fc942b5b14d8c", "scanner": "scanner-primary", "fingerprint": "cad2d71b7bdcb655", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-28wg-ghj8-5hjv", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "deploy/tools/envs-validator/yarn.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d3d83a637007323d", "level": "error", "message": {"text": "Vulnerable dependency nanoid 3.3.11: GHSA-2v37-7h3g-55p8"}, "properties": {"repobilityId": "b8c23ab323f99001", "scanner": "scanner-primary", "fingerprint": "d3d83a637007323d", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-2v37-7h3g-55p8", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "deploy/tools/envs-validator/yarn.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3a52ef576c7010ff", "level": "warning", "message": {"text": "Vulnerable dependency nanoid 3.3.11: GHSA-xwg4-73v4-xw9w"}, "properties": {"repobilityId": "d10186191bb440f8", "scanner": "scanner-primary", "fingerprint": "3a52ef576c7010ff", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-xwg4-73v4-xw9w", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "deploy/tools/envs-validator/yarn.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-af7c2d1a698b18f8", "level": "warning", "message": {"text": "Vulnerable dependency picomatch 4.0.3: GHSA-3v7f-55p6-f55p"}, "properties": {"repobilityId": "7c1f64a4b9d5ab32", "scanner": "scanner-primary", "fingerprint": "af7c2d1a698b18f8", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-3v7f-55p6-f55p", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "deploy/tools/envs-validator/yarn.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8ef68a6260fd350e", "level": "error", "message": {"text": "Vulnerable dependency picomatch 4.0.3: GHSA-c2c7-rcm5-vvqj"}, "properties": {"repobilityId": "75ae39eb60c1525e", "scanner": "scanner-primary", "fingerprint": "8ef68a6260fd350e", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-c2c7-rcm5-vvqj", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "deploy/tools/envs-validator/yarn.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4d9ae268eb82c2ed", "level": "error", "message": {"text": "Vulnerable dependency postcss 8.5.6: GHSA-6g55-p6wh-862q"}, "properties": {"repobilityId": "b8944461c8644339", "scanner": "scanner-primary", "fingerprint": "4d9ae268eb82c2ed", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-6g55-p6wh-862q", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "deploy/tools/envs-validator/yarn.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-491e13682d9ce0c5", "level": "warning", "message": {"text": "Vulnerable dependency postcss 8.5.6: GHSA-fxqj-rqcc-2cmp"}, "properties": {"repobilityId": "1f793820cbec4a56", "scanner": "scanner-primary", "fingerprint": "491e13682d9ce0c5", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-fxqj-rqcc-2cmp", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "deploy/tools/envs-validator/yarn.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b4f81b2dc6b69677", "level": "warning", "message": {"text": "Vulnerable dependency postcss 8.5.6: GHSA-qx2v-qp2m-jg93"}, "properties": {"repobilityId": "6c83605d3aa8fcef", "scanner": "scanner-primary", "fingerprint": "b4f81b2dc6b69677", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-qx2v-qp2m-jg93", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "deploy/tools/envs-validator/yarn.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-204a5d086d1f3785", "level": "warning", "message": {"text": "Vulnerable dependency postcss 8.5.6: GHSA-r28c-9q8g-f849"}, "properties": {"repobilityId": "952a6afbc97e5c3e", "scanner": "scanner-primary", "fingerprint": "204a5d086d1f3785", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-r28c-9q8g-f849", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "deploy/tools/envs-validator/yarn.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d4ce37127b6f57d4", "level": "error", "message": {"text": "Vulnerable dependency rollup 4.53.2: GHSA-mw96-cpmx-2vgc"}, "properties": {"repobilityId": "091ad32a2c844f9b", "scanner": "scanner-primary", "fingerprint": "d4ce37127b6f57d4", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-mw96-cpmx-2vgc", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "deploy/tools/envs-validator/yarn.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b1750de7c68da10a", "level": "error", "message": {"text": "Vulnerable dependency source-map-js 1.2.1: GHSA-68fv-2mgg-jv7q"}, "properties": {"repobilityId": "6eacee421733f25f", "scanner": "scanner-primary", "fingerprint": "b1750de7c68da10a", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-68fv-2mgg-jv7q", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "deploy/tools/envs-validator/yarn.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3abc497e1edc688b", "level": "error", "message": {"text": "Vulnerable dependency rollup 4.52.4: GHSA-mw96-cpmx-2vgc"}, "properties": {"repobilityId": "d83fb13952ea40fc", "scanner": "scanner-primary", "fingerprint": "3abc497e1edc688b", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-mw96-cpmx-2vgc", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "deploy/tools/essential-dapps-chains-config-generator/yarn.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a8c1b631f2dbc924", "level": "note", "message": {"text": "Dependency @blockscout/multichain-aggregator-types is a major version behind"}, "properties": {"repobilityId": "1d82392146551f58", "scanner": "scanner-primary", "fingerprint": "a8c1b631f2dbc924", "layer": "dependencies", "severity": "low", "confidence": 0.9, "tags": ["dependency", "freshness", "outdated"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-04843d685e2e0cfe", "level": "note", "message": {"text": "Dependency @blockscout/tac-operation-lifecycle-types is a major version behind"}, "properties": {"repobilityId": "d4f6c5d6e835fdbc", "scanner": "scanner-primary", "fingerprint": "04843d685e2e0cfe", "layer": "dependencies", "severity": "low", "confidence": 0.9, "tags": ["dependency", "freshness", "outdated"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d0d23e744e6253de", "level": "note", "message": {"text": "Dependency @growthbook/growthbook-react is a major version behind"}, "properties": {"repobilityId": "b522c813c8071e3f", "scanner": "scanner-primary", "fingerprint": "d0d23e744e6253de", "layer": "dependencies", "severity": "low", "confidence": 0.9, "tags": ["dependency", "freshness", "outdated"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4d96aaa36a2ef51d", "level": "warning", "message": {"text": "Dependency @helia/verified-fetch is two or more major versions behind"}, "properties": {"repobilityId": "1e967e4db2e60830", "scanner": "scanner-primary", "fingerprint": "4d96aaa36a2ef51d", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "freshness", "outdated"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4f99afd417647973", "level": "warning", "message": {"text": "Dependency @metamask/post-message-stream is two or more major versions behind"}, "properties": {"repobilityId": "b5d5b74f63c8077e", "scanner": "scanner-primary", "fingerprint": "4f99afd417647973", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "freshness", "outdated"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-79eb338fadb6db9b", "level": "warning", "message": {"text": "Dependency @metamask/providers is two or more major versions behind"}, "properties": {"repobilityId": "f8dd2738afdfc3ac", "scanner": "scanner-primary", "fingerprint": "79eb338fadb6db9b", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "freshness", "outdated"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e7cd08ce12d72ede", "level": "note", "message": {"text": "Dependency @next/bundle-analyzer is a major version behind"}, "properties": {"repobilityId": "cb6e6511be14c634", "scanner": "scanner-primary", "fingerprint": "e7cd08ce12d72ede", "layer": "dependencies", "severity": "low", "confidence": 0.9, "tags": ["dependency", "freshness", "outdated"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-732da2e1235bafda", "level": "note", "message": {"text": "Dependency @opentelemetry/exporter-jaeger is a major version behind"}, "properties": {"repobilityId": "e6837a7e30db6c93", "scanner": "scanner-primary", "fingerprint": "732da2e1235bafda", "layer": "dependencies", "severity": "low", "confidence": 0.9, "tags": ["dependency", "freshness", "outdated"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-417f3f3854c03788", "level": "note", "message": {"text": "Dependency @opentelemetry/resources is a major version behind"}, "properties": {"repobilityId": "ff556b9d821b57fa", "scanner": "scanner-primary", "fingerprint": "417f3f3854c03788", "layer": "dependencies", "severity": "low", "confidence": 0.9, "tags": ["dependency", "freshness", "outdated"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ad28e8bc4836a1a6", "level": "note", "message": {"text": "Dependency @opentelemetry/sdk-trace-node is a major version behind"}, "properties": {"repobilityId": "94482f8c2c6866d2", "scanner": "scanner-primary", "fingerprint": "ad28e8bc4836a1a6", "layer": "dependencies", "severity": "low", "confidence": 0.9, "tags": ["dependency", "freshness", "outdated"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1746a749e4719c7c", "level": "note", "message": {"text": "Dependency @rollbar/react is a major version behind"}, "properties": {"repobilityId": "a6a82fe47a48ee08", "scanner": "scanner-primary", "fingerprint": "1746a749e4719c7c", "layer": "dependencies", "severity": "low", "confidence": 0.9, "tags": ["dependency", "freshness", "outdated"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3f4e59e763fcaf3c", "level": "note", "message": {"text": "Dependency @scure/base is a major version behind"}, "properties": {"repobilityId": "71aaa865e230af79", "scanner": "scanner-primary", "fingerprint": "3f4e59e763fcaf3c", "layer": "dependencies", "severity": "low", "confidence": 0.9, "tags": ["dependency", "freshness", "outdated"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b22150f1c8a5d73d", "level": "error", "message": {"text": "Dangling fetch: POST /node-api/monitoring/invalid-api-schema (ui/address/details/AddressSaveOnGas.tsx:57)"}, "properties": {"repobilityId": "bcc6d39e585a2034", "scanner": "scanner-primary", "fingerprint": "b22150f1c8a5d73d", "layer": "api", "severity": "high", "confidence": 0.9, "tags": ["wiring", "dangling-fetch", "fetch"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ui/address/details/AddressSaveOnGas.tsx"}, "region": {"startLine": 57}}}]}, {"ruleId": "scanner-e589f37257a778f4", "level": "error", "message": {"text": "Dangling fetch: POST /node-api/monitoring/invalid-api-schema (lib/solidityScan/useFetchReport.ts:40)"}, "properties": {"repobilityId": "46f732ba58a8846c", "scanner": "scanner-primary", "fingerprint": "e589f37257a778f4", "layer": "api", "severity": "high", "confidence": 0.9, "tags": ["wiring", "dangling-fetch", "fetch"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "lib/solidityScan/useFetchReport.ts"}, "region": {"startLine": 40}}}]}, {"ruleId": "scanner-b5521e2fb7c9d935", "level": "error", "message": {"text": "Dangling fetch: POST /node-api/monitoring/pageview (lib/monitoring/usePageViewTracking.ts:48)"}, "properties": {"repobilityId": "bb628dc5d4e98aec", "scanner": "scanner-primary", "fingerprint": "b5521e2fb7c9d935", "layer": "api", "severity": "high", "confidence": 0.9, "tags": ["wiring", "dangling-fetch", "fetch"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "lib/monitoring/usePageViewTracking.ts"}, "region": {"startLine": 48}}}]}, {"ruleId": "scanner-eb41c50faece4371", "level": "error", "message": {"text": "Dangling fetch: POST /node-api/monitoring/invalid-api-schema (lib/xStarScore/useFetchXStarScore.ts:40)"}, "properties": {"repobilityId": "133249299d1579cd", "scanner": "scanner-primary", "fingerprint": "eb41c50faece4371", "layer": "api", "severity": "high", "confidence": 0.9, "tags": ["wiring", "dangling-fetch", "fetch"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "lib/xStarScore/useFetchXStarScore.ts"}, "region": {"startLine": 40}}}]}, {"ruleId": "scanner-7e6d161776b758bd", "level": "note", "message": {"text": "16 backend endpoints not called by scanned frontend"}, "properties": {"repobilityId": "3c8e96670c5e1f9f", "scanner": "scanner-primary", "fingerprint": "7e6d161776b758bd", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}]}]}