{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-9dc91b69da1d722e", "name": "TODO/FIXME marker in shipping code \u2014 config/webpack.config.prod.js:110", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 config/webpack.config.prod.js:110"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.7}}, {"id": "scanner-5340a58b3f5732bf", "name": "TODO/FIXME marker in shipping code \u2014 config/webpack.config.dev.js:106", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 config/webpack.config.dev.js:106"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.7}}, {"id": "scanner-13ea46f161c106ab", "name": "Debug `console.log` remains in browser-facing code \u2014 src/App.js:173", "shortDescription": {"text": "Debug `console.log` remains in browser-facing code \u2014 src/App.js:173"}, "fullDescription": {"text": "Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 0.85}}, {"id": "scanner-22cc85cde13e1029", "name": "Debug `console.log` remains in browser-facing code \u2014 src/registerServiceWorker.js:59", "shortDescription": {"text": "Debug `console.log` remains in browser-facing code \u2014 src/registerServiceWorker.js:59"}, "fullDescription": {"text": "Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 0.85}}, {"id": "scanner-0a953d099411af3e", "name": "TODO/FIXME marker in shipping code \u2014 src/index.js:6", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 src/index.js:6"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.7}}, {"id": "scanner-f1a0e7e504cd2b4f", "name": "CVE-2025-27789: @babel/runtime 7.2.0 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2025-27789: @babel/runtime 7.2.0 \u2014 package-lock.json"}, "fullDescription": {"text": "Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups\n\nBabel is a compiler for writing next generation JavaScript. When using versions of Babel prior to 7.26.10 and 8.0.0-alpha.17 to compile regular expression named capturing groups, Babel will generate a polyfill for the `.replace` method that has quadratic complexity on some specific replacement pattern strings (i.e. the second argument passed to `.replace`). Generated code is vulnerable if all the following conditions are true: Using Babel to compile regular expression named capturing groups, usi\n\nPackage: @babel/runtime\nInstalled: 7.2.0\nFixed in: 7.26.10, 8.0.0-alpha.17\nSeverity: MEDIUM\nFix: Upgrade @babel/runtime to 7.26.10, 8.0.0-alpha.17"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d2660630f15626b8", "name": "CVE-2021-3749: axios 0.21.1 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2021-3749: axios 0.21.1 \u2014 package-lock.json"}, "fullDescription": {"text": "nodejs-axios: Regular expression denial of service in trim function\n\naxios is vulnerable to Inefficient Regular Expression Complexity\n\nPackage: axios\nInstalled: 0.21.1\nFixed in: 0.21.2\nSeverity: HIGH\nFix: Upgrade axios to 0.21.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-0a1443acc060deee", "name": "CVE-2025-27152: axios 0.21.1 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2025-27152: axios 0.21.1 \u2014 package-lock.json"}, "fullDescription": {"text": "axios: Possible SSRF and Credential Leakage via Absolute URL in axios Requests\n\naxios is a promise based HTTP client for the browser and node.js. The issue occurs when passing absolute URLs rather than protocol-relative URLs to axios. Even if \u2060baseURL is set, axios sends the request to the specified absolute URL, potentially causing SSRF and credential leakage. This issue impacts both server-side and client-side usage of axios. This issue is fixed in 1.8.2.\n\nPackage: axios\nInstalled: 0.21.1\nFixed in: 1.8.2, 0.30.0\nSeverity: HIGH\nFix: Upgrade axios to 1.8.2, 0.30.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-597e30675ab7a0c7", "name": "CVE-2026-25639: axios 0.21.1 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-25639: axios 0.21.1 \u2014 package-lock.json"}, "fullDescription": {"text": "axios: Axios affected by Denial of Service via __proto__ Key in mergeConfig\n\nAxios is a promise based HTTP client for the browser and Node.js. Prior to versions 0.30.3 and 1.13.5, the mergeConfig function in axios crashes with a TypeError when processing configuration objects containing __proto__ as an own property. An attacker can trigger this by providing a malicious configuration object created via JSON.parse(), causing complete denial of service. This vulnerability is fixed in versions 0.30.3 and 1.13.5.\n\nPackage: axios\nInstalled: 0.21.1\nFixed in: 1.13.5, 0.30.3\nSeverity: HIGH\nFix: Upgrade axios to 1.13.5, 0.30.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-800d5f61992aff53", "name": "CVE-2026-42033: axios 0.21.1 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-42033: axios 0.21.1 \u2014 package-lock.json"}, "fullDescription": {"text": "axios: Axios: HTTP Transport Hijacking via Prototype Pollution\n\nAxios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, when Object.prototype has been polluted by any co-dependency with keys that axios reads without a hasOwnProperty guard, an attacker can (a) silently intercept and modify every JSON response before the application sees it, or (b) fully hijack the underlying HTTP transport, gaining access to request credentials, headers, and body. The precondition is prototype pollution from a separate source in the same \n\nPackage: axios\nInstalled: 0.21.1\nFixed in: 1.15.1, 0.31.1\nSeverity: HIGH\nFix: Upgrade axios to 1.15.1, 0.31.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-dca1059da9c88f6d", "name": "CVE-2026-42035: axios 0.21.1 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-42035: axios 0.21.1 \u2014 package-lock.json"}, "fullDescription": {"text": "axios: Axios: Arbitrary HTTP header injection via prototype pollution\n\nAxios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, a prototype pollution gadget exists in the Axios HTTP adapter (lib/adapters/http.js) that allows an attacker to inject arbitrary HTTP headers into outgoing requests. The vulnerability exploits duck-type checking of the data payload, where if Object.prototype is polluted with getHeaders, append, pipe, on, once, and Symbol.toStringTag, Axios misidentifies any plain object payload as a FormData instance an\n\nPackage: axios\nInstalled: 0.21.1\nFixed in: 1.15.1, 0.31.1\nSeverity: HIGH\nFix: Upgrade axios to 1.15.1, 0.31.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-45d86d60ecdcb642", "name": "CVE-2026-42043: axios 0.21.1 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-42043: axios 0.21.1 \u2014 package-lock.json"}, "fullDescription": {"text": "axios: Axios: NO_PROXY bypass via crafted URL\n\nAxios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, an attacker who can influence the target URL of an Axios request can use any address in the 127.0.0.0/8 range (other than 127.0.0.1) to completely bypass the NO_PROXY protection. This vulnerability is due to an incomplete for CVE-2025-62718, This vulnerability is fixed in 1.15.1 and 0.31.1.\n\nPackage: axios\nInstalled: 0.21.1\nFixed in: 1.15.1, 0.31.1\nSeverity: HIGH\nFix: Upgrade axios to 1.15.1, 0.31.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-0df222d4dab697fa", "name": "CVE-2026-44486: axios 0.21.1 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-44486: axios 0.21.1 \u2014 package-lock.json"}, "fullDescription": {"text": "axios: Axios: Information disclosure of proxy credentials via HTTP redirects\n\nAxios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios\u2019 Node.js HTTP adapter can leak proxy credentials to a redirect target in affected versions. When a request is sent through an authenticated proxy, Axios may add a Proxy-Authorization header. If Axios then follows a redirect and the redirected request is no longer sent through that proxy, the stale Proxy-Authorization header can remain on the redirected request and be sent to the redirect target. T\n\nPackage: axios\nInstalled: 0.21.1\nFixed in: 1.16.0, 0.32.0\nSeverity: HIGH\nFix: Upgrade axios to 1.16.0, 0.32.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-f9b38b84ad8723a9", "name": "CVE-2026-44487: axios 0.21.1 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-44487: axios 0.21.1 \u2014 package-lock.json"}, "fullDescription": {"text": "axios: Axios: Information disclosure of proxy credentials via redirect flows\n\nAxios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios\u2019s Node.js HTTP adapter may forward a Proxy-Authorization header to a redirected origin during specific proxy-to-direct redirect flows. This affects Node.js usage, where an initial HTTP request is sent through an authenticated HTTP proxy, redirects are followed, and the redirected URL is no longer proxied. Under affected redirect shapes, the final origin can receive the proxy credential that was in\n\nPackage: axios\nInstalled: 0.21.1\nFixed in: 1.16.0, 0.32.0\nSeverity: HIGH\nFix: Upgrade axios to 1.16.0, 0.32.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-2b7baa243b9e29e5", "name": "CVE-2026-44492: axios 0.21.1 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-44492: axios 0.21.1 \u2014 package-lock.json"}, "fullDescription": {"text": "axios: Axios: Proxy bypass via IPv4-mapped IPv6 address non-normalization\n\nAxios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios does not normalise IPv4-mapped IPv6 addresses. When NO_PROXY lists an IPv4 address such as 127.0.0.1 or 169.254.169.254, a request URL using the IPv4-mapped IPv6 form (::ffff:7f00:1, ::ffff:a9fe:a9fe) still routes through the configured proxy. Node.js resolves these addresses to the underlying IPv4 host, so the request reaches the internal service via the proxy rather than being blocked. This vuln\n\nPackage: axios\nInstalled: 0.21.1\nFixed in: 1.16.0, 0.32.0\nSeverity: HIGH\nFix: Upgrade axios to 1.16.0, 0.32.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-77c0f79a6d73efb1", "name": "CVE-2026-44495: axios 0.21.1 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-44495: axios 0.21.1 \u2014 package-lock.json"}, "fullDescription": {"text": "axios: Axios: Information disclosure due to prototype pollution vulnerability\n\nAxios is a promise based HTTP client for the browser and Node.js. From 0.19.0 to before 0.31.1 and 1.15.2, Axios contains prototype-pollution gadgets in request config processing. If another vulnerability in the same JavaScript process has already polluted Object.prototype.transformResponse, affected Axios versions may treat that inherited value as request configuration or as an option validator. Axios does not itself create the prototype pollution. Exploitability requires a separate prototype-p\n\nPackage: axios\nInstalled: 0.21.1\nFixed in: 1.15.2, 0.31.1\nSeverity: HIGH\nFix: Upgrade axios to 1.15.2, 0.31.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-8c26937691458f36", "name": "CVE-2026-44496: axios 0.21.1 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-44496: axios 0.21.1 \u2014 package-lock.json"}, "fullDescription": {"text": "axios: Axios: Client-side Denial of Service via unescaped regex metacharacters in XSRF cookie name\n\nAxios is a promise based HTTP client for the browser and Node.js. Axios versions before 0.32.0 on the 0.x line and before 1.16.0 on the 1.x line build a regular expression from the configured XSRF cookie name without escaping regex metacharacters. In standard browser environments, an attacker who can influence the cookie name passed to axios can cause expensive regex backtracking while axios reads document.cookie. The practical impact is client-side availability degradation, such as freezing the\n\nPackage: axios\nInstalled: 0.21.1\nFixed in: 1.16.0, 0.32.0\nSeverity: HIGH\nFix: Upgrade axios to 1.16.0, 0.32.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-3f2aa757bcfc4630", "name": "CVE-2023-45857: axios 0.21.1 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2023-45857: axios 0.21.1 \u2014 package-lock.json"}, "fullDescription": {"text": "axios: exposure of confidential data stored in cookies\n\nAn issue discovered in Axios 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-XSRF-TOKEN for every request made to any host allowing attackers to view sensitive information.\n\nPackage: axios\nInstalled: 0.21.1\nFixed in: 1.6.0, 0.28.0\nSeverity: MEDIUM\nFix: Upgrade axios to 1.6.0, 0.28.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-efce36aa5d24bc7d", "name": "CVE-2025-62718: axios 0.21.1 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2025-62718: axios 0.21.1 \u2014 package-lock.json"}, "fullDescription": {"text": "axios: Axios: Server-Side Request Forgery and proxy bypass due to improper hostname normalization\n\nAxios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.0 and 0.31.0, Axios does not correctly handle hostname normalization when checking NO_PROXY rules. Requests to loopback addresses like localhost. (with a trailing dot) or [::1] (IPv6 literal) skip NO_PROXY matching and go through the configured proxy. This goes against what developers expect and lets attackers force requests through a proxy, even if NO_PROXY is set up to protect loopback or internal services. This is\n\nPackage: axios\nInstalled: 0.21.1\nFixed in: 1.15.0, 0.31.0\nSeverity: MEDIUM\nFix: Upgrade axios to 1.15.0, 0.31.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0a23db566c67c538", "name": "CVE-2026-40175: axios 0.21.1 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-40175: axios 0.21.1 \u2014 package-lock.json"}, "fullDescription": {"text": "axios: Axios: Remote Code Execution via Prototype Pollution escalation\n\nAxios is a promise based HTTP client for the browser and Node.js. Versions prior to 1.15.0 and 0.3.1 are vulnerable to a specific gadget-style attack chain in which prototype pollution in a third-party dependency may be leveraged to inject unsanitized header values into outbound requests. This vulnerability is fixed in 1.15.0 and 0.3.1.\n\nPackage: axios\nInstalled: 0.21.1\nFixed in: 1.15.0, 0.31.0\nSeverity: MEDIUM\nFix: Upgrade axios to 1.15.0, 0.31.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3869ab06a7324275", "name": "CVE-2026-42034: axios 0.21.1 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-42034: axios 0.21.1 \u2014 package-lock.json"}, "fullDescription": {"text": "axios: Axios: Denial of Service via oversized streamed uploads bypassing body limits\n\nAxios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, for stream request bodies, maxBodyLength is bypassed when maxRedirects is set to 0 (native http/https transport path). Oversized streamed uploads are sent fully even when the caller sets strict body limits. This vulnerability is fixed in 1.15.1 and 0.31.1.\n\nPackage: axios\nInstalled: 0.21.1\nFixed in: 1.15.1, 0.31.1\nSeverity: MEDIUM\nFix: Upgrade axios to 1.15.1, 0.31.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1e209100520a6937", "name": "CVE-2026-42036: axios 0.21.1 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-42036: axios 0.21.1 \u2014 package-lock.json"}, "fullDescription": {"text": "axios: Axios: Denial of Service via unbounded stream consumption when 'responseType: 'stream'' is used\n\nAxios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, when responseType: 'stream' is used, Axios returns the response stream without enforcing maxContentLength. This bypasses configured response-size limits and allows unbounded downstream consumption. This vulnerability is fixed in 1.15.1 and 0.31.1.\n\nPackage: axios\nInstalled: 0.21.1\nFixed in: 1.15.1, 0.31.1\nSeverity: MEDIUM\nFix: Upgrade axios to 1.15.1, 0.31.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b927b5ee0087d4c4", "name": "CVE-2026-42038: axios 0.21.1 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-42038: axios 0.21.1 \u2014 package-lock.json"}, "fullDescription": {"text": "axios: Axios: Information disclosure due to `no_proxy` bypass\n\nAxios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, he fix for no_proxy hostname normalization bypass is incomplete. When no_proxy=localhost is set, requests to 127.0.0.1 and [::1] still route through the proxy instead of bypassing it. The shouldBypassProxy() function does pure string matching \u2014 it does not resolve IP aliases or loopback equivalents. This vulnerability is fixed in 1.15.1 and 0.31.1.\n\nPackage: axios\nInstalled: 0.21.1\nFixed in: 1.15.1, 0.31.1\nSeverity: MEDIUM\nFix: Upgrade axios to 1.15.1, 0.31.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-158794895c964af5", "name": "CVE-2026-42039: axios 0.21.1 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-42039: axios 0.21.1 \u2014 package-lock.json"}, "fullDescription": {"text": "axios: Node.js: Axios: Denial of Service via unbounded recursion in toFormData with deeply nested request data\n\nAxios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, toFormData recursively walks nested objects with no depth limit, so a deeply nested value passed as request data crashes the Node.js process with a RangeError. This vulnerability is fixed in 1.15.1 and 0.31.1.\n\nPackage: axios\nInstalled: 0.21.1\nFixed in: 1.15.1, 0.31.1\nSeverity: MEDIUM\nFix: Upgrade axios to 1.15.1, 0.31.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f0515806b65098fe", "name": "CVE-2026-42041: axios 0.21.1 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-42041: axios 0.21.1 \u2014 package-lock.json"}, "fullDescription": {"text": "axios: Axios: Authentication bypass due to prototype pollution of HTTP error handling\n\nAxios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, the Axios library is vulnerable to a Prototype Pollution \"Gadget\" attack that allows any Object.prototype pollution to silently suppress all HTTP error responses (401, 403, 500, etc.), causing them to be treated as successful responses. This completely bypasses application-level authentication and error handling. The root cause is that validateStatus is the only config property using the mergeDirectKeys\n\nPackage: axios\nInstalled: 0.21.1\nFixed in: 1.15.1, 0.31.1\nSeverity: MEDIUM\nFix: Upgrade axios to 1.15.1, 0.31.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-391f2496afe3ebfe", "name": "CVE-2026-42042: axios 0.21.1 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-42042: axios 0.21.1 \u2014 package-lock.json"}, "fullDescription": {"text": "axios: Axios: XSRF token bypass leading to information disclosure\n\nAxios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, the Axios library's XSRF token protection logic uses JavaScript truthy/falsy semantics instead of strict boolean comparison for the withXSRFToken config property. When this property is set to any truthy non-boolean value (via prototype pollution or misconfiguration), the same-origin check (isURLSameOrigin) is short-circuited, causing XSRF tokens to be sent to all request targets including cross-origin s\n\nPackage: axios\nInstalled: 0.21.1\nFixed in: 1.15.1, 0.31.1\nSeverity: MEDIUM\nFix: Upgrade axios to 1.15.1, 0.31.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-654af4ce5630fc80", "name": "CVE-2026-44490: axios 0.21.1 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-44490: axios 0.21.1 \u2014 package-lock.json"}, "fullDescription": {"text": "axios: Axios: Information disclosure and denial of service due to prototype pollution\n\nAxios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, axios exposes two read-side prototype-pollution gadgets. When Object.prototype is polluted by an upstream dependency in the same process (e.g. lodash _.merge / CVE-2018-16487), axios silently picks up the polluted values. (1) lib/utils.js line 406 builds merge()'s accumulator as result = {}, so result[targetKey] (line 414) walks Object.prototype and the polluted bucket's own keys are copied into the mer\n\nPackage: axios\nInstalled: 0.21.1\nFixed in: 1.16.0, 0.32.0\nSeverity: MEDIUM\nFix: Upgrade axios to 1.16.0, 0.32.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-db121f64890c360f", "name": "GHSA-7q8q-rj6j-mhjq: axios 0.21.1 \u2014 package-lock.json", "shortDescription": {"text": "GHSA-7q8q-rj6j-mhjq: axios 0.21.1 \u2014 package-lock.json"}, "fullDescription": {"text": "Axios: Nested axios option objects can consume polluted prototype values\n\n## Summary\n\nAxios can consume inherited properties from nested request option objects when the JavaScript process already has a polluted `Object.prototype`.\n\nThe top-level merged config is protected with a null prototype, but nested plain objects such as `auth` and `paramsSerializer` are cloned into ordinary objects. If application code passes placeholders such as `auth: {}` or `paramsSerializer: {}`, inherited `username`, `password`, `encode`, or `serialize` properties can influence outbound re\n\nPackage: axios\nInstalled: 0.21.1\nFixed in: 0.33.0, 1.18.0\nSeverity: MEDIUM\nFix: Upgrade axios to 0.33.0, 1.18.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3d044307b927c282", "name": "GHSA-mmx7-hfxf-jppx: axios 0.21.1 \u2014 package-lock.json", "shortDescription": {"text": "GHSA-mmx7-hfxf-jppx: axios 0.21.1 \u2014 package-lock.json"}, "fullDescription": {"text": "Axios: Prototype pollution gadgets can alter axios request construction\n\n## Summary\n\naxios is vulnerable to read-side prototype-pollution gadgets when `Object.prototype` has already been polluted by another vulnerability or dependency. The most broadly reachable issue is in the bodyless method aliases: `axios.get()`, `axios.delete()`, `axios.head()`, and `axios.options()` read inherited `data` before config normalization, causing attacker-controlled body data to be sent on requests that did not explicitly set a body.\n\nAdditional low-level paths affect consumers that \n\nPackage: axios\nInstalled: 0.21.1\nFixed in: 1.18.0, 0.33.0\nSeverity: MEDIUM\nFix: Upgrade axios to 1.18.0, 0.33.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c40cc096688de181", "name": "CVE-2026-42040: axios 0.21.1 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-42040: axios 0.21.1 \u2014 package-lock.json"}, "fullDescription": {"text": "axios: Axios: Incorrect null byte handling can lead to data integrity issues\n\nAxios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, the encode() function in lib/helpers/AxiosURLSearchParams.js contains a character mapping (charMap) at line 21 that reverses the safe percent-encoding of null bytes. After encodeURIComponent('\\x00') correctly produces the safe sequence %00, the charMap entry '%00': '\\x00' converts it back to a raw null byte. Primary impact is limited because the standard axios request flow is not affected. This vulnerab\n\nPackage: axios\nInstalled: 0.21.1\nFixed in: 1.15.1, 0.31.1\nSeverity: LOW\nFix: Upgrade axios to 1.15.1, 0.31.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-aa4e72e3a4e7655f", "name": "CVE-2022-1650: eventsource 1.1.0 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2022-1650: eventsource 1.1.0 \u2014 package-lock.json"}, "fullDescription": {"text": "eventsource: Exposure of Sensitive Information\n\nImproper Removal of Sensitive Information Before Storage or Transfer in GitHub repository eventsource/eventsource prior to v2.0.2.\n\nPackage: eventsource\nInstalled: 1.1.0\nFixed in: 1.1.1, 2.0.2\nSeverity: CRITICAL\nFix: Upgrade eventsource to 1.1.1, 2.0.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-92925efb16e1066f", "name": "CVE-2022-0155: follow-redirects 1.14.1 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2022-0155: follow-redirects 1.14.1 \u2014 package-lock.json"}, "fullDescription": {"text": "follow-redirects: Exposure of Private Personal Information to an Unauthorized Actor\n\nfollow-redirects is vulnerable to Exposure of Private Personal Information to an Unauthorized Actor\n\nPackage: follow-redirects\nInstalled: 1.14.1\nFixed in: 1.14.7\nSeverity: HIGH\nFix: Upgrade follow-redirects to 1.14.7"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-be85dad0fd66afbe", "name": "CVE-2022-0536: follow-redirects 1.14.1 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2022-0536: follow-redirects 1.14.1 \u2014 package-lock.json"}, "fullDescription": {"text": "follow-redirects: Exposure of Sensitive Information via Authorization Header leak\n\nImproper Removal of Sensitive Information Before Storage or Transfer in NPM follow-redirects prior to 1.14.8.\n\nPackage: follow-redirects\nInstalled: 1.14.1\nFixed in: 1.14.8\nSeverity: MEDIUM\nFix: Upgrade follow-redirects to 1.14.8"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-da099b9649335199", "name": "CVE-2023-26159: follow-redirects 1.14.1 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2023-26159: follow-redirects 1.14.1 \u2014 package-lock.json"}, "fullDescription": {"text": "follow-redirects: Improper Input Validation due to the improper handling of URLs by the url.parse()\n\nVersions of the package follow-redirects before 1.15.4 are vulnerable to Improper Input Validation due to the improper handling of URLs by the url.parse() function. When new URL() throws an error, it can be manipulated to misinterpret the hostname. An attacker could exploit this weakness to redirect traffic to a malicious site, potentially leading to information disclosure, phishing attacks, or other security breaches.\n\nPackage: follow-redirects\nInstalled: 1.14.1\nFixed in: 1.15.4\nSeverity: MEDIUM\nFix: Upgrade follow-redirects to 1.15.4"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e0bee8a03f71f3ae", "name": "CVE-2024-28849: follow-redirects 1.14.1 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2024-28849: follow-redirects 1.14.1 \u2014 package-lock.json"}, "fullDescription": {"text": "follow-redirects: Possible credential leak\n\nfollow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects. In affected versions follow-redirects only clears authorization header during cross-domain redirect, but keep the proxy-authentication header which contains credentials too. This vulnerability may lead to credentials leak, but has been addressed in version 1.15.6. Users are advised to upgrade. There are no known workarounds for this vulnerability.\n\nPackage: follow-redirects\nInstalled: 1.14.1\nFixed in: 1.15.6\nSeverity: MEDIUM\nFix: Upgrade follow-redirects to 1.15.6"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5a09c327f3a8ab17", "name": "GHSA-r4q5-vmmm-2653: follow-redirects 1.14.1 \u2014 package-lock.json", "shortDescription": {"text": "GHSA-r4q5-vmmm-2653: follow-redirects 1.14.1 \u2014 package-lock.json"}, "fullDescription": {"text": "follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Targets\n\n## Summary\n\nWhen an HTTP request follows a cross-domain redirect (301/302/307/308), `follow-redirects` only strips `authorization`, `proxy-authorization`, and `cookie` headers (matched by regex at index.js:469-476). Any custom authentication header (e.g., `X-API-Key`, `X-Auth-Token`, `Api-Key`, `Token`) is forwarded verbatim to the redirect target.\n\nSince `follow-redirects` is the redirect-handling dependency for **axios** (105K+ stars), this vulnerability affects the entire axios ecosystem.\n\n##\n\nPackage: follow-redirects\nInstalled: 1.14.1\nFixed in: 1.16.0\nSeverity: MEDIUM\nFix: Upgrade follow-redirects to 1.16.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ac3d9d9437c6a651", "name": "CVE-2021-23337: lodash 4.17.19 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2021-23337: lodash 4.17.19 \u2014 package-lock.json"}, "fullDescription": {"text": "nodejs-lodash: command injection via template\n\nLodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.\n\nPackage: lodash\nInstalled: 4.17.19\nFixed in: 4.17.21\nSeverity: HIGH\nFix: Upgrade lodash to 4.17.21"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-85d2249300711840", "name": "CVE-2026-4800: lodash 4.17.19 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-4800: lodash 4.17.19 \u2014 package-lock.json"}, "fullDescription": {"text": "lodash: lodash: Arbitrary code execution via untrusted input in template imports\n\nImpact:\n\nThe fix for CVE-2021-23337 (https://github.com/advisories/GHSA-35jh-r3h4-6jhm) added validation for the variable option in _.template but did not apply the same validation to options.imports key names. Both paths flow into the same Function() constructor sink.\n\nWhen an application passes untrusted input as options.imports key names, an attacker can inject default-parameter expressions that execute arbitrary code at template compilation time.\n\nAdditionally, _.template uses assignInWith t\n\nPackage: lodash\nInstalled: 4.17.19\nFixed in: 4.18.0\nSeverity: HIGH\nFix: Upgrade lodash to 4.18.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-4736589863bfcb55", "name": "CVE-2020-28500: lodash 4.17.19 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2020-28500: lodash 4.17.19 \u2014 package-lock.json"}, "fullDescription": {"text": "nodejs-lodash: ReDoS via the toNumber, trim and trimEnd functions\n\nLodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions.\n\nPackage: lodash\nInstalled: 4.17.19\nFixed in: 4.17.21\nSeverity: MEDIUM\nFix: Upgrade lodash to 4.17.21"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6bfd89211996784d", "name": "CVE-2025-13465: lodash 4.17.19 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2025-13465: lodash 4.17.19 \u2014 package-lock.json"}, "fullDescription": {"text": "lodash: prototype pollution in _.unset and _.omit functions\n\nLodash versions 4.0.0 through 4.17.22 are vulnerable to prototype pollution in the _.unset\u00a0and _.omit\u00a0functions. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes.\n\nThe issue permits deletion of properties but does not allow overwriting their original behavior.\n\nThis issue is patched on 4.17.23\n\nPackage: lodash\nInstalled: 4.17.19\nFixed in: 4.17.23\nSeverity: MEDIUM\nFix: Upgrade lodash to 4.17.23"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a6e9bab8319b0f2f", "name": "CVE-2026-2950: lodash 4.17.19 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-2950: lodash 4.17.19 \u2014 package-lock.json"}, "fullDescription": {"text": "lodash: Lodash: Prototype pollution allows deletion of built-in prototype properties via array path bypass\n\nImpact:\n\nLodash versions 4.17.23 and earlier are vulnerable to prototype pollution in the _.unset and _.omit functions. The fix for (CVE-2025-13465: https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg) only guards against string key members, so an attacker can bypass the check by passing array-wrapped path segments. This allows deletion of properties from built-in prototypes such as Object.prototype, Number.prototype, and String.prototype.\n\nThe issue permits deletion of prot\n\nPackage: lodash\nInstalled: 4.17.19\nFixed in: 4.18.0\nSeverity: MEDIUM\nFix: Upgrade lodash to 4.18.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-67573213d8f59458", "name": "CVE-2022-0235: node-fetch 1.7.1 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2022-0235: node-fetch 1.7.1 \u2014 package-lock.json"}, "fullDescription": {"text": "node-fetch: exposure of sensitive information to an unauthorized actor\n\nnode-fetch is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor\n\nPackage: node-fetch\nInstalled: 1.7.1\nFixed in: 3.1.1, 2.6.7\nSeverity: HIGH\nFix: Upgrade node-fetch to 3.1.1, 2.6.7"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-cfee53392395806d", "name": "CVE-2024-45296: path-to-regexp 1.7.0 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2024-45296: path-to-regexp 1.7.0 \u2014 package-lock.json"}, "fullDescription": {"text": "path-to-regexp: Backtracking regular expressions cause ReDoS\n\npath-to-regexp turns path strings into a regular expressions. In certain cases, path-to-regexp will output a regular expression that can be exploited to cause poor performance. Because JavaScript is single threaded and regex matching runs on the main thread, poor performance will block the event loop and lead to a DoS. The bad regular expression is generated any time you have two parameters within a single segment, separated by something that is not a period (.). For users of 0.1, upgrade to 0.1\n\nPackage: path-to-regexp\nInstalled: 1.7.0\nFixed in: 1.9.0, 0.1.10, 8.0.0, 3.3.0, 6.3.0\nSeverity: HIGH\nFix: Upgrade path-to-regexp to 1.9.0, 0.1.10, 8.0.0, 3.3.0, 6.3.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-c498ff348f66df08", "name": "CVE-2018-6341: react-dom 16.0.0 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2018-6341: react-dom 16.0.0 \u2014 package-lock.json"}, "fullDescription": {"text": "Cross-Site Scripting in react-dom\n\nReact applications which rendered to HTML using the ReactDOMServer API were not escaping user-supplied attribute names at render-time. That lack of escaping could lead to a cross-site scripting vulnerability. This issue affected minor releases 16.0.x, 16.1.x, 16.2.x, 16.3.x, and 16.4.x. It was fixed in 16.0.1, 16.1.2, 16.2.1, 16.3.3, and 16.4.2.\n\nPackage: react-dom\nInstalled: 16.0.0\nFixed in: 16.0.1, 16.1.2, 16.2.1, 16.3.3, 16.4.2\nSeverity: MEDIUM\nFix: Upgrade react-dom to 16.0.1, 16.1.2, 16.2.1, 16.3.3, 16.4.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e7638ad32c5f3034", "name": "CVE-2025-9288: sha.js 2.4.11 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2025-9288: sha.js 2.4.11 \u2014 package-lock.json"}, "fullDescription": {"text": "sha.js: Missing type checks leading to hash rewind and passing on crafted data\n\nImproper Input Validation vulnerability in sha.js allows Input Data Manipulation.This issue affects sha.js: through 2.4.11.\n\nPackage: sha.js\nInstalled: 2.4.11\nFixed in: 2.4.12\nSeverity: CRITICAL\nFix: Upgrade sha.js to 2.4.12"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-e7bd2cc80bfa786a", "name": "CVE-2020-7733: ua-parser-js 0.7.14 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2020-7733: ua-parser-js 0.7.14 \u2014 package-lock.json"}, "fullDescription": {"text": "nodejs-ua-parser-js: Regular expression denial of service via the regex\n\nThe package ua-parser-js before 0.7.22 are vulnerable to Regular Expression Denial of Service (ReDoS) via the regex for Redmi Phones and Mi Pad Tablets UA.\n\nPackage: ua-parser-js\nInstalled: 0.7.14\nFixed in: 0.7.22\nSeverity: HIGH\nFix: Upgrade ua-parser-js to 0.7.22"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-fa5cffe031941e6c", "name": "CVE-2020-7793: ua-parser-js 0.7.14 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2020-7793: ua-parser-js 0.7.14 \u2014 package-lock.json"}, "fullDescription": {"text": "nodejs-ua-parser-js: ReDoS in multiple regexes\n\nThe package ua-parser-js before 0.7.23 are vulnerable to Regular Expression Denial of Service (ReDoS) in multiple regexes (see linked commit for more info).\n\nPackage: ua-parser-js\nInstalled: 0.7.14\nFixed in: 0.7.23\nSeverity: HIGH\nFix: Upgrade ua-parser-js to 0.7.23"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-e95bab6c7ef8920b", "name": "CVE-2021-27292: ua-parser-js 0.7.14 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2021-27292: ua-parser-js 0.7.14 \u2014 package-lock.json"}, "fullDescription": {"text": "nodejs-ua-parser-js: ReDoS via malicious User-Agent header\n\nua-parser-js >= 0.7.14, fixed in 0.7.24, uses a regular expression which is vulnerable to denial of service. If an attacker sends a malicious User-Agent header, ua-parser-js will get stuck processing it for an extended period of time.\n\nPackage: ua-parser-js\nInstalled: 0.7.14\nFixed in: 0.7.24\nSeverity: HIGH\nFix: Upgrade ua-parser-js to 0.7.24"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-80e79f10c9bace4a", "name": "CVE-2020-7733: ua-parser-js 0.7.21 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2020-7733: ua-parser-js 0.7.21 \u2014 package-lock.json"}, "fullDescription": {"text": "nodejs-ua-parser-js: Regular expression denial of service via the regex\n\nThe package ua-parser-js before 0.7.22 are vulnerable to Regular Expression Denial of Service (ReDoS) via the regex for Redmi Phones and Mi Pad Tablets UA.\n\nPackage: ua-parser-js\nInstalled: 0.7.21\nFixed in: 0.7.22\nSeverity: HIGH\nFix: Upgrade ua-parser-js to 0.7.22"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-48d5a9af563123f8", "name": "CVE-2020-7793: ua-parser-js 0.7.21 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2020-7793: ua-parser-js 0.7.21 \u2014 package-lock.json"}, "fullDescription": {"text": "nodejs-ua-parser-js: ReDoS in multiple regexes\n\nThe package ua-parser-js before 0.7.23 are vulnerable to Regular Expression Denial of Service (ReDoS) in multiple regexes (see linked commit for more info).\n\nPackage: ua-parser-js\nInstalled: 0.7.21\nFixed in: 0.7.23\nSeverity: HIGH\nFix: Upgrade ua-parser-js to 0.7.23"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-f272ac92cd951ac6", "name": "CVE-2021-27292: ua-parser-js 0.7.21 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2021-27292: ua-parser-js 0.7.21 \u2014 package-lock.json"}, "fullDescription": {"text": "nodejs-ua-parser-js: ReDoS via malicious User-Agent header\n\nua-parser-js >= 0.7.14, fixed in 0.7.24, uses a regular expression which is vulnerable to denial of service. If an attacker sends a malicious User-Agent header, ua-parser-js will get stuck processing it for an extended period of time.\n\nPackage: ua-parser-js\nInstalled: 0.7.21\nFixed in: 0.7.24\nSeverity: HIGH\nFix: Upgrade ua-parser-js to 0.7.24"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-21bd8651c1cfdc95", "name": "CVE-2021-27516: urijs 1.19.5 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2021-27516: urijs 1.19.5 \u2014 package-lock.json"}, "fullDescription": {"text": "nodejs-urijs: mishandling certain uses of backslash may lead to confidentiality compromise\n\nURI.js (aka urijs) before 1.19.6 mishandles certain uses of backslash such as http:\\/ and interprets the URI as a relative path.\n\nPackage: urijs\nInstalled: 1.19.5\nFixed in: 1.19.6\nSeverity: HIGH\nFix: Upgrade urijs to 1.19.6"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-828585b8f5abfc76", "name": "CVE-2022-1243: urijs 1.19.5 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2022-1243: urijs 1.19.5 \u2014 package-lock.json"}, "fullDescription": {"text": "Incorrect protocol extraction via \\r, \\n and \\t characters\n\nCRHTLF can lead to invalid protocol extraction potentially leading to XSS in GitHub repository medialize/uri.js prior to 1.19.11.\n\nPackage: urijs\nInstalled: 1.19.5\nFixed in: 1.19.11\nSeverity: HIGH\nFix: Upgrade urijs to 1.19.11"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-9ba9e2817ed9713c", "name": "CVE-2021-3647: urijs 1.19.5 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2021-3647: urijs 1.19.5 \u2014 package-lock.json"}, "fullDescription": {"text": "URIjs Vulnerable to Hostname spoofing via backslashes in URL \n\nURI.js is vulnerable to URL Redirection to Untrusted Site\n\nPackage: urijs\nInstalled: 1.19.5\nFixed in: 1.19.7\nSeverity: MEDIUM\nFix: Upgrade urijs to 1.19.7"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9920b549d92b5f86", "name": "CVE-2022-0613: urijs 1.19.5 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2022-0613: urijs 1.19.5 \u2014 package-lock.json"}, "fullDescription": {"text": "urijs: Authorization Bypass Through User-Controlled Key\n\nAuthorization Bypass Through User-Controlled Key in NPM urijs prior to 1.19.8.\n\nPackage: urijs\nInstalled: 1.19.5\nFixed in: 1.19.8\nSeverity: MEDIUM\nFix: Upgrade urijs to 1.19.8"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3fce5596f26dbee6", "name": "CVE-2022-0868: urijs 1.19.5 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2022-0868: urijs 1.19.5 \u2014 package-lock.json"}, "fullDescription": {"text": "Open Redirect in urijs\n\nOpen Redirect in GitHub repository medialize/uri.js prior to 1.19.10.\n\nPackage: urijs\nInstalled: 1.19.5\nFixed in: 1.19.10\nSeverity: MEDIUM\nFix: Upgrade urijs to 1.19.10"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2935fed34c7521d3", "name": "CVE-2022-1233: urijs 1.19.5 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2022-1233: urijs 1.19.5 \u2014 package-lock.json"}, "fullDescription": {"text": "URL Confusion When Scheme Not Supplied in medialize/uri.js\n\nURL Confusion When Scheme Not Supplied in GitHub repository medialize/uri.js prior to 1.19.11.\n\nPackage: urijs\nInstalled: 1.19.5\nFixed in: 1.19.11\nSeverity: MEDIUM\nFix: Upgrade urijs to 1.19.11"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ed261b39fc95eba5", "name": "CVE-2022-24723: urijs 1.19.5 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2022-24723: urijs 1.19.5 \u2014 package-lock.json"}, "fullDescription": {"text": "urijs: Leading white space bypasses protocol validation\n\nURI.js is a Javascript URL mutation library. Before version 1.19.9, whitespace characters are not removed from the beginning of the protocol, so URLs are not parsed properly. This issue has been patched in version 1.19.9. Removing leading whitespace from values before passing them to URI.parse can be used as a workaround.\n\nPackage: urijs\nInstalled: 1.19.5\nFixed in: 1.19.9\nSeverity: MEDIUM\nFix: Upgrade urijs to 1.19.9"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-61fe7fae4fb8af59", "name": "CVE-2022-0686: url-parse 1.4.4 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2022-0686: url-parse 1.4.4 \u2014 package-lock.json"}, "fullDescription": {"text": "npm-url-parse: Authorization bypass through user-controlled key\n\nAuthorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.8.\n\nPackage: url-parse\nInstalled: 1.4.4\nFixed in: 1.5.8\nSeverity: CRITICAL\nFix: Upgrade url-parse to 1.5.8"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-ab28ef31e0a82943", "name": "CVE-2020-8124: url-parse 1.4.4 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2020-8124: url-parse 1.4.4 \u2014 package-lock.json"}, "fullDescription": {"text": "npmjs-url-parse: Improper validation of protocol of the returned URL\n\nInsufficient validation and sanitization of user input exists in url-parse npm package version 1.4.4 and earlier may allow attacker to bypass security checks.\n\nPackage: url-parse\nInstalled: 1.4.4\nFixed in: 1.4.5\nSeverity: MEDIUM\nFix: Upgrade url-parse to 1.4.5"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a12768849f1d59d2", "name": "CVE-2021-27515: url-parse 1.4.4 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2021-27515: url-parse 1.4.4 \u2014 package-lock.json"}, "fullDescription": {"text": "nodejs-url-parse: mishandling certain uses of backslash may lead to confidentiality compromise\n\nurl-parse before 1.5.0 mishandles certain uses of backslash such as http:\\/ and interprets the URI as a relative path.\n\nPackage: url-parse\nInstalled: 1.4.4\nFixed in: 1.5.0\nSeverity: MEDIUM\nFix: Upgrade url-parse to 1.5.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7cffa6fcaef3dc9e", "name": "CVE-2021-3664: url-parse 1.4.4 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2021-3664: url-parse 1.4.4 \u2014 package-lock.json"}, "fullDescription": {"text": "nodejs-url-parse: URL Redirection to Untrusted Site\n\nurl-parse is vulnerable to URL Redirection to Untrusted Site\n\nPackage: url-parse\nInstalled: 1.4.4\nFixed in: 1.5.2\nSeverity: MEDIUM\nFix: Upgrade url-parse to 1.5.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4eb0997dcf6461e2", "name": "CVE-2022-0512: url-parse 1.4.4 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2022-0512: url-parse 1.4.4 \u2014 package-lock.json"}, "fullDescription": {"text": "nodejs-url-parse: authorization bypass through user-controlled key\n\nAuthorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.6.\n\nPackage: url-parse\nInstalled: 1.4.4\nFixed in: 1.5.6\nSeverity: MEDIUM\nFix: Upgrade url-parse to 1.5.6"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ce491b1a5e8cec86", "name": "CVE-2022-0639: url-parse 1.4.4 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2022-0639: url-parse 1.4.4 \u2014 package-lock.json"}, "fullDescription": {"text": "npm-url-parse: Authorization Bypass Through User-Controlled Key\n\nAuthorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.7.\n\nPackage: url-parse\nInstalled: 1.4.4\nFixed in: 1.5.7\nSeverity: MEDIUM\nFix: Upgrade url-parse to 1.5.7"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e650c243bb448a74", "name": "CVE-2022-0691: url-parse 1.4.4 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2022-0691: url-parse 1.4.4 \u2014 package-lock.json"}, "fullDescription": {"text": "npm-url-parse: authorization bypass through user-controlled key\n\nAuthorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.9.\n\nPackage: url-parse\nInstalled: 1.4.4\nFixed in: 1.5.9\nSeverity: MEDIUM\nFix: Upgrade url-parse to 1.5.9"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3a3527e70129fb18", "name": "DS-0002: Image user should not be 'root' \u2014 Dockerfile", "shortDescription": {"text": "DS-0002: Image user should not be 'root' \u2014 Dockerfile"}, "fullDescription": {"text": "Image user should not be 'root'\n\nSpecify at least 1 USER command in Dockerfile with non-root user as argument\n\nRule: DS-0002\nSeverity: HIGH\nTarget: Dockerfile"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-3c4041c454cda88e", "name": "DS-0026: No HEALTHCHECK defined \u2014 Dockerfile", "shortDescription": {"text": "DS-0026: No HEALTHCHECK defined \u2014 Dockerfile"}, "fullDescription": {"text": "No HEALTHCHECK defined\n\nAdd HEALTHCHECK instruction in your Dockerfile\n\nRule: DS-0026\nSeverity: LOW\nTarget: Dockerfile"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fb218c59c373a619", "name": "KSV-0001: Can elevate its own privileges \u2014 kubernetes/config/app.yaml", "shortDescription": {"text": "KSV-0001: Can elevate its own privileges \u2014 kubernetes/config/app.yaml"}, "fullDescription": {"text": "Can elevate its own privileges\n\nContainer 'blockexplorer-app' of Deployment 'blockexplorer-app-deployment' should set 'securityContext.allowPrivilegeEscalation' to false\n\nRule: KSV-0001\nSeverity: MEDIUM\nTarget: kubernetes/config/app.yaml"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8c70e011f3531b53", "name": "KSV-0003: Default capabilities: some containers do not drop all \u2014 kubernetes/config/app.yaml", "shortDescription": {"text": "KSV-0003: Default capabilities: some containers do not drop all \u2014 kubernetes/config/app.yaml"}, "fullDescription": {"text": "Default capabilities: some containers do not drop all\n\nContainer 'blockexplorer-app' of Deployment 'blockexplorer-app-deployment' should add 'ALL' to 'securityContext.capabilities.drop'\n\nRule: KSV-0003\nSeverity: LOW\nTarget: kubernetes/config/app.yaml"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6469d17254c9da50", "name": "KSV-0004: Default capabilities: some containers do not drop any \u2014 kubernetes/config/app.yaml", "shortDescription": {"text": "KSV-0004: Default capabilities: some containers do not drop any \u2014 kubernetes/config/app.yaml"}, "fullDescription": {"text": "Default capabilities: some containers do not drop any\n\nContainer 'blockexplorer-app' of 'deployment' 'blockexplorer-app-deployment' in 'default' namespace should set securityContext.capabilities.drop\n\nRule: KSV-0004\nSeverity: LOW\nTarget: kubernetes/config/app.yaml"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cf565d38c238648e", "name": "KSV-0011: CPU not limited \u2014 kubernetes/config/app.yaml", "shortDescription": {"text": "KSV-0011: CPU not limited \u2014 kubernetes/config/app.yaml"}, "fullDescription": {"text": "CPU not limited\n\nContainer 'blockexplorer-app' of Deployment 'blockexplorer-app-deployment' should set 'resources.limits.cpu'\n\nRule: KSV-0011\nSeverity: LOW\nTarget: kubernetes/config/app.yaml"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e36561a3729a0e6b", "name": "KSV-0012: Runs as root user \u2014 kubernetes/config/app.yaml", "shortDescription": {"text": "KSV-0012: Runs as root user \u2014 kubernetes/config/app.yaml"}, "fullDescription": {"text": "Runs as root user\n\nContainer 'blockexplorer-app' of Deployment 'blockexplorer-app-deployment' should set 'securityContext.runAsNonRoot' to true\n\nRule: KSV-0012\nSeverity: MEDIUM\nTarget: kubernetes/config/app.yaml"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-010ccb7a4f87acad", "name": "KSV-0013: Image tag \":latest\" used \u2014 kubernetes/config/app.yaml", "shortDescription": {"text": "KSV-0013: Image tag \":latest\" used \u2014 kubernetes/config/app.yaml"}, "fullDescription": {"text": "Image tag \":latest\" used\n\nContainer 'blockexplorer-app' of Deployment 'blockexplorer-app-deployment' should specify an image tag\n\nRule: KSV-0013\nSeverity: MEDIUM\nTarget: kubernetes/config/app.yaml"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6799c22df6d32193", "name": "KSV-0014: Root file system is not read-only \u2014 kubernetes/config/app.yaml", "shortDescription": {"text": "KSV-0014: Root file system is not read-only \u2014 kubernetes/config/app.yaml"}, "fullDescription": {"text": "Root file system is not read-only\n\nContainer 'blockexplorer-app' of Deployment 'blockexplorer-app-deployment' should set 'securityContext.readOnlyRootFilesystem' to true\n\nRule: KSV-0014\nSeverity: HIGH\nTarget: kubernetes/config/app.yaml"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-b3bbe63e6e83ff08", "name": "KSV-0018: Memory not limited \u2014 kubernetes/config/app.yaml", "shortDescription": {"text": "KSV-0018: Memory not limited \u2014 kubernetes/config/app.yaml"}, "fullDescription": {"text": "Memory not limited\n\nContainer 'blockexplorer-app' of Deployment 'blockexplorer-app-deployment' should set 'resources.limits.memory'\n\nRule: KSV-0018\nSeverity: LOW\nTarget: kubernetes/config/app.yaml"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d679f6b832615bfd", "name": "KSV-0020: Runs with UID <= 10000 \u2014 kubernetes/config/app.yaml", "shortDescription": {"text": "KSV-0020: Runs with UID <= 10000 \u2014 kubernetes/config/app.yaml"}, "fullDescription": {"text": "Runs with UID <= 10000\n\nContainer 'blockexplorer-app' of Deployment 'blockexplorer-app-deployment' should set 'securityContext.runAsUser' > 10000\n\nRule: KSV-0020\nSeverity: LOW\nTarget: kubernetes/config/app.yaml"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-eab15aa4542691d7", "name": "KSV-0021: Runs with GID <= 10000 \u2014 kubernetes/config/app.yaml", "shortDescription": {"text": "KSV-0021: Runs with GID <= 10000 \u2014 kubernetes/config/app.yaml"}, "fullDescription": {"text": "Runs with GID <= 10000\n\nContainer 'blockexplorer-app' of Deployment 'blockexplorer-app-deployment' should set 'securityContext.runAsGroup' > 10000\n\nRule: KSV-0021\nSeverity: LOW\nTarget: kubernetes/config/app.yaml"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-dccd0d961a1b1e71", "name": "KSV-0030: Runtime/Default Seccomp profile not set \u2014 kubernetes/config/app.yaml", "shortDescription": {"text": "KSV-0030: Runtime/Default Seccomp profile not set \u2014 kubernetes/config/app.yaml"}, "fullDescription": {"text": "Runtime/Default Seccomp profile not set\n\nEither Pod or Container should set 'securityContext.seccompProfile.type' to 'RuntimeDefault'\n\nRule: KSV-0030\nSeverity: LOW\nTarget: kubernetes/config/app.yaml"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b27e0aa41f9e01c2", "name": "KSV-0104: Seccomp policies disabled \u2014 kubernetes/config/app.yaml", "shortDescription": {"text": "KSV-0104: Seccomp policies disabled \u2014 kubernetes/config/app.yaml"}, "fullDescription": {"text": "Seccomp policies disabled\n\ncontainer \"blockexplorer-app\" of deployment \"blockexplorer-app-deployment\" in \"default\" namespace should specify a seccomp profile\n\nRule: KSV-0104\nSeverity: MEDIUM\nTarget: kubernetes/config/app.yaml"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6bdaadde327d8c98", "name": "KSV-0106: Container capabilities must only include NET_BIND_SERVICE \u2014 kubernetes/config/app.yaml", "shortDescription": {"text": "KSV-0106: Container capabilities must only include NET_BIND_SERVICE \u2014 kubernetes/config/app.yaml"}, "fullDescription": {"text": "Container capabilities must only include NET_BIND_SERVICE\n\ncontainer should drop all\n\nRule: KSV-0106\nSeverity: LOW\nTarget: kubernetes/config/app.yaml"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9bb5e4877575959c", "name": "KSV-0110: Workloads in the default namespace \u2014 kubernetes/config/app.yaml", "shortDescription": {"text": "KSV-0110: Workloads in the default namespace \u2014 kubernetes/config/app.yaml"}, "fullDescription": {"text": "Workloads in the default namespace\n\ndeployment blockexplorer-app-deployment in default namespace should set metadata.namespace to a non-default namespace\n\nRule: KSV-0110\nSeverity: LOW\nTarget: kubernetes/config/app.yaml"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-43fa07d96cdfeba0", "name": "KSV-0117: Prevent binding to privileged ports \u2014 kubernetes/config/app.yaml", "shortDescription": {"text": "KSV-0117: Prevent binding to privileged ports \u2014 kubernetes/config/app.yaml"}, "fullDescription": {"text": "Prevent binding to privileged ports\n\ndeployment blockexplorer-app-deployment in default namespace should not set spec.template.spec.containers.ports.containerPort to less than 1024\n\nRule: KSV-0117\nSeverity: MEDIUM\nTarget: kubernetes/config/app.yaml"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b20a98e350b71b9e", "name": "KSV-0118: Default security context configured \u2014 kubernetes/config/app.yaml", "shortDescription": {"text": "KSV-0118: Default security context configured \u2014 kubernetes/config/app.yaml"}, "fullDescription": {"text": "Default security context configured\n\ncontainer blockexplorer-app-deployment in default namespace is using the default security context\n\nRule: KSV-0118\nSeverity: HIGH\nTarget: kubernetes/config/app.yaml"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-d63da3583b14afc0", "name": "Dockerfile runs as root: Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-938859eeaa5295e7", "name": "Docker base image is tag-pinned but not digest-pinned: node:13-alpine", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: node:13-alpine"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2f3178ddda7c2897", "name": "Docker base image is tag-pinned but not digest-pinned: nginx:alpine", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: nginx:alpine"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4e2334481968a763", "name": "Insecure pattern 'direct_innerhtml_assignment' in public/index.html:47", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in public/index.html:47"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.65}}, {"id": "scanner-a6fcbd66e95ea076", "name": "Insecure pattern 'dangerous_innerhtml' in src/components/shared/InfoBanner.js:23", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in src/components/shared/InfoBanner.js:23"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.65}}, {"id": "scanner-6372cebde0220094", "name": "No auth library detected", "shortDescription": {"text": "No auth library detected"}, "fullDescription": {"text": "The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). The repo has auth/admin/session surface indicators, so auth may live in custom code, in a separate service, or be missing."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4601e3ad3bb28677", "name": "No CI/CD pipelines detected", "shortDescription": {"text": "No CI/CD pipelines detected"}, "fullDescription": {"text": "No GitHub Actions, GitLab CI, or CircleCI configs found. Without CI you can't gate deploys on tests/lints."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea3b5e389d8c9c0f", "name": "Low test-to-source ratio", "shortDescription": {"text": "Low test-to-source ratio"}, "fullDescription": {"text": "14 tests / 98 src (ratio 0.14)."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 18 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-25f63eca90ff482c", "name": "Commented-code block (10 lines) in src/components/shared/InfoBanner.js:32", "shortDescription": {"text": "Commented-code block (10 lines) in src/components/shared/InfoBanner.js:32"}, "fullDescription": {"text": "5 of 10 consecutive comment lines look like executable statements. Confirm the block is obsolete, then delete it or recover it from git history when needed."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 0.72}}, {"id": "scanner-0eabfebc7c03d1f2", "name": "Frontend route `/accounts` has no Link/navigate to it \u2014 src/App.js", "shortDescription": {"text": "Frontend route `/accounts` has no Link/navigate to it \u2014 src/App.js"}, "fullDescription": {"text": "The route is registered but no `<Link to=\u2026>` or `navigate(\u2026)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0da67046a2cf24eb", "name": "Frontend route `/account/:id` has no Link/navigate to it \u2014 src/App.js", "shortDescription": {"text": "Frontend route `/account/:id` has no Link/navigate to it \u2014 src/App.js"}, "fullDescription": {"text": "The route is registered but no `<Link to=\u2026>` or `navigate(\u2026)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f13880c8657d6525", "name": "Frontend route `/asset/:id` has no Link/navigate to it \u2014 src/App.js", "shortDescription": {"text": "Frontend route `/asset/:id` has no Link/navigate to it \u2014 src/App.js"}, "fullDescription": {"text": "The route is registered but no `<Link to=\u2026>` or `navigate(\u2026)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-18facecf9b076fbe", "name": "Frontend route `/anchor/:id` has no Link/navigate to it \u2014 src/App.js", "shortDescription": {"text": "Frontend route `/anchor/:id` has no Link/navigate to it \u2014 src/App.js"}, "fullDescription": {"text": "The route is registered but no `<Link to=\u2026>` or `navigate(\u2026)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-53ceafcc5c7ab25f", "name": "Frontend route `/block/:id` has no Link/navigate to it \u2014 src/App.js", "shortDescription": {"text": "Frontend route `/block/:id` has no Link/navigate to it \u2014 src/App.js"}, "fullDescription": {"text": "The route is registered but no `<Link to=\u2026>` or `navigate(\u2026)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9a03b8b213df4487", "name": "Frontend route `/tx/:id` has no Link/navigate to it \u2014 src/App.js", "shortDescription": {"text": "Frontend route `/tx/:id` has no Link/navigate to it \u2014 src/App.js"}, "fullDescription": {"text": "The route is registered but no `<Link to=\u2026>` or `navigate(\u2026)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-35fbeac37d976a95", "name": "Frontend route `/search/:id` has no Link/navigate to it \u2014 src/App.js", "shortDescription": {"text": "Frontend route `/search/:id` has no Link/navigate to it \u2014 src/App.js"}, "fullDescription": {"text": "The route is registered but no `<Link to=\u2026>` or `navigate(\u2026)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-fdaddebd1907958b", "name": "Frontend route `/error/insecure-horizon-server` has no Link/navigate to it \u2014 src/App.js", "shortDescription": {"text": "Frontend route `/error/insecure-horizon-server` has no Link/navigate to it \u2014 src/App.js"}, "fullDescription": {"text": "The route is registered but no `<Link to=\u2026>` or `navigate(\u2026)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-324e90b509b19849", "name": "Frontend route `/error/not-found/:id` has no Link/navigate to it \u2014 src/App.js", "shortDescription": {"text": "Frontend route `/error/not-found/:id` has no Link/navigate to it \u2014 src/App.js"}, "fullDescription": {"text": "The route is registered but no `<Link to=\u2026>` or `navigate(\u2026)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-421ebc8b828789a7", "name": "Frontend route `/error/general/:id` has no Link/navigate to it \u2014 src/App.js", "shortDescription": {"text": "Frontend route `/error/general/:id` has no Link/navigate to it \u2014 src/App.js"}, "fullDescription": {"text": "The route is registered but no `<Link to=\u2026>` or `navigate(\u2026)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-96b94ca3c0cc8912", "name": "Vulnerable dependency react-dom 16.0.0: GHSA-mvjj-gqq2-p4hw", "shortDescription": {"text": "Vulnerable dependency react-dom 16.0.0: GHSA-mvjj-gqq2-p4hw"}, "fullDescription": {"text": "OSV.dev reports `react-dom` at version `16.0.0` (declared in `package.json`) is affected by GHSA-mvjj-gqq2-p4hw (aka CVE-2018-6341).\nNote: `16.0.0` is the declared floor of a range \u2014 the installed version may be newer.\n\nCross-Site Scripting in react-dom\n\nAliases: CVE-2018-6341\nAdvisory: https://osv.dev/vulnerability/GHSA-mvjj-gqq2-p4hw\nFix: upgrade `react-dom` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-161c8f934c6e3d87", "name": "Vulnerable dependency bootstrap 3.4.1: GHSA-q58r-hwc8-rm9j", "shortDescription": {"text": "Vulnerable dependency bootstrap 3.4.1: GHSA-q58r-hwc8-rm9j"}, "fullDescription": {"text": "OSV.dev reports `bootstrap` at version `3.4.1` (declared in `package.json`) is affected by GHSA-q58r-hwc8-rm9j (aka CVE-2025-1647).\nNote: `3.4.1` is the declared floor of a range \u2014 the installed version may be newer.\n\nBootstrap Vulnerable to Cross-Site Scripting in its Popover and Tooltip Components\n\nAliases: CVE-2025-1647\nAdvisory: https://osv.dev/vulnerability/GHSA-q58r-hwc8-rm9j\nFix: upgrade `bootstrap` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-64f879c360d5e2a1", "name": "Vulnerable dependency bootstrap 3.4.1: GHSA-vxmc-5x29-h64v", "shortDescription": {"text": "Vulnerable dependency bootstrap 3.4.1: GHSA-vxmc-5x29-h64v"}, "fullDescription": {"text": "OSV.dev reports `bootstrap` at version `3.4.1` (declared in `package.json`) is affected by GHSA-vxmc-5x29-h64v (aka CVE-2024-6485).\nNote: `3.4.1` is the declared floor of a range \u2014 the installed version may be newer.\n\nBootstrap Cross-Site Scripting (XSS) vulnerability for data-* attributes\n\nAliases: CVE-2024-6485\nAdvisory: https://osv.dev/vulnerability/GHSA-vxmc-5x29-h64v\nFix: upgrade `bootstrap` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-68009c43a61a0c11", "name": "Vulnerable dependency react-dev-utils 4.1.0: GHSA-29gp-92wp-94q8", "shortDescription": {"text": "Vulnerable dependency react-dev-utils 4.1.0: GHSA-29gp-92wp-94q8"}, "fullDescription": {"text": "OSV.dev reports `react-dev-utils` at version `4.1.0` (declared in `package.json`) is affected by GHSA-29gp-92wp-94q8 (aka CVE-2018-6342).\nNote: `4.1.0` is the declared floor of a range \u2014 the installed version may be newer.\n\nreact-dev-utils on Windows vulnerable to Remote Code Execution\n\nAliases: CVE-2018-6342\nAdvisory: https://osv.dev/vulnerability/GHSA-29gp-92wp-94q8\nFix: upgrade `react-dev-utils` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.7}}, {"id": "scanner-31d276b2bc1cffab", "name": "Vulnerable dependency react-dev-utils 4.1.0: GHSA-5q6m-3h65-w53x", "shortDescription": {"text": "Vulnerable dependency react-dev-utils 4.1.0: GHSA-5q6m-3h65-w53x"}, "fullDescription": {"text": "OSV.dev reports `react-dev-utils` at version `4.1.0` (declared in `package.json`) is affected by GHSA-5q6m-3h65-w53x (aka CVE-2021-24033).\nNote: `4.1.0` is the declared floor of a range \u2014 the installed version may be newer.\n\nreact-dev-utils OS Command Injection in function `getProcessForPort`\n\nAliases: CVE-2021-24033\nAdvisory: https://osv.dev/vulnerability/GHSA-5q6m-3h65-w53x\nFix: upgrade `react-dev-utils` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-ae7f7f29f50d1f41", "name": "Vulnerable dependency webpack-dev-server 2.8.2: GHSA-4v9v-hfq4-rm2v", "shortDescription": {"text": "Vulnerable dependency webpack-dev-server 2.8.2: GHSA-4v9v-hfq4-rm2v"}, "fullDescription": {"text": "OSV.dev reports `webpack-dev-server` at version `2.8.2` (declared in `package.json`) is affected by GHSA-4v9v-hfq4-rm2v (aka CVE-2025-30359).\n\nwebpack-dev-server users' source code may be stolen when they access a malicious web site\n\nAliases: CVE-2025-30359\nAdvisory: https://osv.dev/vulnerability/GHSA-4v9v-hfq4-rm2v\nFix: upgrade `webpack-dev-server` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-ff90896eb02fac37", "name": "Vulnerable dependency webpack-dev-server 2.8.2: GHSA-79cf-xcqc-c78w", "shortDescription": {"text": "Vulnerable dependency webpack-dev-server 2.8.2: GHSA-79cf-xcqc-c78w"}, "fullDescription": {"text": "OSV.dev reports `webpack-dev-server` at version `2.8.2` (declared in `package.json`) is affected by GHSA-79cf-xcqc-c78w (aka CVE-2026-6402).\n\nwebpack-dev-server vulnerable to cross-origin source code exposure on non-HTTPS origins\n\nAliases: CVE-2026-6402\nAdvisory: https://osv.dev/vulnerability/GHSA-79cf-xcqc-c78w\nFix: upgrade `webpack-dev-server` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-37222c3568a3b843", "name": "Vulnerable dependency webpack-dev-server 2.8.2: GHSA-9jgg-88mc-972h", "shortDescription": {"text": "Vulnerable dependency webpack-dev-server 2.8.2: GHSA-9jgg-88mc-972h"}, "fullDescription": {"text": "OSV.dev reports `webpack-dev-server` at version `2.8.2` (declared in `package.json`) is affected by GHSA-9jgg-88mc-972h (aka CVE-2025-30360).\n\nwebpack-dev-server users' source code may be stolen when they access a malicious web site with non-Chromium based browser\n\nAliases: CVE-2025-30360\nAdvisory: https://osv.dev/vulnerability/GHSA-9jgg-88mc-972h\nFix: upgrade `webpack-dev-server` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-2b43fac21dddc2aa", "name": "Vulnerable dependency webpack-dev-server 2.8.2: GHSA-cf66-xwfp-gvc4", "shortDescription": {"text": "Vulnerable dependency webpack-dev-server 2.8.2: GHSA-cf66-xwfp-gvc4"}, "fullDescription": {"text": "OSV.dev reports `webpack-dev-server` at version `2.8.2` (declared in `package.json`) is affected by GHSA-cf66-xwfp-gvc4 (aka CVE-2018-14732).\n\nMissing Origin Validation in webpack-dev-server\n\nAliases: CVE-2018-14732\nAdvisory: https://osv.dev/vulnerability/GHSA-cf66-xwfp-gvc4\nFix: upgrade `webpack-dev-server` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-161b53a3cd3921bf", "name": "Vulnerable dependency webpack-dev-server 2.8.2: GHSA-f5vj-f2hx-8m93", "shortDescription": {"text": "Vulnerable dependency webpack-dev-server 2.8.2: GHSA-f5vj-f2hx-8m93"}, "fullDescription": {"text": "OSV.dev reports `webpack-dev-server` at version `2.8.2` (declared in `package.json`) is affected by GHSA-f5vj-f2hx-8m93 (aka CVE-2026-14620).\n\nwebpack-dev-server vulnerable to cross-site request forgery via internal developer endpoints\n\nAliases: CVE-2026-14620\nAdvisory: https://osv.dev/vulnerability/GHSA-f5vj-f2hx-8m93\nFix: upgrade `webpack-dev-server` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-b874f195dcc35abd", "name": "Vulnerable dependency webpack-dev-server 2.8.2: GHSA-m28w-2pqf-7qgj", "shortDescription": {"text": "Vulnerable dependency webpack-dev-server 2.8.2: GHSA-m28w-2pqf-7qgj"}, "fullDescription": {"text": "OSV.dev reports `webpack-dev-server` at version `2.8.2` (declared in `package.json`) is affected by GHSA-m28w-2pqf-7qgj (aka CVE-2026-14631).\n\nwebpack-dev-server vulnerable to denial of service via a malformed Host or Origin header\n\nAliases: CVE-2026-14631\nAdvisory: https://osv.dev/vulnerability/GHSA-m28w-2pqf-7qgj\nFix: upgrade `webpack-dev-server` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-00767350713f678e", "name": "Vulnerable dependency webpack-dev-server 2.8.2: GHSA-mx8g-39q3-5c79", "shortDescription": {"text": "Vulnerable dependency webpack-dev-server 2.8.2: GHSA-mx8g-39q3-5c79"}, "fullDescription": {"text": "OSV.dev reports `webpack-dev-server` at version `2.8.2` (declared in `package.json`) is affected by GHSA-mx8g-39q3-5c79 (aka CVE-2026-9595).\n\nwebpack-dev-server vulnerable to HMR WebSocket interception via permissive user proxies\n\nAliases: CVE-2026-9595\nAdvisory: https://osv.dev/vulnerability/GHSA-mx8g-39q3-5c79\nFix: upgrade `webpack-dev-server` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-6701e814e7477432", "name": "Dependency fetch-ponyfill is two or more major versions behind", "shortDescription": {"text": "Dependency fetch-ponyfill is two or more major versions behind"}, "fullDescription": {"text": "`fetch-ponyfill` is pinned at `4.1.0` in `package.json` while the latest release on the npm registry is `7.1.0` \u2014 3 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `fetch-ponyfill` to `7.1.0`."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-d34ec17c94c60aa9", "name": "Dependency node-localstorage is two or more major versions behind", "shortDescription": {"text": "Dependency node-localstorage is two or more major versions behind"}, "fullDescription": {"text": "`node-localstorage` is pinned at `1.3.0` in `package.json` while the latest release on the npm registry is `3.0.5` \u2014 2 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `node-localstorage` to `3.0.5`."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-40bde19c9a15dd89", "name": "Dependency react-bootstrap is two or more major versions behind", "shortDescription": {"text": "Dependency react-bootstrap is two or more major versions behind"}, "fullDescription": {"text": "`react-bootstrap` is pinned at `0.31.5` in `package.json` while the latest release on the npm registry is `2.10.10` \u2014 2 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `react-bootstrap` to `2.10.10`."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-2fff3f55b9f210a8", "name": "Dependency react-dom is two or more major versions behind", "shortDescription": {"text": "Dependency react-dom is two or more major versions behind"}, "fullDescription": {"text": "`react-dom` is pinned at `16.0.0` in `package.json` while the latest release on the npm registry is `19.2.8` \u2014 3 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `react-dom` to `19.2.8`."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-32385f5ea85bad69", "name": "Dependency react-intl is two or more major versions behind", "shortDescription": {"text": "Dependency react-intl is two or more major versions behind"}, "fullDescription": {"text": "`react-intl` is pinned at `2.4.0` in `package.json` while the latest release on the npm registry is `10.1.22` \u2014 8 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `react-intl` to `10.1.22`."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-f30e3d3d614d821c", "name": "Dependency react-json-pretty is a major version behind", "shortDescription": {"text": "Dependency react-json-pretty is a major version behind"}, "fullDescription": {"text": "`react-json-pretty` is pinned at `1.7.4` in `package.json` while the latest release on the npm registry is `2.2.0` \u2014 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `react-json-pretty` to `2.2.0`."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 0.9}}, {"id": "scanner-ffc02bb642644bfc", "name": "Dependency react-md-spinner is a major version behind", "shortDescription": {"text": "Dependency react-md-spinner is a major version behind"}, "fullDescription": {"text": "`react-md-spinner` is pinned at `0.2.4` in `package.json` while the latest release on the npm registry is `1.0.0` \u2014 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `react-md-spinner` to `1.0.0`."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 0.9}}, {"id": "scanner-61a19548147f7132", "name": "Dependency react-router-dom is two or more major versions behind", "shortDescription": {"text": "Dependency react-router-dom is two or more major versions behind"}, "fullDescription": {"text": "`react-router-dom` is pinned at `4.2.2` in `package.json` while the latest release on the npm registry is `7.18.2` \u2014 3 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `react-router-dom` to `7.18.2`."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-ed9c22c97f1d0022", "name": "Dependency react-router is two or more major versions behind", "shortDescription": {"text": "Dependency react-router is two or more major versions behind"}, "fullDescription": {"text": "`react-router` is pinned at `4.2.0` in `package.json` while the latest release on the npm registry is `8.3.0` \u2014 4 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `react-router` to `8.3.0`."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-099db606e0a0cd54", "name": "Dependency react is two or more major versions behind", "shortDescription": {"text": "Dependency react is two or more major versions behind"}, "fullDescription": {"text": "`react` is pinned at `16.0.0` in `package.json` while the latest release on the npm registry is `19.2.8` \u2014 3 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `react` to `19.2.8`."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-7324dc33df730f23", "name": "Dependency stellar-sdk is two or more major versions behind", "shortDescription": {"text": "Dependency stellar-sdk is two or more major versions behind"}, "fullDescription": {"text": "`stellar-sdk` is pinned at `8.2.3` in `package.json` while the latest release on the npm registry is `13.3.0` \u2014 5 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `stellar-sdk` to `13.3.0`."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-13126998b46674db", "name": "Dependency whatwg-fetch is a major version behind", "shortDescription": {"text": "Dependency whatwg-fetch is a major version behind"}, "fullDescription": {"text": "`whatwg-fetch` is pinned at `2.0.3` in `package.json` while the latest release on the npm registry is `3.6.20` \u2014 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `whatwg-fetch` to `3.6.20`."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 0.9}}]}}, "automationDetails": {"id": "repobility/30813"}, "properties": {"repository": "pi-apps/pi-explorer", "repoUrl": "https://github.com/pi-apps/pi-explorer", "branch": "main"}, "results": [{"ruleId": "scanner-9dc91b69da1d722e", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 config/webpack.config.prod.js:110"}, "properties": {"repobilityId": "22441bd84e0546ad", "scanner": "scanner-primary", "fingerprint": "9dc91b69da1d722e", "layer": "frontend", "severity": "info", "confidence": 0.7, "tags": ["frontend-quality", "fq.todo-marker"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "config/webpack.config.prod.js"}, "region": {"startLine": 110}}}]}, {"ruleId": "scanner-5340a58b3f5732bf", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 config/webpack.config.dev.js:106"}, "properties": {"repobilityId": "2f91ce4cd35588b7", "scanner": "scanner-primary", "fingerprint": "5340a58b3f5732bf", "layer": "frontend", "severity": "info", "confidence": 0.7, "tags": ["frontend-quality", "fq.todo-marker"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "config/webpack.config.dev.js"}, "region": {"startLine": 106}}}]}, {"ruleId": "scanner-13ea46f161c106ab", "level": "note", "message": {"text": "Debug `console.log` remains in browser-facing code \u2014 src/App.js:173"}, "properties": {"repobilityId": "61e09300ded66156", "scanner": "scanner-primary", "fingerprint": "13ea46f161c106ab", "layer": "frontend", "severity": "low", "confidence": 0.85, "tags": ["frontend-quality", "fq.console-leak"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/App.js"}, "region": {"startLine": 173}}}]}, {"ruleId": "scanner-22cc85cde13e1029", "level": "note", "message": {"text": "Debug `console.log` remains in browser-facing code \u2014 src/registerServiceWorker.js:59"}, "properties": {"repobilityId": "cc468c3c29f78814", "scanner": "scanner-primary", "fingerprint": "22cc85cde13e1029", "layer": "frontend", "severity": "low", "confidence": 0.85, "tags": ["frontend-quality", "fq.console-leak"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/registerServiceWorker.js"}, "region": {"startLine": 59}}}]}, {"ruleId": "scanner-0a953d099411af3e", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 src/index.js:6"}, "properties": {"repobilityId": "901f23f330bd582f", "scanner": "scanner-primary", "fingerprint": "0a953d099411af3e", "layer": "frontend", "severity": "info", "confidence": 0.7, "tags": ["frontend-quality", "fq.todo-marker"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/index.js"}, "region": {"startLine": 6}}}]}, {"ruleId": "scanner-f1a0e7e504cd2b4f", "level": "warning", "message": {"text": "CVE-2025-27789: @babel/runtime 7.2.0 \u2014 package-lock.json"}, "properties": {"repobilityId": "116fa68a6d1c5ff0", "scanner": "scanner-primary", "fingerprint": "f1a0e7e504cd2b4f", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-27789"]}}, {"ruleId": "scanner-d2660630f15626b8", "level": "error", "message": {"text": "CVE-2021-3749: axios 0.21.1 \u2014 package-lock.json"}, "properties": {"repobilityId": "45b9c54dcce92e9c", "scanner": "scanner-primary", "fingerprint": "d2660630f15626b8", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2021-3749"]}}, {"ruleId": "scanner-0a1443acc060deee", "level": "error", "message": {"text": "CVE-2025-27152: axios 0.21.1 \u2014 package-lock.json"}, "properties": {"repobilityId": "d1ae9d2ee93c404f", "scanner": "scanner-primary", "fingerprint": "0a1443acc060deee", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-27152"]}}, {"ruleId": "scanner-597e30675ab7a0c7", "level": "error", "message": {"text": "CVE-2026-25639: axios 0.21.1 \u2014 package-lock.json"}, "properties": {"repobilityId": "893516f3a969cf4d", "scanner": "scanner-primary", "fingerprint": "597e30675ab7a0c7", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-25639"]}}, {"ruleId": "scanner-800d5f61992aff53", "level": "error", "message": {"text": "CVE-2026-42033: axios 0.21.1 \u2014 package-lock.json"}, "properties": {"repobilityId": "66ab42945a9252b4", "scanner": "scanner-primary", "fingerprint": "800d5f61992aff53", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-42033"]}}, {"ruleId": "scanner-dca1059da9c88f6d", "level": "error", "message": {"text": "CVE-2026-42035: axios 0.21.1 \u2014 package-lock.json"}, "properties": {"repobilityId": "32a44b7270364eea", "scanner": "scanner-primary", "fingerprint": "dca1059da9c88f6d", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-42035"]}}, {"ruleId": "scanner-45d86d60ecdcb642", "level": "error", "message": {"text": "CVE-2026-42043: axios 0.21.1 \u2014 package-lock.json"}, "properties": {"repobilityId": "402c47d4952ad621", "scanner": "scanner-primary", "fingerprint": "45d86d60ecdcb642", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-42043"]}}, {"ruleId": "scanner-0df222d4dab697fa", "level": "error", "message": {"text": "CVE-2026-44486: axios 0.21.1 \u2014 package-lock.json"}, "properties": {"repobilityId": "df95d747ea8a5d48", "scanner": "scanner-primary", "fingerprint": "0df222d4dab697fa", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44486"]}}, {"ruleId": "scanner-f9b38b84ad8723a9", "level": "error", "message": {"text": "CVE-2026-44487: axios 0.21.1 \u2014 package-lock.json"}, "properties": {"repobilityId": "dc0fed2a6be758a2", "scanner": "scanner-primary", "fingerprint": "f9b38b84ad8723a9", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44487"]}}, {"ruleId": "scanner-2b7baa243b9e29e5", "level": "error", "message": {"text": "CVE-2026-44492: axios 0.21.1 \u2014 package-lock.json"}, "properties": {"repobilityId": "721bd55cf5d6441f", "scanner": "scanner-primary", "fingerprint": "2b7baa243b9e29e5", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44492"]}}, {"ruleId": "scanner-77c0f79a6d73efb1", "level": "error", "message": {"text": "CVE-2026-44495: axios 0.21.1 \u2014 package-lock.json"}, "properties": {"repobilityId": "3f9275d1c9c505dc", "scanner": "scanner-primary", "fingerprint": "77c0f79a6d73efb1", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44495"]}}, {"ruleId": "scanner-8c26937691458f36", "level": "error", "message": {"text": "CVE-2026-44496: axios 0.21.1 \u2014 package-lock.json"}, "properties": {"repobilityId": "0a52470db40718ce", "scanner": "scanner-primary", "fingerprint": "8c26937691458f36", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44496"]}}, {"ruleId": "scanner-3f2aa757bcfc4630", "level": "warning", "message": {"text": "CVE-2023-45857: axios 0.21.1 \u2014 package-lock.json"}, "properties": {"repobilityId": "c6455b56140fc23a", "scanner": "scanner-primary", "fingerprint": "3f2aa757bcfc4630", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2023-45857"]}}, {"ruleId": "scanner-efce36aa5d24bc7d", "level": "warning", "message": {"text": "CVE-2025-62718: axios 0.21.1 \u2014 package-lock.json"}, "properties": {"repobilityId": "0a3a23c9b0ec4c3f", "scanner": "scanner-primary", "fingerprint": "efce36aa5d24bc7d", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-62718"]}}, {"ruleId": "scanner-0a23db566c67c538", "level": "warning", "message": {"text": "CVE-2026-40175: axios 0.21.1 \u2014 package-lock.json"}, "properties": {"repobilityId": "09f9c1fa112e982d", "scanner": "scanner-primary", "fingerprint": "0a23db566c67c538", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-40175"]}}, {"ruleId": "scanner-3869ab06a7324275", "level": "warning", "message": {"text": "CVE-2026-42034: axios 0.21.1 \u2014 package-lock.json"}, "properties": {"repobilityId": "68961d2711064045", "scanner": "scanner-primary", "fingerprint": "3869ab06a7324275", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-42034"]}}, {"ruleId": "scanner-1e209100520a6937", "level": "warning", "message": {"text": "CVE-2026-42036: axios 0.21.1 \u2014 package-lock.json"}, "properties": {"repobilityId": "a6dac289ee8c33a1", "scanner": "scanner-primary", "fingerprint": "1e209100520a6937", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-42036"]}}, {"ruleId": "scanner-b927b5ee0087d4c4", "level": "warning", "message": {"text": "CVE-2026-42038: axios 0.21.1 \u2014 package-lock.json"}, "properties": {"repobilityId": "f15c3e4f66531770", "scanner": "scanner-primary", "fingerprint": "b927b5ee0087d4c4", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-42038"]}}, {"ruleId": "scanner-158794895c964af5", "level": "warning", "message": {"text": "CVE-2026-42039: axios 0.21.1 \u2014 package-lock.json"}, "properties": {"repobilityId": "53340df3286c4767", "scanner": "scanner-primary", "fingerprint": "158794895c964af5", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-42039"]}}, {"ruleId": "scanner-f0515806b65098fe", "level": "warning", "message": {"text": "CVE-2026-42041: axios 0.21.1 \u2014 package-lock.json"}, "properties": {"repobilityId": "6c9b27969c48ada0", "scanner": "scanner-primary", "fingerprint": "f0515806b65098fe", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-42041"]}}, {"ruleId": "scanner-391f2496afe3ebfe", "level": "warning", "message": {"text": "CVE-2026-42042: axios 0.21.1 \u2014 package-lock.json"}, "properties": {"repobilityId": "34e7b8dbf2f6a9a6", "scanner": "scanner-primary", "fingerprint": "391f2496afe3ebfe", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-42042"]}}, {"ruleId": "scanner-654af4ce5630fc80", "level": "warning", "message": {"text": "CVE-2026-44490: axios 0.21.1 \u2014 package-lock.json"}, "properties": {"repobilityId": "ae6ee68d61b62013", "scanner": "scanner-primary", "fingerprint": "654af4ce5630fc80", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44490"]}}, {"ruleId": "scanner-db121f64890c360f", "level": "warning", "message": {"text": "GHSA-7q8q-rj6j-mhjq: axios 0.21.1 \u2014 package-lock.json"}, "properties": {"repobilityId": "91ad60c5ff03c761", "scanner": "scanner-primary", "fingerprint": "db121f64890c360f", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-7q8q-rj6j-mhjq"]}}, {"ruleId": "scanner-3d044307b927c282", "level": "warning", "message": {"text": "GHSA-mmx7-hfxf-jppx: axios 0.21.1 \u2014 package-lock.json"}, "properties": {"repobilityId": "5461ec5428c06e10", "scanner": "scanner-primary", "fingerprint": "3d044307b927c282", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-mmx7-hfxf-jppx"]}}, {"ruleId": "scanner-c40cc096688de181", "level": "note", "message": {"text": "CVE-2026-42040: axios 0.21.1 \u2014 package-lock.json"}, "properties": {"repobilityId": "e1251f5883d576f5", "scanner": "scanner-primary", "fingerprint": "c40cc096688de181", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-42040"]}}, {"ruleId": "scanner-aa4e72e3a4e7655f", "level": "error", "message": {"text": "CVE-2022-1650: eventsource 1.1.0 \u2014 package-lock.json"}, "properties": {"repobilityId": "84fe40aa9e3113c1", "scanner": "scanner-primary", "fingerprint": "aa4e72e3a4e7655f", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2022-1650"]}}, {"ruleId": "scanner-92925efb16e1066f", "level": "error", "message": {"text": "CVE-2022-0155: follow-redirects 1.14.1 \u2014 package-lock.json"}, "properties": {"repobilityId": "d87fd08c6b7d218c", "scanner": "scanner-primary", "fingerprint": "92925efb16e1066f", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2022-0155"]}}, {"ruleId": "scanner-be85dad0fd66afbe", "level": "warning", "message": {"text": "CVE-2022-0536: follow-redirects 1.14.1 \u2014 package-lock.json"}, "properties": {"repobilityId": "67cbeb9f8bccf66b", "scanner": "scanner-primary", "fingerprint": "be85dad0fd66afbe", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2022-0536"]}}, {"ruleId": "scanner-da099b9649335199", "level": "warning", "message": {"text": "CVE-2023-26159: follow-redirects 1.14.1 \u2014 package-lock.json"}, "properties": {"repobilityId": "b7e9224a07df8819", "scanner": "scanner-primary", "fingerprint": "da099b9649335199", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2023-26159"]}}, {"ruleId": "scanner-e0bee8a03f71f3ae", "level": "warning", "message": {"text": "CVE-2024-28849: follow-redirects 1.14.1 \u2014 package-lock.json"}, "properties": {"repobilityId": "91ba14608f4bf885", "scanner": "scanner-primary", "fingerprint": "e0bee8a03f71f3ae", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2024-28849"]}}, {"ruleId": "scanner-5a09c327f3a8ab17", "level": "warning", "message": {"text": "GHSA-r4q5-vmmm-2653: follow-redirects 1.14.1 \u2014 package-lock.json"}, "properties": {"repobilityId": "e85192b558a626b4", "scanner": "scanner-primary", "fingerprint": "5a09c327f3a8ab17", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-r4q5-vmmm-2653"]}}, {"ruleId": "scanner-ac3d9d9437c6a651", "level": "error", "message": {"text": "CVE-2021-23337: lodash 4.17.19 \u2014 package-lock.json"}, "properties": {"repobilityId": "34c11f99925cdeb6", "scanner": "scanner-primary", "fingerprint": "ac3d9d9437c6a651", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2021-23337"]}}, {"ruleId": "scanner-85d2249300711840", "level": "error", "message": {"text": "CVE-2026-4800: lodash 4.17.19 \u2014 package-lock.json"}, "properties": {"repobilityId": "9e31ffbbadb525da", "scanner": "scanner-primary", "fingerprint": "85d2249300711840", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-4800"]}}, {"ruleId": "scanner-4736589863bfcb55", "level": "warning", "message": {"text": "CVE-2020-28500: lodash 4.17.19 \u2014 package-lock.json"}, "properties": {"repobilityId": "ac6ac8b75bb90f24", "scanner": "scanner-primary", "fingerprint": "4736589863bfcb55", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2020-28500"]}}, {"ruleId": "scanner-6bfd89211996784d", "level": "warning", "message": {"text": "CVE-2025-13465: lodash 4.17.19 \u2014 package-lock.json"}, "properties": {"repobilityId": "9a4008c6507da8c3", "scanner": "scanner-primary", "fingerprint": "6bfd89211996784d", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-13465"]}}, {"ruleId": "scanner-a6e9bab8319b0f2f", "level": "warning", "message": {"text": "CVE-2026-2950: lodash 4.17.19 \u2014 package-lock.json"}, "properties": {"repobilityId": "e5ea47dec8a5f16f", "scanner": "scanner-primary", "fingerprint": "a6e9bab8319b0f2f", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-2950"]}}, {"ruleId": "scanner-67573213d8f59458", "level": "error", "message": {"text": "CVE-2022-0235: node-fetch 1.7.1 \u2014 package-lock.json"}, "properties": {"repobilityId": "96099edb3166dcf7", "scanner": "scanner-primary", "fingerprint": "67573213d8f59458", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2022-0235"]}}, {"ruleId": "scanner-cfee53392395806d", "level": "error", "message": {"text": "CVE-2024-45296: path-to-regexp 1.7.0 \u2014 package-lock.json"}, "properties": {"repobilityId": "bf44ab8c4a4bb310", "scanner": "scanner-primary", "fingerprint": "cfee53392395806d", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2024-45296"]}}, {"ruleId": "scanner-c498ff348f66df08", "level": "warning", "message": {"text": "CVE-2018-6341: react-dom 16.0.0 \u2014 package-lock.json"}, "properties": {"repobilityId": "29c036be85b5f589", "scanner": "scanner-primary", "fingerprint": "c498ff348f66df08", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2018-6341"]}}, {"ruleId": "scanner-e7638ad32c5f3034", "level": "error", "message": {"text": "CVE-2025-9288: sha.js 2.4.11 \u2014 package-lock.json"}, "properties": {"repobilityId": "9403d6d57470c285", "scanner": "scanner-primary", "fingerprint": "e7638ad32c5f3034", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-9288"]}}, {"ruleId": "scanner-e7bd2cc80bfa786a", "level": "error", "message": {"text": "CVE-2020-7733: ua-parser-js 0.7.14 \u2014 package-lock.json"}, "properties": {"repobilityId": "9356a06e99dd2bff", "scanner": "scanner-primary", "fingerprint": "e7bd2cc80bfa786a", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2020-7733"]}}, {"ruleId": "scanner-fa5cffe031941e6c", "level": "error", "message": {"text": "CVE-2020-7793: ua-parser-js 0.7.14 \u2014 package-lock.json"}, "properties": {"repobilityId": "6ef8d4e22d8e0429", "scanner": "scanner-primary", "fingerprint": "fa5cffe031941e6c", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2020-7793"]}}, {"ruleId": "scanner-e95bab6c7ef8920b", "level": "error", "message": {"text": "CVE-2021-27292: ua-parser-js 0.7.14 \u2014 package-lock.json"}, "properties": {"repobilityId": "744c29627bcd24a7", "scanner": "scanner-primary", "fingerprint": "e95bab6c7ef8920b", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2021-27292"]}}, {"ruleId": "scanner-80e79f10c9bace4a", "level": "error", "message": {"text": "CVE-2020-7733: ua-parser-js 0.7.21 \u2014 package-lock.json"}, "properties": {"repobilityId": "9356a06e99dd2bff", "scanner": "scanner-primary", "fingerprint": "80e79f10c9bace4a", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2020-7733"]}}, {"ruleId": "scanner-48d5a9af563123f8", "level": "error", "message": {"text": "CVE-2020-7793: ua-parser-js 0.7.21 \u2014 package-lock.json"}, "properties": {"repobilityId": "6ef8d4e22d8e0429", "scanner": "scanner-primary", "fingerprint": "48d5a9af563123f8", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2020-7793"]}}, {"ruleId": "scanner-f272ac92cd951ac6", "level": "error", "message": {"text": "CVE-2021-27292: ua-parser-js 0.7.21 \u2014 package-lock.json"}, "properties": {"repobilityId": "744c29627bcd24a7", "scanner": "scanner-primary", "fingerprint": "f272ac92cd951ac6", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2021-27292"]}}, {"ruleId": "scanner-21bd8651c1cfdc95", "level": "error", "message": {"text": "CVE-2021-27516: urijs 1.19.5 \u2014 package-lock.json"}, "properties": {"repobilityId": "1712816205edfee9", "scanner": "scanner-primary", "fingerprint": "21bd8651c1cfdc95", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2021-27516"]}}, {"ruleId": "scanner-828585b8f5abfc76", "level": "error", "message": {"text": "CVE-2022-1243: urijs 1.19.5 \u2014 package-lock.json"}, "properties": {"repobilityId": "c1ccda17e3df2701", "scanner": "scanner-primary", "fingerprint": "828585b8f5abfc76", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2022-1243"]}}, {"ruleId": "scanner-9ba9e2817ed9713c", "level": "warning", "message": {"text": "CVE-2021-3647: urijs 1.19.5 \u2014 package-lock.json"}, "properties": {"repobilityId": "9dbbebcc5ca1ae68", "scanner": "scanner-primary", "fingerprint": "9ba9e2817ed9713c", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2021-3647"]}}, {"ruleId": "scanner-9920b549d92b5f86", "level": "warning", "message": {"text": "CVE-2022-0613: urijs 1.19.5 \u2014 package-lock.json"}, "properties": {"repobilityId": "138895405dd2c12c", "scanner": "scanner-primary", "fingerprint": "9920b549d92b5f86", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2022-0613"]}}, {"ruleId": "scanner-3fce5596f26dbee6", "level": "warning", "message": {"text": "CVE-2022-0868: urijs 1.19.5 \u2014 package-lock.json"}, "properties": {"repobilityId": "f93842b4f68e3287", "scanner": "scanner-primary", "fingerprint": "3fce5596f26dbee6", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2022-0868"]}}, {"ruleId": "scanner-2935fed34c7521d3", "level": "warning", "message": {"text": "CVE-2022-1233: urijs 1.19.5 \u2014 package-lock.json"}, "properties": {"repobilityId": "202ccff0585d7250", "scanner": "scanner-primary", "fingerprint": "2935fed34c7521d3", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2022-1233"]}}, {"ruleId": "scanner-ed261b39fc95eba5", "level": "warning", "message": {"text": "CVE-2022-24723: urijs 1.19.5 \u2014 package-lock.json"}, "properties": {"repobilityId": "abc03d10a619bd07", "scanner": "scanner-primary", "fingerprint": "ed261b39fc95eba5", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2022-24723"]}}, {"ruleId": "scanner-61fe7fae4fb8af59", "level": "error", "message": {"text": "CVE-2022-0686: url-parse 1.4.4 \u2014 package-lock.json"}, "properties": {"repobilityId": "0fc0da794b09e306", "scanner": "scanner-primary", "fingerprint": "61fe7fae4fb8af59", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2022-0686"]}}, {"ruleId": "scanner-ab28ef31e0a82943", "level": "warning", "message": {"text": "CVE-2020-8124: url-parse 1.4.4 \u2014 package-lock.json"}, "properties": {"repobilityId": "5f8cfdf9b361426a", "scanner": "scanner-primary", "fingerprint": "ab28ef31e0a82943", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2020-8124"]}}, {"ruleId": "scanner-a12768849f1d59d2", "level": "warning", "message": {"text": "CVE-2021-27515: url-parse 1.4.4 \u2014 package-lock.json"}, "properties": {"repobilityId": "c2f7c46ace623637", "scanner": "scanner-primary", "fingerprint": "a12768849f1d59d2", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2021-27515"]}}, {"ruleId": "scanner-7cffa6fcaef3dc9e", "level": "warning", "message": {"text": "CVE-2021-3664: url-parse 1.4.4 \u2014 package-lock.json"}, "properties": {"repobilityId": "4f88440f9a2f88b7", "scanner": "scanner-primary", "fingerprint": "7cffa6fcaef3dc9e", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2021-3664"]}}, {"ruleId": "scanner-4eb0997dcf6461e2", "level": "warning", "message": {"text": "CVE-2022-0512: url-parse 1.4.4 \u2014 package-lock.json"}, "properties": {"repobilityId": "2845a9e205aea1ef", "scanner": "scanner-primary", "fingerprint": "4eb0997dcf6461e2", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2022-0512"]}}, {"ruleId": "scanner-ce491b1a5e8cec86", "level": "warning", "message": {"text": "CVE-2022-0639: url-parse 1.4.4 \u2014 package-lock.json"}, "properties": {"repobilityId": "183dfca720ce48b9", "scanner": "scanner-primary", "fingerprint": "ce491b1a5e8cec86", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2022-0639"]}}, {"ruleId": "scanner-e650c243bb448a74", "level": "warning", "message": {"text": "CVE-2022-0691: url-parse 1.4.4 \u2014 package-lock.json"}, "properties": {"repobilityId": "b975f9525b41f21e", "scanner": "scanner-primary", "fingerprint": "e650c243bb448a74", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2022-0691"]}}, {"ruleId": "scanner-3a3527e70129fb18", "level": "error", "message": {"text": "DS-0002: Image user should not be 'root' \u2014 Dockerfile"}, "properties": {"repobilityId": "691787f6b20605df", "scanner": "scanner-primary", "fingerprint": "3a3527e70129fb18", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-3c4041c454cda88e", "level": "note", "message": {"text": "DS-0026: No HEALTHCHECK defined \u2014 Dockerfile"}, "properties": {"repobilityId": "da995bb2cfa21f65", "scanner": "scanner-primary", "fingerprint": "3c4041c454cda88e", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-fb218c59c373a619", "level": "warning", "message": {"text": "KSV-0001: Can elevate its own privileges \u2014 kubernetes/config/app.yaml"}, "properties": {"repobilityId": "bc80f84e69a13fd0", "scanner": "scanner-primary", "fingerprint": "fb218c59c373a619", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-8c70e011f3531b53", "level": "note", "message": {"text": "KSV-0003: Default capabilities: some containers do not drop all \u2014 kubernetes/config/app.yaml"}, "properties": {"repobilityId": "9b0442f60567e2dd", "scanner": "scanner-primary", "fingerprint": "8c70e011f3531b53", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-6469d17254c9da50", "level": "note", "message": {"text": "KSV-0004: Default capabilities: some containers do not drop any \u2014 kubernetes/config/app.yaml"}, "properties": {"repobilityId": "fac5154112f565ce", "scanner": "scanner-primary", "fingerprint": "6469d17254c9da50", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-cf565d38c238648e", "level": "note", "message": {"text": "KSV-0011: CPU not limited \u2014 kubernetes/config/app.yaml"}, "properties": {"repobilityId": "f0ae6cd51142f073", "scanner": "scanner-primary", "fingerprint": "cf565d38c238648e", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-e36561a3729a0e6b", "level": "warning", "message": {"text": "KSV-0012: Runs as root user \u2014 kubernetes/config/app.yaml"}, "properties": {"repobilityId": "94b9762e84d09fc1", "scanner": "scanner-primary", "fingerprint": "e36561a3729a0e6b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-010ccb7a4f87acad", "level": "warning", "message": {"text": "KSV-0013: Image tag \":latest\" used \u2014 kubernetes/config/app.yaml"}, "properties": {"repobilityId": "612931506a5b3336", "scanner": "scanner-primary", "fingerprint": "010ccb7a4f87acad", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-6799c22df6d32193", "level": "error", "message": {"text": "KSV-0014: Root file system is not read-only \u2014 kubernetes/config/app.yaml"}, "properties": {"repobilityId": "c66b093905c87db5", "scanner": "scanner-primary", "fingerprint": "6799c22df6d32193", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-b3bbe63e6e83ff08", "level": "note", "message": {"text": "KSV-0018: Memory not limited \u2014 kubernetes/config/app.yaml"}, "properties": {"repobilityId": "b1d3b12f0caec5d1", "scanner": "scanner-primary", "fingerprint": "b3bbe63e6e83ff08", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-d679f6b832615bfd", "level": "note", "message": {"text": "KSV-0020: Runs with UID <= 10000 \u2014 kubernetes/config/app.yaml"}, "properties": {"repobilityId": "c49a386d2c3f0c48", "scanner": "scanner-primary", "fingerprint": "d679f6b832615bfd", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-eab15aa4542691d7", "level": "note", "message": {"text": "KSV-0021: Runs with GID <= 10000 \u2014 kubernetes/config/app.yaml"}, "properties": {"repobilityId": "64aff32a83d011df", "scanner": "scanner-primary", "fingerprint": "eab15aa4542691d7", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-dccd0d961a1b1e71", "level": "note", "message": {"text": "KSV-0030: Runtime/Default Seccomp profile not set \u2014 kubernetes/config/app.yaml"}, "properties": {"repobilityId": "f1fddba948dc7811", "scanner": "scanner-primary", "fingerprint": "dccd0d961a1b1e71", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-b27e0aa41f9e01c2", "level": "warning", "message": {"text": "KSV-0104: Seccomp policies disabled \u2014 kubernetes/config/app.yaml"}, "properties": {"repobilityId": "83b3c5d9e3972f49", "scanner": "scanner-primary", "fingerprint": "b27e0aa41f9e01c2", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-6bdaadde327d8c98", "level": "note", "message": {"text": "KSV-0106: Container capabilities must only include NET_BIND_SERVICE \u2014 kubernetes/config/app.yaml"}, "properties": {"repobilityId": "1f0f233b2330841c", "scanner": "scanner-primary", "fingerprint": "6bdaadde327d8c98", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-9bb5e4877575959c", "level": "note", "message": {"text": "KSV-0110: Workloads in the default namespace \u2014 kubernetes/config/app.yaml"}, "properties": {"repobilityId": "d0504a4fe6539d28", "scanner": "scanner-primary", "fingerprint": "9bb5e4877575959c", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-43fa07d96cdfeba0", "level": "warning", "message": {"text": "KSV-0117: Prevent binding to privileged ports \u2014 kubernetes/config/app.yaml"}, "properties": {"repobilityId": "f013ff8eb993bf2f", "scanner": "scanner-primary", "fingerprint": "43fa07d96cdfeba0", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-b20a98e350b71b9e", "level": "error", "message": {"text": "KSV-0118: Default security context configured \u2014 kubernetes/config/app.yaml"}, "properties": {"repobilityId": "2f7c65039a1f94fb", "scanner": "scanner-primary", "fingerprint": "b20a98e350b71b9e", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-d63da3583b14afc0", "level": "warning", "message": {"text": "Dockerfile runs as root: Dockerfile"}, "properties": {"repobilityId": "a2ed1bd120e507db", "scanner": "scanner-primary", "fingerprint": "d63da3583b14afc0", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-938859eeaa5295e7", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: node:13-alpine"}, "properties": {"repobilityId": "7cf5e12e487d9256", "scanner": "scanner-primary", "fingerprint": "938859eeaa5295e7", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Dockerfile"}, "region": {"startLine": 5}}}]}, {"ruleId": "scanner-2f3178ddda7c2897", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: nginx:alpine"}, "properties": {"repobilityId": "2451b60c1344c1ab", "scanner": "scanner-primary", "fingerprint": "2f3178ddda7c2897", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Dockerfile"}, "region": {"startLine": 25}}}]}, {"ruleId": "scanner-4e2334481968a763", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in public/index.html:47"}, "properties": {"repobilityId": "fcd975cc51168fca", "scanner": "scanner-primary", "fingerprint": "4e2334481968a763", "layer": "security", "severity": "medium", "confidence": 0.65, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "public/index.html"}, "region": {"startLine": 47}}}]}, {"ruleId": "scanner-a6fcbd66e95ea076", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in src/components/shared/InfoBanner.js:23"}, "properties": {"repobilityId": "02e3c2e07ccf9e1a", "scanner": "scanner-primary", "fingerprint": "a6fcbd66e95ea076", "layer": "security", "severity": "medium", "confidence": 0.65, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/components/shared/InfoBanner.js"}, "region": {"startLine": 23}}}]}, {"ruleId": "scanner-6372cebde0220094", "level": "warning", "message": {"text": "No auth library detected"}, "properties": {"repobilityId": "a5b6035a5bbf8054", "scanner": "scanner-primary", "fingerprint": "6372cebde0220094", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["coverage", "auth"]}}, {"ruleId": "scanner-4601e3ad3bb28677", "level": "warning", "message": {"text": "No CI/CD pipelines detected"}, "properties": {"repobilityId": "c3ee439bce2bc51e", "scanner": "scanner-primary", "fingerprint": "4601e3ad3bb28677", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-ea3b5e389d8c9c0f", "level": "note", "message": {"text": "Low test-to-source ratio"}, "properties": {"repobilityId": "ef7b2552cc00a375", "scanner": "scanner-primary", "fingerprint": "ea3b5e389d8c9c0f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["tests"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "dc7c8cd1ebf80d4f", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-25f63eca90ff482c", "level": "none", "message": {"text": "Commented-code block (10 lines) in src/components/shared/InfoBanner.js:32"}, "properties": {"repobilityId": "7ea0df913f069c69", "scanner": "scanner-primary", "fingerprint": "25f63eca90ff482c", "layer": "quality", "severity": "info", "confidence": 0.72, "tags": ["integrity", "commented-code", "dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/components/shared/InfoBanner.js"}, "region": {"startLine": 32}}}]}, {"ruleId": "scanner-0eabfebc7c03d1f2", "level": "warning", "message": {"text": "Frontend route `/accounts` has no Link/navigate to it \u2014 src/App.js"}, "properties": {"repobilityId": "2066e7fb63125709", "scanner": "scanner-primary", "fingerprint": "0eabfebc7c03d1f2", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "orphan-page", "wiring"]}}, {"ruleId": "scanner-0da67046a2cf24eb", "level": "warning", "message": {"text": "Frontend route `/account/:id` has no Link/navigate to it \u2014 src/App.js"}, "properties": {"repobilityId": "483b6409bfb27c30", "scanner": "scanner-primary", "fingerprint": "0da67046a2cf24eb", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "orphan-page", "wiring"]}}, {"ruleId": "scanner-f13880c8657d6525", "level": "warning", "message": {"text": "Frontend route `/asset/:id` has no Link/navigate to it \u2014 src/App.js"}, "properties": {"repobilityId": "30228f2d2596ee75", "scanner": "scanner-primary", "fingerprint": "f13880c8657d6525", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "orphan-page", "wiring"]}}, {"ruleId": "scanner-18facecf9b076fbe", "level": "warning", "message": {"text": "Frontend route `/anchor/:id` has no Link/navigate to it \u2014 src/App.js"}, "properties": {"repobilityId": "fd87b947528342f5", "scanner": "scanner-primary", "fingerprint": "18facecf9b076fbe", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "orphan-page", "wiring"]}}, {"ruleId": "scanner-53ceafcc5c7ab25f", "level": "warning", "message": {"text": "Frontend route `/block/:id` has no Link/navigate to it \u2014 src/App.js"}, "properties": {"repobilityId": "153ba088eeffd1f9", "scanner": "scanner-primary", "fingerprint": "53ceafcc5c7ab25f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "orphan-page", "wiring"]}}, {"ruleId": "scanner-9a03b8b213df4487", "level": "warning", "message": {"text": "Frontend route `/tx/:id` has no Link/navigate to it \u2014 src/App.js"}, "properties": {"repobilityId": "239d667bfecba9ab", "scanner": "scanner-primary", "fingerprint": "9a03b8b213df4487", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "orphan-page", "wiring"]}}, {"ruleId": "scanner-35fbeac37d976a95", "level": "warning", "message": {"text": "Frontend route `/search/:id` has no Link/navigate to it \u2014 src/App.js"}, "properties": {"repobilityId": "653a3647431ae5e8", "scanner": "scanner-primary", "fingerprint": "35fbeac37d976a95", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "orphan-page", "wiring"]}}, {"ruleId": "scanner-fdaddebd1907958b", "level": "warning", "message": {"text": "Frontend route `/error/insecure-horizon-server` has no Link/navigate to it \u2014 src/App.js"}, "properties": {"repobilityId": "7bbca6be112b6c6a", "scanner": "scanner-primary", "fingerprint": "fdaddebd1907958b", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "orphan-page", "wiring"]}}, {"ruleId": "scanner-324e90b509b19849", "level": "warning", "message": {"text": "Frontend route `/error/not-found/:id` has no Link/navigate to it \u2014 src/App.js"}, "properties": {"repobilityId": "7da5ab1a1e622c3f", "scanner": "scanner-primary", "fingerprint": "324e90b509b19849", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "orphan-page", "wiring"]}}, {"ruleId": "scanner-421ebc8b828789a7", "level": "warning", "message": {"text": "Frontend route `/error/general/:id` has no Link/navigate to it \u2014 src/App.js"}, "properties": {"repobilityId": "c7a23e201f3845ce", "scanner": "scanner-primary", "fingerprint": "421ebc8b828789a7", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "orphan-page", "wiring"]}}, {"ruleId": "scanner-96b94ca3c0cc8912", "level": "warning", "message": {"text": "Vulnerable dependency react-dom 16.0.0: GHSA-mvjj-gqq2-p4hw"}, "properties": {"repobilityId": "ccffd8a7e6bd5c9a", "scanner": "scanner-primary", "fingerprint": "96b94ca3c0cc8912", "layer": "dependencies", "severity": "medium", "confidence": 0.7, "tags": ["dependency", "sca", "osv", "GHSA-mvjj-gqq2-p4hw"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-161c8f934c6e3d87", "level": "warning", "message": {"text": "Vulnerable dependency bootstrap 3.4.1: GHSA-q58r-hwc8-rm9j"}, "properties": {"repobilityId": "b379270bd1fda16c", "scanner": "scanner-primary", "fingerprint": "161c8f934c6e3d87", "layer": "dependencies", "severity": "medium", "confidence": 0.7, "tags": ["dependency", "sca", "osv", "GHSA-q58r-hwc8-rm9j", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-64f879c360d5e2a1", "level": "warning", "message": {"text": "Vulnerable dependency bootstrap 3.4.1: GHSA-vxmc-5x29-h64v"}, "properties": {"repobilityId": "40d4ced13fb3a9ab", "scanner": "scanner-primary", "fingerprint": "64f879c360d5e2a1", "layer": "dependencies", "severity": "medium", "confidence": 0.7, "tags": ["dependency", "sca", "osv", "GHSA-vxmc-5x29-h64v", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-68009c43a61a0c11", "level": "error", "message": {"text": "Vulnerable dependency react-dev-utils 4.1.0: GHSA-29gp-92wp-94q8"}, "properties": {"repobilityId": "dd339b25b2624c8e", "scanner": "scanner-primary", "fingerprint": "68009c43a61a0c11", "layer": "dependencies", "severity": "high", "confidence": 0.7, "tags": ["dependency", "sca", "osv", "GHSA-29gp-92wp-94q8", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-31d276b2bc1cffab", "level": "warning", "message": {"text": "Vulnerable dependency react-dev-utils 4.1.0: GHSA-5q6m-3h65-w53x"}, "properties": {"repobilityId": "890593bea0020473", "scanner": "scanner-primary", "fingerprint": "31d276b2bc1cffab", "layer": "dependencies", "severity": "medium", "confidence": 0.7, "tags": ["dependency", "sca", "osv", "GHSA-5q6m-3h65-w53x", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ae7f7f29f50d1f41", "level": "warning", "message": {"text": "Vulnerable dependency webpack-dev-server 2.8.2: GHSA-4v9v-hfq4-rm2v"}, "properties": {"repobilityId": "004bca25c7c96374", "scanner": "scanner-primary", "fingerprint": "ae7f7f29f50d1f41", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-4v9v-hfq4-rm2v", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ff90896eb02fac37", "level": "warning", "message": {"text": "Vulnerable dependency webpack-dev-server 2.8.2: GHSA-79cf-xcqc-c78w"}, "properties": {"repobilityId": "127f702f36e57f32", "scanner": "scanner-primary", "fingerprint": "ff90896eb02fac37", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-79cf-xcqc-c78w", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-37222c3568a3b843", "level": "warning", "message": {"text": "Vulnerable dependency webpack-dev-server 2.8.2: GHSA-9jgg-88mc-972h"}, "properties": {"repobilityId": "0ba27c90f6a43675", "scanner": "scanner-primary", "fingerprint": "37222c3568a3b843", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-9jgg-88mc-972h", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2b43fac21dddc2aa", "level": "error", "message": {"text": "Vulnerable dependency webpack-dev-server 2.8.2: GHSA-cf66-xwfp-gvc4"}, "properties": {"repobilityId": "53d41da66bc75ad6", "scanner": "scanner-primary", "fingerprint": "2b43fac21dddc2aa", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-cf66-xwfp-gvc4", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-161b53a3cd3921bf", "level": "warning", "message": {"text": "Vulnerable dependency webpack-dev-server 2.8.2: GHSA-f5vj-f2hx-8m93"}, "properties": {"repobilityId": "af6a71c9dcd8fe6f", "scanner": "scanner-primary", "fingerprint": "161b53a3cd3921bf", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-f5vj-f2hx-8m93", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b874f195dcc35abd", "level": "warning", "message": {"text": "Vulnerable dependency webpack-dev-server 2.8.2: GHSA-m28w-2pqf-7qgj"}, "properties": {"repobilityId": "a8b323e10530c1a1", "scanner": "scanner-primary", "fingerprint": "b874f195dcc35abd", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-m28w-2pqf-7qgj", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-00767350713f678e", "level": "warning", "message": {"text": "Vulnerable dependency webpack-dev-server 2.8.2: GHSA-mx8g-39q3-5c79"}, "properties": {"repobilityId": "8de3b3ccaaa8f805", "scanner": "scanner-primary", "fingerprint": "00767350713f678e", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-mx8g-39q3-5c79", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6701e814e7477432", "level": "warning", "message": {"text": "Dependency fetch-ponyfill is two or more major versions behind"}, "properties": {"repobilityId": "8e5358edf5dc8976", "scanner": "scanner-primary", "fingerprint": "6701e814e7477432", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "freshness", "outdated"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d34ec17c94c60aa9", "level": "warning", "message": {"text": "Dependency node-localstorage is two or more major versions behind"}, "properties": {"repobilityId": "ebc8908e7b30fae8", "scanner": "scanner-primary", "fingerprint": "d34ec17c94c60aa9", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "freshness", "outdated"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-40bde19c9a15dd89", "level": "warning", "message": {"text": "Dependency react-bootstrap is two or more major versions behind"}, "properties": {"repobilityId": "9b739deba63a40f5", "scanner": "scanner-primary", "fingerprint": "40bde19c9a15dd89", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "freshness", "outdated"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2fff3f55b9f210a8", "level": "warning", "message": {"text": "Dependency react-dom is two or more major versions behind"}, "properties": {"repobilityId": "587906d8a8742e4c", "scanner": "scanner-primary", "fingerprint": "2fff3f55b9f210a8", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "freshness", "outdated"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-32385f5ea85bad69", "level": "warning", "message": {"text": "Dependency react-intl is two or more major versions behind"}, "properties": {"repobilityId": "e61182cea6b13dae", "scanner": "scanner-primary", "fingerprint": "32385f5ea85bad69", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "freshness", "outdated"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f30e3d3d614d821c", "level": "note", "message": {"text": "Dependency react-json-pretty is a major version behind"}, "properties": {"repobilityId": "a3d0a3089423d0c7", "scanner": "scanner-primary", "fingerprint": "f30e3d3d614d821c", "layer": "dependencies", "severity": "low", "confidence": 0.9, "tags": ["dependency", "freshness", "outdated"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ffc02bb642644bfc", "level": "note", "message": {"text": "Dependency react-md-spinner is a major version behind"}, "properties": {"repobilityId": "0807aa3f533a2c80", "scanner": "scanner-primary", "fingerprint": "ffc02bb642644bfc", "layer": "dependencies", "severity": "low", "confidence": 0.9, "tags": ["dependency", "freshness", "outdated"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-61a19548147f7132", "level": "warning", "message": {"text": "Dependency react-router-dom is two or more major versions behind"}, "properties": {"repobilityId": "af95e9fd17e64134", "scanner": "scanner-primary", "fingerprint": "61a19548147f7132", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "freshness", "outdated"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ed9c22c97f1d0022", "level": "warning", "message": {"text": "Dependency react-router is two or more major versions behind"}, "properties": {"repobilityId": "e40846dfa375302c", "scanner": "scanner-primary", "fingerprint": "ed9c22c97f1d0022", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "freshness", "outdated"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-099db606e0a0cd54", "level": "warning", "message": {"text": "Dependency react is two or more major versions behind"}, "properties": {"repobilityId": "46fe9df6dde40a91", "scanner": "scanner-primary", "fingerprint": "099db606e0a0cd54", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "freshness", "outdated"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7324dc33df730f23", "level": "warning", "message": {"text": "Dependency stellar-sdk is two or more major versions behind"}, "properties": {"repobilityId": "f99a1aadd425d506", "scanner": "scanner-primary", "fingerprint": "7324dc33df730f23", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "freshness", "outdated"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-13126998b46674db", "level": "note", "message": {"text": "Dependency whatwg-fetch is a major version behind"}, "properties": {"repobilityId": "f01627782e426fc5", "scanner": "scanner-primary", "fingerprint": "13126998b46674db", "layer": "dependencies", "severity": "low", "confidence": 0.9, "tags": ["dependency", "freshness", "outdated"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}]}]}